@authup/server-core 1.0.0-beta.41 → 1.0.0-beta.42

package/dist/core/entities/client-role/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-role/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErF,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB,CAAC,UAAU,CAAC;CAC3E;AAED,MAAM,WAAW,kBAAkB;IAC/B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9G,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAChE"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-role/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB,CAAC,UAAU,CAAC;CAC3E;AAED,MAAM,WAAW,kBAAkB;IAC/B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9G,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAChE"}

package/dist/core/entities/client-scope/service.d.ts

@@ -1,8 +1,7 @@
 import { ClientScopeValidator } from '@authup/core-kit';
 import type { ClientScope } from '@authup/core-kit';
-import type { ActorContext } from '../actor/types.ts';
-import { AbstractEntityService } from '../service.ts';
-import type { EntityRepositoryFindManyResult } from '../types.ts';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import { AbstractEntityService } from '@authup/server-kit';
 import type { IClientScopeRepository, IClientScopeService } from './types.ts';
 export type ClientScopeServiceContext = {
     repository: IClientScopeRepository;

package/dist/core/entities/client-scope/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/service.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,oBAAoB,EAAkC,MAAM,kBAAkB,CAAC;AACxF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,MAAM,yBAAyB,GAAG;IACpC,UAAU,EAAE,sBAAsB,CAAC;CACtC,CAAC;AAEF,qBAAa,kBAAmB,SAAQ,qBAAsB,YAAW,mBAAmB;IACxF,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,GAAG,EAAE,yBAAyB;IAMpC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAajD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IAkBjB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IAkCjB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;CAmB1B"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,oBAAoB,EAAkB,MAAM,kBAAkB,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,MAAM,yBAAyB,GAAG;IACpC,UAAU,EAAE,sBAAsB,CAAC;CACtC,CAAC;AAEF,qBAAa,kBAAmB,SAAQ,qBAAsB,YAAW,mBAAmB;IACxF,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,GAAG,EAAE,yBAAyB;IAMpC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAajD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IAkBjB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IAkCjB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;CAmB1B"}

package/dist/core/entities/client-scope/service.mjs

@@ -1,7 +1,8 @@
-import { AbstractEntityService } from "../service.mjs";
-import { ClientScopeValidator, PermissionName, ValidatorGroup } from "@authup/core-kit";
+import { ClientScopeValidator, PermissionName } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { ValidatorGroup } from "@authup/kit";
 import { BuiltInPolicyType, PolicyData } from "@authup/access";
-import { ConflictError, NotFoundError } from "@ebec/http";
+import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/client-scope/service.ts
 var ClientScopeService = class extends AbstractEntityService {
 	repository;
@@ -28,7 +29,7 @@ var ClientScopeService = class extends AbstractEntityService {
 			PermissionName.CLIENT_DELETE
 		] });
 		const entity = await this.repository.findOneBy({ id });
-		if (!entity) throw new NotFoundError();
+		if (!entity) throw new EntityNotFoundError();
 		return entity;
 	}
 	async create(data, actor) {
@@ -38,7 +39,7 @@ var ClientScopeService = class extends AbstractEntityService {
 		if (await this.repository.findOneBy({
 			client_id: validated.client_id,
 			scope_id: validated.scope_id
-		})) throw new ConflictError("The client-scope assignment already exists.");
+		})) throw new EntityConflictError({ entity: "client-scope" });
 		if (validated.client) validated.client_realm_id = validated.client.realm_id;
 		if (validated.scope) validated.scope_realm_id = validated.scope.realm_id;
 		await actor.permissionEvaluator.evaluate({
@@ -52,7 +53,7 @@ var ClientScopeService = class extends AbstractEntityService {
 	async delete(id, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_DELETE });
 		const entity = await this.repository.findOneBy({ id });
-		if (!entity) throw new NotFoundError();
+		if (!entity) throw new EntityNotFoundError();
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.CLIENT_SCOPE_DELETE,
 			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })

package/dist/core/entities/client-scope/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ConflictError","NotFoundError","ClientScopeValidator","PermissionName","ValidatorGroup","AbstractEntityService","ClientScopeService","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_SCOPE_READ","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_SCOPE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","client_id","scope_id","client","client_realm_id","realm_id","scope","scope_realm_id","evaluate","input","ATTRIBUTES","save","delete","CLIENT_SCOPE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/client-scope/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ConflictError, NotFoundError } from '@ebec/http';\nimport { ClientScopeValidator, PermissionName, ValidatorGroup } from '@authup/core-kit';\nimport type { ClientScope } from '@authup/core-kit';\nimport type { ActorContext } from '../actor/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport type { IClientScopeRepository, IClientScopeService } from './types.ts';\n\nexport type ClientScopeServiceContext = {\n    repository: IClientScopeRepository;\n};\n\nexport class ClientScopeService extends AbstractEntityService implements IClientScopeService {\n    protected repository: IClientScopeRepository;\n\n    protected validator: ClientScopeValidator;\n\n    constructor(ctx: ClientScopeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new ClientScopeValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<ClientScope>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_SCOPE_READ,\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_SCOPE_READ,\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            client_id: validated.client_id,\n            scope_id: validated.scope_id,\n        });\n        if (existing) {\n            throw new ConflictError('The client-scope assignment already exists.');\n        }\n\n        if (validated.client) {\n            validated.client_realm_id = validated.client.realm_id;\n        }\n\n        if (validated.scope) {\n            validated.scope_realm_id = validated.scope.realm_id;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_SCOPE_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_SCOPE_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;AAoBA,IAAaQ,qBAAb,cAAwCD,sBAAAA;CAC1BE;CAEAC;CAEV,YAAYC,KAAgC;AACxC,SAAK;AACL,OAAKF,aAAaE,IAAIF;AACtB,OAAKC,YAAY,IAAIN,sBAAAA;;CAGzB,MAAMQ,QACFC,OACAC,OACoD;AACpD,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;GACff,eAAegB;GAClB,EACL,CAAA;AAEA,SAAO,KAAKZ,WAAWa,SAAST,MAAAA;;CAGpC,MAAMU,OACFC,IACAV,OACoB;AACpB,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;GACff,eAAegB;GAClB,EACL,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAItB,eAAAA;AAGd,SAAOsB;;CAGX,MAAME,OACFC,MACAd,OACoB;AACpB,QAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAeyB,qBAAoB,CAAA;EAEvF,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO3B,eAAe4B,QAAO,CAAA;AAEhF,QAAM,KAAKzB,WAAW0B,oBAAoBJ,UAAAA;AAM1C,MAAIK,MAJmB,KAAK3B,WAAWiB,UAAU;GAC7CW,WAAWN,UAAUM;GACrBC,UAAUP,UAAUO;GACxB,CAAA,CAEI,OAAM,IAAIpC,cAAc,8CAAA;AAG5B,MAAI6B,UAAUQ,OACVR,WAAUS,kBAAkBT,UAAUQ,OAAOE;AAGjD,MAAIV,UAAUW,MACVX,WAAUY,iBAAiBZ,UAAUW,MAAMD;AAG/C,QAAM3B,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMZ,eAAeyB;GACrBe,OAAO,IAAI5C,WAAW,GAAGD,kBAAkB8C,aAAaf,WAAU,CAAA;GACtE,CAAA;EAEA,IAAIN,SAAS,KAAKhB,WAAWkB,OAAOI,UAAAA;AACpCN,WAAS,MAAM,KAAKhB,WAAWsC,KAAKtB,OAAAA;AAEpC,SAAOA;;CAGX,MAAMuB,OACFxB,IACAV,OACoB;AACpB,QAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAe4C,qBAAoB,CAAA;EAEvF,MAAMxB,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAItB,eAAAA;AAGd,QAAMW,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMZ,eAAe4C;GACrBJ,OAAO,IAAI5C,WAAW,GAAGD,kBAAkB8C,aAAarB,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAED,IAAI0B,aAAazB;AACzB,QAAM,KAAKhB,WAAW0C,OAAO1B,OAAAA;AAC7BA,SAAOD,KAAK0B;AAEZ,SAAOzB"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientScopeValidator","PermissionName","AbstractEntityService","ClientScopeService","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_SCOPE_READ","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_SCOPE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","client_id","scope_id","client","client_realm_id","realm_id","scope","scope_realm_id","evaluate","input","ATTRIBUTES","save","delete","CLIENT_SCOPE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/client-scope/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientScopeValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientScope } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IClientScopeRepository, IClientScopeService } from './types.ts';\n\nexport type ClientScopeServiceContext = {\n    repository: IClientScopeRepository;\n};\n\nexport class ClientScopeService extends AbstractEntityService implements IClientScopeService {\n    protected repository: IClientScopeRepository;\n\n    protected validator: ClientScopeValidator;\n\n    constructor(ctx: ClientScopeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new ClientScopeValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<ClientScope>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_SCOPE_READ,\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_SCOPE_READ,\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            client_id: validated.client_id,\n            scope_id: validated.scope_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'client-scope' });\n        }\n\n        if (validated.client) {\n            validated.client_realm_id = validated.client.realm_id;\n        }\n\n        if (validated.scope) {\n            validated.scope_realm_id = validated.scope.realm_id;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_SCOPE_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_SCOPE_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;AAoBA,IAAaQ,qBAAb,cAAwCD,sBAAAA;CAC1BE;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIL,qBAAAA;CACzB;CAEA,MAAMO,QACFC,OACAC,OACoD;EACpD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFX,eAAeY;GACfZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAST,KAAAA;CACpC;CAEA,MAAMU,OACFC,IACAV,OACoB;EACpB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFX,eAAeY;GACfZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,OAAOsB;CACX;CAEA,MAAME,OACFC,MACAd,OACoB;EACpB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMX,eAAewB,oBAAoB,CAAA;EAEvF,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO7B,eAAe8B,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWiB,UAAU;GAC7CW,WAAWN,UAAUM;GACrBC,UAAUP,UAAUO;EACxB,CAAA,GAEI,MAAM,IAAIpC,oBAAoB,EAAEuB,QAAQ,eAAe,CAAA;EAG3D,IAAIM,UAAUQ,QACVR,UAAUS,kBAAkBT,UAAUQ,OAAOE;EAGjD,IAAIV,UAAUW,OACVX,UAAUY,iBAAiBZ,UAAUW,MAAMD;EAG/C,MAAM3B,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMX,eAAewB;GACrBe,OAAO,IAAI5C,WAAW,GAAGD,kBAAkB8C,aAAaf,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIN,SAAS,KAAKhB,WAAWkB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKhB,WAAWsC,KAAKtB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMuB,OACFxB,IACAV,OACoB;EACpB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMX,eAAe2C,oBAAoB,CAAA;EAEvF,MAAMxB,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMW,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMX,eAAe2C;GACrBJ,OAAO,IAAI5C,WAAW,GAAGD,kBAAkB8C,aAAarB,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAI0B,aAAazB;EACzB,MAAM,KAAKhB,WAAW0C,OAAO1B,MAAAA;EAC7BA,OAAOD,KAAK0B;EAEZ,OAAOzB;CACX;AACJ"}

package/dist/core/entities/client-scope/types.d.ts

@@ -1,6 +1,5 @@
 import type { ClientScope } from '@authup/core-kit';
-import type { ActorContext } from '../actor/types.ts';
-import type { EntityRepositoryFindManyResult, IEntityRepository } from '../types.ts';
+import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
 export interface IClientScopeRepository extends IEntityRepository<ClientScope> {
 }
 export interface IClientScopeService {

package/dist/core/entities/client-scope/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErF,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB,CAAC,WAAW,CAAC;CAC7E;AAED,MAAM,WAAW,mBAAmB;IAChC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/G,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjE"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB,CAAC,WAAW,CAAC;CAC7E;AAED,MAAM,WAAW,mBAAmB;IAChC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/G,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjE"}

package/dist/core/entities/identity-provider/types.d.ts

@@ -1,5 +1,5 @@
 import type { IdentityProvider, IdentityProviderProtocol } from '@authup/core-kit';
-import type { IEntityRepository } from '../types.ts';
+import type { IEntityRepository } from '@authup/server-kit';
 export interface IIdentityProviderRepository extends IEntityRepository<IdentityProvider> {
     checkUniqueness(data: Partial<IdentityProvider>, existing?: IdentityProvider): Promise<void>;
     saveWithEA(entity: IdentityProvider, attributes?: Record<string, any>): Promise<IdentityProvider>;

package/dist/core/entities/identity-provider/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,WAAW,2BAA4B,SAAQ,iBAAiB,CAAC,gBAAgB,CAAC;IACpF,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7F,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAElG,cAAc,CAAC,QAAQ,EAAE,wBAAwB,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CACtG"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,MAAM,WAAW,2BAA4B,SAAQ,iBAAiB,CAAC,gBAAgB,CAAC;IACpF,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7F,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAElG,cAAc,CAAC,QAAQ,EAAE,wBAAwB,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CACtG"}

package/dist/core/entities/identity-provider-role-mapping/service.d.ts

@@ -1,8 +1,7 @@
 import { IdentityProviderRoleMappingValidator } from '@authup/core-kit';
 import type { IdentityProviderRoleMapping } from '@authup/core-kit';
-import type { ActorContext } from '../actor/types.ts';
-import { AbstractEntityService } from '../service.ts';
-import type { EntityRepositoryFindManyResult } from '../types.ts';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import { AbstractEntityService } from '@authup/server-kit';
 import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
 import type { IIdentityProviderRoleMappingRepository, IIdentityProviderRoleMappingService } from './types.ts';
 export type IdentityProviderRoleMappingServiceContext = {

package/dist/core/entities/identity-provider-role-mapping/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/service.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,oCAAoC,EAAkC,MAAM,kBAAkB,CAAC;AACxG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,sCAAsC,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAE9G,MAAM,MAAM,yCAAyC,GAAG;IACpD,UAAU,EAAE,sCAAsC,CAAC;IACnD,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,kCAAmC,SAAQ,qBAAsB,YAAW,mCAAmC;IACxH,SAAS,CAAC,UAAU,EAAE,sCAAsC,CAAC;IAE7D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,oCAAoC,CAAC;gBAE9C,GAAG,EAAE,yCAAyC;IAOpD,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,2BAA2B,CAAC,CAAC;IAajE,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;IAkBjC,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;IA2DjC,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;IAsBjC,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;CAmB1C"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,oCAAoC,EAAkB,MAAM,kBAAkB,CAAC;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,sCAAsC,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAE9G,MAAM,MAAM,yCAAyC,GAAG;IACpD,UAAU,EAAE,sCAAsC,CAAC;IACnD,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,kCAAmC,SAAQ,qBAAsB,YAAW,mCAAmC;IACxH,SAAS,CAAC,UAAU,EAAE,sCAAsC,CAAC;IAE7D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,oCAAoC,CAAC;gBAE9C,GAAG,EAAE,yCAAyC;IAOpD,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,2BAA2B,CAAC,CAAC;IAajE,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;IAkBjC,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;IA2DjC,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;IAsBjC,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;CAmB1C"}

package/dist/core/entities/identity-provider-role-mapping/service.mjs

@@ -1,7 +1,8 @@
-import { AbstractEntityService } from "../service.mjs";
-import { IdentityProviderRoleMappingValidator, PermissionName, ValidatorGroup } from "@authup/core-kit";
-import { BuiltInPolicyType, PolicyData } from "@authup/access";
-import { BadRequestError, ConflictError, ForbiddenError, NotFoundError } from "@ebec/http";
+import { IdentityProviderRoleMappingValidator, PermissionName } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { ValidatorGroup } from "@authup/kit";
+import { BuiltInPolicyType, PermissionError, PolicyData } from "@authup/access";
+import { BadRequestError, EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/identity-provider-role-mapping/service.ts
 var IdentityProviderRoleMappingService = class extends AbstractEntityService {
 	repository;
@@ -30,7 +31,7 @@ var IdentityProviderRoleMappingService = class extends AbstractEntityService {
 			PermissionName.IDENTITY_PROVIDER_DELETE
 		] });
 		const entity = await this.repository.findOneBy({ id });
-		if (!entity) throw new NotFoundError();
+		if (!entity) throw new EntityNotFoundError();
 		return entity;
 	}
 	async create(data, actor) {
@@ -40,7 +41,7 @@ var IdentityProviderRoleMappingService = class extends AbstractEntityService {
 		if (await this.repository.findOneBy({
 			provider_id: validated.provider_id,
 			role_id: validated.role_id
-		})) throw new ConflictError("The identity-provider-role-mapping already exists.");
+		})) throw new EntityConflictError({ entity: "identity-provider-role-mapping" });
 		if (validated.provider) validated.provider_realm_id = validated.provider.realm_id;
 		if (validated.role) validated.role_realm_id = validated.role.realm_id;
 		if (validated.role_realm_id && validated.provider_realm_id && validated.role_realm_id !== validated.provider_realm_id) throw new BadRequestError("It is not possible to map an identity provider to a role of another realm.");
@@ -52,7 +53,7 @@ var IdentityProviderRoleMappingService = class extends AbstractEntityService {
 				type: "role",
 				id: validated.role_id,
 				clientId: validated.role.client_id
-			})) throw new ForbiddenError("You don't own the required permissions.");
+			})) throw new PermissionError({ message: "You don't own the required permissions." });
 		}
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE,
@@ -65,7 +66,7 @@ var IdentityProviderRoleMappingService = class extends AbstractEntityService {
 	async update(id, data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE });
 		const entity = await this.repository.findOneBy({ id });
-		if (!entity) throw new NotFoundError();
+		if (!entity) throw new EntityNotFoundError();
 		const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });
 		await this.repository.validateJoinColumns(validated);
 		const merged = this.repository.merge(entity, validated);
@@ -78,7 +79,7 @@ var IdentityProviderRoleMappingService = class extends AbstractEntityService {
 	async delete(id, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE });
 		const entity = await this.repository.findOneBy({ id });
-		if (!entity) throw new NotFoundError();
+		if (!entity) throw new EntityNotFoundError();
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE,
 			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })

package/dist/core/entities/identity-provider-role-mapping/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","BadRequestError","ConflictError","ForbiddenError","NotFoundError","IdentityProviderRoleMappingValidator","PermissionName","ValidatorGroup","AbstractEntityService","IdentityProviderRoleMappingService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","IDENTITY_PROVIDER_ROLE_READ","IDENTITY_PROVIDER_READ","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","IDENTITY_PROVIDER_ROLE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","provider_id","role_id","provider","provider_realm_id","realm_id","role","role_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","evaluate","input","ATTRIBUTES","save","update","IDENTITY_PROVIDER_ROLE_UPDATE","UPDATE","merged","merge","delete","IDENTITY_PROVIDER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/identity-provider-role-mapping/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { \n    BadRequestError, \n    ConflictError, \n    ForbiddenError, \n    NotFoundError, \n} from '@ebec/http';\nimport { IdentityProviderRoleMappingValidator, PermissionName, ValidatorGroup } from '@authup/core-kit';\nimport type { IdentityProviderRoleMapping } from '@authup/core-kit';\nimport type { ActorContext } from '../actor/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IIdentityProviderRoleMappingRepository, IIdentityProviderRoleMappingService } from './types.ts';\n\nexport type IdentityProviderRoleMappingServiceContext = {\n    repository: IIdentityProviderRoleMappingRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class IdentityProviderRoleMappingService extends AbstractEntityService implements IIdentityProviderRoleMappingService {\n    protected repository: IIdentityProviderRoleMappingRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: IdentityProviderRoleMappingValidator;\n\n    constructor(ctx: IdentityProviderRoleMappingServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new IdentityProviderRoleMappingValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<IdentityProviderRoleMapping>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.IDENTITY_PROVIDER_ROLE_READ,\n                PermissionName.IDENTITY_PROVIDER_READ,\n                PermissionName.IDENTITY_PROVIDER_UPDATE,\n                PermissionName.IDENTITY_PROVIDER_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.IDENTITY_PROVIDER_ROLE_READ,\n                PermissionName.IDENTITY_PROVIDER_READ,\n                PermissionName.IDENTITY_PROVIDER_UPDATE,\n                PermissionName.IDENTITY_PROVIDER_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            provider_id: validated.provider_id,\n            role_id: validated.role_id,\n        });\n        if (existing) {\n            throw new ConflictError('The identity-provider-role-mapping already exists.');\n        }\n\n        if (validated.provider) {\n            validated.provider_realm_id = validated.provider.realm_id;\n        }\n\n        if (validated.role) {\n            validated.role_realm_id = validated.role.realm_id;\n        }\n\n        if (\n            validated.role_realm_id &&\n            validated.provider_realm_id &&\n            validated.role_realm_id !== validated.provider_realm_id\n        ) {\n            throw new BadRequestError('It is not possible to map an identity provider to a role of another realm.');\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.role_id,\n                    clientId: validated.role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new ForbiddenError('You don\\'t own the required permissions.');\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const merged = this.repository.merge(entity, validated);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;AA2BA,IAAaU,qCAAb,cAAwDD,sBAAAA;CAC1CE;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;AACxD,SAAK;AACL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,6BAA6BE,IAAIF;AACtC,OAAKC,YAAY,IAAIP,sCAAAA;;CAGzB,MAAMS,QACFC,OACAC,OACoE;AACpE,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;AAEA,SAAO,KAAKb,WAAWc,SAAST,MAAAA;;CAGpC,MAAMU,OACFC,IACAV,OACoC;AACpC,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GAClB,EACL,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAIvB,eAAAA;AAGd,SAAOuB;;CAGX,MAAME,OACFC,MACAd,OACoC;AACpC,QAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMb,eAAe0B,+BAA8B,CAAA;EAEjG,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO5B,eAAe6B,QAAO,CAAA;AAEhF,QAAM,KAAK1B,WAAW2B,oBAAoBJ,UAAAA;AAM1C,MAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,aAAaN,UAAUM;GACvBC,SAASP,UAAUO;GACvB,CAAA,CAEI,OAAM,IAAItC,cAAc,qDAAA;AAG5B,MAAI+B,UAAUQ,SACVR,WAAUS,oBAAoBT,UAAUQ,SAASE;AAGrD,MAAIV,UAAUW,KACVX,WAAUY,gBAAgBZ,UAAUW,KAAKD;AAG7C,MACIV,UAAUY,iBACVZ,UAAUS,qBACVT,UAAUY,kBAAkBZ,UAAUS,kBAEtC,OAAM,IAAIzC,gBAAgB,6EAAA;AAG9B,MAAIgC,UAAUW,QAAQ5B,MAAM8B;OAYpB,CAACC,MAXwB,KAAKpC,2BAA2BqC,WACzD;IACIC,MAAMjC,MAAM8B,SAASG;IACrBvB,IAAIV,MAAM8B,SAAShB,KAAKJ;IAC5B,EACA;IACIuB,MAAM;IACNvB,IAAIO,UAAUO;IACdU,UAAUjB,UAAUW,KAAKO;IAC7B,CAAA,CAGA,OAAM,IAAIhD,eAAe,0CAAA;;AAIjC,QAAMa,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMb,eAAe0B;GACrBqB,OAAO,IAAIrD,WAAW,GAAGD,kBAAkBuD,aAAarB,WAAU,CAAA;GACtE,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,UAAAA;AACpCN,WAAS,MAAM,KAAKjB,WAAW6C,KAAK5B,OAAAA;AAEpC,SAAOA;;CAGX,MAAM6B,OACF9B,IACAI,MACAd,OACoC;AACpC,QAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMb,eAAemD,+BAA8B,CAAA;EAEjG,MAAM9B,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAIvB,eAAAA;EAGd,MAAM6B,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO5B,eAAemD,QAAO,CAAA;AAEhF,QAAM,KAAKhD,WAAW2B,oBAAoBJ,UAAAA;EAE1C,MAAM0B,SAAS,KAAKjD,WAAWkD,MAAMjC,QAAQM,UAAAA;AAE7C,QAAMjB,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMb,eAAemD;GACrBJ,OAAO,IAAIrD,WAAW,GAAGD,kBAAkBuD,aAAaK,QAAO,CAAA;GACnE,CAAA;AAEA,SAAO,KAAKjD,WAAW6C,KAAKI,OAAAA;;CAGhC,MAAME,OACFnC,IACAV,OACoC;AACpC,QAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMb,eAAewD,+BAA8B,CAAA;EAEjG,MAAMnC,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,IAAG,CAAA;AACpD,MAAI,CAACC,OACD,OAAM,IAAIvB,eAAAA;AAGd,QAAMY,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMb,eAAewD;GACrBT,OAAO,IAAIrD,WAAW,GAAGD,kBAAkBuD,aAAa3B,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAED,IAAIqC,aAAapC;AACzB,QAAM,KAAKjB,WAAWsD,OAAOrC,OAAAA;AAC7BA,SAAOD,KAAKqC;AAEZ,SAAOpC"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","PolicyData","BadRequestError","EntityConflictError","EntityNotFoundError","ValidatorGroup","IdentityProviderRoleMappingValidator","PermissionName","AbstractEntityService","IdentityProviderRoleMappingService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","IDENTITY_PROVIDER_ROLE_READ","IDENTITY_PROVIDER_READ","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","IDENTITY_PROVIDER_ROLE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","provider_id","role_id","provider","provider_realm_id","realm_id","role","role_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","message","evaluate","input","ATTRIBUTES","save","update","IDENTITY_PROVIDER_ROLE_UPDATE","UPDATE","merged","merge","delete","IDENTITY_PROVIDER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/identity-provider-role-mapping/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, PolicyData } from '@authup/access';\nimport { BadRequestError, EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { IdentityProviderRoleMappingValidator, PermissionName } from '@authup/core-kit';\nimport type { IdentityProviderRoleMapping } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IIdentityProviderRoleMappingRepository, IIdentityProviderRoleMappingService } from './types.ts';\n\nexport type IdentityProviderRoleMappingServiceContext = {\n    repository: IIdentityProviderRoleMappingRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class IdentityProviderRoleMappingService extends AbstractEntityService implements IIdentityProviderRoleMappingService {\n    protected repository: IIdentityProviderRoleMappingRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: IdentityProviderRoleMappingValidator;\n\n    constructor(ctx: IdentityProviderRoleMappingServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new IdentityProviderRoleMappingValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<IdentityProviderRoleMapping>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.IDENTITY_PROVIDER_ROLE_READ,\n                PermissionName.IDENTITY_PROVIDER_READ,\n                PermissionName.IDENTITY_PROVIDER_UPDATE,\n                PermissionName.IDENTITY_PROVIDER_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.IDENTITY_PROVIDER_ROLE_READ,\n                PermissionName.IDENTITY_PROVIDER_READ,\n                PermissionName.IDENTITY_PROVIDER_UPDATE,\n                PermissionName.IDENTITY_PROVIDER_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            provider_id: validated.provider_id,\n            role_id: validated.role_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'identity-provider-role-mapping' });\n        }\n\n        if (validated.provider) {\n            validated.provider_realm_id = validated.provider.realm_id;\n        }\n\n        if (validated.role) {\n            validated.role_realm_id = validated.role.realm_id;\n        }\n\n        if (\n            validated.role_realm_id &&\n            validated.provider_realm_id &&\n            validated.role_realm_id !== validated.provider_realm_id\n        ) {\n            throw new BadRequestError('It is not possible to map an identity provider to a role of another realm.');\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.role_id,\n                    clientId: validated.role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const merged = this.repository.merge(entity, validated);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;AAsBA,IAAaU,qCAAb,cAAwDD,sBAAAA;CAC1CE;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;EACxD,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIN,qCAAAA;CACzB;CAEA,MAAMQ,QACFC,OACAC,OACoE;EACpE,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAAST,KAAAA;CACpC;CAEA,MAAMU,OACFC,IACAV,OACoC;EACpC,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,OAAOuB;CACX;CAEA,MAAME,OACFC,MACAd,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAeyB,8BAA8B,CAAA;EAEjG,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO9B,eAAe+B,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,aAAaN,UAAUM;GACvBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIrC,oBAAoB,EAAEwB,QAAQ,iCAAiC,CAAA;EAG7E,IAAIM,UAAUQ,UACVR,UAAUS,oBAAoBT,UAAUQ,SAASE;EAGrD,IAAIV,UAAUW,MACVX,UAAUY,gBAAgBZ,UAAUW,KAAKD;EAG7C,IACIV,UAAUY,iBACVZ,UAAUS,qBACVT,UAAUY,kBAAkBZ,UAAUS,mBAEtC,MAAM,IAAIxC,gBAAgB,4EAAA;EAG9B,IAAI+B,UAAUW,QAAQ5B,MAAM8B;OAYpB,CAACC,MAXwB,KAAKpC,2BAA2BqC,WACzD;IACIC,MAAMjC,MAAM8B,SAASG;IACrBvB,IAAIV,MAAM8B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIO,UAAUO;IACdU,UAAUjB,UAAUW,KAAKO;GAC7B,CAAA,GAGA,MAAM,IAAInD,gBAAgB,EAAEoD,SAAS,0CAA2C,CAAA;EAAA;EAIxF,MAAMpC,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMZ,eAAeyB;GACrBsB,OAAO,IAAIrD,WAAW,GAAGF,kBAAkBwD,aAAatB,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAW8C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAI,MACAd,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAemD,8BAA8B,CAAA;EAEjG,MAAM/B,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,MAAM6B,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO9B,eAAesD,OAAO,CAAA;EAEhF,MAAM,KAAKjD,WAAW2B,oBAAoBJ,SAAAA;EAE1C,MAAM2B,SAAS,KAAKlD,WAAWmD,MAAMlC,QAAQM,SAAAA;EAE7C,MAAMjB,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMZ,eAAemD;GACrBJ,OAAO,IAAIrD,WAAW,GAAGF,kBAAkBwD,aAAaK,OAAO,CAAA;EACnE,CAAA;EAEA,OAAO,KAAKlD,WAAW8C,KAAKI,MAAAA;CAChC;CAEA,MAAME,OACFpC,IACAV,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAewD,8BAA8B,CAAA;EAEjG,MAAMpC,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMZ,eAAewD;GACrBT,OAAO,IAAIrD,WAAW,GAAGF,kBAAkBwD,aAAa5B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAIsC,aAAarC;EACzB,MAAM,KAAKjB,WAAWuD,OAAOtC,MAAAA;EAC7BA,OAAOD,KAAKsC;EAEZ,OAAOrC;CACX;AACJ"}

package/dist/core/entities/identity-provider-role-mapping/types.d.ts

@@ -1,6 +1,5 @@
 import type { IdentityProviderRoleMapping } from '@authup/core-kit';
-import type { ActorContext } from '../actor/types.ts';
-import type { EntityRepositoryFindManyResult, IEntityRepository } from '../types.ts';
+import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
 export interface IIdentityProviderRoleMappingRepository extends IEntityRepository<IdentityProviderRoleMapping> {
 }
 export interface IIdentityProviderRoleMappingService {

package/dist/core/entities/identity-provider-role-mapping/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErF,MAAM,WAAW,sCAAuC,SAAQ,iBAAiB,CAAC,2BAA2B,CAAC;CAE7G;AAED,MAAM,WAAW,mCAAmC;IAChD,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAC/H,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9E,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC7F,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACzG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;CACjF"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G,MAAM,WAAW,sCAAuC,SAAQ,iBAAiB,CAAC,2BAA2B,CAAC;CAE7G;AAED,MAAM,WAAW,mCAAmC;IAChD,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAC/H,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9E,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC7F,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACzG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;CACjF"}

package/dist/core/entities/index.d.ts

@@ -1,4 +1,3 @@
-export * from './actor/index.ts';
 export * from './client/index.ts';
 export * from './client-permission/index.ts';
 export * from './client-role/index.ts';
@@ -20,6 +19,4 @@ export * from './user-attribute/index.ts';
 export * from './user-permission/index.ts';
 export * from './user-role/index.ts';
 export * from './identity-provider-role-mapping/index.ts';
-export * from './service.ts';
-export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC;AAE1D,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}

package/dist/core/entities/index.mjs

@@ -1,4 +1,3 @@
-import { AbstractEntityService } from "./service.mjs";
 import { ClientService } from "./client/service.mjs";
 import "./client/index.mjs";
 import { ClientPermissionService } from "./client-permission/service.mjs";
@@ -39,4 +38,4 @@ import { UserRoleService } from "./user-role/service.mjs";
 import "./user-role/index.mjs";
 import { IdentityProviderRoleMappingService } from "./identity-provider-role-mapping/service.mjs";
 import "./identity-provider-role-mapping/index.mjs";
-export { AbstractEntityService, ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, IdentityProviderRoleMappingService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RobotPermissionService, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleService, ScopeService, UserAttributeService, UserPermissionService, UserRoleService, UserService };
+export { ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, IdentityProviderRoleMappingService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RobotPermissionService, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleService, ScopeService, UserAttributeService, UserPermissionService, UserRoleService, UserService };

package/dist/core/entities/permission/service.d.ts

@@ -1,13 +1,12 @@
 import { PermissionValidator } from '@authup/core-kit';
 import type { Permission } from '@authup/core-kit';
-import type { ActorContext } from '../actor/types.ts';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
 import type { IPermissionPolicyRepository } from '../permission-policy/types.ts';
 import type { IPolicyRepository } from '../policy/types.ts';
 import type { IRealmRepository } from '../realm/types.ts';
 import type { IRoleRepository } from '../role/types.ts';
 import type { IRolePermissionRepository } from '../role-permission/types.ts';
-import { AbstractEntityService } from '../service.ts';
-import type { EntityRepositoryFindManyResult } from '../types.ts';
+import { AbstractEntityService } from '@authup/server-kit';
 import type { IPermissionRepository, IPermissionService } from './types.ts';
 export type PermissionServiceContext = {
     repository: IPermissionRepository;

package/dist/core/entities/permission/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission/service.ts"],"names":[],"mappings":"AAWA,OAAO,EAEH,mBAAmB,EAItB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA0C5E,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,qBAAqB,CAAC;IAClC,eAAe,EAAE,gBAAgB,CAAC;IAClC,cAAc,EAAE,eAAe,CAAC;IAChC,wBAAwB,EAAE,yBAAyB,CAAC;IACpD,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,qBAAsB,YAAW,kBAAkB;IACtF,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAE5C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,wBAAwB,EAAE,yBAAyB,CAAC;IAE9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC;gBAE7B,GAAG,EAAE,wBAAwB;IAWnC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAYhD,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAiBhB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAKhB,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAKhB,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IA+FI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAwBtB;;;;OAIG;YACW,mBAAmB;IAuBjC;;;OAGG;YACW,iBAAiB;IAuB/B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;CA4CxC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAEH,mBAAmB,EAGtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA0C5E,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,qBAAqB,CAAC;IAClC,eAAe,EAAE,gBAAgB,CAAC;IAClC,cAAc,EAAE,eAAe,CAAC;IAChC,wBAAwB,EAAE,yBAAyB,CAAC;IACpD,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,qBAAsB,YAAW,kBAAkB;IACtF,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAE5C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,wBAAwB,EAAE,yBAAyB,CAAC;IAE9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC;gBAE7B,GAAG,EAAE,wBAAwB;IAWnC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAYhD,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAiBhB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAKhB,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAKhB,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IA+FI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAwBtB;;;;OAIG;YACW,mBAAmB;IAuBjC;;;OAGG;YACW,iBAAiB;IAuB/B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;CA4CxC"}

package/dist/core/entities/permission/service.mjs

@@ -1,9 +1,8 @@
-import { AbstractEntityService } from "../service.mjs";
-import { PermissionName, PermissionValidator, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME, ValidatorGroup } from "@authup/core-kit";
-import { isPropertySet, isUUID } from "@authup/kit";
+import { PermissionName, PermissionValidator, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { ValidatorGroup, isPropertySet, isUUID } from "@authup/kit";
 import { BuiltInPolicyType, PolicyData, SystemPolicyName } from "@authup/access";
-import { BadRequestError, NotFoundError } from "@ebec/http";
-import { AuthupError } from "@authup/errors";
+import { AuthupError, BadRequestError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/permission/service.ts
 const REALM_ADMIN_EXCLUDED_PERMISSIONS = [
 	PermissionName.REALM_CREATE,
@@ -75,7 +74,7 @@ var PermissionService = class extends AbstractEntityService {
 			PermissionName.PERMISSION_DELETE
 		] });
 		const entity = await this.repository.findOneByIdOrName(idOrName, realm);
-		if (!entity) throw new NotFoundError();
+		if (!entity) throw new EntityNotFoundError();
 		return entity;
 	}
 	async create(data, actor) {
@@ -96,8 +95,8 @@ var PermissionService = class extends AbstractEntityService {
 			else where.name = idOrName;
 			if (realm) where.realm_id = realm.id;
 			entity = await this.repository.findOneBy(where);
-			if (!entity && options.updateOnly) throw new NotFoundError();
-		} else if (options.updateOnly) throw new NotFoundError();
+			if (!entity && options.updateOnly) throw new EntityNotFoundError();
+		} else if (options.updateOnly) throw new EntityNotFoundError();
 		if (entity) {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });
 			group = ValidatorGroup.UPDATE;
@@ -143,7 +142,7 @@ var PermissionService = class extends AbstractEntityService {
 	async delete(id, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });
 		const entity = await this.repository.findOneBy({ id });
-		if (!entity) throw new NotFoundError();
+		if (!entity) throw new EntityNotFoundError();
 		if (entity.built_in) throw new BadRequestError("A built-in permission can not be deleted.");
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.PERMISSION_DELETE,

package/dist/core/entities/permission/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","SystemPolicyName","isPropertySet","isUUID","AuthupError","BadRequestError","NotFoundError","PermissionName","PermissionValidator","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ValidatorGroup","AbstractEntityService","REALM_ADMIN_EXCLUDED_PERMISSIONS","REALM_CREATE","REALM_UPDATE","REALM_DELETE","REALM_ADMIN_BOUND_PERMISSIONS","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","PermissionService","repository","realmRepository","roleRepository","rolePermissionRepository","policyRepository","permissionPolicyRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","findMany","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","CREATE","validated","run","validateJoinColumns","built_in","evaluate","input","ATTRIBUTES","checkUniqueness","merge","created","identity","getActorRealmId","assignDefaultPolicy","assignToAdminRole","assignToRealmAdminRoles","delete","entityId","remove","permission","defaultPolicy","findOneByName","DEFAULT","existing","permission_id","policy_id","entry","permission_realm_id","policy_realm_id","adminRole","role_id","role_realm_id","includes","isBuiltIn","Object","values","policyName","REALM_BOUND","REALM_OR_GLOBAL","policy","realmAdminRoles","findManyBy","role"],"sources":["../../../../src/core/entities/permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData, SystemPolicyName } from '@authup/access';\nimport { isPropertySet, isUUID } from '@authup/kit';\nimport { AuthupError } from '@authup/errors';\nimport { BadRequestError, NotFoundError } from '@ebec/http';\nimport {\n    PermissionName,\n    PermissionValidator,\n    ROLE_ADMIN_NAME,\n    ROLE_REALM_ADMIN_NAME,\n    ValidatorGroup,\n} from '@authup/core-kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { ActorContext } from '../actor/types.ts';\nimport type { IPermissionPolicyRepository } from '../permission-policy/types.ts';\nimport type { IPolicyRepository } from '../policy/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport type { IRoleRepository } from '../role/types.ts';\nimport type { IRolePermissionRepository } from '../role-permission/types.ts';\nimport { AbstractEntityService } from '../service.ts';\nimport type { EntityRepositoryFindManyResult } from '../types.ts';\nimport type { IPermissionRepository, IPermissionService } from './types.ts';\n\nconst REALM_ADMIN_EXCLUDED_PERMISSIONS = [\n    PermissionName.REALM_CREATE,\n    PermissionName.REALM_UPDATE,\n    PermissionName.REALM_DELETE,\n];\n\n/**\n * CUD permissions that get system.realm-bound on realm_admin.\n * Covers direct entity types (both global-capable and realm-only).\n *\n * Junction entity CUD (e.g. user_role, role_permission) intentionally\n * use realm-or-global instead, because their attributes include\n * multiple realm_id fields (e.g. user_realm_id + role_realm_id).\n * With attribute_name_strict: false, realm-bound would reject\n * junctions where one side is global (realm_id: null).\n */\nconst REALM_ADMIN_BOUND_PERMISSIONS = [\n    PermissionName.CLIENT_CREATE,\n    PermissionName.CLIENT_UPDATE,\n    PermissionName.CLIENT_DELETE,\n    PermissionName.IDENTITY_PROVIDER_CREATE,\n    PermissionName.IDENTITY_PROVIDER_UPDATE,\n    PermissionName.IDENTITY_PROVIDER_DELETE,\n    PermissionName.PERMISSION_CREATE,\n    PermissionName.PERMISSION_UPDATE,\n    PermissionName.PERMISSION_DELETE,\n    PermissionName.ROBOT_CREATE,\n    PermissionName.ROBOT_UPDATE,\n    PermissionName.ROBOT_DELETE,\n    PermissionName.ROLE_CREATE,\n    PermissionName.ROLE_UPDATE,\n    PermissionName.ROLE_DELETE,\n    PermissionName.SCOPE_CREATE,\n    PermissionName.SCOPE_UPDATE,\n    PermissionName.SCOPE_DELETE,\n    PermissionName.USER_CREATE,\n    PermissionName.USER_UPDATE,\n    PermissionName.USER_DELETE,\n];\n\nexport type PermissionServiceContext = {\n    repository: IPermissionRepository;\n    realmRepository: IRealmRepository;\n    roleRepository: IRoleRepository;\n    rolePermissionRepository: IRolePermissionRepository;\n    policyRepository: IPolicyRepository;\n    permissionPolicyRepository: IPermissionPolicyRepository;\n};\n\nexport class PermissionService extends AbstractEntityService implements IPermissionService {\n    protected repository: IPermissionRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected roleRepository: IRoleRepository;\n\n    protected rolePermissionRepository: IRolePermissionRepository;\n\n    protected policyRepository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    protected validator: PermissionValidator;\n\n    constructor(ctx: PermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.rolePermissionRepository = ctx.rolePermissionRepository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n        this.validator = new PermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Permission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Permission,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Permission | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new NotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new NotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            if (\n                entity.built_in &&\n                isPropertySet(validated, 'name') &&\n                entity.name !== validated.name\n            ) {\n                throw new BadRequestError('The name of a built-in permission can not be changed.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                input: new PolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            entity = this.repository.merge(entity, validated);\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        await this.assignDefaultPolicy(entity);\n        await this.assignToAdminRole(entity);\n        await this.assignToRealmAdminRoles(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in permission can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    /**\n     * Assign the system.default policy to a newly created permission.\n     * This ensures all permissions are evaluated with the baseline security\n     * policy (identity, permission-binding, realm-match) by default.\n     */\n    private async assignDefaultPolicy(permission: Permission): Promise<void> {\n        const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);\n        }\n\n        const existing = await this.permissionPolicyRepository.findOneBy({\n            permission_id: permission.id,\n            policy_id: defaultPolicy.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.permissionPolicyRepository.create({\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n            policy_id: defaultPolicy.id,\n            policy_realm_id: defaultPolicy.realm_id,\n        });\n        await this.permissionPolicyRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to the global admin role.\n     * The admin role receives every permission without policy restrictions.\n     */\n    private async assignToAdminRole(permission: Permission): Promise<void> {\n        const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);\n        if (!adminRole) {\n            return;\n        }\n\n        const existing = await this.rolePermissionRepository.findOneBy({\n            role_id: adminRole.id,\n            permission_id: permission.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.rolePermissionRepository.create({\n            role_id: adminRole.id,\n            role_realm_id: adminRole.realm_id,\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n        });\n        await this.rolePermissionRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to all matching realm_admin roles.\n     *\n     * Uses differentiated junction policies:\n     * - CUD on global-capable entity types → system.realm-bound\n     * - Everything else → system.realm-or-global\n     *\n     * Eligible permissions:\n     * - Built-in authup permissions (global) — assigned to all realm_admin roles\n     * - Realm-scoped permissions — assigned to the realm_admin in the matching realm\n     *\n     * Excluded:\n     * - Realm CRUD permissions (realm_create, realm_update, realm_delete)\n     * - Custom global permissions (non-built-in with realm_id: null)\n     *\n     * Fails closed: skips assignment entirely if required policies are not found.\n     */\n    private async assignToRealmAdminRoles(permission: Permission): Promise<void> {\n        if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name as PermissionName)) {\n            return;\n        }\n\n        const isBuiltIn = (Object.values(PermissionName) as string[]).includes(permission.name);\n        if (!permission.realm_id && !isBuiltIn) {\n            return;\n        }\n\n        const policyName = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name as PermissionName) ?\n            SystemPolicyName.REALM_BOUND :\n            SystemPolicyName.REALM_OR_GLOBAL;\n\n        const policy = await this.policyRepository.findOneByName(policyName);\n        if (!policy) {\n            return;\n        }\n\n        const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });\n\n        for (const role of realmAdminRoles) {\n            if (permission.realm_id && permission.realm_id !== role.realm_id) {\n                continue;\n            }\n\n            const existing = await this.rolePermissionRepository.findOneBy({\n                role_id: role.id,\n                permission_id: permission.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.rolePermissionRepository.create({\n                role_id: role.id,\n                role_realm_id: role.realm_id,\n                permission_id: permission.id,\n                permission_realm_id: permission.realm_id,\n                policy_id: policy.id,\n            });\n            await this.rolePermissionRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;;AA6BA,MAAMc,mCAAmC;CACrCN,eAAeO;CACfP,eAAeQ;CACfR,eAAeS;CAClB;;;;;;;;;;GAYD,MAAMC,gCAAgC;CAClCV,eAAeW;CACfX,eAAeY;CACfZ,eAAea;CACfb,eAAec;CACfd,eAAee;CACff,eAAegB;CACfhB,eAAeiB;CACfjB,eAAekB;CACflB,eAAemB;CACfnB,eAAeoB;CACfpB,eAAeqB;CACfrB,eAAesB;CACftB,eAAeuB;CACfvB,eAAewB;CACfxB,eAAeyB;CACfzB,eAAe0B;CACf1B,eAAe2B;CACf3B,eAAe4B;CACf5B,eAAe6B;CACf7B,eAAe8B;CACf9B,eAAe+B;CAClB;AAWD,IAAaC,oBAAb,cAAuC3B,sBAAAA;CACzB4B;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;AACvC,SAAK;AACL,OAAKP,aAAaO,IAAIP;AACtB,OAAKC,kBAAkBM,IAAIN;AAC3B,OAAKC,iBAAiBK,IAAIL;AAC1B,OAAKC,2BAA2BI,IAAIJ;AACpC,OAAKC,mBAAmBG,IAAIH;AAC5B,OAAKC,6BAA6BE,IAAIF;AACtC,OAAKC,YAAY,IAAItC,qBAAAA;;CAGzB,MAAMwC,QACFC,OACAC,OACmD;AACnD,QAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF9C,eAAe+C;GACf/C,eAAekB;GACflB,eAAemB;GAClB,EACL,CAAA;AAEA,SAAO,KAAKc,WAAWe,SAASN,MAAAA;;CAGpC,MAAMO,OACFC,UACAP,OACAQ,OACmB;AACnB,QAAMR,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF9C,eAAe+C;GACf/C,eAAekB;GACflB,eAAemB;GAClB,EACL,CAAA;EAEA,MAAMiC,SAAS,MAAM,KAAKnB,WAAWoB,kBAAkBH,UAAUC,MAAAA;AACjE,MAAI,CAACC,OACD,OAAM,IAAIrD,eAAAA;AAGd,SAAOqD;;CAGX,MAAME,OACFC,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMZ,MAAAA;AACpD,SAAOS;;CAGX,MAAMM,OACFR,UACAK,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMZ,OAAO,EAAEgB,YAAY,MAAK,CAAA;AAC7E,SAAOP;;CAGX,MAAMI,KACFN,UACAK,MACAZ,OACAiB,UAAoC,EAAE,EAIvC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,aAAa,WACnC,MAAM,KAAK5B,gBAAgB6B,QAAQR,KAAKO,SAAQ,GAChDL,KAAAA;EAEJ,IAAIL;AACJ,MAAIF,UAAU;GACV,MAAMc,QAA6B,EAAC;AACpC,OAAIpE,OAAOsD,SAAAA,CACPc,OAAMC,KAAKf;OAEXc,OAAMlB,OAAOI;AAGjB,OAAIC,MACAa,OAAMF,WAAWX,MAAMc;AAG3Bb,YAAS,MAAM,KAAKnB,WAAWiC,UAAUF,MAAAA;AACzC,OAAI,CAACZ,UAAUQ,QAAQD,WACnB,OAAM,IAAI5D,eAAAA;aAEP6D,QAAQD,WACf,OAAM,IAAI5D,eAAAA;AAGd,MAAIqD,QAAQ;AACR,SAAMT,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM9C,eAAekB,mBAAkB,CAAA;AACrF2C,WAAQzD,eAAegE;SACpB;AACH,SAAMzB,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM9C,eAAeiB,mBAAkB,CAAA;AACrF4C,WAAQzD,eAAeiE;;EAG3B,MAAMC,YAAY,MAAM,KAAK/B,UAAUgC,IAAIhB,MAAM,EAAEM,OAAM,CAAA;AAEzD,QAAM,KAAK5B,WAAWuC,oBAAoBF,UAAAA;AAE1C,MAAIlB,QAAQ;AACR,OACIA,OAAOqB,YACP9E,cAAc2E,WAAW,OAAA,IACzBlB,OAAON,SAASwB,UAAUxB,KAE1B,OAAM,IAAIhD,gBAAgB,wDAAA;AAG9B,SAAM6C,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAM9C,eAAekB;IACrByD,OAAO,IAAIlF,WAAW,GACjBD,kBAAkBoF,aAAa;KAC5B,GAAGxB;KACH,GAAGkB;KACP,EACJ,CAAA;IACJ,CAAA;AAEA,SAAM,KAAKrC,WAAW4C,gBAAgBP,WAAWlB,OAAAA;AAEjDA,YAAS,KAAKnB,WAAW6C,MAAM1B,QAAQkB,UAAAA;AAEvC,SAAM,KAAKrC,WAAWuB,KAAKJ,OAAAA;AAE3B,UAAO;IACHA;IACA2B,SAAS;IACb;;AAGJ,MAAI,CAACpF,cAAc2E,WAAW,WAAA,IAAe3B,MAAMqC,SAC/CV,WAAUR,WAAW,KAAKmB,gBAAgBtC,MAAAA,IAAU;AAGxD,QAAMA,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM9C,eAAeiB;GACrB0D,OAAO,IAAIlF,WAAW,GAAGD,kBAAkBoF,aAAaN,WAAU,CAAA;GACtE,CAAA;AAEA,QAAM,KAAKrC,WAAW4C,gBAAgBP,UAAAA;AAEtClB,WAAS,KAAKnB,WAAWqB,OAAOgB,UAAAA;AAChClB,WAAS,MAAM,KAAKnB,WAAWuB,KAAKJ,OAAAA;AAEpC,QAAM,KAAK8B,oBAAoB9B,OAAAA;AAC/B,QAAM,KAAK+B,kBAAkB/B,OAAAA;AAC7B,QAAM,KAAKgC,wBAAwBhC,OAAAA;AAEnC,SAAO;GACHA;GACA2B,SAAS;GACb;;CAGJ,MAAMM,OACFpB,IACAtB,OACmB;AACnB,QAAMA,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM9C,eAAemB,mBAAkB,CAAA;EAErF,MAAMiC,SAAS,MAAM,KAAKnB,WAAWiC,UAAU,EAAED,IAAG,CAAA;AACpD,MAAI,CAACb,OACD,OAAM,IAAIrD,eAAAA;AAGd,MAAIqD,OAAOqB,SACP,OAAM,IAAI3E,gBAAgB,4CAAA;AAG9B,QAAM6C,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM9C,eAAemB;GACrBwD,OAAO,IAAIlF,WAAW,GAAGD,kBAAkBoF,aAAaxB,QAAO,CAAA;GACnE,CAAA;EAEA,MAAM,EAAEa,IAAIqB,aAAalC;AACzB,QAAM,KAAKnB,WAAWsD,OAAOnC,OAAAA;AAC7BA,SAAOa,KAAKqB;AAEZ,SAAOlC;;;;;;IAQX,MAAc8B,oBAAoBM,YAAuC;EACrE,MAAMC,gBAAgB,MAAM,KAAKpD,iBAAiBqD,cAAchG,iBAAiBiG,QAAO;AACxF,MAAI,CAACF,cACD,OAAM,IAAI5F,YAAY,OAAOH,iBAAiBiG,QAAQ,4FAA2F;AAOrJ,MAAIC,MAJmB,KAAKtD,2BAA2B4B,UAAU;GAC7D2B,eAAeL,WAAWvB;GAC1B6B,WAAWL,cAAcxB;GAC7B,CAAA,CAEI;EAGJ,MAAM8B,QAAQ,KAAKzD,2BAA2BgB,OAAO;GACjDuC,eAAeL,WAAWvB;GAC1B+B,qBAAqBR,WAAW1B;GAChCgC,WAAWL,cAAcxB;GACzBgC,iBAAiBR,cAAc3B;GACnC,CAAA;AACA,QAAM,KAAKxB,2BAA2BkB,KAAKuC,MAAAA;;;;;IAO/C,MAAcZ,kBAAkBK,YAAuC;EACnE,MAAMU,YAAY,MAAM,KAAK/D,eAAeuD,cAAcxF,gBAAAA;AAC1D,MAAI,CAACgG,UACD;AAOJ,MAAIN,MAJmB,KAAKxD,yBAAyB8B,UAAU;GAC3DiC,SAASD,UAAUjC;GACnB4B,eAAeL,WAAWvB;GAC9B,CAAA,CAEI;EAGJ,MAAM8B,QAAQ,KAAK3D,yBAAyBkB,OAAO;GAC/C6C,SAASD,UAAUjC;GACnBmC,eAAeF,UAAUpC;GACzB+B,eAAeL,WAAWvB;GAC1B+B,qBAAqBR,WAAW1B;GACpC,CAAA;AACA,QAAM,KAAK1B,yBAAyBoB,KAAKuC,MAAAA;;;;;;;;;;;;;;;;;;IAoB7C,MAAcX,wBAAwBI,YAAuC;AACzE,MAAIlF,iCAAiC+F,SAASb,WAAW1C,KAAI,CACzD;EAGJ,MAAMwD,YAAY,OAAQE,OAAOxG,eAAAA,CAA6BqG,SAASb,WAAW1C,KAAI;AACtF,MAAI,CAAC0C,WAAW1B,YAAY,CAACwC,UACzB;EAGJ,MAAMG,aAAa/F,8BAA8B2F,SAASb,WAAW1C,KAAI,GACrEpD,iBAAiBgH,cACjBhH,iBAAiBiH;EAErB,MAAMC,SAAS,MAAM,KAAKvE,iBAAiBqD,cAAce,WAAAA;AACzD,MAAI,CAACG,OACD;EAGJ,MAAMC,kBAAkB,MAAM,KAAK1E,eAAe2E,WAAW,EAAEhE,MAAM3C,uBAAsB,CAAA;AAE3F,OAAK,MAAM4G,QAAQF,iBAAiB;AAChC,OAAIrB,WAAW1B,YAAY0B,WAAW1B,aAAaiD,KAAKjD,SACpD;AAOJ,OAAI8B,MAJmB,KAAKxD,yBAAyB8B,UAAU;IAC3DiC,SAASY,KAAK9C;IACd4B,eAAeL,WAAWvB;IAC9B,CAAA,CAEI;GAGJ,MAAM8B,QAAQ,KAAK3D,yBAAyBkB,OAAO;IAC/C6C,SAASY,KAAK9C;IACdmC,eAAeW,KAAKjD;IACpB+B,eAAeL,WAAWvB;IAC1B+B,qBAAqBR,WAAW1B;IAChCgC,WAAWc,OAAO3C;IACtB,CAAA;AACA,SAAM,KAAK7B,yBAAyBoB,KAAKuC,MAAAA"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","SystemPolicyName","ValidatorGroup","isPropertySet","isUUID","AuthupError","BadRequestError","EntityNotFoundError","PermissionName","PermissionValidator","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","AbstractEntityService","REALM_ADMIN_EXCLUDED_PERMISSIONS","REALM_CREATE","REALM_UPDATE","REALM_DELETE","REALM_ADMIN_BOUND_PERMISSIONS","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","PermissionService","repository","realmRepository","roleRepository","rolePermissionRepository","policyRepository","permissionPolicyRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","findMany","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","CREATE","validated","run","validateJoinColumns","built_in","evaluate","input","ATTRIBUTES","checkUniqueness","merge","created","identity","getActorRealmId","assignDefaultPolicy","assignToAdminRole","assignToRealmAdminRoles","delete","entityId","remove","permission","defaultPolicy","findOneByName","DEFAULT","existing","permission_id","policy_id","entry","permission_realm_id","policy_realm_id","adminRole","role_id","role_realm_id","includes","isBuiltIn","Object","values","policyName","REALM_BOUND","REALM_OR_GLOBAL","policy","realmAdminRoles","findManyBy","role"],"sources":["../../../../src/core/entities/permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData, SystemPolicyName } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { AuthupError, BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    PermissionValidator,\n    ROLE_ADMIN_NAME,\n    ROLE_REALM_ADMIN_NAME,\n} from '@authup/core-kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository } from '../permission-policy/types.ts';\nimport type { IPolicyRepository } from '../policy/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport type { IRoleRepository } from '../role/types.ts';\nimport type { IRolePermissionRepository } from '../role-permission/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IPermissionRepository, IPermissionService } from './types.ts';\n\nconst REALM_ADMIN_EXCLUDED_PERMISSIONS = [\n    PermissionName.REALM_CREATE,\n    PermissionName.REALM_UPDATE,\n    PermissionName.REALM_DELETE,\n];\n\n/**\n * CUD permissions that get system.realm-bound on realm_admin.\n * Covers direct entity types (both global-capable and realm-only).\n *\n * Junction entity CUD (e.g. user_role, role_permission) intentionally\n * use realm-or-global instead, because their attributes include\n * multiple realm_id fields (e.g. user_realm_id + role_realm_id).\n * With attribute_name_strict: false, realm-bound would reject\n * junctions where one side is global (realm_id: null).\n */\nconst REALM_ADMIN_BOUND_PERMISSIONS = [\n    PermissionName.CLIENT_CREATE,\n    PermissionName.CLIENT_UPDATE,\n    PermissionName.CLIENT_DELETE,\n    PermissionName.IDENTITY_PROVIDER_CREATE,\n    PermissionName.IDENTITY_PROVIDER_UPDATE,\n    PermissionName.IDENTITY_PROVIDER_DELETE,\n    PermissionName.PERMISSION_CREATE,\n    PermissionName.PERMISSION_UPDATE,\n    PermissionName.PERMISSION_DELETE,\n    PermissionName.ROBOT_CREATE,\n    PermissionName.ROBOT_UPDATE,\n    PermissionName.ROBOT_DELETE,\n    PermissionName.ROLE_CREATE,\n    PermissionName.ROLE_UPDATE,\n    PermissionName.ROLE_DELETE,\n    PermissionName.SCOPE_CREATE,\n    PermissionName.SCOPE_UPDATE,\n    PermissionName.SCOPE_DELETE,\n    PermissionName.USER_CREATE,\n    PermissionName.USER_UPDATE,\n    PermissionName.USER_DELETE,\n];\n\nexport type PermissionServiceContext = {\n    repository: IPermissionRepository;\n    realmRepository: IRealmRepository;\n    roleRepository: IRoleRepository;\n    rolePermissionRepository: IRolePermissionRepository;\n    policyRepository: IPolicyRepository;\n    permissionPolicyRepository: IPermissionPolicyRepository;\n};\n\nexport class PermissionService extends AbstractEntityService implements IPermissionService {\n    protected repository: IPermissionRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected roleRepository: IRoleRepository;\n\n    protected rolePermissionRepository: IRolePermissionRepository;\n\n    protected policyRepository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    protected validator: PermissionValidator;\n\n    constructor(ctx: PermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.rolePermissionRepository = ctx.rolePermissionRepository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n        this.validator = new PermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Permission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Permission,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Permission | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            if (\n                entity.built_in &&\n                isPropertySet(validated, 'name') &&\n                entity.name !== validated.name\n            ) {\n                throw new BadRequestError('The name of a built-in permission can not be changed.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                input: new PolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            entity = this.repository.merge(entity, validated);\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        await this.assignDefaultPolicy(entity);\n        await this.assignToAdminRole(entity);\n        await this.assignToRealmAdminRoles(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in permission can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    /**\n     * Assign the system.default policy to a newly created permission.\n     * This ensures all permissions are evaluated with the baseline security\n     * policy (identity, permission-binding, realm-match) by default.\n     */\n    private async assignDefaultPolicy(permission: Permission): Promise<void> {\n        const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);\n        }\n\n        const existing = await this.permissionPolicyRepository.findOneBy({\n            permission_id: permission.id,\n            policy_id: defaultPolicy.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.permissionPolicyRepository.create({\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n            policy_id: defaultPolicy.id,\n            policy_realm_id: defaultPolicy.realm_id,\n        });\n        await this.permissionPolicyRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to the global admin role.\n     * The admin role receives every permission without policy restrictions.\n     */\n    private async assignToAdminRole(permission: Permission): Promise<void> {\n        const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);\n        if (!adminRole) {\n            return;\n        }\n\n        const existing = await this.rolePermissionRepository.findOneBy({\n            role_id: adminRole.id,\n            permission_id: permission.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.rolePermissionRepository.create({\n            role_id: adminRole.id,\n            role_realm_id: adminRole.realm_id,\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n        });\n        await this.rolePermissionRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to all matching realm_admin roles.\n     *\n     * Uses differentiated junction policies:\n     * - CUD on global-capable entity types → system.realm-bound\n     * - Everything else → system.realm-or-global\n     *\n     * Eligible permissions:\n     * - Built-in authup permissions (global) — assigned to all realm_admin roles\n     * - Realm-scoped permissions — assigned to the realm_admin in the matching realm\n     *\n     * Excluded:\n     * - Realm CRUD permissions (realm_create, realm_update, realm_delete)\n     * - Custom global permissions (non-built-in with realm_id: null)\n     *\n     * Fails closed: skips assignment entirely if required policies are not found.\n     */\n    private async assignToRealmAdminRoles(permission: Permission): Promise<void> {\n        if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name as PermissionName)) {\n            return;\n        }\n\n        const isBuiltIn = (Object.values(PermissionName) as string[]).includes(permission.name);\n        if (!permission.realm_id && !isBuiltIn) {\n            return;\n        }\n\n        const policyName = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name as PermissionName) ?\n            SystemPolicyName.REALM_BOUND :\n            SystemPolicyName.REALM_OR_GLOBAL;\n\n        const policy = await this.policyRepository.findOneByName(policyName);\n        if (!policy) {\n            return;\n        }\n\n        const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });\n\n        for (const role of realmAdminRoles) {\n            if (permission.realm_id && permission.realm_id !== role.realm_id) {\n                continue;\n            }\n\n            const existing = await this.rolePermissionRepository.findOneBy({\n                role_id: role.id,\n                permission_id: permission.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.rolePermissionRepository.create({\n                role_id: role.id,\n                role_realm_id: role.realm_id,\n                permission_id: permission.id,\n                permission_realm_id: permission.realm_id,\n                policy_id: policy.id,\n            });\n            await this.rolePermissionRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;AA0BA,MAAMc,mCAAmC;CACrCL,eAAeM;CACfN,eAAeO;CACfP,eAAeQ;;;;;;;;;;;GAanB,MAAMC,gCAAgC;CAClCT,eAAeU;CACfV,eAAeW;CACfX,eAAeY;CACfZ,eAAea;CACfb,eAAec;CACfd,eAAee;CACff,eAAegB;CACfhB,eAAeiB;CACfjB,eAAekB;CACflB,eAAemB;CACfnB,eAAeoB;CACfpB,eAAeqB;CACfrB,eAAesB;CACftB,eAAeuB;CACfvB,eAAewB;CACfxB,eAAeyB;CACfzB,eAAe0B;CACf1B,eAAe2B;CACf3B,eAAe4B;CACf5B,eAAe6B;CACf7B,eAAe8B;;AAYnB,IAAaC,oBAAb,cAAuC3B,sBAAAA;CACzB4B;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKP,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIrC,oBAAAA;CACzB;CAEA,MAAMuC,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKc,WAAWe,SAASN,KAAAA;CACpC;CAEA,MAAMO,OACFC,UACAP,OACAQ,OACmB;EACnB,MAAMR,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMiC,SAAS,MAAM,KAAKnB,WAAWoB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAIpD,oBAAAA;EAGd,OAAOoD;CACX;CAEA,MAAME,OACFC,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMZ,KAAAA;EACpD,OAAOS;CACX;CAEA,MAAMM,OACFR,UACAK,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMZ,OAAO,EAAEgB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAZ,OACAiB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,aAAa,WACnC,MAAM,KAAK5B,gBAAgB6B,QAAQR,KAAKO,QAAQ,IAChDL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAInE,OAAOqD,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMlB,OAAOI;GAGjB,IAAIC,OACAa,MAAMF,WAAWX,MAAMc;GAG3Bb,SAAS,MAAM,KAAKnB,WAAWiC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAI3D,oBAAAA;EAElB,OAAO,IAAI4D,QAAQD,YACf,MAAM,IAAI3D,oBAAAA;EAGd,IAAIoD,QAAQ;GACR,MAAMT,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAeiB,kBAAkB,CAAA;GACrF2C,QAAQlE,eAAeyE;EAC3B,OAAO;GACH,MAAMzB,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAegB,kBAAkB,CAAA;GACrF4C,QAAQlE,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK/B,UAAUgC,IAAIhB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK5B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIlB,QAAQ;GACR,IACIA,OAAOqB,YACP7E,cAAc0E,WAAW,MAAA,KACzBlB,OAAON,SAASwB,UAAUxB,MAE1B,MAAM,IAAI/C,gBAAgB,uDAAA;GAG9B,MAAM4C,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAM7C,eAAeiB;IACrByD,OAAO,IAAIlF,WAAW,GACjBD,kBAAkBoF,aAAa;KAC5B,GAAGxB;KACH,GAAGkB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,WAAWlB,MAAAA;GAEjDA,SAAS,KAAKnB,WAAW6C,MAAM1B,QAAQkB,SAAAA;GAEvC,MAAM,KAAKrC,WAAWuB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,IAAI,CAACnF,cAAc0E,WAAW,UAAA,KAAe3B,MAAMqC,UAC/CV,UAAUR,WAAW,KAAKmB,gBAAgBtC,KAAAA,KAAU;EAGxD,MAAMA,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAegB;GACrB0D,OAAO,IAAIlF,WAAW,GAAGD,kBAAkBoF,aAAaN,UAAU,CAAA;EACtE,CAAA;EAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,SAAAA;EAEtClB,SAAS,KAAKnB,WAAWqB,OAAOgB,SAAAA;EAChClB,SAAS,MAAM,KAAKnB,WAAWuB,KAAKJ,MAAAA;EAEpC,MAAM,KAAK8B,oBAAoB9B,MAAAA;EAC/B,MAAM,KAAK+B,kBAAkB/B,MAAAA;EAC7B,MAAM,KAAKgC,wBAAwBhC,MAAAA;EAEnC,OAAO;GACHA;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMM,OACFpB,IACAtB,OACmB;EACnB,MAAMA,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAekB,kBAAkB,CAAA;EAErF,MAAMiC,SAAS,MAAM,KAAKnB,WAAWiC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAIpD,oBAAAA;EAGd,IAAIoD,OAAOqB,UACP,MAAM,IAAI1E,gBAAgB,2CAAA;EAG9B,MAAM4C,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAekB;GACrBwD,OAAO,IAAIlF,WAAW,GAAGD,kBAAkBoF,aAAaxB,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEa,IAAIqB,aAAalC;EACzB,MAAM,KAAKnB,WAAWsD,OAAOnC,MAAAA;EAC7BA,OAAOa,KAAKqB;EAEZ,OAAOlC;CACX;;;;;IAOA,MAAc8B,oBAAoBM,YAAuC;EACrE,MAAMC,gBAAgB,MAAM,KAAKpD,iBAAiBqD,cAAchG,iBAAiBiG,OAAO;EACxF,IAAI,CAACF,eACD,MAAM,IAAI3F,YAAY,OAAOJ,iBAAiBiG,QAAQ,2FAA2F;EAOrJ,IAAIC,MAJmB,KAAKtD,2BAA2B4B,UAAU;GAC7D2B,eAAeL,WAAWvB;GAC1B6B,WAAWL,cAAcxB;EAC7B,CAAA,GAEI;EAGJ,MAAM8B,QAAQ,KAAKzD,2BAA2BgB,OAAO;GACjDuC,eAAeL,WAAWvB;GAC1B+B,qBAAqBR,WAAW1B;GAChCgC,WAAWL,cAAcxB;GACzBgC,iBAAiBR,cAAc3B;EACnC,CAAA;EACA,MAAM,KAAKxB,2BAA2BkB,KAAKuC,KAAAA;CAC/C;;;;IAMA,MAAcZ,kBAAkBK,YAAuC;EACnE,MAAMU,YAAY,MAAM,KAAK/D,eAAeuD,cAAcvF,eAAAA;EAC1D,IAAI,CAAC+F,WACD;EAOJ,IAAIN,MAJmB,KAAKxD,yBAAyB8B,UAAU;GAC3DiC,SAASD,UAAUjC;GACnB4B,eAAeL,WAAWvB;EAC9B,CAAA,GAEI;EAGJ,MAAM8B,QAAQ,KAAK3D,yBAAyBkB,OAAO;GAC/C6C,SAASD,UAAUjC;GACnBmC,eAAeF,UAAUpC;GACzB+B,eAAeL,WAAWvB;GAC1B+B,qBAAqBR,WAAW1B;EACpC,CAAA;EACA,MAAM,KAAK1B,yBAAyBoB,KAAKuC,KAAAA;CAC7C;;;;;;;;;;;;;;;;;IAmBA,MAAcX,wBAAwBI,YAAuC;EACzE,IAAIlF,iCAAiC+F,SAASb,WAAW1C,IAAI,GACzD;EAGJ,MAAMwD,YAAY,OAAQE,OAAOvG,cAAAA,EAA6BoG,SAASb,WAAW1C,IAAI;EACtF,IAAI,CAAC0C,WAAW1B,YAAY,CAACwC,WACzB;EAGJ,MAAMG,aAAa/F,8BAA8B2F,SAASb,WAAW1C,IAAI,IACrEpD,iBAAiBgH,cACjBhH,iBAAiBiH;EAErB,MAAMC,SAAS,MAAM,KAAKvE,iBAAiBqD,cAAce,UAAAA;EACzD,IAAI,CAACG,QACD;EAGJ,MAAMC,kBAAkB,MAAM,KAAK1E,eAAe2E,WAAW,EAAEhE,MAAM1C,sBAAsB,CAAA;EAE3F,KAAK,MAAM2G,QAAQF,iBAAiB;GAChC,IAAIrB,WAAW1B,YAAY0B,WAAW1B,aAAaiD,KAAKjD,UACpD;GAOJ,IAAI8B,MAJmB,KAAKxD,yBAAyB8B,UAAU;IAC3DiC,SAASY,KAAK9C;IACd4B,eAAeL,WAAWvB;GAC9B,CAAA,GAEI;GAGJ,MAAM8B,QAAQ,KAAK3D,yBAAyBkB,OAAO;IAC/C6C,SAASY,KAAK9C;IACdmC,eAAeW,KAAKjD;IACpB+B,eAAeL,WAAWvB;IAC1B+B,qBAAqBR,WAAW1B;IAChCgC,WAAWc,OAAO3C;GACtB,CAAA;GACA,MAAM,KAAK7B,yBAAyBoB,KAAKuC,KAAAA;EAC7C;CACJ;AACJ"}

package/dist/core/entities/permission/types.d.ts

@@ -1,6 +1,5 @@
 import type { Permission } from '@authup/core-kit';
-import type { ActorContext } from '../actor/types.ts';
-import type { EntityRepositoryFindManyResult, IEntityRepository } from '../types.ts';
+import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
 export interface IPermissionRepository extends IEntityRepository<Permission> {
     checkUniqueness(data: Partial<Permission>, existing?: Permission): Promise<void>;
 }

package/dist/core/entities/permission/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErF,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB,CAAC,UAAU,CAAC;IACxE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,kBAAkB;IAC/B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9G,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9F,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAChE"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB,CAAC,UAAU,CAAC;IACxE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,kBAAkB;IAC/B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9G,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9F,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAChE"}

package/dist/core/entities/permission-policy/service.d.ts

@@ -1,8 +1,7 @@
 import { PermissionPolicyValidator } from '@authup/core-kit';
 import type { PermissionPolicy } from '@authup/core-kit';
-import type { ActorContext } from '../actor/types.ts';
-import { AbstractEntityService } from '../service.ts';
-import type { EntityRepositoryFindManyResult } from '../types.ts';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import { AbstractEntityService } from '@authup/server-kit';
 import type { IPermissionPolicyRepository, IPermissionPolicyService } from './types.ts';
 export type PermissionPolicyServiceContext = {
     repository: IPermissionPolicyRepository;

package/dist/core/entities/permission-policy/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/service.ts"],"names":[],"mappings":"AASA,OAAO,EAAkB,yBAAyB,EAAkB,MAAM,kBAAkB,CAAC;AAC7F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,MAAM,8BAA8B,GAAG;IACzC,UAAU,EAAE,2BAA2B,CAAC;CAC3C,CAAC;AAEF,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,SAAS,EAAE,yBAAyB,CAAC;gBAEnC,GAAG,EAAE,8BAA8B;IAMzC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IAWtD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAgBtB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAkCtB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;CAmB/B"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,MAAM,8BAA8B,GAAG;IACzC,UAAU,EAAE,2BAA2B,CAAC;CAC3C,CAAC;AAEF,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,SAAS,EAAE,yBAAyB,CAAC;gBAEnC,GAAG,EAAE,8BAA8B;IAMzC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IAWtD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAgBtB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAkCtB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;CAmB/B"}

package/dist/core/entities/permission-policy/service.mjs

@@ -1,7 +1,8 @@
-import { AbstractEntityService } from "../service.mjs";
-import { PermissionName, PermissionPolicyValidator, ValidatorGroup } from "@authup/core-kit";
+import { PermissionName, PermissionPolicyValidator } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { ValidatorGroup } from "@authup/kit";
 import { BuiltInPolicyType, PolicyData } from "@authup/access";
-import { ConflictError, NotFoundError } from "@ebec/http";
+import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/permission-policy/service.ts
 var PermissionPolicyService = class extends AbstractEntityService {
 	repository;
@@ -18,7 +19,7 @@ var PermissionPolicyService = class extends AbstractEntityService {
 	async getOne(id, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.PERMISSION_READ, PermissionName.PERMISSION_UPDATE] });
 		const entity = await this.repository.findOneBy({ id });
-		if (!entity) throw new NotFoundError();
+		if (!entity) throw new EntityNotFoundError();
 		return entity;
 	}
 	async create(data, actor) {
@@ -28,7 +29,7 @@ var PermissionPolicyService = class extends AbstractEntityService {
 		if (await this.repository.findOneBy({
 			permission_id: validated.permission_id,
 			policy_id: validated.policy_id
-		})) throw new ConflictError("The permission-policy assignment already exists.");
+		})) throw new EntityConflictError({ entity: "permission-policy" });
 		if (validated.permission) validated.permission_realm_id = validated.permission.realm_id;
 		if (validated.policy) validated.policy_realm_id = validated.policy.realm_id;
 		await actor.permissionEvaluator.evaluate({
@@ -42,7 +43,7 @@ var PermissionPolicyService = class extends AbstractEntityService {
 	async delete(id, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });
 		const entity = await this.repository.findOneBy({ id });
-		if (!entity) throw new NotFoundError();
+		if (!entity) throw new EntityNotFoundError();
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.PERMISSION_UPDATE,
 			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })