@authup/server-core 1.0.0-beta.40 → 1.0.0-beta.42

package/dist/core/entities/user-role/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/service.ts"],"names":[],"mappings":"AASA,OAAO,EAAkB,iBAAiB,EAAkB,MAAM,kBAAkB,CAAC;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,MAAM,sBAAsB,GAAG;IACjC,UAAU,EAAE,mBAAmB,CAAC;IAChC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,eAAgB,SAAQ,qBAAsB,YAAW,gBAAgB;IAClF,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAE1C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,iBAAiB,CAAC;gBAE3B,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IAY9C,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAiBd,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAmDd,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;CAmBvB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,MAAM,sBAAsB,GAAG;IACjC,UAAU,EAAE,mBAAmB,CAAC;IAChC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,eAAgB,SAAQ,qBAAsB,YAAW,gBAAgB;IAClF,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAE1C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,iBAAiB,CAAC;gBAE3B,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IAY9C,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAiBd,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAmDd,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;CAmBvB"}

package/dist/core/entities/user-role/service.mjs

@@ -1,7 +1,8 @@
-import { AbstractEntityService } from "../service.mjs";
-import { PermissionName, UserRoleValidator, ValidatorGroup } from "@authup/core-kit";
-import { BuiltInPolicyType, PolicyData } from "@authup/access";
-import { ConflictError, ForbiddenError, NotFoundError } from "@ebec/http";
+import { PermissionName, UserRoleValidator } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { ValidatorGroup } from "@authup/kit";
+import { BuiltInPolicyType, PermissionError, PolicyData } from "@authup/access";
+import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/user-role/service.ts
 var UserRoleService = class extends AbstractEntityService {
 	repository;
@@ -28,7 +29,7 @@ var UserRoleService = class extends AbstractEntityService {
 			PermissionName.USER_ROLE_UPDATE
 		] });
 		const entity = await this.repository.findOneBy({ id });
-		if (!entity) throw new NotFoundError();
+		if (!entity) throw new EntityNotFoundError();
 		return entity;
 	}
 	async create(data, actor) {
@@ -38,7 +39,7 @@ var UserRoleService = class extends AbstractEntityService {
 		if (await this.repository.findOneBy({
 			role_id: validated.role_id,
 			user_id: validated.user_id
-		})) throw new ConflictError("The user-role assignment already exists.");
+		})) throw new EntityConflictError({ entity: "user-role" });
 		if (validated.role) validated.role_realm_id = validated.role.realm_id;
 		if (validated.user) validated.user_realm_id = validated.user.realm_id;
 		if (validated.role && actor.identity) {
@@ -49,7 +50,7 @@ var UserRoleService = class extends AbstractEntityService {
 				type: "role",
 				id: validated.role_id,
 				clientId: validated.role.client_id
-			})) throw new ForbiddenError("You don't own the required permissions.");
+			})) throw new PermissionError({ message: "You don't own the required permissions." });
 		}
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_ROLE_CREATE,
@@ -62,7 +63,7 @@ var UserRoleService = class extends AbstractEntityService {
 	async delete(id, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_DELETE });
 		const entity = await this.repository.findOneBy({ id });
-		if (!entity) throw new NotFoundError();
+		if (!entity) throw new EntityNotFoundError();
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_ROLE_DELETE,
 			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })

package/dist/core/entities/user-role/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ConflictError","ForbiddenError","NotFoundError","PermissionName","UserRoleValidator","ValidatorGroup","AbstractEntityService","UserRoleService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_ROLE_READ","USER_ROLE_CREATE","USER_ROLE_UPDATE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","role_id","user_id","role","role_realm_id","realm_id","user","user_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","evaluate","input","ATTRIBUTES","save","delete","USER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/user-role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ConflictError, ForbiddenError, NotFoundError } from '@ebec/http';\nimport { PermissionName, UserRoleValidator, ValidatorGroup } from '@authup/core-kit';\nimport type { UserRole } from '@authup/core-kit';\nimport type { ActorContext } from '../actor/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IUserRoleRepository, IUserRoleService } from './types.ts';\n\nexport type UserRoleServiceContext = {\n    repository: IUserRoleRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserRoleService extends AbstractEntityService implements IUserRoleService {\n    protected repository: IUserRoleRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: UserRoleValidator;\n\n    constructor(ctx: UserRoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new UserRoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserRole>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            role_id: validated.role_id,\n            user_id: validated.user_id,\n        });\n        if (existing) {\n            throw new ConflictError('The user-role assignment already exists.');\n        }\n\n        if (validated.role) {\n            validated.role_realm_id = validated.role.realm_id;\n        }\n\n        if (validated.user) {\n            validated.user_realm_id = validated.user.realm_id;\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.role_id,\n                    clientId: validated.role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new ForbiddenError('You don\\'t own the required permissions.');\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;AAsBA,IAAaS,kBAAb,cAAqCD,sBAAAA;CACvBE;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;AACrC,SAAK;AACL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,6BAA6BE,IAAIF;AACtC,OAAKC,YAAY,IAAIN,mBAAAA;;CAGzB,MAAMQ,QACFC,OACAC,OACiD;AACjD,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;AAEA,SAAO,KAAKZ,WAAWa,SAASR,MAAAA;;CAGpC,MAAMS,OACFC,IACAT,OACiB;AACjB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAItB,eAAAA;AAGd,SAAOsB;;CAGX,MAAME,OACFC,MACAb,OACiB;AACjB,QAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAegB,kBAAiB,CAAA;EAEpF,MAAMU,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAO1B,eAAe2B,QAAO,CAAA;AAEhF,QAAM,KAAKxB,WAAWyB,oBAAoBJ,UAAAA;AAM1C,MAAIK,MAJmB,KAAK1B,WAAWiB,UAAU;GAC7CU,SAASN,UAAUM;GACnBC,SAASP,UAAUO;GACvB,CAAA,CAEI,OAAM,IAAIpC,cAAc,2CAAA;AAG5B,MAAI6B,UAAUQ,KACVR,WAAUS,gBAAgBT,UAAUQ,KAAKE;AAG7C,MAAIV,UAAUW,KACVX,WAAUY,gBAAgBZ,UAAUW,KAAKD;AAG7C,MAAIV,UAAUQ,QAAQvB,MAAM4B;OAYpB,CAACC,MAXwB,KAAKlC,2BAA2BmC,WACzD;IACIC,MAAM/B,MAAM4B,SAASG;IACrBtB,IAAIT,MAAM4B,SAASf,KAAKJ;IAC5B,EACA;IACIsB,MAAM;IACNtB,IAAIM,UAAUM;IACdW,UAAUjB,UAAUQ,KAAKU;IAC7B,CAAA,CAGA,OAAM,IAAI9C,eAAe,0CAAA;;AAIjC,QAAMa,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMd,eAAegB;GACrB8B,OAAO,IAAIlD,WAAW,GAAGD,kBAAkBoD,aAAarB,WAAU,CAAA;GACtE,CAAA;EAEA,IAAIL,SAAS,KAAKhB,WAAWkB,OAAOG,UAAAA;AACpCL,WAAS,MAAM,KAAKhB,WAAW2C,KAAK3B,OAAAA;AAEpC,SAAOA;;CAGX,MAAM4B,OACF7B,IACAT,OACiB;AACjB,QAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAekD,kBAAiB,CAAA;EAEpF,MAAM7B,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAItB,eAAAA;AAGd,QAAMY,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMd,eAAekD;GACrBJ,OAAO,IAAIlD,WAAW,GAAGD,kBAAkBoD,aAAa1B,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAED,IAAI+B,aAAa9B;AACzB,QAAM,KAAKhB,WAAW+C,OAAO/B,OAAAA;AAC7BA,SAAOD,KAAK+B;AAEZ,SAAO9B"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","PolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","UserRoleValidator","AbstractEntityService","UserRoleService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_ROLE_READ","USER_ROLE_CREATE","USER_ROLE_UPDATE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","role_id","user_id","role","role_realm_id","realm_id","user","user_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","message","evaluate","input","ATTRIBUTES","save","delete","USER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/user-role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, PolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, UserRoleValidator } from '@authup/core-kit';\nimport type { UserRole } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IUserRoleRepository, IUserRoleService } from './types.ts';\n\nexport type UserRoleServiceContext = {\n    repository: IUserRoleRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserRoleService extends AbstractEntityService implements IUserRoleService {\n    protected repository: IUserRoleRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: UserRoleValidator;\n\n    constructor(ctx: UserRoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new UserRoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserRole>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            role_id: validated.role_id,\n            user_id: validated.user_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'user-role' });\n        }\n\n        if (validated.role) {\n            validated.role_realm_id = validated.role.realm_id;\n        }\n\n        if (validated.user) {\n            validated.user_realm_id = validated.user.realm_id;\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.role_id,\n                    clientId: validated.role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;AAsBA,IAAaS,kBAAb,cAAqCD,sBAAAA;CACvBE;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;EACrC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIL,kBAAAA;CACzB;CAEA,MAAMO,QACFC,OACAC,OACiD;EACjD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,IACAT,OACiB;EACjB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,OAAOsB;CACX;CAEA,MAAME,OACFC,MACAb,OACiB;EACjB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMb,eAAee,iBAAiB,CAAA;EAEpF,MAAMU,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAO5B,eAAe6B,OAAO,CAAA;EAEhF,MAAM,KAAKxB,WAAWyB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK1B,WAAWiB,UAAU;GAC7CU,SAASN,UAAUM;GACnBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAInC,oBAAoB,EAAEuB,QAAQ,YAAY,CAAA;EAGxD,IAAIK,UAAUQ,MACVR,UAAUS,gBAAgBT,UAAUQ,KAAKE;EAG7C,IAAIV,UAAUW,MACVX,UAAUY,gBAAgBZ,UAAUW,KAAKD;EAG7C,IAAIV,UAAUQ,QAAQvB,MAAM4B;OAYpB,CAACC,MAXwB,KAAKlC,2BAA2BmC,WACzD;IACIC,MAAM/B,MAAM4B,SAASG;IACrBtB,IAAIT,MAAM4B,SAASf,KAAKJ;GAC5B,GACA;IACIsB,MAAM;IACNtB,IAAIM,UAAUM;IACdW,UAAUjB,UAAUQ,KAAKU;GAC7B,CAAA,GAGA,MAAM,IAAIhD,gBAAgB,EAAEiD,SAAS,0CAA2C,CAAA;EAAA;EAIxF,MAAMlC,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMb,eAAee;GACrB+B,OAAO,IAAIlD,WAAW,GAAGF,kBAAkBqD,aAAatB,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIL,SAAS,KAAKhB,WAAWkB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKhB,WAAW4C,KAAK5B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM6B,OACF9B,IACAT,OACiB;EACjB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMb,eAAekD,iBAAiB,CAAA;EAEpF,MAAM9B,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMb,eAAekD;GACrBJ,OAAO,IAAIlD,WAAW,GAAGF,kBAAkBqD,aAAa3B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAIgC,aAAa/B;EACzB,MAAM,KAAKhB,WAAWgD,OAAOhC,MAAAA;EAC7BA,OAAOD,KAAKgC;EAEZ,OAAO/B;CACX;AACJ"}

package/dist/core/entities/user-role/types.d.ts

@@ -1,6 +1,5 @@
 import type { UserRole } from '@authup/core-kit';
-import type { ActorContext } from '../actor/types.ts';
-import type { EntityRepositoryFindManyResult, IEntityRepository } from '../types.ts';
+import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
 export interface IUserRoleRepository extends IEntityRepository<UserRole> {
 }
 export interface IUserRoleService {

package/dist/core/entities/user-role/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErF,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB,CAAC,QAAQ,CAAC;CACvE;AAED,MAAM,WAAW,gBAAgB;IAC7B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5G,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1E,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC9D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB,CAAC,QAAQ,CAAC;CACvE;AAED,MAAM,WAAW,gBAAgB;IAC7B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5G,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1E,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC9D"}

package/dist/core/identity/index.d.ts

@@ -1,6 +1,7 @@
 export * from './entities/index.ts';
 export * from './password-recovery/index.ts';
 export * from './permission/index.ts';
+export * from './policy/index.ts';
 export * from './provider/index.ts';
 export * from './registration/index.ts';
 export * from './resolver/index.ts';

package/dist/core/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/identity/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/identity/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC"}

package/dist/core/identity/index.mjs

@@ -1,7 +1,10 @@
 import { PasswordRecoveryService } from "./password-recovery/service.mjs";
 import "./password-recovery/index.mjs";
+import { PermissionCheckerService } from "./permission/checker/service.mjs";
 import { IdentityPermissionProvider } from "./permission/module.mjs";
 import "./permission/index.mjs";
+import { PolicyCheckerService } from "./policy/checker/service.mjs";
+import "./policy/index.mjs";
 import { IdentityProviderMapperOperation } from "./provider/mapper/constants.mjs";
 import { IdentityProviderAccountBaseMapper } from "./provider/mapper/base.mjs";
 import { IdentityProviderAttributeMapper } from "./provider/mapper/attributes/module.mjs";
@@ -25,4 +28,4 @@ import "./registration/index.mjs";
 import { IdentityResolver } from "./resolver/module.mjs";
 import "./resolver/index.mjs";
 import { IdentityRoleProvider } from "./role/module.mjs";
-export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityResolver, IdentityRoleProvider, PasswordRecoveryService, RegistrationService, createIdentityProviderOAuth2Authenticator };
+export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityResolver, IdentityRoleProvider, PasswordRecoveryService, PermissionCheckerService, PolicyCheckerService, RegistrationService, createIdentityProviderOAuth2Authenticator };

package/dist/core/identity/password-recovery/check.d.ts

@@ -0,0 +1,7 @@
+import { type PasswordRecoveryDisabledError } from './disabled.ts';
+import { type EmailVerificationRequiredError } from './email-verification-required.ts';
+import { type ResetTokenExpiredError } from './token-expired.ts';
+export declare function isPasswordRecoveryDisabledError(input: unknown): input is PasswordRecoveryDisabledError;
+export declare function isEmailVerificationRequiredError(input: unknown): input is EmailVerificationRequiredError;
+export declare function isResetTokenExpiredError(input: unknown): input is ResetTokenExpiredError;
+//# sourceMappingURL=check.d.ts.map

package/dist/core/identity/password-recovery/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/check.ts"],"names":[],"mappings":"AAQA,OAAO,EAA6C,KAAK,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAC9G,OAAO,EAA8C,KAAK,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AACnI,OAAO,EAAsC,KAAK,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAErG,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,6BAA6B,CAItG;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,8BAA8B,CAIxG;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CAIxF"}

package/dist/core/identity/password-recovery/check.mjs

@@ -0,0 +1,24 @@
+import { PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE } from "./disabled.mjs";
+import { EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE } from "./email-verification-required.mjs";
+import { RESET_TOKEN_EXPIRED_ERROR_INSTANCE } from "./token-expired.mjs";
+import { ErrorCode, hasInstanceof, isAuthupError } from "@authup/errors";
+//#region src/core/identity/password-recovery/check.ts
+function isPasswordRecoveryDisabledError(input) {
+	if (hasInstanceof(input, PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE)) return true;
+	if (!isAuthupError(input)) return false;
+	return input.code === ErrorCode.PASSWORD_RECOVERY_DISABLED;
+}
+function isEmailVerificationRequiredError(input) {
+	if (hasInstanceof(input, EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE)) return true;
+	if (!isAuthupError(input)) return false;
+	return input.code === ErrorCode.EMAIL_VERIFICATION_REQUIRED;
+}
+function isResetTokenExpiredError(input) {
+	if (hasInstanceof(input, RESET_TOKEN_EXPIRED_ERROR_INSTANCE)) return true;
+	if (!isAuthupError(input)) return false;
+	return input.code === ErrorCode.RESET_TOKEN_EXPIRED;
+}
+//#endregion
+export { isEmailVerificationRequiredError, isPasswordRecoveryDisabledError, isResetTokenExpiredError };
+
+//# sourceMappingURL=check.mjs.map

package/dist/core/identity/password-recovery/check.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.mjs","names":["ErrorCode","hasInstanceof","isAuthupError","PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE","EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE","RESET_TOKEN_EXPIRED_ERROR_INSTANCE","isPasswordRecoveryDisabledError","input","code","PASSWORD_RECOVERY_DISABLED","isEmailVerificationRequiredError","EMAIL_VERIFICATION_REQUIRED","isResetTokenExpiredError","RESET_TOKEN_EXPIRED"],"sources":["../../../../src/core/identity/password-recovery/check.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode, hasInstanceof, isAuthupError } from '@authup/errors';\nimport { PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE, type PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE, type EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { RESET_TOKEN_EXPIRED_ERROR_INSTANCE, type ResetTokenExpiredError } from './token-expired.ts';\n\nexport function isPasswordRecoveryDisabledError(input: unknown): input is PasswordRecoveryDisabledError {\n    if (hasInstanceof(input, PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.PASSWORD_RECOVERY_DISABLED;\n}\n\nexport function isEmailVerificationRequiredError(input: unknown): input is EmailVerificationRequiredError {\n    if (hasInstanceof(input, EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.EMAIL_VERIFICATION_REQUIRED;\n}\n\nexport function isResetTokenExpiredError(input: unknown): input is ResetTokenExpiredError {\n    if (hasInstanceof(input, RESET_TOKEN_EXPIRED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.RESET_TOKEN_EXPIRED;\n}\n"],"mappings":";;;;;AAYA,SAAgBM,gCAAgCC,OAAc;CAC1D,IAAIN,cAAcM,OAAOJ,yCAAAA,GAA4C,OAAO;CAC5E,IAAI,CAACD,cAAcK,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMC,SAASR,UAAUS;AACpC;AAEA,SAAgBC,iCAAiCH,OAAc;CAC3D,IAAIN,cAAcM,OAAOH,0CAAAA,GAA6C,OAAO;CAC7E,IAAI,CAACF,cAAcK,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMC,SAASR,UAAUW;AACpC;AAEA,SAAgBC,yBAAyBL,OAAc;CACnD,IAAIN,cAAcM,OAAOF,kCAAAA,GAAqC,OAAO;CACrE,IAAI,CAACH,cAAcK,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMC,SAASR,UAAUa;AACpC"}

package/dist/core/identity/password-recovery/disabled.d.ts

@@ -0,0 +1,6 @@
+import { BadRequestError } from '@authup/errors';
+export declare const PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE: unique symbol;
+export declare class PasswordRecoveryDisabledError extends BadRequestError {
+    constructor();
+}
+//# sourceMappingURL=disabled.d.ts.map

package/dist/core/identity/password-recovery/disabled.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disabled.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/disabled.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAA6B,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,yCAAyC,eAAkE,CAAC;AAEzH,qBAAa,6BAA8B,SAAQ,eAAe;;CAQjE"}

package/dist/core/identity/password-recovery/disabled.mjs

@@ -0,0 +1,16 @@
+import { BadRequestError, ErrorCode, markInstanceof } from "@authup/errors";
+//#region src/core/identity/password-recovery/disabled.ts
+const PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE = Symbol.for("@authup/server-core/PasswordRecoveryDisabledError");
+var PasswordRecoveryDisabledError = class extends BadRequestError {
+	constructor() {
+		super({
+			code: ErrorCode.PASSWORD_RECOVERY_DISABLED,
+			message: "Password recovery is not enabled."
+		});
+		markInstanceof(this, PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE);
+	}
+};
+//#endregion
+export { PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE, PasswordRecoveryDisabledError };
+
+//# sourceMappingURL=disabled.mjs.map

package/dist/core/identity/password-recovery/disabled.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"disabled.mjs","names":["BadRequestError","ErrorCode","markInstanceof","PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE","Symbol","for","PasswordRecoveryDisabledError","code","PASSWORD_RECOVERY_DISABLED","message"],"sources":["../../../../src/core/identity/password-recovery/disabled.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, ErrorCode, markInstanceof } from '@authup/errors';\n\nexport const PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE = Symbol.for('@authup/server-core/PasswordRecoveryDisabledError');\n\nexport class PasswordRecoveryDisabledError extends BadRequestError {\n    constructor() {\n        super({\n            code: ErrorCode.PASSWORD_RECOVERY_DISABLED,\n            message: 'Password recovery is not enabled.',\n        });\n        markInstanceof(this, PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;AASA,MAAaG,4CAA4CC,OAAOC,IAAI,mDAAA;AAEpE,IAAaC,gCAAb,cAAmDN,gBAAAA;CAC/C,cAAc;EACV,MAAM;GACFO,MAAMN,UAAUO;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,yCAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/email-verification-required.d.ts

@@ -0,0 +1,6 @@
+import { BadRequestError } from '@authup/errors';
+export declare const EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE: unique symbol;
+export declare class EmailVerificationRequiredError extends BadRequestError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=email-verification-required.d.ts.map

package/dist/core/identity/password-recovery/email-verification-required.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification-required.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/email-verification-required.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAA6B,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,0CAA0C,eAAmE,CAAC;AAE3H,qBAAa,8BAA+B,SAAQ,eAAe;gBACnD,OAAO,GAAE,MAA0C;CAOlE"}

package/dist/core/identity/password-recovery/email-verification-required.mjs

@@ -0,0 +1,16 @@
+import { BadRequestError, ErrorCode, markInstanceof } from "@authup/errors";
+//#region src/core/identity/password-recovery/email-verification-required.ts
+const EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE = Symbol.for("@authup/server-core/EmailVerificationRequiredError");
+var EmailVerificationRequiredError = class extends BadRequestError {
+	constructor(message = "Email verification is required.") {
+		super({
+			code: ErrorCode.EMAIL_VERIFICATION_REQUIRED,
+			message
+		});
+		markInstanceof(this, EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE);
+	}
+};
+//#endregion
+export { EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE, EmailVerificationRequiredError };
+
+//# sourceMappingURL=email-verification-required.mjs.map

package/dist/core/identity/password-recovery/email-verification-required.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification-required.mjs","names":["BadRequestError","ErrorCode","markInstanceof","EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE","Symbol","for","EmailVerificationRequiredError","message","code","EMAIL_VERIFICATION_REQUIRED"],"sources":["../../../../src/core/identity/password-recovery/email-verification-required.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, ErrorCode, markInstanceof } from '@authup/errors';\n\nexport const EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE = Symbol.for('@authup/server-core/EmailVerificationRequiredError');\n\nexport class EmailVerificationRequiredError extends BadRequestError {\n    constructor(message: string = 'Email verification is required.') {\n        super({\n            code: ErrorCode.EMAIL_VERIFICATION_REQUIRED,\n            message,\n        });\n        markInstanceof(this, EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;AASA,MAAaG,6CAA6CC,OAAOC,IAAI,oDAAA;AAErE,IAAaC,iCAAb,cAAoDN,gBAAAA;CAChD,YAAYO,UAAkB,mCAAmC;EAC7D,MAAM;GACFC,MAAMP,UAAUQ;GAChBF;EACJ,CAAA;EACAL,eAAe,MAAMC,0CAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/service.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,mBAAmB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,OAAO,EAAE,8BAA8B,CAAC;IAElD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;gBAEtB,GAAG,EAAE,8BAA8B;IAOzC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAsDxE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;YA0C9D,0BAA0B;YA8C1B,yBAAyB;CA2E1C"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/service.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,mBAAmB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,OAAO,EAAE,8BAA8B,CAAC;IAElD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;gBAEtB,GAAG,EAAE,8BAA8B;IAOzC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAsDxE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;YA0C9D,0BAA0B;YA8C1B,yBAAyB;CA2E1C"}

package/dist/core/identity/password-recovery/service.mjs

@@ -1,5 +1,8 @@
 import { UserCredentialsService } from "../../authentication/credential/entities/user/module.mjs";
-import { BadRequestError, NotFoundError } from "@ebec/http";
+import { PasswordRecoveryDisabledError } from "./disabled.mjs";
+import { EmailVerificationRequiredError } from "./email-verification-required.mjs";
+import { ResetTokenExpiredError } from "./token-expired.mjs";
+import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 import { Container } from "validup";
 import { createValidationChain, createValidator } from "@validup/adapter-validator";
 import { randomBytes } from "node:crypto";
@@ -16,8 +19,8 @@ var PasswordRecoveryService = class {
 		this.mailClient = ctx.mailClient;
 	}
 	async forgotPassword(data) {
-		if (!this.options.passwordRecoveryEnabled) throw new BadRequestError("Password recovery is not enabled.");
-		if (!this.options.emailVerificationEnabled) throw new BadRequestError("Email verification is not enabled, but required to reset a password.");
+		if (!this.options.passwordRecoveryEnabled) throw new PasswordRecoveryDisabledError();
+		if (!this.options.emailVerificationEnabled) throw new EmailVerificationRequiredError("Email verification is not enabled, but required to reset a password.");
 		const validated = await this.runForgotPasswordValidator(data);
 		const realm = await this.realmRepository.resolve(validated.realm_id, true);
 		const where = {
@@ -26,7 +29,7 @@ var PasswordRecoveryService = class {
 			realm_id: realm.id
 		};
 		const entity = await this.repository.findOneByWithEmail(where);
-		if (!entity) throw new NotFoundError();
+		if (!entity) throw new EntityNotFoundError();
 		const merged = this.repository.merge(entity, {
 			reset_expires: new Date(Date.now() + 1e3 * 60 * 30).toISOString(),
 			reset_hash: randomBytes(32).toString("hex")
@@ -52,7 +55,7 @@ var PasswordRecoveryService = class {
 		return { reset_expires: merged.reset_expires };
 	}
 	async resetPassword(data) {
-		if (!this.options.passwordRecoveryEnabled) throw new BadRequestError("Password recovery is not enabled.");
+		if (!this.options.passwordRecoveryEnabled) throw new PasswordRecoveryDisabledError();
 		const validated = await this.runResetPasswordValidator(data);
 		await this.repository.validateJoinColumns(validated);
 		const realm = await this.realmRepository.resolve(validated.realm_id, true);
@@ -63,8 +66,8 @@ var PasswordRecoveryService = class {
 			realm_id: realm.id
 		};
 		const entity = await this.repository.findOneBy(where);
-		if (!entity) throw new NotFoundError();
-		if (!entity.reset_expires || new Date(entity.reset_expires) < /* @__PURE__ */ new Date()) throw new BadRequestError("Reset token has expired.");
+		if (!entity) throw new EntityNotFoundError();
+		if (!entity.reset_expires || new Date(entity.reset_expires) < /* @__PURE__ */ new Date()) throw new ResetTokenExpiredError();
 		const hashedPassword = await new UserCredentialsService().protect(validated.password);
 		const merged = this.repository.merge(entity, {
 			reset_at: (/* @__PURE__ */ new Date()).toISOString(),

package/dist/core/identity/password-recovery/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BadRequestError","NotFoundError","createValidationChain","createValidator","randomBytes","Container","UserCredentialsService","PasswordRecoveryService","options","repository","realmRepository","mailClient","ctx","forgotPassword","data","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realm_id","where","name","email","id","entity","findOneByWithEmail","merged","merge","reset_expires","Date","now","toISOString","reset_hash","toString","save","send","to","subject","html","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","reset_at","validator","oneOfContainer","oneOf","mount","chain","exists","notEmpty","trim","toLowerCase","isEmail","matches","withMessage","isString","optional","isUUID","values","run","isLength","min","max"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, NotFoundError } from '@ebec/http';\nimport { createValidationChain, createValidator } from '@validup/adapter-validator';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IPasswordRecoveryService,\n    PasswordForgotResult,\n    PasswordRecoveryServiceContext,\n    PasswordRecoveryServiceOptions,\n    PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient } from '../../mail/types.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n    protected options: PasswordRecoveryServiceOptions;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected mailClient: IMailClient;\n\n    constructor(ctx: PasswordRecoveryServiceContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.mailClient = ctx.mailClient;\n    }\n\n    async forgotPassword(data: Record<string, any>): Promise<PasswordForgotResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new BadRequestError('Password recovery is not enabled.');\n        }\n\n        if (!this.options.emailVerificationEnabled) {\n            throw new BadRequestError('Email verification is not enabled, but required to reset a password.');\n        }\n\n        const validated = await this.runForgotPasswordValidator(data);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneByWithEmail(where);\n\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            reset_expires: new Date(Date.now() + (1000 * 60 * 30)).toISOString(),\n            reset_hash: randomBytes(32).toString('hex'),\n        });\n\n        await this.repository.save(merged);\n\n        try {\n            await this.mailClient.send({\n                to: entity.email,\n                subject: 'Forgot Password - Reset code',\n                html: `\n                <p>Please use the code below to reset your account password.</p>\n                <p>${merged.reset_hash}</p>\n                `,\n            });\n        } catch {\n            this.repository.merge(merged, {\n                reset_hash: null,\n                reset_expires: null,\n            });\n            await this.repository.save(merged);\n\n            throw new BadRequestError('Password recovery failed. Could not send reset email.');\n        }\n\n        return { reset_expires: merged.reset_expires! };\n    }\n\n    async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new BadRequestError('Password recovery is not enabled.');\n        }\n\n        const validated = await this.runResetPasswordValidator(data);\n\n        await this.repository.validateJoinColumns(validated);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            reset_hash: validated.token,\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneBy(where);\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        if (!entity.reset_expires || new Date(entity.reset_expires) < new Date()) {\n            throw new BadRequestError('Reset token has expired.');\n        }\n\n        const credentialsService = new UserCredentialsService();\n        const hashedPassword = await credentialsService.protect(validated.password);\n\n        const merged = this.repository.merge(entity, {\n            reset_at: new Date().toISOString(),\n            reset_hash: null,\n            reset_expires: null,\n            password: hashedPassword,\n        });\n\n        await this.repository.save(merged);\n\n        return { reset_at: merged.reset_at! };\n    }\n\n    private async runForgotPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n\n        oneOfContainer.mount('email', createValidator(() => {\n            const chain = createValidationChain();\n            return chain\n                .exists()\n                .notEmpty()\n                .trim()\n                .toLowerCase()\n                .isEmail()\n                .matches(/^[^A-Z]+$/)\n                .withMessage('Email must be lowercase.');\n        }));\n\n        oneOfContainer.mount(\n            'name',\n            createValidator(() => {\n                const chain = createValidationChain();\n                return chain\n                    .exists()\n                    .notEmpty()\n                    .isString()\n                    .trim()\n                    .toLowerCase();\n            }),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(() => {\n                const chain = createValidationChain();\n                return chain.exists()\n                    .isUUID()\n                    .optional({ values: 'null' });\n            }),\n        );\n\n        return validator.run(data);\n    }\n\n    private async runResetPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n        oneOfContainer.mount(\n            'email',\n            createValidator(() => {\n                const chain = createValidationChain();\n                return chain\n                    .exists()\n                    .notEmpty()\n                    .trim()\n                    .toLowerCase()\n                    .isEmail()\n                    .matches(/^[^A-Z]+$/)\n                    .withMessage('Email must be lowercase.');\n            }),\n        );\n        oneOfContainer.mount(\n            'name',\n            createValidator(() => {\n                const chain = createValidationChain();\n                return chain\n                    .exists()\n                    .notEmpty()\n                    .isString()\n                    .trim()\n                    .toLowerCase();\n            }),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(() => {\n                const chain = createValidationChain();\n                return chain\n                    .exists()\n                    .isUUID()\n                    .optional({ values: 'null' });\n            }),\n        );\n\n        validator.mount(\n            'token',\n            createValidator(() => {\n                const chain = createValidationChain();\n                return chain\n                    .exists()\n                    .notEmpty()\n                    .isLength({\n                        min: 3,\n                        max: 256, \n                    });\n            }),\n        );\n\n        validator.mount(\n            'password',\n            createValidator(() => {\n                const chain = createValidationChain();\n                return chain\n                    .exists()\n                    .notEmpty()\n                    .isLength({\n                        min: 5,\n                        max: 512, \n                    });\n            }),\n        );\n\n        return validator.run(data);\n    }\n}\n"],"mappings":";;;;;;AAsBA,IAAaO,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;AAC7C,OAAKJ,UAAUI,IAAIJ;AACnB,OAAKC,aAAaG,IAAIH;AACtB,OAAKC,kBAAkBE,IAAIF;AAC3B,OAAKC,aAAaC,IAAID;;CAG1B,MAAME,eAAeC,MAA0D;AAC3E,MAAI,CAAC,KAAKN,QAAQO,wBACd,OAAM,IAAIf,gBAAgB,oCAAA;AAG9B,MAAI,CAAC,KAAKQ,QAAQQ,yBACd,OAAM,IAAIhB,gBAAgB,uEAAA;EAG9B,MAAMiB,YAAY,MAAM,KAAKC,2BAA2BJ,KAAAA;EAExD,MAAMK,QAAQ,MAAM,KAAKT,gBAAgBU,QAAQH,UAAUI,UAAU,KAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,MAAK,GAAI,EAAE;GAClD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,OAAM,GAAI,EAAE;GACrDH,UAAUF,MAAMM;GACpB;EAEA,MAAMC,SAAS,MAAM,KAAKjB,WAAWkB,mBAAmBL,MAAAA;AAExD,MAAI,CAACI,OACD,OAAM,IAAIzB,eAAAA;EAGd,MAAM2B,SAAS,KAAKnB,WAAWoB,MAAMH,QAAQ;GACzCI,eAAe,IAAIC,KAAKA,KAAKC,KAAG,GAAM,MAAO,KAAK,GAAA,CAAKC,aAAW;GAClEC,YAAY9B,YAAY,GAAA,CAAI+B,SAAS,MAAA;GACzC,CAAA;AAEA,QAAM,KAAK1B,WAAW2B,KAAKR,OAAAA;AAE3B,MAAI;AACA,SAAM,KAAKjB,WAAW0B,KAAK;IACvBC,IAAIZ,OAAOF;IACXe,SAAS;IACTC,MAAM;;qBAEDZ,OAAOM,WAAW;;IAE3B,CAAA;UACI;AACJ,QAAKzB,WAAWoB,MAAMD,QAAQ;IAC1BM,YAAY;IACZJ,eAAe;IACnB,CAAA;AACA,SAAM,KAAKrB,WAAW2B,KAAKR,OAAAA;AAE3B,SAAM,IAAI5B,gBAAgB,wDAAA;;AAG9B,SAAO,EAAE8B,eAAeF,OAAOE,eAAe;;CAGlD,MAAMW,cAAc3B,MAAyD;AACzE,MAAI,CAAC,KAAKN,QAAQO,wBACd,OAAM,IAAIf,gBAAgB,oCAAA;EAG9B,MAAMiB,YAAY,MAAM,KAAKyB,0BAA0B5B,KAAAA;AAEvD,QAAM,KAAKL,WAAWkC,oBAAoB1B,UAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKT,gBAAgBU,QAAQH,UAAUI,UAAU,KAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,MAAK,GAAI,EAAE;GAClD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,OAAM,GAAI,EAAE;GACrDU,YAAYjB,UAAU2B;GACtBvB,UAAUF,MAAMM;GACpB;EAEA,MAAMC,SAAS,MAAM,KAAKjB,WAAWoC,UAAUvB,MAAAA;AAC/C,MAAI,CAACI,OACD,OAAM,IAAIzB,eAAAA;AAGd,MAAI,CAACyB,OAAOI,iBAAiB,IAAIC,KAAKL,OAAOI,cAAa,mBAAI,IAAIC,MAAAA,CAC9D,OAAM,IAAI/B,gBAAgB,2BAAA;EAI9B,MAAM+C,iBAAiB,MAAMD,IADExC,wBACFwC,CAAmBE,QAAQ/B,UAAUgC,SAAQ;EAE1E,MAAMrB,SAAS,KAAKnB,WAAWoB,MAAMH,QAAQ;GACzCwB,2BAAU,IAAInB,MAAAA,EAAOE,aAAW;GAChCC,YAAY;GACZJ,eAAe;GACfmB,UAAUF;GACd,CAAA;AAEA,QAAM,KAAKtC,WAAW2B,KAAKR,OAAAA;AAE3B,SAAO,EAAEsB,UAAUtB,OAAOsB,UAAU;;CAGxC,MAAchC,2BAA2BJ,MAA2B;EAChE,MAAMqC,YAAY,IAAI9C,UAAe,EAAC,CAAA;EAEtC,MAAM+C,iBAAiB,IAAI/C,UAAU,EAAEgD,OAAO,MAAK,CAAA;AAEnDD,iBAAeE,MAAM,SAASnD,sBAAgB;AAE1C,UADcD,uBACPqD,CACFC,QAAM,CACNC,UAAQ,CACRC,MAAI,CACJC,aAAW,CACXC,SAAO,CACPC,QAAQ,YAAA,CACRC,YAAY,2BAAA;IACrB,CAAA;AAEAV,iBAAeE,MACX,QACAnD,sBAAgB;AAEZ,UADcD,uBACPqD,CACFC,QAAM,CACNC,UAAQ,CACRM,UAAQ,CACRL,MAAI,CACJC,aAAW;IACpB,CAAA;AAGJR,YAAUG,MAAMF,eAAAA;AAEhBD,YAAUG,MACN,YACA,EAAEU,UAAU,MAAK,EACjB7D,sBAAgB;AAEZ,UADcD,uBACPqD,CAAMC,QAAM,CACdS,QAAM,CACND,SAAS,EAAEE,QAAQ,QAAO,CAAA;IACnC,CAAA;AAGJ,SAAOf,UAAUgB,IAAIrD,KAAAA;;CAGzB,MAAc4B,0BAA0B5B,MAA2B;EAC/D,MAAMqC,YAAY,IAAI9C,UAAe,EAAC,CAAA;EAEtC,MAAM+C,iBAAiB,IAAI/C,UAAU,EAAEgD,OAAO,MAAK,CAAA;AACnDD,iBAAeE,MACX,SACAnD,sBAAgB;AAEZ,UADcD,uBACPqD,CACFC,QAAM,CACNC,UAAQ,CACRC,MAAI,CACJC,aAAW,CACXC,SAAO,CACPC,QAAQ,YAAA,CACRC,YAAY,2BAAA;IACrB,CAAA;AAEJV,iBAAeE,MACX,QACAnD,sBAAgB;AAEZ,UADcD,uBACPqD,CACFC,QAAM,CACNC,UAAQ,CACRM,UAAQ,CACRL,MAAI,CACJC,aAAW;IACpB,CAAA;AAGJR,YAAUG,MAAMF,eAAAA;AAEhBD,YAAUG,MACN,YACA,EAAEU,UAAU,MAAK,EACjB7D,sBAAgB;AAEZ,UADcD,uBACPqD,CACFC,QAAM,CACNS,QAAM,CACND,SAAS,EAAEE,QAAQ,QAAO,CAAA;IACnC,CAAA;AAGJf,YAAUG,MACN,SACAnD,sBAAgB;AAEZ,UADcD,uBACPqD,CACFC,QAAM,CACNC,UAAQ,CACRW,SAAS;IACNC,KAAK;IACLC,KAAK;IACT,CAAA;IACR,CAAA;AAGJnB,YAAUG,MACN,YACAnD,sBAAgB;AAEZ,UADcD,uBACPqD,CACFC,QAAM,CACNC,UAAQ,CACRW,SAAS;IACNC,KAAK;IACLC,KAAK;IACT,CAAA;IACR,CAAA;AAGJ,SAAOnB,UAAUgB,IAAIrD,KAAAA"}
+{"version":3,"file":"service.mjs","names":["BadRequestError","EntityNotFoundError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidationChain","createValidator","randomBytes","Container","UserCredentialsService","PasswordRecoveryService","options","repository","realmRepository","mailClient","ctx","forgotPassword","data","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realm_id","where","name","email","id","entity","findOneByWithEmail","merged","merge","reset_expires","Date","now","toISOString","reset_hash","toString","save","send","to","subject","html","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","reset_at","validator","oneOfContainer","oneOf","mount","chain","exists","notEmpty","trim","toLowerCase","isEmail","matches","withMessage","isString","optional","isUUID","values","run","isLength","min","max"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidationChain, createValidator } from '@validup/adapter-validator';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IPasswordRecoveryService,\n    PasswordForgotResult,\n    PasswordRecoveryServiceContext,\n    PasswordRecoveryServiceOptions,\n    PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient } from '../../mail/types.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n    protected options: PasswordRecoveryServiceOptions;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected mailClient: IMailClient;\n\n    constructor(ctx: PasswordRecoveryServiceContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.mailClient = ctx.mailClient;\n    }\n\n    async forgotPassword(data: Record<string, any>): Promise<PasswordForgotResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        if (!this.options.emailVerificationEnabled) {\n            throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n        }\n\n        const validated = await this.runForgotPasswordValidator(data);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneByWithEmail(where);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            reset_expires: new Date(Date.now() + (1000 * 60 * 30)).toISOString(),\n            reset_hash: randomBytes(32).toString('hex'),\n        });\n\n        await this.repository.save(merged);\n\n        try {\n            await this.mailClient.send({\n                to: entity.email,\n                subject: 'Forgot Password - Reset code',\n                html: `\n                <p>Please use the code below to reset your account password.</p>\n                <p>${merged.reset_hash}</p>\n                `,\n            });\n        } catch {\n            this.repository.merge(merged, {\n                reset_hash: null,\n                reset_expires: null,\n            });\n            await this.repository.save(merged);\n\n            throw new BadRequestError('Password recovery failed. Could not send reset email.');\n        }\n\n        return { reset_expires: merged.reset_expires! };\n    }\n\n    async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        const validated = await this.runResetPasswordValidator(data);\n\n        await this.repository.validateJoinColumns(validated);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            reset_hash: validated.token,\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneBy(where);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!entity.reset_expires || new Date(entity.reset_expires) < new Date()) {\n            throw new ResetTokenExpiredError();\n        }\n\n        const credentialsService = new UserCredentialsService();\n        const hashedPassword = await credentialsService.protect(validated.password);\n\n        const merged = this.repository.merge(entity, {\n            reset_at: new Date().toISOString(),\n            reset_hash: null,\n            reset_expires: null,\n            password: hashedPassword,\n        });\n\n        await this.repository.save(merged);\n\n        return { reset_at: merged.reset_at! };\n    }\n\n    private async runForgotPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n\n        oneOfContainer.mount('email', createValidator(() => {\n            const chain = createValidationChain();\n            return chain\n                .exists()\n                .notEmpty()\n                .trim()\n                .toLowerCase()\n                .isEmail()\n                .matches(/^[^A-Z]+$/)\n                .withMessage('Email must be lowercase.');\n        }));\n\n        oneOfContainer.mount(\n            'name',\n            createValidator(() => {\n                const chain = createValidationChain();\n                return chain\n                    .exists()\n                    .notEmpty()\n                    .isString()\n                    .trim()\n                    .toLowerCase();\n            }),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(() => {\n                const chain = createValidationChain();\n                return chain.exists()\n                    .isUUID()\n                    .optional({ values: 'null' });\n            }),\n        );\n\n        return validator.run(data);\n    }\n\n    private async runResetPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n        oneOfContainer.mount(\n            'email',\n            createValidator(() => {\n                const chain = createValidationChain();\n                return chain\n                    .exists()\n                    .notEmpty()\n                    .trim()\n                    .toLowerCase()\n                    .isEmail()\n                    .matches(/^[^A-Z]+$/)\n                    .withMessage('Email must be lowercase.');\n            }),\n        );\n        oneOfContainer.mount(\n            'name',\n            createValidator(() => {\n                const chain = createValidationChain();\n                return chain\n                    .exists()\n                    .notEmpty()\n                    .isString()\n                    .trim()\n                    .toLowerCase();\n            }),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(() => {\n                const chain = createValidationChain();\n                return chain\n                    .exists()\n                    .isUUID()\n                    .optional({ values: 'null' });\n            }),\n        );\n\n        validator.mount(\n            'token',\n            createValidator(() => {\n                const chain = createValidationChain();\n                return chain\n                    .exists()\n                    .notEmpty()\n                    .isLength({\n                        min: 3,\n                        max: 256, \n                    });\n            }),\n        );\n\n        validator.mount(\n            'password',\n            createValidator(() => {\n                const chain = createValidationChain();\n                return chain\n                    .exists()\n                    .notEmpty()\n                    .isLength({\n                        min: 5,\n                        max: 512, \n                    });\n            }),\n        );\n\n        return validator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;AAyBA,IAAaU,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKJ,UAAUI,IAAIJ;EACnB,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,aAAaC,IAAID;CAC1B;CAEA,MAAME,eAAeC,MAA0D;EAC3E,IAAI,CAAC,KAAKN,QAAQO,yBACd,MAAM,IAAIhB,8BAAAA;EAGd,IAAI,CAAC,KAAKS,QAAQQ,0BACd,MAAM,IAAIhB,+BAA+B,sEAAA;EAG7C,MAAMiB,YAAY,MAAM,KAAKC,2BAA2BJ,IAAAA;EAExD,MAAMK,QAAQ,MAAM,KAAKT,gBAAgBU,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKjB,WAAWkB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAM8B,SAAS,KAAKnB,WAAWoB,MAAMH,QAAQ;GACzCI,eAAe,IAAIC,KAAKA,KAAKC,IAAG,IAAM,MAAO,KAAK,EAAA,EAAKC,YAAW;GAClEC,YAAY9B,YAAY,EAAA,EAAI+B,SAAS,KAAA;EACzC,CAAA;EAEA,MAAM,KAAK1B,WAAW2B,KAAKR,MAAAA;EAE3B,IAAI;GACA,MAAM,KAAKjB,WAAW0B,KAAK;IACvBC,IAAIZ,OAAOF;IACXe,SAAS;IACTC,MAAM;;qBAEDZ,OAAOM,WAAW;;GAE3B,CAAA;EACJ,QAAQ;GACJ,KAAKzB,WAAWoB,MAAMD,QAAQ;IAC1BM,YAAY;IACZJ,eAAe;GACnB,CAAA;GACA,MAAM,KAAKrB,WAAW2B,KAAKR,MAAAA;GAE3B,MAAM,IAAI/B,gBAAgB,uDAAA;EAC9B;EAEA,OAAO,EAAEiC,eAAeF,OAAOE,cAAe;CAClD;CAEA,MAAMW,cAAc3B,MAAyD;EACzE,IAAI,CAAC,KAAKN,QAAQO,yBACd,MAAM,IAAIhB,8BAAAA;EAGd,MAAMkB,YAAY,MAAM,KAAKyB,0BAA0B5B,IAAAA;EAEvD,MAAM,KAAKL,WAAWkC,oBAAoB1B,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKT,gBAAgBU,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,YAAYjB,UAAU2B;GACtBvB,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKjB,WAAWoC,UAAUvB,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAI5B,oBAAAA;EAGd,IAAI,CAAC4B,OAAOI,iBAAiB,IAAIC,KAAKL,OAAOI,aAAa,oBAAI,IAAIC,KAAAA,GAC9D,MAAM,IAAI9B,uBAAAA;EAId,MAAM8C,iBAAiB,MAAMD,IADExC,uBACFwC,EAAmBE,QAAQ/B,UAAUgC,QAAQ;EAE1E,MAAMrB,SAAS,KAAKnB,WAAWoB,MAAMH,QAAQ;GACzCwB,2BAAU,IAAInB,KAAAA,GAAOE,YAAW;GAChCC,YAAY;GACZJ,eAAe;GACfmB,UAAUF;EACd,CAAA;EAEA,MAAM,KAAKtC,WAAW2B,KAAKR,MAAAA;EAE3B,OAAO,EAAEsB,UAAUtB,OAAOsB,SAAU;CACxC;CAEA,MAAchC,2BAA2BJ,MAA2B;EAChE,MAAMqC,YAAY,IAAI9C,UAAe,CAAC,CAAA;EAEtC,MAAM+C,iBAAiB,IAAI/C,UAAU,EAAEgD,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MAAM,SAASnD,sBAAgB;GAE1C,OADcD,sBACPqD,EACFC,OAAM,EACNC,SAAQ,EACRC,KAAI,EACJC,YAAW,EACXC,QAAO,EACPC,QAAQ,WAAA,EACRC,YAAY,0BAAA;EACrB,CAAA,CAAA;EAEAV,eAAeE,MACX,QACAnD,sBAAgB;GAEZ,OADcD,sBACPqD,EACFC,OAAM,EACNC,SAAQ,EACRM,SAAQ,EACRL,KAAI,EACJC,YAAW;EACpB,CAAA,CAAA;EAGJR,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEU,UAAU,KAAK,GACjB7D,sBAAgB;GAEZ,OADcD,sBACPqD,EAAMC,OAAM,EACdS,OAAM,EACND,SAAS,EAAEE,QAAQ,OAAO,CAAA;EACnC,CAAA,CAAA;EAGJ,OAAOf,UAAUgB,IAAIrD,IAAAA;CACzB;CAEA,MAAc4B,0BAA0B5B,MAA2B;EAC/D,MAAMqC,YAAY,IAAI9C,UAAe,CAAC,CAAA;EAEtC,MAAM+C,iBAAiB,IAAI/C,UAAU,EAAEgD,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACAnD,sBAAgB;GAEZ,OADcD,sBACPqD,EACFC,OAAM,EACNC,SAAQ,EACRC,KAAI,EACJC,YAAW,EACXC,QAAO,EACPC,QAAQ,WAAA,EACRC,YAAY,0BAAA;EACrB,CAAA,CAAA;EAEJV,eAAeE,MACX,QACAnD,sBAAgB;GAEZ,OADcD,sBACPqD,EACFC,OAAM,EACNC,SAAQ,EACRM,SAAQ,EACRL,KAAI,EACJC,YAAW;EACpB,CAAA,CAAA;EAGJR,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEU,UAAU,KAAK,GACjB7D,sBAAgB;GAEZ,OADcD,sBACPqD,EACFC,OAAM,EACNS,OAAM,EACND,SAAS,EAAEE,QAAQ,OAAO,CAAA;EACnC,CAAA,CAAA;EAGJf,UAAUG,MACN,SACAnD,sBAAgB;GAEZ,OADcD,sBACPqD,EACFC,OAAM,EACNC,SAAQ,EACRW,SAAS;IACNC,KAAK;IACLC,KAAK;GACT,CAAA;EACR,CAAA,CAAA;EAGJnB,UAAUG,MACN,YACAnD,sBAAgB;GAEZ,OADcD,sBACPqD,EACFC,OAAM,EACNC,SAAQ,EACRW,SAAS;IACNC,KAAK;IACLC,KAAK;GACT,CAAA;EACR,CAAA,CAAA;EAGJ,OAAOnB,UAAUgB,IAAIrD,IAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/token-expired.d.ts

@@ -0,0 +1,6 @@
+import { BadRequestError } from '@authup/errors';
+export declare const RESET_TOKEN_EXPIRED_ERROR_INSTANCE: unique symbol;
+export declare class ResetTokenExpiredError extends BadRequestError {
+    constructor();
+}
+//# sourceMappingURL=token-expired.d.ts.map

package/dist/core/identity/password-recovery/token-expired.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-expired.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/token-expired.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAA6B,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,kCAAkC,eAA2D,CAAC;AAE3G,qBAAa,sBAAuB,SAAQ,eAAe;;CAQ1D"}

package/dist/core/identity/password-recovery/token-expired.mjs

@@ -0,0 +1,16 @@
+import { BadRequestError, ErrorCode, markInstanceof } from "@authup/errors";
+//#region src/core/identity/password-recovery/token-expired.ts
+const RESET_TOKEN_EXPIRED_ERROR_INSTANCE = Symbol.for("@authup/server-core/ResetTokenExpiredError");
+var ResetTokenExpiredError = class extends BadRequestError {
+	constructor() {
+		super({
+			code: ErrorCode.RESET_TOKEN_EXPIRED,
+			message: "Reset token has expired."
+		});
+		markInstanceof(this, RESET_TOKEN_EXPIRED_ERROR_INSTANCE);
+	}
+};
+//#endregion
+export { RESET_TOKEN_EXPIRED_ERROR_INSTANCE, ResetTokenExpiredError };
+
+//# sourceMappingURL=token-expired.mjs.map

package/dist/core/identity/password-recovery/token-expired.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-expired.mjs","names":["BadRequestError","ErrorCode","markInstanceof","RESET_TOKEN_EXPIRED_ERROR_INSTANCE","Symbol","for","ResetTokenExpiredError","code","RESET_TOKEN_EXPIRED","message"],"sources":["../../../../src/core/identity/password-recovery/token-expired.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, ErrorCode, markInstanceof } from '@authup/errors';\n\nexport const RESET_TOKEN_EXPIRED_ERROR_INSTANCE = Symbol.for('@authup/server-core/ResetTokenExpiredError');\n\nexport class ResetTokenExpiredError extends BadRequestError {\n    constructor() {\n        super({\n            code: ErrorCode.RESET_TOKEN_EXPIRED,\n            message: 'Reset token has expired.',\n        });\n        markInstanceof(this, RESET_TOKEN_EXPIRED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;AASA,MAAaG,qCAAqCC,OAAOC,IAAI,4CAAA;AAE7D,IAAaC,yBAAb,cAA4CN,gBAAAA;CACxC,cAAc;EACV,MAAM;GACFO,MAAMN,UAAUO;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,kCAAAA;CACzB;AACJ"}

package/dist/core/identity/permission/checker/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/permission/checker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/permission/checker/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/identity/permission/checker/index.mjs

@@ -0,0 +1,2 @@
+import { PermissionCheckerService } from "./service.mjs";
+export { PermissionCheckerService };

package/dist/core/identity/permission/checker/service.d.ts

@@ -0,0 +1,10 @@
+import type { Result } from '@authup/kit';
+import type { ActorContext } from '@authup/server-kit';
+import type { IPermissionCheckerService, PermissionCheckerServiceContext } from './types.ts';
+export declare class PermissionCheckerService implements IPermissionCheckerService {
+    protected ctx: PermissionCheckerServiceContext;
+    constructor(ctx: PermissionCheckerServiceContext);
+    check(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<void>;
+    safeCheck(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<Result<null>>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/identity/permission/checker/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/permission/checker/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EACR,yBAAyB,EACzB,+BAA+B,EAClC,MAAM,YAAY,CAAC;AAEpB,qBAAa,wBAAyB,YAAW,yBAAyB;IACtE,SAAS,CAAC,GAAG,EAAE,+BAA+B,CAAC;gBAEnC,GAAG,EAAE,+BAA+B;IAI1C,KAAK,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IA0CV,SAAS,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ3B"}

package/dist/core/identity/permission/checker/service.mjs

@@ -0,0 +1,55 @@
+import { PolicyEngine as PolicyEngine$1 } from "../../../security/policy/engine.mjs";
+import { toIdentityPolicyData } from "../identity-policy-data.mjs";
+import { isUUID } from "@authup/kit";
+import { BuiltInPolicyType, PermissionEvaluator, PolicyData } from "@authup/access";
+import { EntityNotFoundError, normalizeError } from "@authup/errors";
+//#region src/core/identity/permission/checker/service.ts
+var PermissionCheckerService = class {
+	ctx;
+	constructor(ctx) {
+		this.ctx = ctx;
+	}
+	async check(idOrName, data, actor, realm) {
+		let criteria;
+		if (isUUID(idOrName)) criteria = { id: idOrName };
+		else {
+			const realmEntity = await this.ctx.realmRepository.resolve(realm);
+			criteria = {
+				name: idOrName,
+				...realmEntity ? { realm_id: realmEntity.id } : {}
+			};
+		}
+		const entity = await this.ctx.repository.findOneBy(criteria);
+		if (!entity) throw new EntityNotFoundError();
+		const input = { ...data };
+		if (typeof input[BuiltInPolicyType.IDENTITY] === "undefined") input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);
+		const evaluationContext = {
+			name: entity.name,
+			input: new PolicyData(input)
+		};
+		const evaluator = new PermissionEvaluator({
+			provider: this.ctx.permissionProvider,
+			policyEngine: new PolicyEngine$1(this.ctx.identityPermissionProvider)
+		});
+		if (evaluationContext.input && evaluationContext.input.has(BuiltInPolicyType.ATTRIBUTES)) await evaluator.evaluate(evaluationContext);
+		else await evaluator.preEvaluate(evaluationContext);
+	}
+	async safeCheck(idOrName, data, actor, realm) {
+		try {
+			await this.check(idOrName, data, actor, realm);
+			return {
+				success: true,
+				data: null
+			};
+		} catch (e) {
+			return {
+				success: false,
+				error: normalizeError(e)
+			};
+		}
+	}
+};
+//#endregion
+export { PermissionCheckerService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/identity/permission/checker/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionEvaluator","PolicyData","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PermissionCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","realmEntity","realmRepository","resolve","name","realm_id","entity","repository","findOneBy","input","IDENTITY","identity","evaluationContext","evaluator","provider","permissionProvider","policyEngine","identityPermissionProvider","has","ATTRIBUTES","evaluate","preEvaluate","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/permission/checker/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PermissionEvaluationContext } from '@authup/access';\nimport { BuiltInPolicyType, PermissionEvaluator, PolicyData } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../identity-policy-data.ts';\nimport type {\n    IPermissionCheckerService,\n    PermissionCheckerServiceContext,\n} from './types.ts';\n\nexport class PermissionCheckerService implements IPermissionCheckerService {\n    protected ctx: PermissionCheckerServiceContext;\n\n    constructor(ctx: PermissionCheckerServiceContext) {\n        this.ctx = ctx;\n    }\n\n    async check(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<void> {\n        let criteria: Record<string, any>;\n        if (isUUID(idOrName)) {\n            criteria = { id: idOrName };\n        } else {\n            const realmEntity = await this.ctx.realmRepository.resolve(realm);\n            criteria = {\n                name: idOrName,\n                ...(realmEntity ? { realm_id: realmEntity.id } : {}),\n            };\n        }\n\n        const entity = await this.ctx.repository.findOneBy(criteria);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const input = { ...data };\n        if (typeof input[BuiltInPolicyType.IDENTITY] === 'undefined') {\n            input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n        }\n\n        const evaluationContext: PermissionEvaluationContext = {\n            name: entity.name,\n            input: new PolicyData(input),\n        };\n\n        const evaluator = new PermissionEvaluator({\n            provider: this.ctx.permissionProvider,\n            policyEngine: new PolicyEngine(this.ctx.identityPermissionProvider),\n        });\n\n        if (\n            evaluationContext.input &&\n            evaluationContext.input.has(BuiltInPolicyType.ATTRIBUTES)\n        ) {\n            await evaluator.evaluate(evaluationContext);\n        } else {\n            await evaluator.preEvaluate(evaluationContext);\n        }\n    }\n\n    async safeCheck(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Result<null>> {\n        try {\n            await this.check(idOrName, data, actor, realm);\n            return { success: true, data: null };\n        } catch (e) {\n            return { success: false, error: normalizeError(e) };\n        }\n    }\n}\n"],"mappings":";;;;;;AAoBA,IAAaQ,2BAAb,MAAaA;CACCC;CAEV,YAAYA,KAAsC;EAC9C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACH,MAAMM,cAAc,MAAM,KAAKR,IAAIS,gBAAgBC,QAAQL,KAAAA;GAC3DC,WAAW;IACPK,MAAMT;IACN,GAAIM,cAAc,EAAEI,UAAUJ,YAAYD,GAAG,IAAI,CAAC;GACtD;EACJ;EAEA,MAAMM,SAAS,MAAM,KAAKb,IAAIc,WAAWC,UAAUT,QAAAA;EACnD,IAAI,CAACO,QACD,MAAM,IAAIlB,oBAAAA;EAGd,MAAMqB,QAAQ,EAAE,GAAGb,KAAK;EACxB,IAAI,OAAOa,MAAMzB,kBAAkB0B,cAAc,aAC7CD,MAAMzB,kBAAkB0B,YAAYnB,qBAAqBM,MAAMc,QAAQ;EAG3E,MAAMC,oBAAiD;GACnDR,MAAME,OAAOF;GACbK,OAAO,IAAIvB,WAAWuB,KAAAA;EAC1B;EAEA,MAAMI,YAAY,IAAI5B,oBAAoB;GACtC6B,UAAU,KAAKrB,IAAIsB;GACnBC,cAAc,IAAI1B,eAAa,KAAKG,IAAIwB,0BAA0B;EACtE,CAAA;EAEA,IACIL,kBAAkBH,SAClBG,kBAAkBH,MAAMS,IAAIlC,kBAAkBmC,UAAU,GAExD,MAAMN,UAAUO,SAASR,iBAAAA;OAEzB,MAAMC,UAAUQ,YAAYT,iBAAAA;CAEpC;CAEA,MAAMU,UACF3B,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAEyB,SAAS;IAAM3B,MAAM;GAAK;EACvC,SAAS4B,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAOpC,eAAemC,CAAAA;GAAG;EACtD;CACJ;AACJ"}

package/dist/core/identity/permission/checker/types.d.ts

@@ -0,0 +1,42 @@
+import type { IPermissionProvider } from '@authup/access';
+import type { Result } from '@authup/kit';
+import type { ActorContext } from '@authup/server-kit';
+import type { IPermissionRepository, IRealmRepository } from '../../../entities/index.ts';
+import type { IIdentityPermissionProvider } from '../types.ts';
+export type PermissionCheckerServiceContext = {
+    repository: IPermissionRepository;
+    realmRepository: IRealmRepository;
+    permissionProvider: IPermissionProvider;
+    identityPermissionProvider: IIdentityPermissionProvider;
+};
+export interface IPermissionCheckerService {
+    /**
+     * Resolve a permission by id (UUID) or name and evaluate it against
+     * the supplied data and actor. Throws on any failure — entity not
+     * found, evaluator denial, validator error.
+     *
+     * If `data[identity]` is omitted, the actor's identity (flattened to
+     * `IdentityPolicyData`) is injected. If `data[attributes]` is present,
+     * the evaluator runs a full `evaluate`; otherwise it runs a
+     * `preEvaluate` (data-less gate check).
+     *
+     * @param idOrName Permission UUID or name. Names are resolved within
+     *   the supplied realm (or the resolved fallback realm).
+     * @param data Caller-supplied evaluation input. Mutated copy is used
+     *   internally.
+     * @param actor The caller context. `actor.identity` becomes the
+     *   default identity input when `data[identity]` is unset.
+     * @param realm Optional realm id used to disambiguate name lookups.
+     * @throws {EntityNotFoundError} When no permission matches.
+     * @throws {Error} Whatever the evaluator throws on denial.
+     */
+    check(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<void>;
+    /**
+     * Same as `check`, but never throws — collapses any failure into a
+     * `Result<null>` with `success: false` and the originating error.
+     * Use this at boundaries that want to embed denial in a response body
+     * rather than propagate it.
+     */
+    safeCheck(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<Result<null>>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/permission/checker/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/permission/checker/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EACR,qBAAqB,EACrB,gBAAgB,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE/D,MAAM,MAAM,+BAA+B,GAAG;IAC1C,UAAU,EAAE,qBAAqB,CAAC;IAClC,eAAe,EAAE,gBAAgB,CAAC;IAClC,kBAAkB,EAAE,mBAAmB,CAAC;IACxC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,MAAM,WAAW,yBAAyB;IACtC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CACD,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;OAKG;IACH,SAAS,CACL,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;CAC5B"}

package/dist/core/identity/permission/identity-policy-data.d.ts

@@ -0,0 +1,4 @@
+import type { IdentityPolicyData } from '@authup/access';
+import type { Identity } from '@authup/core-kit';
+export declare function toIdentityPolicyData(identity: Identity | undefined): IdentityPolicyData | undefined;
+//# sourceMappingURL=identity-policy-data.d.ts.map

package/dist/core/identity/permission/identity-policy-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-policy-data.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/identity-policy-data.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAAG,kBAAkB,GAAG,SAAS,CA4BnG"}