@authup/server-core 1.0.0-beta.41 → 1.0.0-beta.42

package/dist/core/identity/provider/authentication/presets/instagram.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"instagram.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderInstagramAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","username","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/instagram.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderInstagramAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'user_profile';\n        ctx.provider.authorize_url = 'https://api.instagram.com/oauth/authorize';\n        ctx.provider.token_url = 'https://api.instagram.com/oauth/access_token';\n        ctx.provider.user_info_url = 'https://graph.instagram.com/me?fields=id,username';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.id,\n            attributeCandidates: {\n                name: [\n                    userInfo.username,\n                    userInfo.id,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAaA,IAAaE,yCAAb,cAA4DD,oCAAAA;CACxD,YAAYE,KAAiD;AACzDA,MAAIC,SAASC,QAAQ;AACrBF,MAAIC,SAASE,gBAAgB;AAC7BH,MAAIC,SAASG,YAAY;AACzBJ,MAAIC,SAASI,gBAAgB;AAE7B,QAAML,IAAAA;;CAGV,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;GACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,aAAY;AAEtD,SAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB,EACjBC,MAAM,CACFT,SAASU,UACTV,SAASO,GACZ,EACL;GACAI,MAAML;GACNb,UAAU,KAAKA;GACnB"}
+{"version":3,"file":"instagram.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderInstagramAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","username","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/instagram.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderInstagramAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'user_profile';\n        ctx.provider.authorize_url = 'https://api.instagram.com/oauth/authorize';\n        ctx.provider.token_url = 'https://api.instagram.com/oauth/access_token';\n        ctx.provider.user_info_url = 'https://graph.instagram.com/me?fields=id,username';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.id,\n            attributeCandidates: {\n                name: [\n                    userInfo.username,\n                    userInfo.id,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAaA,IAAaE,yCAAb,cAA4DD,oCAAAA;CACxD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQ;EACrBF,IAAIC,SAASE,gBAAgB;EAC7BH,IAAIC,SAASG,YAAY;EACzBJ,IAAIC,SAASI,gBAAgB;EAE7B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB,EACjBC,MAAM,CACFT,SAASU,UACTV,SAASO,EAAAA,EAEjB;GACAI,MAAML;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/presets/paypal.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"paypal.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderPaypalAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","user_id","attributeCandidates","name","email","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/paypal.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderPaypalAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'openid profile email';\n        ctx.provider.authorize_url = 'https://www.paypal.com/signin/authorize';\n        ctx.provider.token_url = 'https://api.paypal.com/v1/identity/openidconnect/tokenservice';\n        ctx.provider.user_info_url = 'https://api.paypal.com/v1/oauth2/token/userinfo?schema=openid';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.user_id,\n            attributeCandidates: {\n                name: [\n                    userInfo.name,\n                    userInfo.user_id,\n                ],\n                email: [\n                    userInfo.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAaA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;AACzDA,MAAIC,SAASC,QAAQ;AACrBF,MAAIC,SAASE,gBAAgB;AAC7BH,MAAIC,SAASG,YAAY;AACzBJ,MAAIC,SAASI,gBAAgB;AAE7B,QAAML,IAAAA;;CAGV,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;GACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,aAAY;AAEtD,SAAO;GACHE,IAAIP,SAASQ;GACbC,qBAAqB;IACjBC,MAAM,CACFV,SAASU,MACTV,SAASQ,QACZ;IACDG,OAAO,CACHX,SAASW,MACZ;IACL;GACAC,MAAMN;GACNb,UAAU,KAAKA;GACnB"}
+{"version":3,"file":"paypal.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderPaypalAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","user_id","attributeCandidates","name","email","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/paypal.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderPaypalAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'openid profile email';\n        ctx.provider.authorize_url = 'https://www.paypal.com/signin/authorize';\n        ctx.provider.token_url = 'https://api.paypal.com/v1/identity/openidconnect/tokenservice';\n        ctx.provider.user_info_url = 'https://api.paypal.com/v1/oauth2/token/userinfo?schema=openid';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.user_id,\n            attributeCandidates: {\n                name: [\n                    userInfo.name,\n                    userInfo.user_id,\n                ],\n                email: [\n                    userInfo.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAaA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQ;EACrBF,IAAIC,SAASE,gBAAgB;EAC7BH,IAAIC,SAASG,YAAY;EACzBJ,IAAIC,SAASI,gBAAgB;EAE7B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASQ;GACbC,qBAAqB;IACjBC,MAAM,CACFV,SAASU,MACTV,SAASQ,OAAAA;IAEbG,OAAO,CACHX,SAASW,KAAAA;GAEjB;GACAC,MAAMN;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/protocols/ldap/collection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collection.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/collection.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAEjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,kDAAkD,EAAE,MAAM,YAAY,CAAC;AAErF,qBAAa,2CAA4C,SAAQ,4BAA4B,CAAC,IAAI,CAAC;IAC/F,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,aAAa,EAAE,kBAAkB,CAAC;gBAEhC,GAAG,EAAE,kDAAkD;IAQ7D,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA6BtF"}
+{"version":3,"file":"collection.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/collection.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAEjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,kDAAkD,EAAE,MAAM,YAAY,CAAC;AAErF,qBAAa,2CAA4C,SAAQ,4BAA4B,CAAC,IAAI,CAAC;IAC/F,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,aAAa,EAAE,kBAAkB,CAAC;gBAEhC,GAAG,EAAE,kDAAkD;IAQ7D,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA6BtF"}

package/dist/core/identity/provider/authentication/protocols/ldap/collection.mjs

@@ -1,7 +1,8 @@
 import { BaseCredentialsAuthenticator } from "../../../../../authentication/base.mjs";
 import "../../../../../authentication/index.mjs";
 import { IdentityProviderLdapAuthenticator } from "./module.mjs";
-import { IdentityProviderProtocol, UserError, isLdapIdentityProvider } from "@authup/core-kit";
+import { IdentityProviderProtocol, isLdapIdentityProvider } from "@authup/core-kit";
+import { EntityCredentialsInvalidError } from "@authup/errors";
 //#region src/core/identity/provider/authentication/protocols/ldap/collection.ts
 var IdentityProviderLdapCollectionAuthenticator = class extends BaseCredentialsAuthenticator {
 	repository;
@@ -27,7 +28,7 @@ var IdentityProviderLdapCollectionAuthenticator = class extends BaseCredentialsA
 			error = response.error;
 		}
 		if (error) throw error;
-		throw UserError.credentialsInvalid();
+		throw new EntityCredentialsInvalidError({ entity: "user" });
 	}
 };
 //#endregion

package/dist/core/identity/provider/authentication/protocols/ldap/collection.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"collection.mjs","names":["IdentityProviderProtocol","UserError","isLdapIdentityProvider","IdentityProviderLdapAuthenticator","BaseCredentialsAuthenticator","IdentityProviderLdapCollectionAuthenticator","repository","accountManager","clientFactory","ctx","authenticate","name","password","realmId","error","entities","findByProtocol","LDAP","provider","authenticator","response","safeAuthenticate","success","data","credentialsInvalid"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/collection.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { IdentityProviderProtocol, UserError, isLdapIdentityProvider } from '@authup/core-kit';\nimport type { IIdentityProviderRepository } from '../../../../../entities/index.ts';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport { IdentityProviderLdapAuthenticator } from './module.ts';\nimport type { ILdapClientFactory } from '../../../../../ldap/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../../../../authentication/index.ts';\nimport type { IdentityProviderLdapCollectionAuthenticatorContext } from './types.ts';\n\nexport class IdentityProviderLdapCollectionAuthenticator extends BaseCredentialsAuthenticator<User> {\n    protected repository: IIdentityProviderRepository;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected clientFactory: ILdapClientFactory;\n\n    constructor(ctx: IdentityProviderLdapCollectionAuthenticatorContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.accountManager = ctx.accountManager;\n        this.clientFactory = ctx.clientFactory;\n    }\n\n    async authenticate(name: string, password: string, realmId?: string): Promise<User> {\n        let error : Error | undefined;\n        const entities = await this.repository.findByProtocol(IdentityProviderProtocol.LDAP, realmId);\n\n        for (const provider of entities) {\n            if (!isLdapIdentityProvider(provider)) {\n                continue;\n            }\n\n            const authenticator = new IdentityProviderLdapAuthenticator({\n                provider,\n                accountManager: this.accountManager,\n                clientFactory: this.clientFactory,\n            });\n\n            const response = await authenticator.safeAuthenticate(name, password);\n            if (response.success === true) {\n                return response.data;\n            }\n\n            error = response.error;\n        }\n\n        if (error) {\n            throw error;\n        }\n\n        throw UserError.credentialsInvalid();\n    }\n}\n"],"mappings":";;;;;AAgBA,IAAaK,8CAAb,cAAiED,6BAAAA;CACnDE;CAEAC;CAEAC;CAEV,YAAYC,KAAyD;AACjE,SAAK;AAEL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,iBAAiBE,IAAIF;AAC1B,OAAKC,gBAAgBC,IAAID;;CAG7B,MAAME,aAAaC,MAAcC,UAAkBC,SAAiC;EAChF,IAAIC;EACJ,MAAMC,WAAW,MAAM,KAAKT,WAAWU,eAAehB,yBAAyBiB,MAAMJ,QAAAA;AAErF,OAAK,MAAMK,YAAYH,UAAU;AAC7B,OAAI,CAACb,uBAAuBgB,SAAAA,CACxB;GASJ,MAAME,WAAW,MAAMD,IANGhB,kCAAkC;IACxDe;IACAX,gBAAgB,KAAKA;IACrBC,eAAe,KAAKA;IACxB,CAEuBW,CAAcE,iBAAiBV,MAAMC,SAAAA;AAC5D,OAAIQ,SAASE,YAAY,KACrB,QAAOF,SAASG;AAGpBT,WAAQM,SAASN;;AAGrB,MAAIA,MACA,OAAMA;AAGV,QAAMb,UAAUuB,oBAAkB"}
+{"version":3,"file":"collection.mjs","names":["IdentityProviderProtocol","isLdapIdentityProvider","EntityCredentialsInvalidError","IdentityProviderLdapAuthenticator","BaseCredentialsAuthenticator","IdentityProviderLdapCollectionAuthenticator","repository","accountManager","clientFactory","ctx","authenticate","name","password","realmId","error","entities","findByProtocol","LDAP","provider","authenticator","response","safeAuthenticate","success","data","entity"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/collection.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { IdentityProviderProtocol, isLdapIdentityProvider } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError } from '@authup/errors';\nimport type { IIdentityProviderRepository } from '../../../../../entities/index.ts';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport { IdentityProviderLdapAuthenticator } from './module.ts';\nimport type { ILdapClientFactory } from '../../../../../ldap/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../../../../authentication/index.ts';\nimport type { IdentityProviderLdapCollectionAuthenticatorContext } from './types.ts';\n\nexport class IdentityProviderLdapCollectionAuthenticator extends BaseCredentialsAuthenticator<User> {\n    protected repository: IIdentityProviderRepository;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected clientFactory: ILdapClientFactory;\n\n    constructor(ctx: IdentityProviderLdapCollectionAuthenticatorContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.accountManager = ctx.accountManager;\n        this.clientFactory = ctx.clientFactory;\n    }\n\n    async authenticate(name: string, password: string, realmId?: string): Promise<User> {\n        let error : Error | undefined;\n        const entities = await this.repository.findByProtocol(IdentityProviderProtocol.LDAP, realmId);\n\n        for (const provider of entities) {\n            if (!isLdapIdentityProvider(provider)) {\n                continue;\n            }\n\n            const authenticator = new IdentityProviderLdapAuthenticator({\n                provider,\n                accountManager: this.accountManager,\n                clientFactory: this.clientFactory,\n            });\n\n            const response = await authenticator.safeAuthenticate(name, password);\n            if (response.success === true) {\n                return response.data;\n            }\n\n            error = response.error;\n        }\n\n        if (error) {\n            throw error;\n        }\n\n        throw new EntityCredentialsInvalidError({ entity: 'user' });\n    }\n}\n"],"mappings":";;;;;;AAiBA,IAAaK,8CAAb,cAAiED,6BAAAA;CACnDE;CAEAC;CAEAC;CAEV,YAAYC,KAAyD;EACjE,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,gBAAgBC,IAAID;CAC7B;CAEA,MAAME,aAAaC,MAAcC,UAAkBC,SAAiC;EAChF,IAAIC;EACJ,MAAMC,WAAW,MAAM,KAAKT,WAAWU,eAAehB,yBAAyBiB,MAAMJ,OAAAA;EAErF,KAAK,MAAMK,YAAYH,UAAU;GAC7B,IAAI,CAACd,uBAAuBiB,QAAAA,GACxB;GASJ,MAAME,WAAW,MAAMD,IANGhB,kCAAkC;IACxDe;IACAX,gBAAgB,KAAKA;IACrBC,eAAe,KAAKA;GACxB,CAEuBW,EAAcE,iBAAiBV,MAAMC,QAAAA;GAC5D,IAAIQ,SAASE,YAAY,MACrB,OAAOF,SAASG;GAGpBT,QAAQM,SAASN;EACrB;EAEA,IAAIA,OACA,MAAMA;EAGV,MAAM,IAAIZ,8BAA8B,EAAEsB,QAAQ,OAAO,CAAA;CAC7D;AACJ"}

package/dist/core/identity/provider/authentication/protocols/ldap/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAEjF,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAE3E,qBAAa,iCAAkC,SAAQ,4BAA4B,CAAC,IAAI,CAAC;IACrF,SAAS,CAAC,QAAQ,EAAG,oBAAoB,CAAC;IAE1C,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC;gBAElB,GAAG,EAAE,wCAAwC;IAgBnD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;cA8ClD,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;cAatD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;cAgBlE,MAAM,IAAK,OAAO,CAAC,IAAI,CAAC;cAIxB,UAAU,IAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;cAgBpC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IA0ClF,SAAS,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,GAAI,MAAM,GAAG,SAAS;IAK7C,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CAuD7E"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAEjF,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,YAAY,CAAC;AAE3E,qBAAa,iCAAkC,SAAQ,4BAA4B,CAAC,IAAI,CAAC;IACrF,SAAS,CAAC,QAAQ,EAAG,oBAAoB,CAAC;IAE1C,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC;gBAElB,GAAG,EAAE,wCAAwC;IAgBnD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;cA+ClD,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC;cAatD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;cAgBlE,MAAM,IAAK,OAAO,CAAC,IAAI,CAAC;cAIxB,UAAU,IAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;cAgBpC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IA0ClF,SAAS,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,GAAI,MAAM,GAAG,SAAS;IAK7C,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CAuD7E"}

package/dist/core/identity/provider/authentication/protocols/ldap/module.mjs

@@ -1,7 +1,7 @@
 import { BaseCredentialsAuthenticator } from "../../../../../authentication/base.mjs";
 import "../../../../../authentication/index.mjs";
-import { UserError } from "@authup/core-kit";
 import { template } from "@authup/kit";
+import { EntityCredentialsInvalidError } from "@authup/errors";
 import ldap from "ldapjs";
 //#region src/core/identity/provider/authentication/protocols/ldap/module.ts
 var IdentityProviderLdapAuthenticator = class extends BaseCredentialsAuthenticator {
@@ -26,10 +26,13 @@ var IdentityProviderLdapAuthenticator = class extends BaseCredentialsAuthenticat
 		let bind = await this.safeBind();
 		if (!bind.success) {
 			await this.safeUnbind();
-			throw UserError.credentialsInvalid();
+			throw new EntityCredentialsInvalidError({ entity: "user" });
 		}
 		const entity = await this.findOneByName(name);
-		if (!entity) throw UserError.credentialsInvalid();
+		if (!entity) {
+			await this.safeUnbind();
+			throw new EntityCredentialsInvalidError({ entity: "user" });
+		}
 		const identity = {
 			id: entity.dn,
 			attributeCandidates: {
@@ -44,7 +47,7 @@ var IdentityProviderLdapAuthenticator = class extends BaseCredentialsAuthenticat
 		} catch {}
 		bind = await this.safeBind(identity.id, password);
 		await this.safeUnbind();
-		if (!bind.success) throw UserError.credentialsInvalid();
+		if (!bind.success) throw new EntityCredentialsInvalidError({ entity: "user" });
 		return (await this.accountManager.save(identity)).user;
 	}
 	async bind(user, password) {

package/dist/core/identity/provider/authentication/protocols/ldap/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["UserError","template","ldap","BaseCredentialsAuthenticator","IdentityProviderLdapAuthenticator","provider","accountManager","client","ctx","clientFactory","create","url","tls","startTLS","start_tls","baseDn","base_dn","user","password","userNameAttribute","user_name_attribute","authenticate","name","bind","safeBind","success","safeUnbind","credentialsInvalid","entity","findOneByName","identity","id","dn","attributeCandidates","extractCnFromDn","email","user_mail_attribute","data","roles","findUserGroups","account","save","isDn","nameAttribute","resolveDn","user_base_dn","e","error","unbind","input","filter","user_filter","name_attribute","mail_attribute","display_name_attribute","user_display_name_attribute","EqualityFilter","attribute","value","OrFilter","filters","entities","search","scope","length","match","exec","trim","undefined","group_name_attribute","memberAttribute","group_member_attribute","group_filter","member_attribute","AndFilter","group_class","group_member_user_attribute","group_base_dn","attributeKey","names","push","Array","isArray","el"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { LdapIdentityProvider, User } from '@authup/core-kit';\nimport { UserError } from '@authup/core-kit';\nimport type { Result } from '@authup/kit';\nimport { template } from '@authup/kit';\nimport ldap from 'ldapjs';\nimport type { Filter } from 'ldapjs';\nimport { BaseCredentialsAuthenticator } from '../../../../../authentication/index.ts';\nimport type { ILdapClient } from '../../../../../ldap/index.ts';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type { IdentityProviderLdapAuthenticatorContext } from './types.ts';\n\nexport class IdentityProviderLdapAuthenticator extends BaseCredentialsAuthenticator<User> {\n    protected provider : LdapIdentityProvider;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected client: ILdapClient;\n\n    constructor(ctx: IdentityProviderLdapAuthenticatorContext) {\n        super();\n\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n        this.client = ctx.clientFactory.create({\n            url: ctx.provider.url,\n            tls: ctx.provider.tls,\n            startTLS: ctx.provider.start_tls,\n            baseDn: ctx.provider.base_dn,\n            user: ctx.provider.user,\n            password: ctx.provider.password,\n            userNameAttribute: ctx.provider.user_name_attribute,\n        });\n    }\n\n    async authenticate(name: string, password: string) : Promise<User> {\n        let bind = await this.safeBind();\n        if (!bind.success) {\n            await this.safeUnbind();\n\n            throw UserError.credentialsInvalid();\n        }\n\n        const entity = await this.findOneByName(name);\n        if (!entity) {\n            throw UserError.credentialsInvalid();\n        }\n\n        const identity : IdentityProviderIdentity = {\n            id: entity.dn,\n            attributeCandidates: {\n                name: [\n                    entity[this.provider.user_name_attribute || 'cn'],\n                    this.extractCnFromDn(entity.dn),\n                ],\n                email: [\n                    entity[this.provider.user_mail_attribute || 'mail'],\n                ],\n            },\n            data: entity,\n            provider: this.provider,\n        };\n\n        try {\n            identity.roles = await this.findUserGroups(entity);\n        } catch {\n            // todo: log event\n        }\n\n        bind = await this.safeBind(identity.id, password);\n        await this.safeUnbind();\n\n        if (!bind.success) {\n            throw UserError.credentialsInvalid();\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    protected async bind(user?: string, password?: string) : Promise<void> {\n        if (!user) {\n            return this.client.bind();\n        }\n\n        if (!this.client.isDn(user)) {\n            const nameAttribute = this.provider.user_name_attribute || 'cn';\n            user = `${nameAttribute}=${user},${this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn)}`;\n        }\n\n        return this.client.bind(user, password);\n    }\n\n    protected async safeBind(user?: string, password?: string) : Promise<Result<null>> {\n        try {\n            await this.bind(user, password);\n\n            return {\n                success: true,\n                data: null, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    protected async unbind() : Promise<void> {\n        return this.client.unbind();\n    }\n\n    protected async safeUnbind() : Promise<Result<null>> {\n        try {\n            await this.unbind();\n\n            return {\n                success: true,\n                data: null, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    protected async findOneByName(input: string) : Promise<Record<string, any> | null> {\n        let filter : Filter | string;\n\n        if (this.provider.user_filter) {\n            filter = template(this.provider.user_filter, {\n                input,\n                name_attribute: this.provider.user_name_attribute || 'cn',\n                mail_attribute: this.provider.user_mail_attribute || 'mail',\n                display_name_attribute: this.provider.user_display_name_attribute || 'cn',\n            });\n        } else if (this.provider.user_name_attribute) {\n            filter = new ldap.EqualityFilter({\n                attribute: this.provider.user_name_attribute,\n                value: input,\n            });\n        } else {\n            filter = new ldap.OrFilter({\n                filters: [\n                    new ldap.EqualityFilter({\n                        attribute: 'cn',\n                        value: input,\n                    }),\n                    new ldap.EqualityFilter({\n                        attribute: 'sAMAccountName',\n                        value: input,\n                    }),\n                ],\n            });\n        }\n\n        const entities = await this.client.search({\n            filter,\n            scope: 'sub',\n        }, this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn));\n\n        if (entities.length === 0) {\n            return null;\n        }\n\n        return entities[0];\n    }\n\n    protected extractCnFromDn(dn: string) : string | undefined {\n        const match = /^cn=([^,]+)/i.exec(dn);\n        return match ? match[1].trim() : undefined;\n    }\n\n    public async findUserGroups(user: Record<string, any>) : Promise<string[]> {\n        const nameAttribute = this.provider.group_name_attribute || 'cn';\n        const memberAttribute = this.provider.group_member_attribute || 'member';\n\n        let filter : Filter | string;\n        if (this.provider.group_filter) {\n            filter = template(this.provider.group_filter, {\n                ...user,\n                name_attribute: nameAttribute,\n                member_attribute: memberAttribute,\n            });\n        } else {\n            filter = new ldap.AndFilter({\n                filters: [\n                    new ldap.EqualityFilter({\n                        attribute: 'objectClass',\n                        value: this.provider.group_class || 'group',\n                    }),\n                    new ldap.EqualityFilter({\n                        attribute: memberAttribute,\n                        value: user[this.provider.group_member_user_attribute || 'dn'],\n                    }),\n                ],\n            });\n        }\n\n        const entities = await this.client.search({\n            filter,\n            scope: 'sub',\n        }, this.client.resolveDn(this.provider.group_base_dn, this.provider.base_dn));\n\n        if (entities.length === 0) {\n            return [];\n        }\n\n        const attributeKey = this.provider.group_name_attribute || 'cn';\n        const names : string[] = [];\n        for (const entity of entities) {\n            const attribute = entity[attributeKey];\n            if (typeof attribute === 'undefined') {\n                continue;\n            }\n\n            if (typeof attribute === 'string') {\n                names.push(attribute);\n                continue;\n            }\n\n            if (Array.isArray(attribute)) {\n                names.push(...attribute.filter((el) => typeof el === 'string'));\n            }\n        }\n\n        return names;\n    }\n}\n"],"mappings":";;;;;;AAmBA,IAAaI,oCAAb,cAAuDD,6BAAAA;CACzCE;CAEAC;CAEAC;CAEV,YAAYC,KAA+C;AACvD,SAAK;AAEL,OAAKF,iBAAiBE,IAAIF;AAC1B,OAAKD,WAAWG,IAAIH;AACpB,OAAKE,SAASC,IAAIC,cAAcC,OAAO;GACnCC,KAAKH,IAAIH,SAASM;GAClBC,KAAKJ,IAAIH,SAASO;GAClBC,UAAUL,IAAIH,SAASS;GACvBC,QAAQP,IAAIH,SAASW;GACrBC,MAAMT,IAAIH,SAASY;GACnBC,UAAUV,IAAIH,SAASa;GACvBC,mBAAmBX,IAAIH,SAASe;GACpC,CAAA;;CAGJ,MAAMC,aAAaC,MAAcJ,UAAkC;EAC/D,IAAIK,OAAO,MAAM,KAAKC,UAAQ;AAC9B,MAAI,CAACD,KAAKE,SAAS;AACf,SAAM,KAAKC,YAAU;AAErB,SAAM1B,UAAU2B,oBAAkB;;EAGtC,MAAMC,SAAS,MAAM,KAAKC,cAAcP,KAAAA;AACxC,MAAI,CAACM,OACD,OAAM5B,UAAU2B,oBAAkB;EAGtC,MAAMG,WAAsC;GACxCC,IAAIH,OAAOI;GACXC,qBAAqB;IACjBX,MAAM,CACFM,OAAO,KAAKvB,SAASe,uBAAuB,OAC5C,KAAKc,gBAAgBN,OAAOI,GAAE,CACjC;IACDG,OAAO,CACHP,OAAO,KAAKvB,SAAS+B,uBAAuB,QAC/C;IACL;GACAC,MAAMT;GACNvB,UAAU,KAAKA;GACnB;AAEA,MAAI;AACAyB,YAASQ,QAAQ,MAAM,KAAKC,eAAeX,OAAAA;UACvC;AAIRL,SAAO,MAAM,KAAKC,SAASM,SAASC,IAAIb,SAAAA;AACxC,QAAM,KAAKQ,YAAU;AAErB,MAAI,CAACH,KAAKE,QACN,OAAMzB,UAAU2B,oBAAkB;AAKtC,UAAOa,MAFe,KAAKlC,eAAemC,KAAKX,SAAAA,EAEhCb;;CAGnB,MAAgBM,KAAKN,MAAeC,UAAmC;AACnE,MAAI,CAACD,KACD,QAAO,KAAKV,OAAOgB,MAAI;AAG3B,MAAI,CAAC,KAAKhB,OAAOmC,KAAKzB,KAAAA,CAElBA,QAAO,GADe,KAAKZ,SAASe,uBAAuB,KACnC,GAAGH,KAAK,GAAG,KAAKV,OAAOqC,UAAU,KAAKvC,SAASwC,cAAc,KAAKxC,SAASW,QAAO;AAG9G,SAAO,KAAKT,OAAOgB,KAAKN,MAAMC,SAAAA;;CAGlC,MAAgBM,SAASP,MAAeC,UAA2C;AAC/E,MAAI;AACA,SAAM,KAAKK,KAAKN,MAAMC,SAAAA;AAEtB,UAAO;IACHO,SAAS;IACTY,MAAM;IACV;WACKS,GAAG;AACR,UAAO;IACHrB,SAAS;IACTsB,OAAOD;IACX;;;CAIR,MAAgBE,SAAyB;AACrC,SAAO,KAAKzC,OAAOyC,QAAM;;CAG7B,MAAgBtB,aAAqC;AACjD,MAAI;AACA,SAAM,KAAKsB,QAAM;AAEjB,UAAO;IACHvB,SAAS;IACTY,MAAM;IACV;WACKS,GAAG;AACR,UAAO;IACHrB,SAAS;IACTsB,OAAOD;IACX;;;CAIR,MAAgBjB,cAAcoB,OAAqD;EAC/E,IAAIC;AAEJ,MAAI,KAAK7C,SAAS8C,YACdD,UAASjD,SAAS,KAAKI,SAAS8C,aAAa;GACzCF;GACAG,gBAAgB,KAAK/C,SAASe,uBAAuB;GACrDiC,gBAAgB,KAAKhD,SAAS+B,uBAAuB;GACrDkB,wBAAwB,KAAKjD,SAASkD,+BAA+B;GACzE,CAAA;WACO,KAAKlD,SAASe,oBACrB8B,UAAS,IAAIhD,KAAKsD,eAAe;GAC7BC,WAAW,KAAKpD,SAASe;GACzBsC,OAAOT;GACX,CAAA;MAEAC,UAAS,IAAIhD,KAAKyD,SAAS,EACvBC,SAAS,CACL,IAAI1D,KAAKsD,eAAe;GACpBC,WAAW;GACXC,OAAOT;GACX,CAAA,EACA,IAAI/C,KAAKsD,eAAe;GACpBC,WAAW;GACXC,OAAOT;GACX,CAAA,CACH,EACL,CAAA;EAGJ,MAAMY,WAAW,MAAM,KAAKtD,OAAOuD,OAAO;GACtCZ;GACAa,OAAO;GACX,EAAG,KAAKxD,OAAOqC,UAAU,KAAKvC,SAASwC,cAAc,KAAKxC,SAASW,QAAO,CAAA;AAE1E,MAAI6C,SAASG,WAAW,EACpB,QAAO;AAGX,SAAOH,SAAS;;CAGV3B,gBAAgBF,IAAiC;EACvD,MAAMiC,QAAQ,eAAeC,KAAKlC,GAAAA;AAClC,SAAOiC,QAAQA,MAAM,GAAGE,MAAI,GAAKC,KAAAA;;CAGrC,MAAa7B,eAAetB,MAA+C;EACvE,MAAM0B,gBAAgB,KAAKtC,SAASgE,wBAAwB;EAC5D,MAAMC,kBAAkB,KAAKjE,SAASkE,0BAA0B;EAEhE,IAAIrB;AACJ,MAAI,KAAK7C,SAASmE,aACdtB,UAASjD,SAAS,KAAKI,SAASmE,cAAc;GAC1C,GAAGvD;GACHmC,gBAAgBT;GAChB8B,kBAAkBH;GACtB,CAAA;MAEApB,UAAS,IAAIhD,KAAKwE,UAAU,EACxBd,SAAS,CACL,IAAI1D,KAAKsD,eAAe;GACpBC,WAAW;GACXC,OAAO,KAAKrD,SAASsE,eAAe;GACxC,CAAA,EACA,IAAIzE,KAAKsD,eAAe;GACpBC,WAAWa;GACXZ,OAAOzC,KAAK,KAAKZ,SAASuE,+BAA+B;GAC7D,CAAA,CACH,EACL,CAAA;EAGJ,MAAMf,WAAW,MAAM,KAAKtD,OAAOuD,OAAO;GACtCZ;GACAa,OAAO;GACX,EAAG,KAAKxD,OAAOqC,UAAU,KAAKvC,SAASwE,eAAe,KAAKxE,SAASW,QAAO,CAAA;AAE3E,MAAI6C,SAASG,WAAW,EACpB,QAAO,EAAE;EAGb,MAAMc,eAAe,KAAKzE,SAASgE,wBAAwB;EAC3D,MAAMU,QAAmB,EAAE;AAC3B,OAAK,MAAMnD,UAAUiC,UAAU;GAC3B,MAAMJ,YAAY7B,OAAOkD;AACzB,OAAI,OAAOrB,cAAc,YACrB;AAGJ,OAAI,OAAOA,cAAc,UAAU;AAC/BsB,UAAMC,KAAKvB,UAAAA;AACX;;AAGJ,OAAIwB,MAAMC,QAAQzB,UAAAA,CACdsB,OAAMC,KAAI,GAAIvB,UAAUP,QAAQiC,OAAO,OAAOA,OAAO,SAAA,CAAA;;AAI7D,SAAOJ"}
+{"version":3,"file":"module.mjs","names":["EntityCredentialsInvalidError","template","ldap","BaseCredentialsAuthenticator","IdentityProviderLdapAuthenticator","provider","accountManager","client","ctx","clientFactory","create","url","tls","startTLS","start_tls","baseDn","base_dn","user","password","userNameAttribute","user_name_attribute","authenticate","name","bind","safeBind","success","safeUnbind","entity","findOneByName","identity","id","dn","attributeCandidates","extractCnFromDn","email","user_mail_attribute","data","roles","findUserGroups","account","save","isDn","nameAttribute","resolveDn","user_base_dn","e","error","unbind","input","filter","user_filter","name_attribute","mail_attribute","display_name_attribute","user_display_name_attribute","EqualityFilter","attribute","value","OrFilter","filters","entities","search","scope","length","match","exec","trim","undefined","group_name_attribute","memberAttribute","group_member_attribute","group_filter","member_attribute","AndFilter","group_class","group_member_user_attribute","group_base_dn","attributeKey","names","push","Array","isArray","el"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { LdapIdentityProvider, User } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError } from '@authup/errors';\nimport type { Result } from '@authup/kit';\nimport { template } from '@authup/kit';\nimport ldap from 'ldapjs';\nimport type { Filter } from 'ldapjs';\nimport { BaseCredentialsAuthenticator } from '../../../../../authentication/index.ts';\nimport type { ILdapClient } from '../../../../../ldap/index.ts';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type { IdentityProviderLdapAuthenticatorContext } from './types.ts';\n\nexport class IdentityProviderLdapAuthenticator extends BaseCredentialsAuthenticator<User> {\n    protected provider : LdapIdentityProvider;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected client: ILdapClient;\n\n    constructor(ctx: IdentityProviderLdapAuthenticatorContext) {\n        super();\n\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n        this.client = ctx.clientFactory.create({\n            url: ctx.provider.url,\n            tls: ctx.provider.tls,\n            startTLS: ctx.provider.start_tls,\n            baseDn: ctx.provider.base_dn,\n            user: ctx.provider.user,\n            password: ctx.provider.password,\n            userNameAttribute: ctx.provider.user_name_attribute,\n        });\n    }\n\n    async authenticate(name: string, password: string) : Promise<User> {\n        let bind = await this.safeBind();\n        if (!bind.success) {\n            await this.safeUnbind();\n\n            throw new EntityCredentialsInvalidError({ entity: 'user' });\n        }\n\n        const entity = await this.findOneByName(name);\n        if (!entity) {\n            await this.safeUnbind();\n            throw new EntityCredentialsInvalidError({ entity: 'user' });\n        }\n\n        const identity : IdentityProviderIdentity = {\n            id: entity.dn,\n            attributeCandidates: {\n                name: [\n                    entity[this.provider.user_name_attribute || 'cn'],\n                    this.extractCnFromDn(entity.dn),\n                ],\n                email: [\n                    entity[this.provider.user_mail_attribute || 'mail'],\n                ],\n            },\n            data: entity,\n            provider: this.provider,\n        };\n\n        try {\n            identity.roles = await this.findUserGroups(entity);\n        } catch {\n            // todo: log event\n        }\n\n        bind = await this.safeBind(identity.id, password);\n        await this.safeUnbind();\n\n        if (!bind.success) {\n            throw new EntityCredentialsInvalidError({ entity: 'user' });\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    protected async bind(user?: string, password?: string) : Promise<void> {\n        if (!user) {\n            return this.client.bind();\n        }\n\n        if (!this.client.isDn(user)) {\n            const nameAttribute = this.provider.user_name_attribute || 'cn';\n            user = `${nameAttribute}=${user},${this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn)}`;\n        }\n\n        return this.client.bind(user, password);\n    }\n\n    protected async safeBind(user?: string, password?: string) : Promise<Result<null>> {\n        try {\n            await this.bind(user, password);\n\n            return {\n                success: true,\n                data: null, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    protected async unbind() : Promise<void> {\n        return this.client.unbind();\n    }\n\n    protected async safeUnbind() : Promise<Result<null>> {\n        try {\n            await this.unbind();\n\n            return {\n                success: true,\n                data: null, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    protected async findOneByName(input: string) : Promise<Record<string, any> | null> {\n        let filter : Filter | string;\n\n        if (this.provider.user_filter) {\n            filter = template(this.provider.user_filter, {\n                input,\n                name_attribute: this.provider.user_name_attribute || 'cn',\n                mail_attribute: this.provider.user_mail_attribute || 'mail',\n                display_name_attribute: this.provider.user_display_name_attribute || 'cn',\n            });\n        } else if (this.provider.user_name_attribute) {\n            filter = new ldap.EqualityFilter({\n                attribute: this.provider.user_name_attribute,\n                value: input,\n            });\n        } else {\n            filter = new ldap.OrFilter({\n                filters: [\n                    new ldap.EqualityFilter({\n                        attribute: 'cn',\n                        value: input,\n                    }),\n                    new ldap.EqualityFilter({\n                        attribute: 'sAMAccountName',\n                        value: input,\n                    }),\n                ],\n            });\n        }\n\n        const entities = await this.client.search({\n            filter,\n            scope: 'sub',\n        }, this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn));\n\n        if (entities.length === 0) {\n            return null;\n        }\n\n        return entities[0];\n    }\n\n    protected extractCnFromDn(dn: string) : string | undefined {\n        const match = /^cn=([^,]+)/i.exec(dn);\n        return match ? match[1].trim() : undefined;\n    }\n\n    public async findUserGroups(user: Record<string, any>) : Promise<string[]> {\n        const nameAttribute = this.provider.group_name_attribute || 'cn';\n        const memberAttribute = this.provider.group_member_attribute || 'member';\n\n        let filter : Filter | string;\n        if (this.provider.group_filter) {\n            filter = template(this.provider.group_filter, {\n                ...user,\n                name_attribute: nameAttribute,\n                member_attribute: memberAttribute,\n            });\n        } else {\n            filter = new ldap.AndFilter({\n                filters: [\n                    new ldap.EqualityFilter({\n                        attribute: 'objectClass',\n                        value: this.provider.group_class || 'group',\n                    }),\n                    new ldap.EqualityFilter({\n                        attribute: memberAttribute,\n                        value: user[this.provider.group_member_user_attribute || 'dn'],\n                    }),\n                ],\n            });\n        }\n\n        const entities = await this.client.search({\n            filter,\n            scope: 'sub',\n        }, this.client.resolveDn(this.provider.group_base_dn, this.provider.base_dn));\n\n        if (entities.length === 0) {\n            return [];\n        }\n\n        const attributeKey = this.provider.group_name_attribute || 'cn';\n        const names : string[] = [];\n        for (const entity of entities) {\n            const attribute = entity[attributeKey];\n            if (typeof attribute === 'undefined') {\n                continue;\n            }\n\n            if (typeof attribute === 'string') {\n                names.push(attribute);\n                continue;\n            }\n\n            if (Array.isArray(attribute)) {\n                names.push(...attribute.filter((el) => typeof el === 'string'));\n            }\n        }\n\n        return names;\n    }\n}\n"],"mappings":";;;;;;AAmBA,IAAaI,oCAAb,cAAuDD,6BAAAA;CACzCE;CAEAC;CAEAC;CAEV,YAAYC,KAA+C;EACvD,MAAK;EAEL,KAAKF,iBAAiBE,IAAIF;EAC1B,KAAKD,WAAWG,IAAIH;EACpB,KAAKE,SAASC,IAAIC,cAAcC,OAAO;GACnCC,KAAKH,IAAIH,SAASM;GAClBC,KAAKJ,IAAIH,SAASO;GAClBC,UAAUL,IAAIH,SAASS;GACvBC,QAAQP,IAAIH,SAASW;GACrBC,MAAMT,IAAIH,SAASY;GACnBC,UAAUV,IAAIH,SAASa;GACvBC,mBAAmBX,IAAIH,SAASe;EACpC,CAAA;CACJ;CAEA,MAAMC,aAAaC,MAAcJ,UAAkC;EAC/D,IAAIK,OAAO,MAAM,KAAKC,SAAQ;EAC9B,IAAI,CAACD,KAAKE,SAAS;GACf,MAAM,KAAKC,WAAU;GAErB,MAAM,IAAI1B,8BAA8B,EAAE2B,QAAQ,OAAO,CAAA;EAC7D;EAEA,MAAMA,SAAS,MAAM,KAAKC,cAAcN,IAAAA;EACxC,IAAI,CAACK,QAAQ;GACT,MAAM,KAAKD,WAAU;GACrB,MAAM,IAAI1B,8BAA8B,EAAE2B,QAAQ,OAAO,CAAA;EAC7D;EAEA,MAAME,WAAsC;GACxCC,IAAIH,OAAOI;GACXC,qBAAqB;IACjBV,MAAM,CACFK,OAAO,KAAKtB,SAASe,uBAAuB,OAC5C,KAAKa,gBAAgBN,OAAOI,EAAE,CAAA;IAElCG,OAAO,CACHP,OAAO,KAAKtB,SAAS8B,uBAAuB,OAAA;GAEpD;GACAC,MAAMT;GACNtB,UAAU,KAAKA;EACnB;EAEA,IAAI;GACAwB,SAASQ,QAAQ,MAAM,KAAKC,eAAeX,MAAAA;EAC/C,QAAQ,CAER;EAEAJ,OAAO,MAAM,KAAKC,SAASK,SAASC,IAAIZ,QAAAA;EACxC,MAAM,KAAKQ,WAAU;EAErB,IAAI,CAACH,KAAKE,SACN,MAAM,IAAIzB,8BAA8B,EAAE2B,QAAQ,OAAO,CAAA;EAK7D,QAAOY,MAFe,KAAKjC,eAAekC,KAAKX,QAAAA,GAEhCZ;CACnB;CAEA,MAAgBM,KAAKN,MAAeC,UAAmC;EACnE,IAAI,CAACD,MACD,OAAO,KAAKV,OAAOgB,KAAI;EAG3B,IAAI,CAAC,KAAKhB,OAAOkC,KAAKxB,IAAAA,GAElBA,OAAO,GADe,KAAKZ,SAASe,uBAAuB,KACnC,GAAGH,KAAK,GAAG,KAAKV,OAAOoC,UAAU,KAAKtC,SAASuC,cAAc,KAAKvC,SAASW,OAAO;EAG9G,OAAO,KAAKT,OAAOgB,KAAKN,MAAMC,QAAAA;CAClC;CAEA,MAAgBM,SAASP,MAAeC,UAA2C;EAC/E,IAAI;GACA,MAAM,KAAKK,KAAKN,MAAMC,QAAAA;GAEtB,OAAO;IACHO,SAAS;IACTW,MAAM;GACV;EACJ,SAASS,GAAG;GACR,OAAO;IACHpB,SAAS;IACTqB,OAAOD;GACX;EACJ;CACJ;CAEA,MAAgBE,SAAyB;EACrC,OAAO,KAAKxC,OAAOwC,OAAM;CAC7B;CAEA,MAAgBrB,aAAqC;EACjD,IAAI;GACA,MAAM,KAAKqB,OAAM;GAEjB,OAAO;IACHtB,SAAS;IACTW,MAAM;GACV;EACJ,SAASS,GAAG;GACR,OAAO;IACHpB,SAAS;IACTqB,OAAOD;GACX;EACJ;CACJ;CAEA,MAAgBjB,cAAcoB,OAAqD;EAC/E,IAAIC;EAEJ,IAAI,KAAK5C,SAAS6C,aACdD,SAAShD,SAAS,KAAKI,SAAS6C,aAAa;GACzCF;GACAG,gBAAgB,KAAK9C,SAASe,uBAAuB;GACrDgC,gBAAgB,KAAK/C,SAAS8B,uBAAuB;GACrDkB,wBAAwB,KAAKhD,SAASiD,+BAA+B;EACzE,CAAA;OACG,IAAI,KAAKjD,SAASe,qBACrB6B,SAAS,IAAI/C,KAAKqD,eAAe;GAC7BC,WAAW,KAAKnD,SAASe;GACzBqC,OAAOT;EACX,CAAA;OAEAC,SAAS,IAAI/C,KAAKwD,SAAS,EACvBC,SAAS,CACL,IAAIzD,KAAKqD,eAAe;GACpBC,WAAW;GACXC,OAAOT;EACX,CAAA,GACA,IAAI9C,KAAKqD,eAAe;GACpBC,WAAW;GACXC,OAAOT;EACX,CAAA,CAAA,EAER,CAAA;EAGJ,MAAMY,WAAW,MAAM,KAAKrD,OAAOsD,OAAO;GACtCZ;GACAa,OAAO;EACX,GAAG,KAAKvD,OAAOoC,UAAU,KAAKtC,SAASuC,cAAc,KAAKvC,SAASW,OAAO,CAAA;EAE1E,IAAI4C,SAASG,WAAW,GACpB,OAAO;EAGX,OAAOH,SAAS;CACpB;CAEU3B,gBAAgBF,IAAiC;EACvD,MAAMiC,QAAQ,eAAeC,KAAKlC,EAAAA;EAClC,OAAOiC,QAAQA,MAAM,GAAGE,KAAI,IAAKC,KAAAA;CACrC;CAEA,MAAa7B,eAAerB,MAA+C;EACvE,MAAMyB,gBAAgB,KAAKrC,SAAS+D,wBAAwB;EAC5D,MAAMC,kBAAkB,KAAKhE,SAASiE,0BAA0B;EAEhE,IAAIrB;EACJ,IAAI,KAAK5C,SAASkE,cACdtB,SAAShD,SAAS,KAAKI,SAASkE,cAAc;GAC1C,GAAGtD;GACHkC,gBAAgBT;GAChB8B,kBAAkBH;EACtB,CAAA;OAEApB,SAAS,IAAI/C,KAAKuE,UAAU,EACxBd,SAAS,CACL,IAAIzD,KAAKqD,eAAe;GACpBC,WAAW;GACXC,OAAO,KAAKpD,SAASqE,eAAe;EACxC,CAAA,GACA,IAAIxE,KAAKqD,eAAe;GACpBC,WAAWa;GACXZ,OAAOxC,KAAK,KAAKZ,SAASsE,+BAA+B;EAC7D,CAAA,CAAA,EAER,CAAA;EAGJ,MAAMf,WAAW,MAAM,KAAKrD,OAAOsD,OAAO;GACtCZ;GACAa,OAAO;EACX,GAAG,KAAKvD,OAAOoC,UAAU,KAAKtC,SAASuE,eAAe,KAAKvE,SAASW,OAAO,CAAA;EAE3E,IAAI4C,SAASG,WAAW,GACpB,OAAO,CAAA;EAGX,MAAMc,eAAe,KAAKxE,SAAS+D,wBAAwB;EAC3D,MAAMU,QAAmB,CAAA;EACzB,KAAK,MAAMnD,UAAUiC,UAAU;GAC3B,MAAMJ,YAAY7B,OAAOkD;GACzB,IAAI,OAAOrB,cAAc,aACrB;GAGJ,IAAI,OAAOA,cAAc,UAAU;IAC/BsB,MAAMC,KAAKvB,SAAAA;IACX;GACJ;GAEA,IAAIwB,MAAMC,QAAQzB,SAAAA,GACdsB,MAAMC,KAAI,GAAIvB,UAAUP,QAAQiC,OAAO,OAAOA,OAAO,QAAA,CAAA;EAE7D;EAEA,OAAOJ;CACX;AACJ"}

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["buildIdentityProviderAuthorizeCallbackPath","extractTokenPayload","OAuth2Client","IdentityProviderOAuth2Authenticator","client","options","accountManager","provider","ctx","clientId","client_id","clientSecret","client_secret","redirectUri","baseURL","id","scope","authorizationEndpoint","authorize_url","tokenEndpoint","token_url","userinfoEndpoint","user_info_url","undefined","buildRedirectURL","parameters","authorize","buildURL","authenticate","params","token","createWithAuthorizationCode","identity","buildIdentityWithTokenGrantResponse","account","save","user","safeAuthenticate","data","success","e","error","input","payload","access_token","sub","attributeCandidates","name","email"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';\nimport { buildIdentityProviderAuthorizeCallbackPath } from '@authup/core-kit';\nimport type { Result } from '@authup/kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';\nimport { OAuth2Client } from '@hapic/oauth2';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type {\n    IOAuth2Authenticator,\n    IdentityProviderOAuth2AuthenticatorContext,\n    IdentityProviderOAuth2AuthenticatorOptions,\n    OAuth2AuthorizationCodeGrantPayload,\n} from './types.ts';\n\nexport class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {\n    protected client : OAuth2Client;\n\n    protected options : IdentityProviderOAuth2AuthenticatorOptions;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected provider : OAuth2IdentityProvider | OpenIDIdentityProvider;\n\n    //----------------------------------------------------------------------\n\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n\n        this.client = new OAuth2Client({\n            options: {\n                clientId: ctx.provider.client_id,\n                clientSecret: ctx.provider.client_secret,\n                redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,\n                scope: ctx.provider.scope,\n                authorizationEndpoint: ctx.provider.authorize_url,\n                tokenEndpoint: ctx.provider.token_url,\n                userinfoEndpoint: ctx.provider.user_info_url || undefined,\n            },\n        });\n    }\n\n    //----------------------------------------------------------------------\n\n    buildRedirectURL(parameters: Partial<AuthorizeParameters> = {}) : string {\n        return this.client.authorize.buildURL(parameters);\n    }\n\n    //----------------------------------------------------------------------\n\n    async authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User> {\n        const token = await this.client.token.createWithAuthorizationCode(params);\n\n        const identity = await this.buildIdentityWithTokenGrantResponse(token);\n        if (this.options.clientId) {\n            identity.clientId = this.options.clientId;\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    async safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>> {\n        try {\n            const data = await this.authenticate(params);\n            return {\n                success: true,\n                data, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse) : Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAsBA,IAAaG,sCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiD;AACzD,OAAKH,UAAUG,IAAIH;AACnB,OAAKC,iBAAiBE,IAAIF;AAC1B,OAAKC,WAAWC,IAAID;AAEpB,OAAKH,SAAS,IAAIF,aAAa,EAC3BG,SAAS;GACLI,UAAUD,IAAID,SAASG;GACvBC,cAAcH,IAAID,SAASK;GAC3BC,aAAa,GAAGL,IAAIH,QAAQS,UAAUd,2CAA2CQ,IAAID,SAASQ,GAAE;GAChGC,OAAOR,IAAID,SAASS;GACpBC,uBAAuBT,IAAID,SAASW;GACpCC,eAAeX,IAAID,SAASa;GAC5BC,kBAAkBb,IAAID,SAASe,iBAAiBC,KAAAA;GACpD,EACJ,CAAA;;CAKJC,iBAAiBC,aAA2C,EAAE,EAAW;AACrE,SAAO,KAAKrB,OAAOsB,UAAUC,SAASF,WAAAA;;CAK1C,MAAMG,aAAaC,QAA4D;EAC3E,MAAMC,QAAQ,MAAM,KAAK1B,OAAO0B,MAAMC,4BAA4BF,OAAAA;EAElE,MAAMG,WAAW,MAAM,KAAKC,oCAAoCH,MAAAA;AAChE,MAAI,KAAKzB,QAAQI,SACbuB,UAASvB,WAAW,KAAKJ,QAAQI;AAKrC,UAAOyB,MAFe,KAAK5B,eAAe6B,KAAKH,SAAAA,EAEhCI;;CAGnB,MAAMC,iBAAiBR,QAAoE;AACvF,MAAI;AAEA,UAAO;IACHU,SAAS;IACTD,MAAAA,MAHe,KAAKV,aAAaC,OAAAA;IAIrC;WACKW,GAAG;AACR,UAAO;IACHD,SAAS;IACTE,OAAOD;IACX;;;CAMR,MAAgBP,oCAAoCS,OAA+D;EAC/G,MAAMC,UAAU1C,oBAAoByC,MAAME,aAAY;AAEtD,SAAO;GACH7B,IAAI4B,QAAQE;GACZC,qBAAqB;IACjBC,MAAM,CACFJ,QAAQE,IACX;IACDG,OAAO,CACHL,QAAQK,MACX;IACL;GACAV,MAAMK;GACNpC,UAAU,KAAKA;GACnB"}
+{"version":3,"file":"module.mjs","names":["buildIdentityProviderAuthorizeCallbackPath","extractTokenPayload","OAuth2Client","IdentityProviderOAuth2Authenticator","client","options","accountManager","provider","ctx","clientId","client_id","clientSecret","client_secret","redirectUri","baseURL","id","scope","authorizationEndpoint","authorize_url","tokenEndpoint","token_url","userinfoEndpoint","user_info_url","undefined","buildRedirectURL","parameters","authorize","buildURL","authenticate","params","token","createWithAuthorizationCode","identity","buildIdentityWithTokenGrantResponse","account","save","user","safeAuthenticate","data","success","e","error","input","payload","access_token","sub","attributeCandidates","name","email"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';\nimport { buildIdentityProviderAuthorizeCallbackPath } from '@authup/core-kit';\nimport type { Result } from '@authup/kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';\nimport { OAuth2Client } from '@hapic/oauth2';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type {\n    IOAuth2Authenticator,\n    IdentityProviderOAuth2AuthenticatorContext,\n    IdentityProviderOAuth2AuthenticatorOptions,\n    OAuth2AuthorizationCodeGrantPayload,\n} from './types.ts';\n\nexport class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {\n    protected client : OAuth2Client;\n\n    protected options : IdentityProviderOAuth2AuthenticatorOptions;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected provider : OAuth2IdentityProvider | OpenIDIdentityProvider;\n\n    //----------------------------------------------------------------------\n\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n\n        this.client = new OAuth2Client({\n            options: {\n                clientId: ctx.provider.client_id,\n                clientSecret: ctx.provider.client_secret,\n                redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,\n                scope: ctx.provider.scope,\n                authorizationEndpoint: ctx.provider.authorize_url,\n                tokenEndpoint: ctx.provider.token_url,\n                userinfoEndpoint: ctx.provider.user_info_url || undefined,\n            },\n        });\n    }\n\n    //----------------------------------------------------------------------\n\n    buildRedirectURL(parameters: Partial<AuthorizeParameters> = {}) : string {\n        return this.client.authorize.buildURL(parameters);\n    }\n\n    //----------------------------------------------------------------------\n\n    async authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User> {\n        const token = await this.client.token.createWithAuthorizationCode(params);\n\n        const identity = await this.buildIdentityWithTokenGrantResponse(token);\n        if (this.options.clientId) {\n            identity.clientId = this.options.clientId;\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    async safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>> {\n        try {\n            const data = await this.authenticate(params);\n            return {\n                success: true,\n                data, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse) : Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAsBA,IAAaG,sCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiD;EACzD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,WAAWC,IAAID;EAEpB,KAAKH,SAAS,IAAIF,aAAa,EAC3BG,SAAS;GACLI,UAAUD,IAAID,SAASG;GACvBC,cAAcH,IAAID,SAASK;GAC3BC,aAAa,GAAGL,IAAIH,QAAQS,UAAUd,2CAA2CQ,IAAID,SAASQ,EAAE;GAChGC,OAAOR,IAAID,SAASS;GACpBC,uBAAuBT,IAAID,SAASW;GACpCC,eAAeX,IAAID,SAASa;GAC5BC,kBAAkBb,IAAID,SAASe,iBAAiBC,KAAAA;EACpD,EACJ,CAAA;CACJ;CAIAC,iBAAiBC,aAA2C,CAAC,GAAY;EACrE,OAAO,KAAKrB,OAAOsB,UAAUC,SAASF,UAAAA;CAC1C;CAIA,MAAMG,aAAaC,QAA4D;EAC3E,MAAMC,QAAQ,MAAM,KAAK1B,OAAO0B,MAAMC,4BAA4BF,MAAAA;EAElE,MAAMG,WAAW,MAAM,KAAKC,oCAAoCH,KAAAA;EAChE,IAAI,KAAKzB,QAAQI,UACbuB,SAASvB,WAAW,KAAKJ,QAAQI;EAKrC,QAAOyB,MAFe,KAAK5B,eAAe6B,KAAKH,QAAAA,GAEhCI;CACnB;CAEA,MAAMC,iBAAiBR,QAAoE;EACvF,IAAI;GAEA,OAAO;IACHU,SAAS;IACTD,MAAAA,MAHe,KAAKV,aAAaC,MAAAA;GAIrC;EACJ,SAASW,GAAG;GACR,OAAO;IACHD,SAAS;IACTE,OAAOD;GACX;EACJ;CACJ;CAIA,MAAgBP,oCAAoCS,OAA+D;EAC/G,MAAMC,UAAU1C,oBAAoByC,MAAME,YAAY;EAEtD,OAAO;GACH7B,IAAI4B,QAAQE;GACZC,qBAAqB;IACjBC,MAAM,CACFJ,QAAQE,GAAAA;IAEZG,OAAO,CACHL,QAAQK,KAAAA;GAEhB;GACAV,MAAMK;GACNpC,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/protocols/open-id/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderOpenIDAuthenticator","buildIdentityWithTokenGrantResponse","input","payload","access_token","id","sub","attributeCandidates","name","preferred_username","nickname","email","data","provider"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../oauth2/index.ts';\n\nexport class IdentityProviderOpenIDAuthenticator extends IdentityProviderOAuth2Authenticator {\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.preferred_username,\n                    payload.nickname,\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAYA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,MAAgBE,oCAAoCC,OAA8D;EAC9G,MAAMC,UAAUL,oBAAoBI,MAAME,aAAY;AAEtD,SAAO;GACHC,IAAIF,QAAQG;GACZC,qBAAqB;IACjBC,MAAM;KACFL,QAAQM;KACRN,QAAQO;KACRP,QAAQG;KACX;IACDK,OAAO,CACHR,QAAQQ,MACX;IACL;GACAC,MAAMT;GACNU,UAAU,KAAKA;GACnB"}
+{"version":3,"file":"module.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderOpenIDAuthenticator","buildIdentityWithTokenGrantResponse","input","payload","access_token","id","sub","attributeCandidates","name","preferred_username","nickname","email","data","provider"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../oauth2/index.ts';\n\nexport class IdentityProviderOpenIDAuthenticator extends IdentityProviderOAuth2Authenticator {\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.preferred_username,\n                    payload.nickname,\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;AAYA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,MAAgBE,oCAAoCC,OAA8D;EAC9G,MAAMC,UAAUL,oBAAoBI,MAAME,YAAY;EAEtD,OAAO;GACHC,IAAIF,QAAQG;GACZC,qBAAqB;IACjBC,MAAM;KACFL,QAAQM;KACRN,QAAQO;KACRP,QAAQG;;IAEZK,OAAO,CACHR,QAAQQ,KAAAA;GAEhB;GACAC,MAAMT;GACNU,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/mapper/attributes/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderAttributeMapper","repository","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","value","resolve","push","key","target_name","target_value","realmId","provider_realm_id"],"sources":["../../../../../../src/core/identity/provider/mapper/attributes/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderAttributeMappingRepository } from './types.ts';\n\nexport class IdentityProviderAttributeMapper extends IdentityProviderAccountBaseMapper {\n    protected repository: IIdentityProviderAttributeMappingRepository;\n\n    constructor(repository: IIdentityProviderAttributeMappingRepository) {\n        super();\n\n        this.repository = repository;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.repository.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation, value] = this.resolve(identity, entity);\n\n            items.push({\n                key: entity.target_name,\n                value: entity.target_value ? entity.target_value : value,\n                realmId: entity.provider_realm_id,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;AAWA,IAAaC,kCAAb,cAAqDD,kCAAAA;CACvCE;CAEV,YAAYA,YAAyD;AACjE,SAAK;AAEL,OAAKA,aAAaA;;CAGtB,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,WAAWI,iBAAiBF,SAASG,SAASC,GAAE;EAE5E,MAAMC,QAA0C,EAAE;AAClD,OAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,WAAWC,SAAS,KAAKC,QAAQT,UAAUM,OAAAA;AAElDD,SAAMK,KAAK;IACPC,KAAKL,OAAOM;IACZJ,OAAOF,OAAOO,eAAeP,OAAOO,eAAeL;IACnDM,SAASR,OAAOS;IAChBR;IACJ,CAAA;;AAGJ,SAAOF"}
+{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderAttributeMapper","repository","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","value","resolve","push","key","target_name","target_value","realmId","provider_realm_id"],"sources":["../../../../../../src/core/identity/provider/mapper/attributes/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderAttributeMappingRepository } from './types.ts';\n\nexport class IdentityProviderAttributeMapper extends IdentityProviderAccountBaseMapper {\n    protected repository: IIdentityProviderAttributeMappingRepository;\n\n    constructor(repository: IIdentityProviderAttributeMappingRepository) {\n        super();\n\n        this.repository = repository;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.repository.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation, value] = this.resolve(identity, entity);\n\n            items.push({\n                key: entity.target_name,\n                value: entity.target_value ? entity.target_value : value,\n                realmId: entity.provider_realm_id,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;AAWA,IAAaC,kCAAb,cAAqDD,kCAAAA;CACvCE;CAEV,YAAYA,YAAyD;EACjE,MAAK;EAEL,KAAKA,aAAaA;CACtB;CAEA,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,WAAWI,iBAAiBF,SAASG,SAASC,EAAE;EAE5E,MAAMC,QAA0C,CAAA;EAChD,KAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,WAAWC,SAAS,KAAKC,QAAQT,UAAUM,MAAAA;GAElDD,MAAMK,KAAK;IACPC,KAAKL,OAAOM;IACZJ,OAAOF,OAAOO,eAAeP,OAAOO,eAAeL;IACnDM,SAASR,OAAOS;IAChBR;GACJ,CAAA;EACJ;EAEA,OAAOF;CACX;AACJ"}

package/dist/core/identity/provider/mapper/base.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"base.mjs","names":["IdentityProviderMappingSyncMode","getJWTClaimByPattern","IdentityProviderIdentityOperation","IdentityProviderMapperOperation","IdentityProviderAccountBaseMapper","resolve","identity","mapping","operation","synchronization_mode","ONCE","UPDATE","NONE","name","value","CREATE","data","value_is_regex","length","DELETE"],"sources":["../../../../../src/core/identity/provider/mapper/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderBaseMapping } from '@authup/core-kit';\nimport { IdentityProviderMappingSyncMode } from '@authup/core-kit';\nimport { getJWTClaimByPattern } from '@authup/specs';\nimport { IdentityProviderIdentityOperation } from '../constants.ts';\nimport type { IdentityProviderIdentity } from '../types.ts';\nimport { IdentityProviderMapperOperation } from './constants.ts';\nimport type { IIdentityProviderMapper, IdentityProviderMapperElement } from './types.ts';\n\nexport abstract class IdentityProviderAccountBaseMapper implements IIdentityProviderMapper {\n    protected resolve(\n        identity: IdentityProviderIdentity,\n        mapping: IdentityProviderBaseMapping,\n    ) : [IdentityProviderMapperOperation, unknown] | [IdentityProviderMapperOperation] {\n        let operation : IdentityProviderMapperOperation;\n        if (\n            mapping.synchronization_mode === IdentityProviderMappingSyncMode.ONCE &&\n            identity.operation === IdentityProviderIdentityOperation.UPDATE\n        ) {\n            operation = IdentityProviderMapperOperation.NONE;\n\n            return [operation];\n        }\n\n        if (!mapping.name || !mapping.value) {\n            operation = IdentityProviderMapperOperation.CREATE;\n\n            return [operation];\n        }\n\n        const value = getJWTClaimByPattern(\n            identity.data,\n            mapping.name,\n            mapping.value,\n            mapping.value_is_regex,\n        );\n\n        if (value.length === 0) {\n            operation = IdentityProviderMapperOperation.DELETE;\n        } else {\n            operation = IdentityProviderMapperOperation.CREATE;\n        }\n\n        return [operation, value];\n    }\n\n    abstract execute(\n        identity: IdentityProviderIdentity\n    ): Promise<IdentityProviderMapperElement[]>;\n}\n"],"mappings":";;;;;AAeA,IAAsBI,oCAAtB,MAAsBA;CACRC,QACNC,UACAC,SAC+E;EAC/E,IAAIC;AACJ,MACID,QAAQE,yBAAyBT,gCAAgCU,QACjEJ,SAASE,cAAcN,kCAAkCS,QAC3D;AACEH,eAAYL,gCAAgCS;AAE5C,UAAO,CAACJ,UAAU;;AAGtB,MAAI,CAACD,QAAQM,QAAQ,CAACN,QAAQO,OAAO;AACjCN,eAAYL,gCAAgCY;AAE5C,UAAO,CAACP,UAAU;;EAGtB,MAAMM,QAAQb,qBACVK,SAASU,MACTT,QAAQM,MACRN,QAAQO,OACRP,QAAQU,eAAc;AAG1B,MAAIH,MAAMI,WAAW,EACjBV,aAAYL,gCAAgCgB;MAE5CX,aAAYL,gCAAgCY;AAGhD,SAAO,CAACP,WAAWM,MAAM"}
+{"version":3,"file":"base.mjs","names":["IdentityProviderMappingSyncMode","getJWTClaimByPattern","IdentityProviderIdentityOperation","IdentityProviderMapperOperation","IdentityProviderAccountBaseMapper","resolve","identity","mapping","operation","synchronization_mode","ONCE","UPDATE","NONE","name","value","CREATE","data","value_is_regex","length","DELETE"],"sources":["../../../../../src/core/identity/provider/mapper/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderBaseMapping } from '@authup/core-kit';\nimport { IdentityProviderMappingSyncMode } from '@authup/core-kit';\nimport { getJWTClaimByPattern } from '@authup/specs';\nimport { IdentityProviderIdentityOperation } from '../constants.ts';\nimport type { IdentityProviderIdentity } from '../types.ts';\nimport { IdentityProviderMapperOperation } from './constants.ts';\nimport type { IIdentityProviderMapper, IdentityProviderMapperElement } from './types.ts';\n\nexport abstract class IdentityProviderAccountBaseMapper implements IIdentityProviderMapper {\n    protected resolve(\n        identity: IdentityProviderIdentity,\n        mapping: IdentityProviderBaseMapping,\n    ) : [IdentityProviderMapperOperation, unknown] | [IdentityProviderMapperOperation] {\n        let operation : IdentityProviderMapperOperation;\n        if (\n            mapping.synchronization_mode === IdentityProviderMappingSyncMode.ONCE &&\n            identity.operation === IdentityProviderIdentityOperation.UPDATE\n        ) {\n            operation = IdentityProviderMapperOperation.NONE;\n\n            return [operation];\n        }\n\n        if (!mapping.name || !mapping.value) {\n            operation = IdentityProviderMapperOperation.CREATE;\n\n            return [operation];\n        }\n\n        const value = getJWTClaimByPattern(\n            identity.data,\n            mapping.name,\n            mapping.value,\n            mapping.value_is_regex,\n        );\n\n        if (value.length === 0) {\n            operation = IdentityProviderMapperOperation.DELETE;\n        } else {\n            operation = IdentityProviderMapperOperation.CREATE;\n        }\n\n        return [operation, value];\n    }\n\n    abstract execute(\n        identity: IdentityProviderIdentity\n    ): Promise<IdentityProviderMapperElement[]>;\n}\n"],"mappings":";;;;;AAeA,IAAsBI,oCAAtB,MAAsBA;CACRC,QACNC,UACAC,SAC+E;EAC/E,IAAIC;EACJ,IACID,QAAQE,yBAAyBT,gCAAgCU,QACjEJ,SAASE,cAAcN,kCAAkCS,QAC3D;GACEH,YAAYL,gCAAgCS;GAE5C,OAAO,CAACJ,SAAAA;EACZ;EAEA,IAAI,CAACD,QAAQM,QAAQ,CAACN,QAAQO,OAAO;GACjCN,YAAYL,gCAAgCY;GAE5C,OAAO,CAACP,SAAAA;EACZ;EAEA,MAAMM,QAAQb,qBACVK,SAASU,MACTT,QAAQM,MACRN,QAAQO,OACRP,QAAQU,cAAc;EAG1B,IAAIH,MAAMI,WAAW,GACjBV,YAAYL,gCAAgCgB;OAE5CX,YAAYL,gCAAgCY;EAGhD,OAAO,CAACP,WAAWM,KAAAA;CACvB;AAKJ"}

package/dist/core/identity/provider/mapper/permission/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderPermissionMapper","repository","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","resolve","push","value","permission_id","realmId","permission_realm_id"],"sources":["../../../../../../src/core/identity/provider/mapper/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderPermissionMappingRepository } from './types.ts';\n\nexport class IdentityProviderPermissionMapper extends IdentityProviderAccountBaseMapper {\n    protected repository: IIdentityProviderPermissionMappingRepository;\n\n    constructor(repository: IIdentityProviderPermissionMappingRepository) {\n        super();\n\n        this.repository = repository;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.repository.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation] = this.resolve(identity, entity);\n\n            items.push({\n                value: entity.permission_id,\n                realmId: entity.permission_realm_id,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;AAYA,IAAaC,mCAAb,cAAsDD,kCAAAA;CACxCE;CAEV,YAAYA,YAA0D;AAClE,SAAK;AAEL,OAAKA,aAAaA;;CAGtB,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,WAAWI,iBAAiBF,SAASG,SAASC,GAAE;EAE5E,MAAMC,QAA0C,EAAE;AAClD,OAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,aAAa,KAAKC,QAAQR,UAAUM,OAAAA;AAE3CD,SAAMI,KAAK;IACPC,OAAOJ,OAAOK;IACdC,SAASN,OAAOO;IAChBN;IACJ,CAAA;;AAGJ,SAAOF"}
+{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderPermissionMapper","repository","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","resolve","push","value","permission_id","realmId","permission_realm_id"],"sources":["../../../../../../src/core/identity/provider/mapper/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderPermissionMappingRepository } from './types.ts';\n\nexport class IdentityProviderPermissionMapper extends IdentityProviderAccountBaseMapper {\n    protected repository: IIdentityProviderPermissionMappingRepository;\n\n    constructor(repository: IIdentityProviderPermissionMappingRepository) {\n        super();\n\n        this.repository = repository;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.repository.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation] = this.resolve(identity, entity);\n\n            items.push({\n                value: entity.permission_id,\n                realmId: entity.permission_realm_id,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;AAYA,IAAaC,mCAAb,cAAsDD,kCAAAA;CACxCE;CAEV,YAAYA,YAA0D;EAClE,MAAK;EAEL,KAAKA,aAAaA;CACtB;CAEA,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,WAAWI,iBAAiBF,SAASG,SAASC,EAAE;EAE5E,MAAMC,QAA0C,CAAA;EAChD,KAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,aAAa,KAAKC,QAAQR,UAAUM,MAAAA;GAE3CD,MAAMI,KAAK;IACPC,OAAOJ,OAAOK;IACdC,SAASN,OAAOO;IAChBN;GACJ,CAAA;EACJ;EAEA,OAAOF;CACX;AACJ"}

package/dist/core/identity/provider/mapper/role/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderRoleMapper","finder","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","resolve","push","value","role_id","realmId","role_realm_id"],"sources":["../../../../../../src/core/identity/provider/mapper/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderRoleMappingFinder } from './types.ts';\n\nexport class IdentityProviderRoleMapper extends IdentityProviderAccountBaseMapper {\n    protected finder: IIdentityProviderRoleMappingFinder;\n\n    constructor(finder: IIdentityProviderRoleMappingFinder) {\n        super();\n\n        this.finder = finder;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.finder.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation] = this.resolve(identity, entity);\n\n            items.push({\n                value: entity.role_id,\n                realmId: entity.role_realm_id,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;AAYA,IAAaC,6BAAb,cAAgDD,kCAAAA;CAClCE;CAEV,YAAYA,QAA4C;AACpD,SAAK;AAEL,OAAKA,SAASA;;CAGlB,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,OAAOI,iBAAiBF,SAASG,SAASC,GAAE;EAExE,MAAMC,QAA0C,EAAE;AAClD,OAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,aAAa,KAAKC,QAAQR,UAAUM,OAAAA;AAE3CD,SAAMI,KAAK;IACPC,OAAOJ,OAAOK;IACdC,SAASN,OAAOO;IAChBN;IACJ,CAAA;;AAGJ,SAAOF"}
+{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderRoleMapper","finder","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","resolve","push","value","role_id","realmId","role_realm_id"],"sources":["../../../../../../src/core/identity/provider/mapper/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderRoleMappingFinder } from './types.ts';\n\nexport class IdentityProviderRoleMapper extends IdentityProviderAccountBaseMapper {\n    protected finder: IIdentityProviderRoleMappingFinder;\n\n    constructor(finder: IIdentityProviderRoleMappingFinder) {\n        super();\n\n        this.finder = finder;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.finder.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation] = this.resolve(identity, entity);\n\n            items.push({\n                value: entity.role_id,\n                realmId: entity.role_realm_id,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;AAYA,IAAaC,6BAAb,cAAgDD,kCAAAA;CAClCE;CAEV,YAAYA,QAA4C;EACpD,MAAK;EAEL,KAAKA,SAASA;CAClB;CAEA,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,OAAOI,iBAAiBF,SAASG,SAASC,EAAE;EAExE,MAAMC,QAA0C,CAAA;EAChD,KAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,aAAa,KAAKC,QAAQR,UAAUM,MAAAA;GAE3CD,MAAMI,KAAK;IACPC,OAAOJ,OAAOK;IACdC,SAASN,OAAOO;IAChBN;GACJ,CAAA;EACJ;EAEA,OAAOF;CACX;AACJ"}

package/dist/core/identity/registration/check.d.ts

@@ -0,0 +1,3 @@
+import { type RegistrationDisabledError } from './error.ts';
+export declare function isRegistrationDisabledError(input: unknown): input is RegistrationDisabledError;
+//# sourceMappingURL=check.d.ts.map

package/dist/core/identity/registration/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/check.ts"],"names":[],"mappings":"AAQA,OAAO,EAAwC,KAAK,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAElG,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,yBAAyB,CAI9F"}

package/dist/core/identity/registration/check.mjs

@@ -0,0 +1,12 @@
+import { REGISTRATION_DISABLED_ERROR_INSTANCE } from "./error.mjs";
+import { ErrorCode, hasInstanceof, isAuthupError } from "@authup/errors";
+//#region src/core/identity/registration/check.ts
+function isRegistrationDisabledError(input) {
+	if (hasInstanceof(input, REGISTRATION_DISABLED_ERROR_INSTANCE)) return true;
+	if (!isAuthupError(input)) return false;
+	return input.code === ErrorCode.REGISTRATION_DISABLED;
+}
+//#endregion
+export { isRegistrationDisabledError };
+
+//# sourceMappingURL=check.mjs.map

package/dist/core/identity/registration/check.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.mjs","names":["ErrorCode","hasInstanceof","isAuthupError","REGISTRATION_DISABLED_ERROR_INSTANCE","isRegistrationDisabledError","input","code","REGISTRATION_DISABLED"],"sources":["../../../../src/core/identity/registration/check.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode, hasInstanceof, isAuthupError } from '@authup/errors';\nimport { REGISTRATION_DISABLED_ERROR_INSTANCE, type RegistrationDisabledError } from './error.ts';\n\nexport function isRegistrationDisabledError(input: unknown): input is RegistrationDisabledError {\n    if (hasInstanceof(input, REGISTRATION_DISABLED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.REGISTRATION_DISABLED;\n}\n"],"mappings":";;;AAUA,SAAgBI,4BAA4BC,OAAc;CACtD,IAAIJ,cAAcI,OAAOF,oCAAAA,GAAuC,OAAO;CACvE,IAAI,CAACD,cAAcG,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMC,SAASN,UAAUO;AACpC"}

package/dist/core/identity/registration/error.d.ts

@@ -0,0 +1,6 @@
+import { BadRequestError } from '@authup/errors';
+export declare const REGISTRATION_DISABLED_ERROR_INSTANCE: unique symbol;
+export declare class RegistrationDisabledError extends BadRequestError {
+    constructor();
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/core/identity/registration/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/error.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAA6B,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,oCAAoC,eAA8D,CAAC;AAEhH,qBAAa,yBAA0B,SAAQ,eAAe;;CAQ7D"}

package/dist/core/identity/registration/error.mjs

@@ -0,0 +1,16 @@
+import { BadRequestError, ErrorCode, markInstanceof } from "@authup/errors";
+//#region src/core/identity/registration/error.ts
+const REGISTRATION_DISABLED_ERROR_INSTANCE = Symbol.for("@authup/server-core/RegistrationDisabledError");
+var RegistrationDisabledError = class extends BadRequestError {
+	constructor() {
+		super({
+			code: ErrorCode.REGISTRATION_DISABLED,
+			message: "User registration is not enabled."
+		});
+		markInstanceof(this, REGISTRATION_DISABLED_ERROR_INSTANCE);
+	}
+};
+//#endregion
+export { REGISTRATION_DISABLED_ERROR_INSTANCE, RegistrationDisabledError };
+
+//# sourceMappingURL=error.mjs.map

package/dist/core/identity/registration/error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.mjs","names":["BadRequestError","ErrorCode","markInstanceof","REGISTRATION_DISABLED_ERROR_INSTANCE","Symbol","for","RegistrationDisabledError","code","REGISTRATION_DISABLED","message"],"sources":["../../../../src/core/identity/registration/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, ErrorCode, markInstanceof } from '@authup/errors';\n\nexport const REGISTRATION_DISABLED_ERROR_INSTANCE = Symbol.for('@authup/server-core/RegistrationDisabledError');\n\nexport class RegistrationDisabledError extends BadRequestError {\n    constructor() {\n        super({\n            code: ErrorCode.REGISTRATION_DISABLED,\n            message: 'User registration is not enabled.',\n        });\n        markInstanceof(this, REGISTRATION_DISABLED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;AASA,MAAaG,uCAAuCC,OAAOC,IAAI,+CAAA;AAE/D,IAAaC,4BAAb,cAA+CN,gBAAAA;CAC3C,cAAc;EACV,MAAM;GACFO,MAAMN,UAAUO;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,oCAAAA;CACzB;AACJ"}

package/dist/core/identity/registration/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/service.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,0BAA0B;IAOrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgDhE,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAczD"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/service.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,0BAA0B;IAOrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgDhE,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAczD"}

package/dist/core/identity/registration/service.mjs

@@ -1,7 +1,8 @@
 import { UserCredentialsService } from "../../authentication/credential/entities/user/module.mjs";
+import { RegistrationDisabledError } from "./error.mjs";
 import { UserValidator } from "@authup/core-kit";
 import { createNanoID } from "@authup/kit";
-import { BadRequestError, NotFoundError } from "@ebec/http";
+import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 import { Container } from "validup";
 import { randomBytes } from "node:crypto";
 //#region src/core/identity/registration/service.ts
@@ -17,7 +18,7 @@ var RegistrationService = class {
 		this.realmRepository = ctx.realmRepository;
 	}
 	async register(data) {
-		if (!this.options.registrationEnabled) throw new BadRequestError("User registration is not enabled.");
+		if (!this.options.registrationEnabled) throw new RegistrationDisabledError();
 		const validator = new Container({});
 		validator.mount(new UserValidator({ pathsToInclude: [
 			"email",
@@ -54,7 +55,7 @@ var RegistrationService = class {
 	}
 	async activate(data) {
 		const entity = await this.repository.findOneBy({ activate_hash: data.token });
-		if (!entity) throw new NotFoundError();
+		if (!entity) throw new EntityNotFoundError();
 		const merged = this.repository.merge(entity, {
 			active: true,
 			activate_hash: null

package/dist/core/identity/registration/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["UserValidator","createNanoID","BadRequestError","NotFoundError","randomBytes","Container","UserCredentialsService","RegistrationService","options","mailClient","repository","realmRepository","ctx","register","data","registrationEnabled","validator","mount","pathsToInclude","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","send","to","email","subject","html","remove","activate","findOneBy","token","merged","merge"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserValidator } from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { BadRequestError, NotFoundError } from '@ebec/http';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient } from '../../mail/types.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async register(data: Record<string, any>): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new BadRequestError('User registration is not enabled.');\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({ pathsToInclude: ['email', 'name', 'password', 'realm_id'] }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                await this.mailClient.send({\n                    to: entity.email,\n                    subject: 'Registration - Activation code',\n                    html: `\n                    <p>Please use the code below to activate your account and start using the site.</p>\n                    <p>${entity.activate_hash}</p>\n                    `,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new BadRequestError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new NotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n    }\n}\n"],"mappings":";;;;;;;AAsBA,IAAaO,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;AACzC,OAAKJ,UAAUI,IAAIJ;AACnB,OAAKC,aAAaG,IAAIH;AACtB,OAAKC,aAAaE,IAAIF;AACtB,OAAKC,kBAAkBC,IAAID;;CAG/B,MAAME,SAASC,MAAwD;AACnE,MAAI,CAAC,KAAKN,QAAQO,oBACd,OAAM,IAAIb,gBAAgB,oCAAA;EAG9B,MAAMc,YAAY,IAAIX,UAAU,EAAC,CAAA;AACjCW,YAAUC,MAAM,IAAIjB,cAAc,EAAEkB,gBAAgB;GAAC;GAAS;GAAQ;GAAY;GAAW,EAAC,CAAA,CAAA;EAC9F,MAAMC,YAAY,MAAMH,UAAUI,IAAIN,MAAM,EAAEO,OAAO,UAAS,CAAA;AAE9D,QAAM,KAAKX,WAAWY,oBAAoBH,UAAAA;AAE1C,MAAI,KAAKX,QAAQe,0BAA0B;AACvCJ,aAAUK,SAAS;AACnBL,aAAUM,gBAAgBrB,YAAY,GAAA,CAAIsB,SAAS,MAAA;QAEnDP,WAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKjB,WAAWkB,OAAOT,UAAAA;EAEtC,MAAMU,qBAAqB,IAAIvB,wBAAAA;AAC/BqB,SAAOG,WAAWH,OAAOG,YAAY7B,aAAa,GAAA;AAClD0B,SAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,SAAQ;AAGlEH,SAAOO,YAAWF,MADE,KAAKrB,gBAAgBsB,QAAQN,OAAOO,UAAU,KAAA,EAC1CC;AAExB,QAAM,KAAKzB,WAAW0B,KAAKT,OAAAA;AAE3B,MAAI,KAAKnB,QAAQe,yBACb,KAAI;AACA,SAAM,KAAKd,WAAW4B,KAAK;IACvBC,IAAIX,OAAOY;IACXC,SAAS;IACTC,MAAM;;yBAEDd,OAAOF,cAAc;;IAE9B,CAAA;UACI;AACJ,SAAM,KAAKf,WAAWgC,OAAOf,OAAAA;AAC7B,SAAM,IAAIzB,gBAAgB,wDAAA;;AAIlC,SAAO,EAAEsB,QAAQG,OAAOH,QAAO;;CAGnC,MAAMmB,SAAS7B,MAAwC;EACnD,MAAMa,SAAS,MAAM,KAAKjB,WAAWkC,UAAU,EAAEnB,eAAeX,KAAK+B,OAAM,CAAA;AAE3E,MAAI,CAAClB,OACD,OAAM,IAAIxB,eAAAA;EAGd,MAAM2C,SAAS,KAAKpC,WAAWqC,MAAMpB,QAAQ;GACzCH,QAAQ;GACRC,eAAe;GACnB,CAAA;AAEA,QAAM,KAAKf,WAAW0B,KAAKU,OAAAA"}
+{"version":3,"file":"service.mjs","names":["UserValidator","createNanoID","BadRequestError","EntityNotFoundError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","RegistrationService","options","mailClient","repository","realmRepository","ctx","register","data","registrationEnabled","validator","mount","pathsToInclude","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","send","to","email","subject","html","remove","activate","findOneBy","token","merged","merge"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserValidator } from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient } from '../../mail/types.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async register(data: Record<string, any>): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({ pathsToInclude: ['email', 'name', 'password', 'realm_id'] }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                await this.mailClient.send({\n                    to: entity.email,\n                    subject: 'Registration - Activation code',\n                    html: `\n                    <p>Please use the code below to activate your account and start using the site.</p>\n                    <p>${entity.activate_hash}</p>\n                    `,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new BadRequestError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n    }\n}\n"],"mappings":";;;;;;;;AAuBA,IAAaQ,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EACnB,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,SAASC,MAAwD;EACnE,IAAI,CAAC,KAAKN,QAAQO,qBACd,MAAM,IAAIZ,0BAAAA;EAGd,MAAMa,YAAY,IAAIX,UAAU,CAAC,CAAA;EACjCW,UAAUC,MAAM,IAAIlB,cAAc,EAAEmB,gBAAgB;GAAC;GAAS;GAAQ;GAAY;IAAY,CAAA,CAAA;EAC9F,MAAMC,YAAY,MAAMH,UAAUI,IAAIN,MAAM,EAAEO,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKX,WAAWY,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKX,QAAQe,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,gBAAgBrB,YAAY,EAAA,EAAIsB,SAAS,KAAA;EACvD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKjB,WAAWkB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAIvB,uBAAAA;EAC/BqB,OAAOG,WAAWH,OAAOG,YAAY9B,aAAa,EAAA;EAClD2B,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,YAAWF,MADE,KAAKrB,gBAAgBsB,QAAQN,OAAOO,UAAU,IAAA,GAC1CC;EAExB,MAAM,KAAKzB,WAAW0B,KAAKT,MAAAA;EAE3B,IAAI,KAAKnB,QAAQe,0BACb,IAAI;GACA,MAAM,KAAKd,WAAW4B,KAAK;IACvBC,IAAIX,OAAOY;IACXC,SAAS;IACTC,MAAM;;yBAEDd,OAAOF,cAAc;;GAE9B,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKf,WAAWgC,OAAOf,MAAAA;GAC7B,MAAM,IAAI1B,gBAAgB,uDAAA;EAC9B;EAGJ,OAAO,EAAEuB,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAMmB,SAAS7B,MAAwC;EACnD,MAAMa,SAAS,MAAM,KAAKjB,WAAWkC,UAAU,EAAEnB,eAAeX,KAAK+B,MAAM,CAAA;EAE3E,IAAI,CAAClB,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAM4C,SAAS,KAAKpC,WAAWqC,MAAMpB,QAAQ;GACzCH,QAAQ;GACRC,eAAe;EACnB,CAAA;EAEA,MAAM,KAAKf,WAAW0B,KAAKU,MAAAA;CAC/B;AACJ"}

package/dist/core/identity/resolver/entities/ldap/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["LdapIdentityResolver","repository"],"sources":["../../../../../../src/core/identity/resolver/entities/ldap/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IIdentityProviderRepository } from '../../../../entities/index.ts';\n\nexport class LdapIdentityResolver {\n    protected repository : IIdentityProviderRepository;\n}\n"],"mappings":";AASA,IAAaA,uBAAb,MAAaA;CACCC"}
+{"version":3,"file":"module.mjs","names":["LdapIdentityResolver","repository"],"sources":["../../../../../../src/core/identity/resolver/entities/ldap/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IIdentityProviderRepository } from '../../../../entities/index.ts';\n\nexport class LdapIdentityResolver {\n    protected repository : IIdentityProviderRepository;\n}\n"],"mappings":";AASA,IAAaA,uBAAb,MAAaA;CACCC;AACd"}

package/dist/core/identity/resolver/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityType","isUUID","IdentityResolver","clientRepository","userRepository","robotRepository","ctx","resolve","type","key","realmKey","CLIENT","resolveClient","ROBOT","resolveRobot","USER","resolveUser","data","findOneById","findOneByName"],"sources":["../../../../src/core/identity/resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    ClientIdentity, \n    Identity, \n    Robot, \n    RobotIdentity, \n    User, \n    UserIdentity,\n} from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { IIdentityResolver, IdentityResolverContext } from './types.ts';\nimport type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';\n\nexport class IdentityResolver implements IIdentityResolver {\n    protected clientRepository: IClientIdentityRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected robotRepository: IRobotIdentityRepository;\n\n    constructor(ctx: IdentityResolverContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async resolve(\n        type: `${IdentityType}`,\n        key: string,\n        realmKey?: string,\n    ): Promise<Identity | null> {\n        switch (type) {\n            case IdentityType.CLIENT: {\n                return this.resolveClient(key, realmKey);\n            }\n            case IdentityType.ROBOT: {\n                return this.resolveRobot(key, realmKey);\n            }\n            case IdentityType.USER: {\n                return this.resolveUser(key, realmKey);\n            }\n        }\n\n        return null;\n    }\n\n    private async resolveClient(\n        key: string,\n        realmKey?: string,\n    ) : Promise<ClientIdentity | null> {\n        let data : Client | null;\n\n        if (isUUID(key)) {\n            data = await this.clientRepository.findOneById(key);\n        } else {\n            data = await this.clientRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.CLIENT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveRobot(\n        key: string,\n        realmKey?: string,\n    ) : Promise<RobotIdentity | null> {\n        let data : Robot | null;\n\n        if (isUUID(key)) {\n            data = await this.robotRepository.findOneById(key);\n        } else {\n            data = await this.robotRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.ROBOT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveUser(\n        key: string,\n        realmKey?: string,\n    ) : Promise<UserIdentity | null> {\n        let data : User | null;\n\n        if (isUUID(key)) {\n            data = await this.userRepository.findOneById(key);\n        } else {\n            data = await this.userRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.USER,\n                data, \n            };\n        }\n\n        return null;\n    }\n}\n"],"mappings":";;;AAqBA,IAAaE,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;AACtC,OAAKH,mBAAmBG,IAAIH;AAC5B,OAAKC,iBAAiBE,IAAIF;AAC1B,OAAKC,kBAAkBC,IAAID;;CAG/B,MAAME,QACFC,MACAC,KACAC,UACwB;AACxB,UAAQF,MAAR;GACI,KAAKR,aAAaW,OACd,QAAO,KAAKC,cAAcH,KAAKC,SAAAA;GAEnC,KAAKV,aAAaa,MACd,QAAO,KAAKC,aAAaL,KAAKC,SAAAA;GAElC,KAAKV,aAAae,KACd,QAAO,KAAKC,YAAYP,KAAKC,SAAAA;;AAIrC,SAAO;;CAGX,MAAcE,cACVH,KACAC,UAC+B;EAC/B,IAAIO;AAEJ,MAAIhB,OAAOQ,IAAAA,CACPQ,QAAO,MAAM,KAAKd,iBAAiBe,YAAYT,IAAAA;MAE/CQ,QAAO,MAAM,KAAKd,iBAAiBgB,cAAcV,KAAKC,SAAAA;AAG1D,MAAIO,KACA,QAAO;GACHT,MAAMR,aAAaW;GACnBM;GACJ;AAGJ,SAAO;;CAGX,MAAcH,aACVL,KACAC,UAC8B;EAC9B,IAAIO;AAEJ,MAAIhB,OAAOQ,IAAAA,CACPQ,QAAO,MAAM,KAAKZ,gBAAgBa,YAAYT,IAAAA;MAE9CQ,QAAO,MAAM,KAAKZ,gBAAgBc,cAAcV,KAAKC,SAAAA;AAGzD,MAAIO,KACA,QAAO;GACHT,MAAMR,aAAaa;GACnBI;GACJ;AAGJ,SAAO;;CAGX,MAAcD,YACVP,KACAC,UAC6B;EAC7B,IAAIO;AAEJ,MAAIhB,OAAOQ,IAAAA,CACPQ,QAAO,MAAM,KAAKb,eAAec,YAAYT,IAAAA;MAE7CQ,QAAO,MAAM,KAAKb,eAAee,cAAcV,KAAKC,SAAAA;AAGxD,MAAIO,KACA,QAAO;GACHT,MAAMR,aAAae;GACnBE;GACJ;AAGJ,SAAO"}
+{"version":3,"file":"module.mjs","names":["IdentityType","isUUID","IdentityResolver","clientRepository","userRepository","robotRepository","ctx","resolve","type","key","realmKey","CLIENT","resolveClient","ROBOT","resolveRobot","USER","resolveUser","data","findOneById","findOneByName"],"sources":["../../../../src/core/identity/resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    ClientIdentity, \n    Identity, \n    Robot, \n    RobotIdentity, \n    User, \n    UserIdentity,\n} from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { IIdentityResolver, IdentityResolverContext } from './types.ts';\nimport type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';\n\nexport class IdentityResolver implements IIdentityResolver {\n    protected clientRepository: IClientIdentityRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected robotRepository: IRobotIdentityRepository;\n\n    constructor(ctx: IdentityResolverContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async resolve(\n        type: `${IdentityType}`,\n        key: string,\n        realmKey?: string,\n    ): Promise<Identity | null> {\n        switch (type) {\n            case IdentityType.CLIENT: {\n                return this.resolveClient(key, realmKey);\n            }\n            case IdentityType.ROBOT: {\n                return this.resolveRobot(key, realmKey);\n            }\n            case IdentityType.USER: {\n                return this.resolveUser(key, realmKey);\n            }\n        }\n\n        return null;\n    }\n\n    private async resolveClient(\n        key: string,\n        realmKey?: string,\n    ) : Promise<ClientIdentity | null> {\n        let data : Client | null;\n\n        if (isUUID(key)) {\n            data = await this.clientRepository.findOneById(key);\n        } else {\n            data = await this.clientRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.CLIENT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveRobot(\n        key: string,\n        realmKey?: string,\n    ) : Promise<RobotIdentity | null> {\n        let data : Robot | null;\n\n        if (isUUID(key)) {\n            data = await this.robotRepository.findOneById(key);\n        } else {\n            data = await this.robotRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.ROBOT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveUser(\n        key: string,\n        realmKey?: string,\n    ) : Promise<UserIdentity | null> {\n        let data : User | null;\n\n        if (isUUID(key)) {\n            data = await this.userRepository.findOneById(key);\n        } else {\n            data = await this.userRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.USER,\n                data, \n            };\n        }\n\n        return null;\n    }\n}\n"],"mappings":";;;AAqBA,IAAaE,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,QACFC,MACAC,KACAC,UACwB;EACxB,QAAQF,MAAR;GACI,KAAKR,aAAaW,QACd,OAAO,KAAKC,cAAcH,KAAKC,QAAAA;GAEnC,KAAKV,aAAaa,OACd,OAAO,KAAKC,aAAaL,KAAKC,QAAAA;GAElC,KAAKV,aAAae,MACd,OAAO,KAAKC,YAAYP,KAAKC,QAAAA;EAErC;EAEA,OAAO;CACX;CAEA,MAAcE,cACVH,KACAC,UAC+B;EAC/B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKd,iBAAiBe,YAAYT,GAAAA;OAE/CQ,OAAO,MAAM,KAAKd,iBAAiBgB,cAAcV,KAAKC,QAAAA;EAG1D,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaW;GACnBM;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcH,aACVL,KACAC,UAC8B;EAC9B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKZ,gBAAgBa,YAAYT,GAAAA;OAE9CQ,OAAO,MAAM,KAAKZ,gBAAgBc,cAAcV,KAAKC,QAAAA;EAGzD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaa;GACnBI;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcD,YACVP,KACAC,UAC6B;EAC7B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKb,eAAec,YAAYT,GAAAA;OAE7CQ,OAAO,MAAM,KAAKb,eAAee,cAAcV,KAAKC,QAAAA;EAGxD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAae;GACnBE;EACJ;EAGJ,OAAO;CACX;AACJ"}

package/dist/core/identity/role/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityRoleProvider","clientRepository","userRepository","robotRepository","ctx","getRolesFor","identity","type","getBoundRoles","id","then","data","reduceByIdentityClient","entities","clientId","filter","entity","client_id"],"sources":["../../../../src/core/identity/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Role } from '@authup/core-kit';\nimport type { IdentityPolicyData } from '@authup/access';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';\n\nexport class IdentityRoleProvider implements IIdentityRoleProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected robotRepository: IRobotRepository;\n\n    constructor(ctx: IdentityRoleProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async getRolesFor(identity: IdentityPolicyData) : Promise<Role[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.clientRepository.getBoundRoles(identity.id);\n            }\n            case 'user': {\n                return this.userRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n            case 'robot': {\n                return this.robotRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n        }\n\n        return [];\n    }\n\n    private reduceByIdentityClient<T extends { client_id?: string | null }>(\n        entities: T[],\n        identity: IdentityPolicyData,\n    ): T[] {\n        if (!identity.clientId) {\n            return entities;\n        }\n\n        return entities.filter((entity) => entity.client_id === identity.clientId);\n    }\n}\n"],"mappings":";AAcA,IAAaA,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;AAC1C,OAAKH,mBAAmBG,IAAIH;AAC5B,OAAKC,iBAAiBE,IAAIF;AAC1B,OAAKC,kBAAkBC,IAAID;;CAG/B,MAAME,YAAYC,UAAgD;AAC9D,UAAQA,SAASC,MAAjB;GACI,KAAK,SACD,QAAO,KAAKN,iBAAiBO,cAAcF,SAASG,GAAE;GAE1D,KAAK,OACD,QAAO,KAAKP,eAAeM,cAAcF,SAASG,GAAE,CAC/CC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,SAAAA,CAAAA;GAE1D,KAAK,QACD,QAAO,KAAKH,gBAAgBK,cAAcF,SAASG,GAAE,CAChDC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,SAAAA,CAAAA;;AAI9D,SAAO,EAAE;;CAGLM,uBACJC,UACAP,UACG;AACH,MAAI,CAACA,SAASQ,SACV,QAAOD;AAGX,SAAOA,SAASE,QAAQC,WAAWA,OAAOC,cAAcX,SAASQ,SAAQ"}
+{"version":3,"file":"module.mjs","names":["IdentityRoleProvider","clientRepository","userRepository","robotRepository","ctx","getRolesFor","identity","type","getBoundRoles","id","then","data","reduceByIdentityClient","entities","clientId","filter","entity","client_id"],"sources":["../../../../src/core/identity/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Role } from '@authup/core-kit';\nimport type { IdentityPolicyData } from '@authup/access';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';\n\nexport class IdentityRoleProvider implements IIdentityRoleProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected robotRepository: IRobotRepository;\n\n    constructor(ctx: IdentityRoleProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async getRolesFor(identity: IdentityPolicyData) : Promise<Role[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.clientRepository.getBoundRoles(identity.id);\n            }\n            case 'user': {\n                return this.userRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n            case 'robot': {\n                return this.robotRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n        }\n\n        return [];\n    }\n\n    private reduceByIdentityClient<T extends { client_id?: string | null }>(\n        entities: T[],\n        identity: IdentityPolicyData,\n    ): T[] {\n        if (!identity.clientId) {\n            return entities;\n        }\n\n        return entities.filter((entity) => entity.client_id === identity.clientId);\n    }\n}\n"],"mappings":";AAcA,IAAaA,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,YAAYC,UAAgD;EAC9D,QAAQA,SAASC,MAAjB;GACI,KAAK,UACD,OAAO,KAAKN,iBAAiBO,cAAcF,SAASG,EAAE;GAE1D,KAAK,QACD,OAAO,KAAKP,eAAeM,cAAcF,SAASG,EAAE,EAC/CC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;GAE1D,KAAK,SACD,OAAO,KAAKH,gBAAgBK,cAAcF,SAASG,EAAE,EAChDC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;EAE9D;EAEA,OAAO,CAAA;CACX;CAEQM,uBACJC,UACAP,UACG;EACH,IAAI,CAACA,SAASQ,UACV,OAAOD;EAGX,OAAOA,SAASE,QAAQC,WAAWA,OAAOC,cAAcX,SAASQ,QAAQ;CAC7E;AACJ"}

package/dist/core/index.mjs

@@ -8,7 +8,6 @@ import { UserAuthenticator } from "./authentication/entities/user/module.mjs";
 import { CredentialsAuthenticator } from "./authentication/module.mjs";
 import { SessionManager } from "./authentication/session/module.mjs";
 import "./authentication/index.mjs";
-import { AbstractEntityService } from "./entities/service.mjs";
 import { ClientService } from "./entities/client/service.mjs";
 import { ClientPermissionService } from "./entities/client-permission/service.mjs";
 import { ClientRoleService } from "./entities/client-role/service.mjs";
@@ -55,7 +54,11 @@ import { OAuth2TokenSigner } from "./oauth2/token/signer/module.mjs";
 import { OAuth2TokenVerifier } from "./oauth2/token/verifier/module.mjs";
 import "./oauth2/index.mjs";
 import { PasswordRecoveryService } from "./identity/password-recovery/service.mjs";
+import { PermissionBindingPolicyEvaluator } from "./security/policy/evaluator.mjs";
+import { PolicyEngine } from "./security/policy/engine.mjs";
+import { PermissionCheckerService } from "./identity/permission/checker/service.mjs";
 import { IdentityPermissionProvider } from "./identity/permission/module.mjs";
+import { PolicyCheckerService } from "./identity/policy/checker/service.mjs";
 import { IdentityProviderMapperOperation } from "./identity/provider/mapper/constants.mjs";
 import { IdentityProviderAccountBaseMapper } from "./identity/provider/mapper/base.mjs";
 import { IdentityProviderAttributeMapper } from "./identity/provider/mapper/attributes/module.mjs";
@@ -100,7 +103,5 @@ import { RobotProvisioningSynchronizer } from "./provisioning/synchronizer/robot
 import { ScopeProvisioningSynchronizer } from "./provisioning/synchronizer/scope/module.mjs";
 import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/module.mjs";
 import "./provisioning/index.mjs";
-import { PermissionBindingPolicyEvaluator } from "./security/policy/evaluator.mjs";
-import { PolicyEngine } from "./security/policy/engine.mjs";
 import "./security/index.mjs";
-export { AbstractEntityService, BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, CredentialsAuthenticator, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionPolicyService, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, UserAttributeService, UserAuthenticator, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createIdentityProviderOAuth2Authenticator, generateOAuth2CodeVerifier, normalizeEntityProvisioningStrategy };
+export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, CredentialsAuthenticator, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, UserAttributeService, UserAuthenticator, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createIdentityProviderOAuth2Authenticator, generateOAuth2CodeVerifier, normalizeEntityProvisioningStrategy };

package/dist/core/oauth2/authorization/code/issuer/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeIssuer","repository","options","issue","input","identity","entity","redirect_uri","client_id","scope","nonce","code_challenge","code_challenge_method","realm_id","data","realm","id","realm_name","name","sub","sub_kind","type","idToken","id_token","save","maxAge","updateIdToken"],"sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IOAuth2AuthorizationCodeRepository, OAuth2AuthorizationCodeInput } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeIssuerOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeIssuer implements IOAuth2AuthorizationCodeIssuer {\n    protected repository: IOAuth2AuthorizationCodeRepository;\n\n    protected options: OAuth2AuthorizationCodeIssuerOptions;\n\n    constructor(\n        repository: IOAuth2AuthorizationCodeRepository,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) {\n        this.repository = repository;\n        this.options = options;\n    }\n\n    async issue(\n        input: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) : Promise<OAuth2AuthorizationCode> {\n        const entity: OAuth2AuthorizationCodeInput = {\n            redirect_uri: input.redirect_uri,\n            client_id: input.client_id,\n            scope: input.scope,\n            nonce: input.nonce,\n            code_challenge: input.code_challenge,\n            code_challenge_method: input.code_challenge_method,\n\n            realm_id: identity.data.realm.id,\n            realm_name: identity.data.realm.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        if (options.idToken) {\n            entity.id_token = options.idToken;\n        }\n\n        return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });\n    }\n\n    async updateIdToken(\n        entity: OAuth2AuthorizationCode,\n        idToken: string,\n    ) : Promise<void> {\n        entity.id_token = idToken;\n\n        await this.repository.save(entity, { maxAge: this.options.maxAge });\n    }\n}\n"],"mappings":";AAWA,IAAaA,gCAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,UAAgD,EAAE,EACpD;AACE,OAAKD,aAAaA;AAClB,OAAKC,UAAUA;;CAGnB,MAAMC,MACFC,OACAC,UACAH,UAAgD,EAAE,EACjB;EACjC,MAAMI,SAAuC;GACzCC,cAAcH,MAAMG;GACpBC,WAAWJ,MAAMI;GACjBC,OAAOL,MAAMK;GACbC,OAAON,MAAMM;GACbC,gBAAgBP,MAAMO;GACtBC,uBAAuBR,MAAMQ;GAE7BC,UAAUR,SAASS,KAAKC,MAAMC;GAC9BC,YAAYZ,SAASS,KAAKC,MAAMG;GAChCC,KAAKd,SAASS,KAAKE;GACnBI,UAAUf,SAASgB;GACvB;AAEA,MAAInB,QAAQoB,QACRhB,QAAOiB,WAAWrB,QAAQoB;AAG9B,SAAO,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQvB,QAAQuB,UAAU,KAAKvB,QAAQuB,QAAO,CAAA;;CAGxF,MAAMC,cACFpB,QACAgB,SACc;AACdhB,SAAOiB,WAAWD;AAElB,QAAM,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQ,KAAKvB,QAAQuB,QAAO,CAAA"}
+{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeIssuer","repository","options","issue","input","identity","entity","redirect_uri","client_id","scope","nonce","code_challenge","code_challenge_method","realm_id","data","realm","id","realm_name","name","sub","sub_kind","type","idToken","id_token","save","maxAge","updateIdToken"],"sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IOAuth2AuthorizationCodeRepository, OAuth2AuthorizationCodeInput } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeIssuerOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeIssuer implements IOAuth2AuthorizationCodeIssuer {\n    protected repository: IOAuth2AuthorizationCodeRepository;\n\n    protected options: OAuth2AuthorizationCodeIssuerOptions;\n\n    constructor(\n        repository: IOAuth2AuthorizationCodeRepository,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) {\n        this.repository = repository;\n        this.options = options;\n    }\n\n    async issue(\n        input: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) : Promise<OAuth2AuthorizationCode> {\n        const entity: OAuth2AuthorizationCodeInput = {\n            redirect_uri: input.redirect_uri,\n            client_id: input.client_id,\n            scope: input.scope,\n            nonce: input.nonce,\n            code_challenge: input.code_challenge,\n            code_challenge_method: input.code_challenge_method,\n\n            realm_id: identity.data.realm.id,\n            realm_name: identity.data.realm.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        if (options.idToken) {\n            entity.id_token = options.idToken;\n        }\n\n        return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });\n    }\n\n    async updateIdToken(\n        entity: OAuth2AuthorizationCode,\n        idToken: string,\n    ) : Promise<void> {\n        entity.id_token = idToken;\n\n        await this.repository.save(entity, { maxAge: this.options.maxAge });\n    }\n}\n"],"mappings":";AAWA,IAAaA,gCAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,UAAgD,CAAC,GACnD;EACE,KAAKD,aAAaA;EAClB,KAAKC,UAAUA;CACnB;CAEA,MAAMC,MACFC,OACAC,UACAH,UAAgD,CAAC,GAChB;EACjC,MAAMI,SAAuC;GACzCC,cAAcH,MAAMG;GACpBC,WAAWJ,MAAMI;GACjBC,OAAOL,MAAMK;GACbC,OAAON,MAAMM;GACbC,gBAAgBP,MAAMO;GACtBC,uBAAuBR,MAAMQ;GAE7BC,UAAUR,SAASS,KAAKC,MAAMC;GAC9BC,YAAYZ,SAASS,KAAKC,MAAMG;GAChCC,KAAKd,SAASS,KAAKE;GACnBI,UAAUf,SAASgB;EACvB;EAEA,IAAInB,QAAQoB,SACRhB,OAAOiB,WAAWrB,QAAQoB;EAG9B,OAAO,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQvB,QAAQuB,UAAU,KAAKvB,QAAQuB,OAAO,CAAA;CACxF;CAEA,MAAMC,cACFpB,QACAgB,SACc;EACdhB,OAAOiB,WAAWD;EAElB,MAAM,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQ,KAAKvB,QAAQuB,OAAO,CAAA;CACrE;AACJ"}