@authup/server-core 1.0.0-beta.41 → 1.0.0-beta.42

package/dist/core/provisioning/strategy/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["createValidator","Container","z","ProvisioningStrategyValidator","options","oneOf","initialize","mergeContainer","mount","enum","array","string","optional","altContainer"],"sources":["../../../../src/core/provisioning/strategy/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/adapter-zod';\nimport type { ContainerOptions } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport type { ProvisioningEntityMergeStrategy, ProvisioningEntityReplaceStrategy, ProvisioningEntityStrategy } from './types.ts';\n\nexport class ProvisioningStrategyValidator extends Container<ProvisioningEntityStrategy> {\n    constructor(options: ContainerOptions<ProvisioningEntityStrategy> = {}) {\n        super({\n            ...options,\n            oneOf: true,\n        });\n    }\n\n    protected initialize() {\n        super.initialize();\n\n        const mergeContainer = new Container<ProvisioningEntityMergeStrategy>();\n        mergeContainer.mount('type', createValidator(\n            z\n                .enum(['merge']),\n        ));\n        mergeContainer.mount('attributes', createValidator(\n            z\n                .array(z.string())\n                .optional(),\n        ));\n        this.mount(mergeContainer);\n\n        const altContainer = new Container<ProvisioningEntityReplaceStrategy>();\n        altContainer.mount('type', createValidator(\n            z\n                .enum(['replace', 'createOnly', 'absent']),\n        ));\n        this.mount(altContainer);\n    }\n}\n"],"mappings":";;;;AAaA,IAAaG,gCAAb,cAAmDF,UAAAA;CAC/C,YAAYG,UAAwD,EAAE,EAAE;AACpE,QAAM;GACF,GAAGA;GACHC,OAAO;GACX,CAAA;;CAGMC,aAAa;AACnB,QAAMA,YAAAA;EAEN,MAAMC,iBAAiB,IAAIN,WAAAA;AAC3BM,iBAAeC,MAAM,QAAQR,gBACzBE,EACKO,KAAK,CAAC,QAAQ,CAAA,CAAA,CAAA;AAEvBF,iBAAeC,MAAM,cAAcR,gBAC/BE,EACKQ,MAAMR,EAAES,QAAM,CAAA,CACdC,UAAQ,CAAA,CAAA;AAEjB,OAAKJ,MAAMD,eAAAA;EAEX,MAAMM,eAAe,IAAIZ,WAAAA;AACzBY,eAAaL,MAAM,QAAQR,gBACvBE,EACKO,KAAK;GAAC;GAAW;GAAc;GAAS,CAAA,CAAA,CAAA;AAEjD,OAAKD,MAAMK,aAAAA"}
+{"version":3,"file":"validator.mjs","names":["createValidator","Container","z","ProvisioningStrategyValidator","options","oneOf","initialize","mergeContainer","mount","enum","array","string","optional","altContainer"],"sources":["../../../../src/core/provisioning/strategy/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/adapter-zod';\nimport type { ContainerOptions } from 'validup';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport type { ProvisioningEntityMergeStrategy, ProvisioningEntityReplaceStrategy, ProvisioningEntityStrategy } from './types.ts';\n\nexport class ProvisioningStrategyValidator extends Container<ProvisioningEntityStrategy> {\n    constructor(options: ContainerOptions<ProvisioningEntityStrategy> = {}) {\n        super({\n            ...options,\n            oneOf: true,\n        });\n    }\n\n    protected initialize() {\n        super.initialize();\n\n        const mergeContainer = new Container<ProvisioningEntityMergeStrategy>();\n        mergeContainer.mount('type', createValidator(\n            z\n                .enum(['merge']),\n        ));\n        mergeContainer.mount('attributes', createValidator(\n            z\n                .array(z.string())\n                .optional(),\n        ));\n        this.mount(mergeContainer);\n\n        const altContainer = new Container<ProvisioningEntityReplaceStrategy>();\n        altContainer.mount('type', createValidator(\n            z\n                .enum(['replace', 'createOnly', 'absent']),\n        ));\n        this.mount(altContainer);\n    }\n}\n"],"mappings":";;;;AAaA,IAAaG,gCAAb,cAAmDF,UAAAA;CAC/C,YAAYG,UAAwD,CAAC,GAAG;EACpE,MAAM;GACF,GAAGA;GACHC,OAAO;EACX,CAAA;CACJ;CAEUC,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,iBAAiB,IAAIN,UAAAA;EAC3BM,eAAeC,MAAM,QAAQR,gBACzBE,EACKO,KAAK,CAAC,OAAA,CAAQ,CAAA,CAAA;EAEvBF,eAAeC,MAAM,cAAcR,gBAC/BE,EACKQ,MAAMR,EAAES,OAAM,CAAA,EACdC,SAAQ,CAAA,CAAA;EAEjB,KAAKJ,MAAMD,cAAAA;EAEX,MAAMM,eAAe,IAAIZ,UAAAA;EACzBY,aAAaL,MAAM,QAAQR,gBACvBE,EACKO,KAAK;GAAC;GAAW;GAAc;GAAS,CAAA,CAAA;EAEjD,KAAKD,MAAMK,YAAAA;CACf;AACJ"}

package/dist/core/provisioning/synchronizer/base.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"base.mjs","names":["BaseProvisioningSynchronizer","synchronizeMany","input","output","entity","push","synchronize"],"sources":["../../../../src/core/provisioning/synchronizer/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IProvisioningSynchronizer } from '../types.ts';\n\nexport abstract class BaseProvisioningSynchronizer<T> implements IProvisioningSynchronizer<T> {\n    // Sequential to avoid race conditions on concurrent upserts.\n    // Can be switched to Promise.all() if callers guarantee unique inputs.\n    async synchronizeMany(input: T[]): Promise<T[]> {\n        const output: T[] = [];\n        for (const entity of input) {\n            output.push(await this.synchronize(entity));\n        }\n        return output;\n    }\n\n    abstract synchronize(input: T): Promise<T>;\n}\n"],"mappings":";AASA,IAAsBA,+BAAtB,MAAsBA;CAGlB,MAAMC,gBAAgBC,OAA0B;EAC5C,MAAMC,SAAc,EAAE;AACtB,OAAK,MAAMC,UAAUF,MACjBC,QAAOE,KAAK,MAAM,KAAKC,YAAYF,OAAAA,CAAAA;AAEvC,SAAOD"}
+{"version":3,"file":"base.mjs","names":["BaseProvisioningSynchronizer","synchronizeMany","input","output","entity","push","synchronize"],"sources":["../../../../src/core/provisioning/synchronizer/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IProvisioningSynchronizer } from '../types.ts';\n\nexport abstract class BaseProvisioningSynchronizer<T> implements IProvisioningSynchronizer<T> {\n    // Sequential to avoid race conditions on concurrent upserts.\n    // Can be switched to Promise.all() if callers guarantee unique inputs.\n    async synchronizeMany(input: T[]): Promise<T[]> {\n        const output: T[] = [];\n        for (const entity of input) {\n            output.push(await this.synchronize(entity));\n        }\n        return output;\n    }\n\n    abstract synchronize(input: T): Promise<T>;\n}\n"],"mappings":";AASA,IAAsBA,+BAAtB,MAAsBA;CAGlB,MAAMC,gBAAgBC,OAA0B;EAC5C,MAAMC,SAAc,CAAA;EACpB,KAAK,MAAMC,UAAUF,OACjBC,OAAOE,KAAK,MAAM,KAAKC,YAAYF,MAAAA,CAAAA;EAEvC,OAAOD;CACX;AAGJ"}

package/dist/core/provisioning/synchronizer/client/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","ClientProvisioningSynchronizer","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","permissionSynchronizer","roleSynchronizer","ctx","permissionRepository","roleRepository","repository","clientPermissionRepository","ownerKey","ownerRealmKey","clientRoleRepository","synchronize","input","strategy","attributes","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","length","roles","globalRoles","realmRoles","children","map","child","client_id","client","synchronizeMany"],"sources":["../../../../../src/core/provisioning/synchronizer/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    ClientPermission, \n    ClientRole, \n    Permission, \n    Role,\n} from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type { IClientRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity } from '../../entities/client';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport type { RoleProvisioningEntity } from '../../entities/role';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { ClientProvisioningSynchronizerContext } from './types.ts';\n\nexport class ClientProvisioningSynchronizer extends BaseProvisioningSynchronizer<ClientProvisioningEntity> {\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<ClientPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<ClientRole>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    constructor(ctx: ClientProvisioningSynchronizerContext) {\n        super();\n\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientPermissionRepository,\n            ownerKey: 'client_id',\n            ownerRealmKey: 'client_realm_id',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientRoleRepository,\n            ownerKey: 'client_id',\n            ownerRealmKey: 'client_realm_id',\n        });\n\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n    }\n\n    async synchronize(input: ClientProvisioningEntity): Promise<ClientProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.clientRepository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.clientRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.clientRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n                    attributes = await this.clientRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n        }\n\n        // Permissions (Global + Realm)\n        const permissions = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realm_id ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permission_id',\n                'permission_realm_id',\n            );\n        }\n\n        // Roles (Global + Realm)\n        const roles = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realm_id ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'role_id',\n                'role_realm_id',\n            );\n        }\n\n        // Containers\n\n        if (input.relations && input.relations.permissions) {\n            const children = input.relations.permissions.map((child) => {\n                child.attributes.client_id = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(children);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const children = input.relations.roles.map((child) => {\n                child.attributes.client_id = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(children);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAyBA,IAAaM,iCAAb,cAAoDH,6BAAAA;CACtCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;AACpD,SAAK;AAEL,OAAKP,mBAAmBO,IAAIP;AAE5B,OAAKC,qBAAqB,IAAIJ,2BAA2BU,IAAIC,qBAAoB;AACjF,OAAKN,eAAe,IAAIL,2BAA2BU,IAAIE,eAAc;AAErE,OAAKN,qBAAqB,IAAIL,iCAAiC;GAC3DY,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;GACnB,CAAA;AACA,OAAKT,eAAe,IAAIN,iCAAiC;GACrDY,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;GACnB,CAAA;AAEA,OAAKR,yBAAyBE,IAAIF;AAClC,OAAKC,mBAAmBC,IAAID;;CAGhC,MAAMS,YAAYC,OAAoE;EAClF,MAAMC,WAAWtB,oCAAoCqB,MAAMC,SAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKlB,iBAAiBmB,UAAU;GACnDC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GAC3C,CAAA;AAEA,MAAIJ,SAASK,SAAS5B,+BAA+B6B,QAAQ;AACzD,OAAIL,WACA,OAAM,KAAKlB,iBAAiBwB,OAAON,WAAAA;AAEvC,UAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;IACpC;;AAGJ,MAAIA,WACA,SAAQD,SAASK,MAAjB;GACI,KAAK5B,+BAA+B+B;AAChCP,iBAAa,KAAKlB,iBAAiB0B,MAC/BR,YACAD,SAASC,aACLzB,WAAWuB,MAAME,YAAYD,SAASC,WAAU,GAChDF,MAAME,WAAU;AAExBA,iBAAa,MAAM,KAAKlB,iBAAiB2B,KAAKT,WAAAA;AAC9C;GACJ,KAAKxB,+BAA+BkC;AAChCZ,UAAME,WAAWW,KAAKX,WAAWW;AACjCX,iBAAa,MAAM,KAAKlB,iBAAiB2B,KAAK,KAAK3B,iBAAiB8B,OAAOd,MAAME,WAAU,CAAA;AAC3F;;MAGRA,cAAa,MAAM,KAAKlB,iBAAiB2B,KAAK,KAAK3B,iBAAiB8B,OAAOd,MAAME,WAAU,CAAA;EAI/F,MAAMa,cAAc,CAAA,GACb,MAAM,KAAK9B,mBAAmB+B,cAC7BhB,MAAMiB,aAAajB,MAAMiB,UAAUC,kBAAiB,EAAA,GAEpDhB,WAAWG,WACX,MAAM,KAAKpB,mBAAmBkC,aAC1BnB,MAAMiB,aAAajB,MAAMiB,UAAUG,kBACnClB,WAAWG,SAAQ,GAEvB,EAAE,CACT;AAED,MAAIU,YAAYM,SAAS,EACrB,OAAM,KAAKlC,mBAAmBY,YAC1BG,YACAa,aACA,iBACA,sBAAA;EAKR,MAAMO,QAAQ,CAAA,GACP,MAAM,KAAKpC,aAAa8B,cACvBhB,MAAMiB,aAAajB,MAAMiB,UAAUM,YAAW,EAAA,GAE9CrB,WAAWG,WACX,MAAM,KAAKnB,aAAaiC,aACpBnB,MAAMiB,aAAajB,MAAMiB,UAAUO,YACnCtB,WAAWG,SAAQ,GAEvB,EAAE,CACT;AAED,MAAIiB,MAAMD,SAAS,EACf,OAAM,KAAKjC,aAAaW,YACpBG,YACAoB,OACA,WACA,gBAAA;AAMR,MAAItB,MAAMiB,aAAajB,MAAMiB,UAAUF,aAAa;GAChD,MAAMU,WAAWzB,MAAMiB,UAAUF,YAAYW,KAAKC,UAAAA;AAC9CA,UAAMzB,WAAW0B,YAAY1B,WAAWW;AACxCc,UAAMzB,WAAW2B,SAAS3B;AAC1B,WAAOyB;KACX;AAEA,SAAM,KAAKtC,uBAAuByC,gBAAgBL,SAAAA;;AAGtD,MAAIzB,MAAMiB,aAAajB,MAAMiB,UAAUK,OAAO;GAC1C,MAAMG,WAAWzB,MAAMiB,UAAUK,MAAMI,KAAKC,UAAAA;AACxCA,UAAMzB,WAAW0B,YAAY1B,WAAWW;AACxCc,UAAMzB,WAAW2B,SAAS3B;AAC1B,WAAOyB;KACX;AAEA,SAAM,KAAKrC,iBAAiBwC,gBAAgBL,SAAAA;;AAGhD,SAAO;GACH,GAAGzB;GACHE;GACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","ClientProvisioningSynchronizer","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","permissionSynchronizer","roleSynchronizer","ctx","permissionRepository","roleRepository","repository","clientPermissionRepository","ownerKey","ownerRealmKey","clientRoleRepository","synchronize","input","strategy","attributes","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","length","roles","globalRoles","realmRoles","children","map","child","client_id","client","synchronizeMany"],"sources":["../../../../../src/core/provisioning/synchronizer/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    ClientPermission, \n    ClientRole, \n    Permission, \n    Role,\n} from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type { IClientRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity } from '../../entities/client';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport type { RoleProvisioningEntity } from '../../entities/role';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { ClientProvisioningSynchronizerContext } from './types.ts';\n\nexport class ClientProvisioningSynchronizer extends BaseProvisioningSynchronizer<ClientProvisioningEntity> {\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<ClientPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<ClientRole>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    constructor(ctx: ClientProvisioningSynchronizerContext) {\n        super();\n\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientPermissionRepository,\n            ownerKey: 'client_id',\n            ownerRealmKey: 'client_realm_id',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientRoleRepository,\n            ownerKey: 'client_id',\n            ownerRealmKey: 'client_realm_id',\n        });\n\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n    }\n\n    async synchronize(input: ClientProvisioningEntity): Promise<ClientProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.clientRepository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.clientRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.clientRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n                    attributes = await this.clientRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n        }\n\n        // Permissions (Global + Realm)\n        const permissions = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realm_id ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permission_id',\n                'permission_realm_id',\n            );\n        }\n\n        // Roles (Global + Realm)\n        const roles = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realm_id ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'role_id',\n                'role_realm_id',\n            );\n        }\n\n        // Containers\n\n        if (input.relations && input.relations.permissions) {\n            const children = input.relations.permissions.map((child) => {\n                child.attributes.client_id = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(children);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const children = input.relations.roles.map((child) => {\n                child.attributes.client_id = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(children);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAyBA,IAAaM,iCAAb,cAAoDH,6BAAAA;CACtCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAK;EAEL,KAAKP,mBAAmBO,IAAIP;EAE5B,KAAKC,qBAAqB,IAAIJ,2BAA2BU,IAAIC,oBAAoB;EACjF,KAAKN,eAAe,IAAIL,2BAA2BU,IAAIE,cAAc;EAErE,KAAKN,qBAAqB,IAAIL,iCAAiC;GAC3DY,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKT,eAAe,IAAIN,iCAAiC;GACrDY,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;EAEA,KAAKR,yBAAyBE,IAAIF;EAClC,KAAKC,mBAAmBC,IAAID;CAChC;CAEA,MAAMS,YAAYC,OAAoE;EAClF,MAAMC,WAAWtB,oCAAoCqB,MAAMC,QAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKlB,iBAAiBmB,UAAU;GACnDC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;EAC3C,CAAA;EAEA,IAAIJ,SAASK,SAAS5B,+BAA+B6B,QAAQ;GACzD,IAAIL,YACA,MAAM,KAAKlB,iBAAiBwB,OAAON,UAAAA;GAEvC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQD,SAASK,MAAjB;GACI,KAAK5B,+BAA+B+B;IAChCP,aAAa,KAAKlB,iBAAiB0B,MAC/BR,YACAD,SAASC,aACLzB,WAAWuB,MAAME,YAAYD,SAASC,UAAU,IAChDF,MAAME,UAAU;IAExBA,aAAa,MAAM,KAAKlB,iBAAiB2B,KAAKT,UAAAA;IAC9C;GACJ,KAAKxB,+BAA+BkC;IAChCZ,MAAME,WAAWW,KAAKX,WAAWW;IACjCX,aAAa,MAAM,KAAKlB,iBAAiB2B,KAAK,KAAK3B,iBAAiB8B,OAAOd,MAAME,UAAU,CAAA;IAC3F;EACR;OAEAA,aAAa,MAAM,KAAKlB,iBAAiB2B,KAAK,KAAK3B,iBAAiB8B,OAAOd,MAAME,UAAU,CAAA;EAI/F,MAAMa,cAAc,CAAA,GACb,MAAM,KAAK9B,mBAAmB+B,cAC7BhB,MAAMiB,aAAajB,MAAMiB,UAAUC,iBAAiB,GAAA,GAEpDhB,WAAWG,WACX,MAAM,KAAKpB,mBAAmBkC,aAC1BnB,MAAMiB,aAAajB,MAAMiB,UAAUG,kBACnClB,WAAWG,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIU,YAAYM,SAAS,GACrB,MAAM,KAAKlC,mBAAmBY,YAC1BG,YACAa,aACA,iBACA,qBAAA;EAKR,MAAMO,QAAQ,CAAA,GACP,MAAM,KAAKpC,aAAa8B,cACvBhB,MAAMiB,aAAajB,MAAMiB,UAAUM,WAAW,GAAA,GAE9CrB,WAAWG,WACX,MAAM,KAAKnB,aAAaiC,aACpBnB,MAAMiB,aAAajB,MAAMiB,UAAUO,YACnCtB,WAAWG,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIiB,MAAMD,SAAS,GACf,MAAM,KAAKjC,aAAaW,YACpBG,YACAoB,OACA,WACA,eAAA;EAMR,IAAItB,MAAMiB,aAAajB,MAAMiB,UAAUF,aAAa;GAChD,MAAMU,WAAWzB,MAAMiB,UAAUF,YAAYW,KAAKC,UAAAA;IAC9CA,MAAMzB,WAAW0B,YAAY1B,WAAWW;IACxCc,MAAMzB,WAAW2B,SAAS3B;IAC1B,OAAOyB;GACX,CAAA;GAEA,MAAM,KAAKtC,uBAAuByC,gBAAgBL,QAAAA;EACtD;EAEA,IAAIzB,MAAMiB,aAAajB,MAAMiB,UAAUK,OAAO;GAC1C,MAAMG,WAAWzB,MAAMiB,UAAUK,MAAMI,KAAKC,UAAAA;IACxCA,MAAMzB,WAAW0B,YAAY1B,WAAWW;IACxCc,MAAMzB,WAAW2B,SAAS3B;IAC1B,OAAOyB;GACX,CAAA;GAEA,MAAM,KAAKrC,iBAAiBwC,gBAAgBL,QAAAA;EAChD;EAEA,OAAO;GACH,GAAGzB;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/entity-resolver.d.ts

@@ -1,5 +1,5 @@
 import type { ObjectLiteral } from '@authup/kit';
-import type { IEntityRepository } from '../../entities/index.ts';
+import type { IEntityRepository } from '@authup/server-kit';
 export declare class ProvisioningEntityResolver<T extends ObjectLiteral = ObjectLiteral> {
     protected repository: IEntityRepository<T>;
     constructor(repository: IEntityRepository<T>);

package/dist/core/provisioning/synchronizer/entity-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-resolver.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/entity-resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,qBAAa,0BAA0B,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IAC3E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;gBAE/B,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAItC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAoB7C,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAoBxE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;CAmBpG"}
+{"version":3,"file":"entity-resolver.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/entity-resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,qBAAa,0BAA0B,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IAC3E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;gBAE/B,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAItC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAoB7C,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAoBxE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;CAmBpG"}

package/dist/core/provisioning/synchronizer/entity-resolver.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"entity-resolver.mjs","names":["ProvisioningEntityResolver","repository","resolveGlobal","names","length","hasWildcard","includes","findManyBy","realm_id","client_id","name","resolveRealm","realmId","resolveClient","clientId"],"sources":["../../../../src/core/provisioning/synchronizer/entity-resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { IEntityRepository } from '../../entities/index.ts';\n\nexport class ProvisioningEntityResolver<T extends ObjectLiteral = ObjectLiteral> {\n    protected repository: IEntityRepository<T>;\n\n    constructor(repository: IEntityRepository<T>) {\n        this.repository = repository;\n    }\n\n    async resolveGlobal(names?: string[]): Promise<T[]> {\n        if (!names || names.length === 0) {\n            return [];\n        }\n\n        const hasWildcard = names.includes('*');\n        if (hasWildcard) {\n            return this.repository.findManyBy({\n                realm_id: null,\n                client_id: null,\n            });\n        }\n\n        return this.repository.findManyBy({\n            name: names,\n            realm_id: null,\n            client_id: null,\n        });\n    }\n\n    async resolveRealm(names: string[] | undefined, realmId: string): Promise<T[]> {\n        if (!names || names.length === 0) {\n            return [];\n        }\n\n        const hasWildcard = names.includes('*');\n        if (hasWildcard) {\n            return this.repository.findManyBy({\n                realm_id: realmId,\n                client_id: null,\n            });\n        }\n\n        return this.repository.findManyBy({\n            name: names,\n            realm_id: realmId,\n            client_id: null,\n        });\n    }\n\n    async resolveClient(names: string[] | undefined, realmId: string, clientId: string): Promise<T[]> {\n        if (!names || names.length === 0) {\n            return [];\n        }\n\n        const hasWildcard = names.includes('*');\n        if (hasWildcard) {\n            return this.repository.findManyBy({\n                realm_id: realmId,\n                client_id: clientId,\n            });\n        }\n\n        return this.repository.findManyBy({\n            name: names,\n            realm_id: realmId,\n            client_id: clientId,\n        });\n    }\n}\n"],"mappings":";AAUA,IAAaA,6BAAb,MAAaA;CACCC;CAEV,YAAYA,YAAkC;AAC1C,OAAKA,aAAaA;;CAGtB,MAAMC,cAAcC,OAAgC;AAChD,MAAI,CAACA,SAASA,MAAMC,WAAW,EAC3B,QAAO,EAAE;AAIb,MADoBD,MAAMG,SAAS,IAC/BD,CACA,QAAO,KAAKJ,WAAWM,WAAW;GAC9BC,UAAU;GACVC,WAAW;GACf,CAAA;AAGJ,SAAO,KAAKR,WAAWM,WAAW;GAC9BG,MAAMP;GACNK,UAAU;GACVC,WAAW;GACf,CAAA;;CAGJ,MAAME,aAAaR,OAA6BS,SAA+B;AAC3E,MAAI,CAACT,SAASA,MAAMC,WAAW,EAC3B,QAAO,EAAE;AAIb,MADoBD,MAAMG,SAAS,IAC/BD,CACA,QAAO,KAAKJ,WAAWM,WAAW;GAC9BC,UAAUI;GACVH,WAAW;GACf,CAAA;AAGJ,SAAO,KAAKR,WAAWM,WAAW;GAC9BG,MAAMP;GACNK,UAAUI;GACVH,WAAW;GACf,CAAA;;CAGJ,MAAMI,cAAcV,OAA6BS,SAAiBE,UAAgC;AAC9F,MAAI,CAACX,SAASA,MAAMC,WAAW,EAC3B,QAAO,EAAE;AAIb,MADoBD,MAAMG,SAAS,IAC/BD,CACA,QAAO,KAAKJ,WAAWM,WAAW;GAC9BC,UAAUI;GACVH,WAAWK;GACf,CAAA;AAGJ,SAAO,KAAKb,WAAWM,WAAW;GAC9BG,MAAMP;GACNK,UAAUI;GACVH,WAAWK;GACf,CAAA"}
+{"version":3,"file":"entity-resolver.mjs","names":["ProvisioningEntityResolver","repository","resolveGlobal","names","length","hasWildcard","includes","findManyBy","realm_id","client_id","name","resolveRealm","realmId","resolveClient","clientId"],"sources":["../../../../src/core/provisioning/synchronizer/entity-resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { IEntityRepository } from '@authup/server-kit';\n\nexport class ProvisioningEntityResolver<T extends ObjectLiteral = ObjectLiteral> {\n    protected repository: IEntityRepository<T>;\n\n    constructor(repository: IEntityRepository<T>) {\n        this.repository = repository;\n    }\n\n    async resolveGlobal(names?: string[]): Promise<T[]> {\n        if (!names || names.length === 0) {\n            return [];\n        }\n\n        const hasWildcard = names.includes('*');\n        if (hasWildcard) {\n            return this.repository.findManyBy({\n                realm_id: null,\n                client_id: null,\n            });\n        }\n\n        return this.repository.findManyBy({\n            name: names,\n            realm_id: null,\n            client_id: null,\n        });\n    }\n\n    async resolveRealm(names: string[] | undefined, realmId: string): Promise<T[]> {\n        if (!names || names.length === 0) {\n            return [];\n        }\n\n        const hasWildcard = names.includes('*');\n        if (hasWildcard) {\n            return this.repository.findManyBy({\n                realm_id: realmId,\n                client_id: null,\n            });\n        }\n\n        return this.repository.findManyBy({\n            name: names,\n            realm_id: realmId,\n            client_id: null,\n        });\n    }\n\n    async resolveClient(names: string[] | undefined, realmId: string, clientId: string): Promise<T[]> {\n        if (!names || names.length === 0) {\n            return [];\n        }\n\n        const hasWildcard = names.includes('*');\n        if (hasWildcard) {\n            return this.repository.findManyBy({\n                realm_id: realmId,\n                client_id: clientId,\n            });\n        }\n\n        return this.repository.findManyBy({\n            name: names,\n            realm_id: realmId,\n            client_id: clientId,\n        });\n    }\n}\n"],"mappings":";AAUA,IAAaA,6BAAb,MAAaA;CACCC;CAEV,YAAYA,YAAkC;EAC1C,KAAKA,aAAaA;CACtB;CAEA,MAAMC,cAAcC,OAAgC;EAChD,IAAI,CAACA,SAASA,MAAMC,WAAW,GAC3B,OAAO,CAAA;EAIX,IADoBD,MAAMG,SAAS,GAC/BD,GACA,OAAO,KAAKJ,WAAWM,WAAW;GAC9BC,UAAU;GACVC,WAAW;EACf,CAAA;EAGJ,OAAO,KAAKR,WAAWM,WAAW;GAC9BG,MAAMP;GACNK,UAAU;GACVC,WAAW;EACf,CAAA;CACJ;CAEA,MAAME,aAAaR,OAA6BS,SAA+B;EAC3E,IAAI,CAACT,SAASA,MAAMC,WAAW,GAC3B,OAAO,CAAA;EAIX,IADoBD,MAAMG,SAAS,GAC/BD,GACA,OAAO,KAAKJ,WAAWM,WAAW;GAC9BC,UAAUI;GACVH,WAAW;EACf,CAAA;EAGJ,OAAO,KAAKR,WAAWM,WAAW;GAC9BG,MAAMP;GACNK,UAAUI;GACVH,WAAW;EACf,CAAA;CACJ;CAEA,MAAMI,cAAcV,OAA6BS,SAAiBE,UAAgC;EAC9F,IAAI,CAACX,SAASA,MAAMC,WAAW,GAC3B,OAAO,CAAA;EAIX,IADoBD,MAAMG,SAAS,GAC/BD,GACA,OAAO,KAAKJ,WAAWM,WAAW;GAC9BC,UAAUI;GACVH,WAAWK;EACf,CAAA;EAGJ,OAAO,KAAKb,WAAWM,WAAW;GAC9BG,MAAMP;GACNK,UAAUI;GACVH,WAAWK;EACf,CAAA;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/junction-synchronizer.d.ts

@@ -1,5 +1,5 @@
 import type { ObjectLiteral } from '@authup/kit';
-import type { IEntityRepository } from '../../entities/index.ts';
+import type { IEntityRepository } from '@authup/server-kit';
 export type ProvisioningJunctionSynchronizerContext<T extends ObjectLiteral = ObjectLiteral> = {
     repository: IEntityRepository<T>;
     ownerKey: string;

package/dist/core/provisioning/synchronizer/junction-synchronizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"junction-synchronizer.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/junction-synchronizer.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,MAAM,uCAAuC,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IAAI;IAC3F,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,qBAAa,gCAAgC,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACjF,SAAS,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC,CAAC,CAAC;gBAE9C,GAAG,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAIrD,WAAW,CACb,KAAK,EAAE;QACH,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC3B,EACD,OAAO,EAAE,KAAK,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC3B,CAAC,EACF,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC;CAoBnB"}
+{"version":3,"file":"junction-synchronizer.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/junction-synchronizer.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,MAAM,MAAM,uCAAuC,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IAAI;IAC3F,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,qBAAa,gCAAgC,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACjF,SAAS,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC,CAAC,CAAC;gBAE9C,GAAG,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAIrD,WAAW,CACb,KAAK,EAAE;QACH,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC3B,EACD,OAAO,EAAE,KAAK,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC3B,CAAC,EACF,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC;CAoBnB"}

package/dist/core/provisioning/synchronizer/junction-synchronizer.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"junction-synchronizer.mjs","names":["ProvisioningJunctionSynchronizer","ctx","synchronize","owner","targets","targetKey","targetRealmKey","extraAttributes","target","existing","repository","findOneBy","ownerKey","id","entity","create","ownerRealmKey","realm_id","save"],"sources":["../../../../src/core/provisioning/synchronizer/junction-synchronizer.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { IEntityRepository } from '../../entities/index.ts';\n\nexport type ProvisioningJunctionSynchronizerContext<T extends ObjectLiteral = ObjectLiteral> = {\n    repository: IEntityRepository<T>,\n    ownerKey: string,\n    ownerRealmKey: string,\n};\n\nexport class ProvisioningJunctionSynchronizer<T extends ObjectLiteral = ObjectLiteral> {\n    protected ctx: ProvisioningJunctionSynchronizerContext<T>;\n\n    constructor(ctx: ProvisioningJunctionSynchronizerContext<T>) {\n        this.ctx = ctx;\n    }\n\n    async synchronize(\n        owner: {\n            id: string,\n            realm_id?: string | null \n        },\n        targets: Array<{\n            id: string,\n            realm_id?: string | null \n        }>,\n        targetKey: string,\n        targetRealmKey: string,\n        extraAttributes?: Record<string, unknown>,\n    ): Promise<void> {\n        for (const target of targets) {\n            const existing = await this.ctx.repository.findOneBy({\n                [this.ctx.ownerKey]: owner.id,\n                [targetKey]: target.id,\n            });\n\n            if (!existing) {\n                const entity = this.ctx.repository.create({\n                    [this.ctx.ownerKey]: owner.id,\n                    [this.ctx.ownerRealmKey]: owner.realm_id,\n                    [targetKey]: target.id,\n                    [targetRealmKey]: target.realm_id,\n                    ...(extraAttributes || {}),\n                } as Partial<T>);\n\n                await this.ctx.repository.save(entity);\n            }\n        }\n    }\n}\n"],"mappings":";AAgBA,IAAaA,mCAAb,MAAaA;CACCC;CAEV,YAAYA,KAAiD;AACzD,OAAKA,MAAMA;;CAGf,MAAMC,YACFC,OAIAC,SAIAC,WACAC,gBACAC,iBACa;AACb,OAAK,MAAMC,UAAUJ,QAMjB,KAAI,CAACK,MALkB,KAAKR,IAAIS,WAAWC,UAAU;IAChD,KAAKV,IAAIW,WAAWT,MAAMU;IAC1BR,YAAYG,OAAOK;GACxB,CAAA,EAEe;GACX,MAAMC,SAAS,KAAKb,IAAIS,WAAWK,OAAO;KACrC,KAAKd,IAAIW,WAAWT,MAAMU;KAC1B,KAAKZ,IAAIe,gBAAgBb,MAAMc;KAC/BZ,YAAYG,OAAOK;KACnBP,iBAAiBE,OAAOS;IACzB,GAAIV,mBAAmB,EAAE;IAC7B,CAAA;AAEA,SAAM,KAAKN,IAAIS,WAAWQ,KAAKJ,OAAAA"}
+{"version":3,"file":"junction-synchronizer.mjs","names":["ProvisioningJunctionSynchronizer","ctx","synchronize","owner","targets","targetKey","targetRealmKey","extraAttributes","target","existing","repository","findOneBy","ownerKey","id","entity","create","ownerRealmKey","realm_id","save"],"sources":["../../../../src/core/provisioning/synchronizer/junction-synchronizer.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { IEntityRepository } from '@authup/server-kit';\n\nexport type ProvisioningJunctionSynchronizerContext<T extends ObjectLiteral = ObjectLiteral> = {\n    repository: IEntityRepository<T>,\n    ownerKey: string,\n    ownerRealmKey: string,\n};\n\nexport class ProvisioningJunctionSynchronizer<T extends ObjectLiteral = ObjectLiteral> {\n    protected ctx: ProvisioningJunctionSynchronizerContext<T>;\n\n    constructor(ctx: ProvisioningJunctionSynchronizerContext<T>) {\n        this.ctx = ctx;\n    }\n\n    async synchronize(\n        owner: {\n            id: string,\n            realm_id?: string | null \n        },\n        targets: Array<{\n            id: string,\n            realm_id?: string | null \n        }>,\n        targetKey: string,\n        targetRealmKey: string,\n        extraAttributes?: Record<string, unknown>,\n    ): Promise<void> {\n        for (const target of targets) {\n            const existing = await this.ctx.repository.findOneBy({\n                [this.ctx.ownerKey]: owner.id,\n                [targetKey]: target.id,\n            });\n\n            if (!existing) {\n                const entity = this.ctx.repository.create({\n                    [this.ctx.ownerKey]: owner.id,\n                    [this.ctx.ownerRealmKey]: owner.realm_id,\n                    [targetKey]: target.id,\n                    [targetRealmKey]: target.realm_id,\n                    ...(extraAttributes || {}),\n                } as Partial<T>);\n\n                await this.ctx.repository.save(entity);\n            }\n        }\n    }\n}\n"],"mappings":";AAgBA,IAAaA,mCAAb,MAAaA;CACCC;CAEV,YAAYA,KAAiD;EACzD,KAAKA,MAAMA;CACf;CAEA,MAAMC,YACFC,OAIAC,SAIAC,WACAC,gBACAC,iBACa;EACb,KAAK,MAAMC,UAAUJ,SAMjB,IAAI,CAACK,MALkB,KAAKR,IAAIS,WAAWC,UAAU;IAChD,KAAKV,IAAIW,WAAWT,MAAMU;IAC1BR,YAAYG,OAAOK;EACxB,CAAA,GAEe;GACX,MAAMC,SAAS,KAAKb,IAAIS,WAAWK,OAAO;KACrC,KAAKd,IAAIW,WAAWT,MAAMU;KAC1B,KAAKZ,IAAIe,gBAAgBb,MAAMc;KAC/BZ,YAAYG,OAAOK;KACnBP,iBAAiBE,OAAOS;IACzB,GAAIV,mBAAmB,CAAC;GAC5B,CAAA;GAEA,MAAM,KAAKN,IAAIS,WAAWQ,KAAKJ,MAAAA;EACnC;CAER;AACJ"}

package/dist/core/provisioning/synchronizer/permission/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","PermissionProvisioningSynchronizer","repository","policyRepository","permissionPolicyRepository","ctx","synchronize","input","strategy","attributes","findOneBy","name","realm_id","client_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","policies","length","synchronizePolicies","permission","policyNames","Error","policyName","policy","findOneByName","existing","permission_id","policy_id","entry","permission_realm_id","policy_realm_id"],"sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPermissionRepository, IPolicyRepository } from '../../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PermissionProvisioningSynchronizerContext } from './types.ts';\n\nexport class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer<PermissionProvisioningEntity> {\n    protected repository : IPermissionRepository;\n\n    protected policyRepository?: IPolicyRepository;\n\n    protected permissionPolicyRepository?: IPermissionPolicyRepository;\n\n    constructor(ctx: PermissionProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PermissionProvisioningEntity): Promise<PermissionProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n            client_id: input.attributes.client_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes,\n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (input.relations?.policies && input.relations.policies.length > 0) {\n            await this.synchronizePolicies(attributes, input.relations.policies);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n\n    private async synchronizePolicies(permission: Permission, policyNames: string[]): Promise<void> {\n        if (!this.policyRepository || !this.permissionPolicyRepository) {\n            throw new Error(\n                'Provisioning: policy/permissionPolicy repositories must be wired to attach policies to permissions.',\n            );\n        }\n\n        for (const policyName of policyNames) {\n            const policy = await this.policyRepository.findOneByName(policyName);\n            if (!policy) {\n                throw new Error(\n                    `Provisioning: policy '${policyName}' not found for permission '${permission.name}'.`,\n                );\n            }\n\n            const existing = await this.permissionPolicyRepository.findOneBy({\n                permission_id: permission.id,\n                policy_id: policy.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.permissionPolicyRepository.create({\n                permission_id: permission.id,\n                permission_realm_id: permission.realm_id,\n                policy_id: policy.id,\n                policy_realm_id: policy.realm_id,\n            });\n            await this.permissionPolicyRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;AAgBA,IAAaI,qCAAb,cAAwDD,6BAAAA;CAC1CE;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;AACxD,SAAK;AAEL,OAAKH,aAAaG,IAAIH;AACtB,OAAKC,mBAAmBE,IAAIF;AAC5B,OAAKC,6BAA6BC,IAAID;;CAG1C,MAAME,YAAYC,OAA4E;EAC1F,MAAMC,WAAWT,oCAAoCQ,MAAMC,SAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKP,WAAWQ,UAAU;GAC7CC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GACvCC,WAAWN,MAAME,WAAWI,aAAa;GAC7C,CAAA;AAEA,MAAIL,SAASM,SAAShB,+BAA+BiB,QAAQ;AACzD,OAAIN,WACA,OAAM,KAAKP,WAAWc,OAAOP,WAAAA;AAEjC,UAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;IACpC;;AAGJ,MAAIA,WACA,SAAQD,SAASM,MAAjB;GACI,KAAKhB,+BAA+BmB;AAChCR,iBAAa,KAAKP,WAAWgB,MACzBT,YACAD,SAASC,aACLZ,WAAWU,MAAME,YAAYD,SAASC,WAAU,GAChDF,MAAME,WAAU;AAGxBA,iBAAa,MAAM,KAAKP,WAAWiB,KAAKV,WAAAA;AACxC;GACJ,KAAKX,+BAA+BsB;AAChCb,UAAME,WAAWY,KAAKZ,WAAWY;AACjCZ,iBAAa,MAAM,KAAKP,WAAWiB,KAAK,KAAKjB,WAAWoB,OAAOf,MAAME,WAAU,CAAA;AAC/E;;MAGRA,cAAa,MAAM,KAAKP,WAAWiB,KAAK,KAAKjB,WAAWoB,OAAOf,MAAME,WAAU,CAAA;AAGnF,MAAIF,MAAMgB,WAAWC,YAAYjB,MAAMgB,UAAUC,SAASC,SAAS,EAC/D,OAAM,KAAKC,oBAAoBjB,YAAYF,MAAMgB,UAAUC,SAAQ;AAGvE,SAAO;GACH,GAAGjB;GACHE;GACJ;;CAGJ,MAAciB,oBAAoBC,YAAwBC,aAAsC;AAC5F,MAAI,CAAC,KAAKzB,oBAAoB,CAAC,KAAKC,2BAChC,OAAM,IAAIyB,MACN,sGAAA;AAIR,OAAK,MAAMC,cAAcF,aAAa;GAClC,MAAMG,SAAS,MAAM,KAAK5B,iBAAiB6B,cAAcF,WAAAA;AACzD,OAAI,CAACC,OACD,OAAM,IAAIF,MACN,yBAAyBC,WAAW,8BAA8BH,WAAWhB,KAAK,IAAG;AAQ7F,OAAIsB,MAJmB,KAAK7B,2BAA2BM,UAAU;IAC7DwB,eAAeP,WAAWN;IAC1Bc,WAAWJ,OAAOV;IACtB,CAAA,CAEI;GAGJ,MAAMe,QAAQ,KAAKhC,2BAA2BkB,OAAO;IACjDY,eAAeP,WAAWN;IAC1BgB,qBAAqBV,WAAWf;IAChCuB,WAAWJ,OAAOV;IAClBiB,iBAAiBP,OAAOnB;IAC5B,CAAA;AACA,SAAM,KAAKR,2BAA2Be,KAAKiB,MAAAA"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","PermissionProvisioningSynchronizer","repository","policyRepository","permissionPolicyRepository","ctx","synchronize","input","strategy","attributes","findOneBy","name","realm_id","client_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","policies","length","synchronizePolicies","permission","policyNames","Error","policyName","policy","findOneByName","existing","permission_id","policy_id","entry","permission_realm_id","policy_realm_id"],"sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPermissionRepository, IPolicyRepository } from '../../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PermissionProvisioningSynchronizerContext } from './types.ts';\n\nexport class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer<PermissionProvisioningEntity> {\n    protected repository : IPermissionRepository;\n\n    protected policyRepository?: IPolicyRepository;\n\n    protected permissionPolicyRepository?: IPermissionPolicyRepository;\n\n    constructor(ctx: PermissionProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PermissionProvisioningEntity): Promise<PermissionProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n            client_id: input.attributes.client_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes,\n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (input.relations?.policies && input.relations.policies.length > 0) {\n            await this.synchronizePolicies(attributes, input.relations.policies);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n\n    private async synchronizePolicies(permission: Permission, policyNames: string[]): Promise<void> {\n        if (!this.policyRepository || !this.permissionPolicyRepository) {\n            throw new Error(\n                'Provisioning: policy/permissionPolicy repositories must be wired to attach policies to permissions.',\n            );\n        }\n\n        for (const policyName of policyNames) {\n            const policy = await this.policyRepository.findOneByName(policyName);\n            if (!policy) {\n                throw new Error(\n                    `Provisioning: policy '${policyName}' not found for permission '${permission.name}'.`,\n                );\n            }\n\n            const existing = await this.permissionPolicyRepository.findOneBy({\n                permission_id: permission.id,\n                policy_id: policy.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.permissionPolicyRepository.create({\n                permission_id: permission.id,\n                permission_realm_id: permission.realm_id,\n                policy_id: policy.id,\n                policy_realm_id: policy.realm_id,\n            });\n            await this.permissionPolicyRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;AAgBA,IAAaI,qCAAb,cAAwDD,6BAAAA;CAC1CE;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;EACxD,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,6BAA6BC,IAAID;CAC1C;CAEA,MAAME,YAAYC,OAA4E;EAC1F,MAAMC,WAAWT,oCAAoCQ,MAAMC,QAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKP,WAAWQ,UAAU;GAC7CC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GACvCC,WAAWN,MAAME,WAAWI,aAAa;EAC7C,CAAA;EAEA,IAAIL,SAASM,SAAShB,+BAA+BiB,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKP,WAAWc,OAAOP,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQD,SAASM,MAAjB;GACI,KAAKhB,+BAA+BmB;IAChCR,aAAa,KAAKP,WAAWgB,MACzBT,YACAD,SAASC,aACLZ,WAAWU,MAAME,YAAYD,SAASC,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKP,WAAWiB,KAAKV,UAAAA;IACxC;GACJ,KAAKX,+BAA+BsB;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKP,WAAWiB,KAAK,KAAKjB,WAAWoB,OAAOf,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKP,WAAWiB,KAAK,KAAKjB,WAAWoB,OAAOf,MAAME,UAAU,CAAA;EAGnF,IAAIF,MAAMgB,WAAWC,YAAYjB,MAAMgB,UAAUC,SAASC,SAAS,GAC/D,MAAM,KAAKC,oBAAoBjB,YAAYF,MAAMgB,UAAUC,QAAQ;EAGvE,OAAO;GACH,GAAGjB;GACHE;EACJ;CACJ;CAEA,MAAciB,oBAAoBC,YAAwBC,aAAsC;EAC5F,IAAI,CAAC,KAAKzB,oBAAoB,CAAC,KAAKC,4BAChC,MAAM,IAAIyB,MACN,qGAAA;EAIR,KAAK,MAAMC,cAAcF,aAAa;GAClC,MAAMG,SAAS,MAAM,KAAK5B,iBAAiB6B,cAAcF,UAAAA;GACzD,IAAI,CAACC,QACD,MAAM,IAAIF,MACN,yBAAyBC,WAAW,8BAA8BH,WAAWhB,KAAK,GAAG;GAQ7F,IAAIsB,MAJmB,KAAK7B,2BAA2BM,UAAU;IAC7DwB,eAAeP,WAAWN;IAC1Bc,WAAWJ,OAAOV;GACtB,CAAA,GAEI;GAGJ,MAAMe,QAAQ,KAAKhC,2BAA2BkB,OAAO;IACjDY,eAAeP,WAAWN;IAC1BgB,qBAAqBV,WAAWf;IAChCuB,WAAWJ,OAAOV;IAClBiB,iBAAiBP,OAAOnB;GAC5B,CAAA;GACA,MAAM,KAAKR,2BAA2Be,KAAKiB,KAAAA;EAC/C;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/policy/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["BaseProvisioningSynchronizer","PolicyProvisioningSynchronizer","repository","permissionPolicyRepository","ctx","synchronize","input","entity","findOneBy","name","attributes","realm_id","mergeData","type","built_in","parent_id","parent","invert","merge","saveWithEA","extraAttributes","create","synchronizeChildren","id","children","parentId","declaredNames","map","c","reduce","prev","child","Promise","resolve","cleanupStaleChildren","existingChildren","findManyBy","staleChildren","filter","includes","cleanupStaleChild","referencingJunctions","policy_id","length","deleteFromTree","detached"],"sources":["../../../../../src/core/provisioning/synchronizer/policy/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Policy } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPolicyRepository } from '../../../entities/index.ts';\nimport type { PolicyProvisioningEntity } from '../../entities/policy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PolicyProvisioningSynchronizerContext } from './types.ts';\n\nexport class PolicyProvisioningSynchronizer extends BaseProvisioningSynchronizer<PolicyProvisioningEntity> {\n    protected repository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    constructor(ctx: PolicyProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PolicyProvisioningEntity): Promise<PolicyProvisioningEntity> {\n        let entity = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (entity) {\n            // Only assign `invert` when the source declares it explicitly.\n            // TypeORM's `merge` is a plain assign and would otherwise clobber\n            // an existing flag with `undefined` (turning `invert: true` into\n            // `null`/`false` on every reprovisioning pass).\n            const mergeData: Partial<Policy> = {\n                type: input.attributes.type,\n                built_in: input.attributes.built_in,\n                parent_id: input.attributes.parent_id,\n                parent: input.attributes.parent,\n            };\n            if (typeof input.attributes.invert !== 'undefined') {\n                mergeData.invert = input.attributes.invert;\n            }\n            entity = this.repository.merge(entity, mergeData);\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        } else {\n            entity = this.repository.create(input.attributes);\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        }\n\n        await this.synchronizeChildren(entity.id, input.children || []);\n\n        return {\n            ...input,\n            attributes: entity,\n        };\n    }\n\n    private async synchronizeChildren(\n        parentId: string,\n        children: PolicyProvisioningEntity[] = [],\n    ): Promise<void> {\n        const declaredNames = children.map((c) => c.attributes.name);\n\n        await children.reduce(async (prev, child) => {\n            await prev;\n            child.attributes.parent_id = parentId;\n            child.attributes.parent = { id: parentId } as any;\n            await this.synchronize(child);\n        }, Promise.resolve());\n\n        await this.cleanupStaleChildren(parentId, declaredNames);\n    }\n\n    private async cleanupStaleChildren(\n        parentId: string,\n        declaredNames: (string | undefined)[],\n    ): Promise<void> {\n        const existingChildren = await this.repository.findManyBy({ parent_id: parentId });\n\n        const staleChildren = existingChildren.filter(\n            (child) => !declaredNames.includes(child.name),\n        );\n\n        await staleChildren.reduce(async (prev, child) => {\n            await prev;\n            await this.cleanupStaleChild(child);\n        }, Promise.resolve());\n    }\n\n    private async cleanupStaleChild(child: Policy): Promise<void> {\n        const referencingJunctions = await this.permissionPolicyRepository.findManyBy({ policy_id: child.id });\n\n        if (referencingJunctions.length === 0) {\n            await this.repository.deleteFromTree(child);\n        } else {\n            const detached = this.repository.merge(child, {\n                parent_id: null,\n                parent: null,\n                built_in: false,\n            });\n            await this.repository.saveWithEA(detached);\n        }\n    }\n}\n"],"mappings":";;AAcA,IAAaC,iCAAb,cAAoDD,6BAAAA;CACtCE;CAEAC;CAEV,YAAYC,KAA4C;AACpD,SAAK;AAEL,OAAKF,aAAaE,IAAIF;AACtB,OAAKC,6BAA6BC,IAAID;;CAG1C,MAAME,YAAYC,OAAoE;EAClF,IAAIC,SAAS,MAAM,KAAKL,WAAWM,UAAU;GACzCC,MAAMH,MAAMI,WAAWD;GACvBE,UAAUL,MAAMI,WAAWC,YAAY;GAC3C,CAAA;AAEA,MAAIJ,QAAQ;GAKR,MAAMK,YAA6B;IAC/BC,MAAMP,MAAMI,WAAWG;IACvBC,UAAUR,MAAMI,WAAWI;IAC3BC,WAAWT,MAAMI,WAAWK;IAC5BC,QAAQV,MAAMI,WAAWM;IAC7B;AACA,OAAI,OAAOV,MAAMI,WAAWO,WAAW,YACnCL,WAAUK,SAASX,MAAMI,WAAWO;AAExCV,YAAS,KAAKL,WAAWgB,MAAMX,QAAQK,UAAAA;AACvC,SAAM,KAAKV,WAAWiB,WAAWZ,QAAQD,MAAMc,gBAAe;SAC3D;AACHb,YAAS,KAAKL,WAAWmB,OAAOf,MAAMI,WAAU;AAChD,SAAM,KAAKR,WAAWiB,WAAWZ,QAAQD,MAAMc,gBAAe;;AAGlE,QAAM,KAAKE,oBAAoBf,OAAOgB,IAAIjB,MAAMkB,YAAY,EAAE,CAAA;AAE9D,SAAO;GACH,GAAGlB;GACHI,YAAYH;GAChB;;CAGJ,MAAce,oBACVG,UACAD,WAAuC,EAAE,EAC5B;EACb,MAAME,gBAAgBF,SAASG,KAAKC,MAAMA,EAAElB,WAAWD,KAAI;AAE3D,QAAMe,SAASK,OAAO,OAAOC,MAAMC,UAAAA;AAC/B,SAAMD;AACNC,SAAMrB,WAAWK,YAAYU;AAC7BM,SAAMrB,WAAWM,SAAS,EAAEO,IAAIE,UAAS;AACzC,SAAM,KAAKpB,YAAY0B,MAAAA;KACxBC,QAAQC,SAAO,CAAA;AAElB,QAAM,KAAKC,qBAAqBT,UAAUC,cAAAA;;CAG9C,MAAcQ,qBACVT,UACAC,eACa;AAOb,SAJsBS,MAFS,KAAKjC,WAAWkC,WAAW,EAAErB,WAAWU,UAAS,CAAA,EAEzCa,QAClCP,UAAU,CAACL,cAAca,SAASR,MAAMtB,KAAI,CAG3C4B,CAAcR,OAAO,OAAOC,MAAMC,UAAAA;AACpC,SAAMD;AACN,SAAM,KAAKU,kBAAkBT,MAAAA;KAC9BC,QAAQC,SAAO,CAAA;;CAGtB,MAAcO,kBAAkBT,OAA8B;AAG1D,OAAIU,MAF+B,KAAKtC,2BAA2BiC,WAAW,EAAEM,WAAWX,MAAMR,IAAG,CAAA,EAE3EoB,WAAW,EAChC,OAAM,KAAKzC,WAAW0C,eAAeb,MAAAA;OAClC;GACH,MAAMc,WAAW,KAAK3C,WAAWgB,MAAMa,OAAO;IAC1ChB,WAAW;IACXC,QAAQ;IACRF,UAAU;IACd,CAAA;AACA,SAAM,KAAKZ,WAAWiB,WAAW0B,SAAAA"}
+{"version":3,"file":"module.mjs","names":["BaseProvisioningSynchronizer","PolicyProvisioningSynchronizer","repository","permissionPolicyRepository","ctx","synchronize","input","entity","findOneBy","name","attributes","realm_id","mergeData","type","built_in","parent_id","parent","invert","merge","saveWithEA","extraAttributes","create","synchronizeChildren","id","children","parentId","declaredNames","map","c","reduce","prev","child","Promise","resolve","cleanupStaleChildren","existingChildren","findManyBy","staleChildren","filter","includes","cleanupStaleChild","referencingJunctions","policy_id","length","deleteFromTree","detached"],"sources":["../../../../../src/core/provisioning/synchronizer/policy/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Policy } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPolicyRepository } from '../../../entities/index.ts';\nimport type { PolicyProvisioningEntity } from '../../entities/policy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PolicyProvisioningSynchronizerContext } from './types.ts';\n\nexport class PolicyProvisioningSynchronizer extends BaseProvisioningSynchronizer<PolicyProvisioningEntity> {\n    protected repository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    constructor(ctx: PolicyProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PolicyProvisioningEntity): Promise<PolicyProvisioningEntity> {\n        let entity = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (entity) {\n            // Only assign `invert` when the source declares it explicitly.\n            // TypeORM's `merge` is a plain assign and would otherwise clobber\n            // an existing flag with `undefined` (turning `invert: true` into\n            // `null`/`false` on every reprovisioning pass).\n            const mergeData: Partial<Policy> = {\n                type: input.attributes.type,\n                built_in: input.attributes.built_in,\n                parent_id: input.attributes.parent_id,\n                parent: input.attributes.parent,\n            };\n            if (typeof input.attributes.invert !== 'undefined') {\n                mergeData.invert = input.attributes.invert;\n            }\n            entity = this.repository.merge(entity, mergeData);\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        } else {\n            entity = this.repository.create(input.attributes);\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        }\n\n        await this.synchronizeChildren(entity.id, input.children || []);\n\n        return {\n            ...input,\n            attributes: entity,\n        };\n    }\n\n    private async synchronizeChildren(\n        parentId: string,\n        children: PolicyProvisioningEntity[] = [],\n    ): Promise<void> {\n        const declaredNames = children.map((c) => c.attributes.name);\n\n        await children.reduce(async (prev, child) => {\n            await prev;\n            child.attributes.parent_id = parentId;\n            child.attributes.parent = { id: parentId } as any;\n            await this.synchronize(child);\n        }, Promise.resolve());\n\n        await this.cleanupStaleChildren(parentId, declaredNames);\n    }\n\n    private async cleanupStaleChildren(\n        parentId: string,\n        declaredNames: (string | undefined)[],\n    ): Promise<void> {\n        const existingChildren = await this.repository.findManyBy({ parent_id: parentId });\n\n        const staleChildren = existingChildren.filter(\n            (child) => !declaredNames.includes(child.name),\n        );\n\n        await staleChildren.reduce(async (prev, child) => {\n            await prev;\n            await this.cleanupStaleChild(child);\n        }, Promise.resolve());\n    }\n\n    private async cleanupStaleChild(child: Policy): Promise<void> {\n        const referencingJunctions = await this.permissionPolicyRepository.findManyBy({ policy_id: child.id });\n\n        if (referencingJunctions.length === 0) {\n            await this.repository.deleteFromTree(child);\n        } else {\n            const detached = this.repository.merge(child, {\n                parent_id: null,\n                parent: null,\n                built_in: false,\n            });\n            await this.repository.saveWithEA(detached);\n        }\n    }\n}\n"],"mappings":";;AAcA,IAAaC,iCAAb,cAAoDD,6BAAAA;CACtCE;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAK;EAEL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,6BAA6BC,IAAID;CAC1C;CAEA,MAAME,YAAYC,OAAoE;EAClF,IAAIC,SAAS,MAAM,KAAKL,WAAWM,UAAU;GACzCC,MAAMH,MAAMI,WAAWD;GACvBE,UAAUL,MAAMI,WAAWC,YAAY;EAC3C,CAAA;EAEA,IAAIJ,QAAQ;GAKR,MAAMK,YAA6B;IAC/BC,MAAMP,MAAMI,WAAWG;IACvBC,UAAUR,MAAMI,WAAWI;IAC3BC,WAAWT,MAAMI,WAAWK;IAC5BC,QAAQV,MAAMI,WAAWM;GAC7B;GACA,IAAI,OAAOV,MAAMI,WAAWO,WAAW,aACnCL,UAAUK,SAASX,MAAMI,WAAWO;GAExCV,SAAS,KAAKL,WAAWgB,MAAMX,QAAQK,SAAAA;GACvC,MAAM,KAAKV,WAAWiB,WAAWZ,QAAQD,MAAMc,eAAe;EAClE,OAAO;GACHb,SAAS,KAAKL,WAAWmB,OAAOf,MAAMI,UAAU;GAChD,MAAM,KAAKR,WAAWiB,WAAWZ,QAAQD,MAAMc,eAAe;EAClE;EAEA,MAAM,KAAKE,oBAAoBf,OAAOgB,IAAIjB,MAAMkB,YAAY,CAAA,CAAE;EAE9D,OAAO;GACH,GAAGlB;GACHI,YAAYH;EAChB;CACJ;CAEA,MAAce,oBACVG,UACAD,WAAuC,CAAA,GAC1B;EACb,MAAME,gBAAgBF,SAASG,KAAKC,MAAMA,EAAElB,WAAWD,IAAI;EAE3D,MAAMe,SAASK,OAAO,OAAOC,MAAMC,UAAAA;GAC/B,MAAMD;GACNC,MAAMrB,WAAWK,YAAYU;GAC7BM,MAAMrB,WAAWM,SAAS,EAAEO,IAAIE,SAAS;GACzC,MAAM,KAAKpB,YAAY0B,KAAAA;EAC3B,GAAGC,QAAQC,QAAO,CAAA;EAElB,MAAM,KAAKC,qBAAqBT,UAAUC,aAAAA;CAC9C;CAEA,MAAcQ,qBACVT,UACAC,eACa;EAOb,OAJsBS,MAFS,KAAKjC,WAAWkC,WAAW,EAAErB,WAAWU,SAAS,CAAA,GAEzCa,QAClCP,UAAU,CAACL,cAAca,SAASR,MAAMtB,IAAI,CAG3C4B,EAAcR,OAAO,OAAOC,MAAMC,UAAAA;GACpC,MAAMD;GACN,MAAM,KAAKU,kBAAkBT,KAAAA;EACjC,GAAGC,QAAQC,QAAO,CAAA;CACtB;CAEA,MAAcO,kBAAkBT,OAA8B;EAG1D,KAAIU,MAF+B,KAAKtC,2BAA2BiC,WAAW,EAAEM,WAAWX,MAAMR,GAAG,CAAA,GAE3EoB,WAAW,GAChC,MAAM,KAAKzC,WAAW0C,eAAeb,KAAAA;OAClC;GACH,MAAMc,WAAW,KAAK3C,WAAWgB,MAAMa,OAAO;IAC1ChB,WAAW;IACXC,QAAQ;IACRF,UAAU;GACd,CAAA;GACA,MAAM,KAAKZ,WAAWiB,WAAW0B,QAAAA;EACrC;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/realm/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","RealmProvisioningSynchronizer","repository","clientSynchronizer","permissionSynchronizer","roleSynchronizer","userSynchronizer","robotSynchronizer","scopeSynchronizer","ctx","synchronize","input","strategy","attributes","findOneBy","name","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","clients","map","child","realm_id","realm","synchronizeMany","permissions","roles","users","robots","scopes"],"sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IRealmRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity, ScopeProvisioningEntity } from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { RealmProvisioningEntity } from '../../entities/realm/index.ts';\nimport type { RobotProvisioningEntity } from '../../entities/robot/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RealmProvisioningSynchronizerContext } from './types.ts';\n\nexport class RealmProvisioningSynchronizer extends BaseProvisioningSynchronizer<RealmProvisioningEntity> {\n    protected repository : IRealmRepository;\n\n    protected clientSynchronizer: IProvisioningSynchronizer<ClientProvisioningEntity>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    protected userSynchronizer: IProvisioningSynchronizer<UserProvisioningEntity>;\n\n    protected robotSynchronizer: IProvisioningSynchronizer<RobotProvisioningEntity>;\n\n    protected scopeSynchronizer : IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n    constructor(ctx: RealmProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.clientSynchronizer = ctx.clientSynchronizer;\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n        this.userSynchronizer = ctx.userSynchronizer;\n        this.robotSynchronizer = ctx.robotSynchronizer;\n        this.scopeSynchronizer = ctx.scopeSynchronizer;\n    }\n\n    async synchronize(input: RealmProvisioningEntity): Promise<RealmProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n        let attributes = await this.repository.findOneBy({ name: input.attributes.name });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (input.relations && input.relations.clients) {\n            const clients = input.relations.clients.map(\n                (child) => {\n                    child.attributes.realm_id = attributes.id;\n                    child.attributes.realm = attributes;\n                    return child;\n                },\n            );\n\n            await this.clientSynchronizer.synchronizeMany(clients);\n        }\n\n        if (input.relations && input.relations.permissions) {\n            const permissions = input.relations.permissions.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(permissions);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const roles = input.relations.roles.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(roles);\n        }\n\n        if (input.relations && input.relations.users) {\n            const users = input.relations.users.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.userSynchronizer.synchronizeMany(users);\n        }\n\n        if (input.relations && input.relations.robots) {\n            const robots = input.relations.robots.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.robotSynchronizer.synchronizeMany(robots);\n        }\n\n        if (input.relations && input.relations.scopes) {\n            const scopes = input.relations.scopes.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.scopeSynchronizer.synchronizeMany(scopes);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;AAoBA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2C;AACnD,SAAK;AAEL,OAAKP,aAAaO,IAAIP;AACtB,OAAKC,qBAAqBM,IAAIN;AAC9B,OAAKC,yBAAyBK,IAAIL;AAClC,OAAKC,mBAAmBI,IAAIJ;AAC5B,OAAKC,mBAAmBG,IAAIH;AAC5B,OAAKC,oBAAoBE,IAAIF;AAC7B,OAAKC,oBAAoBC,IAAID;;CAGjC,MAAME,YAAYC,OAAkE;EAChF,MAAMC,WAAWb,oCAAoCY,MAAMC,SAAQ;EACnE,IAAIC,aAAa,MAAM,KAAKX,WAAWY,UAAU,EAAEC,MAAMJ,MAAME,WAAWE,MAAK,CAAA;AAE/E,MAAIH,SAASI,SAASlB,+BAA+BmB,QAAQ;AACzD,OAAIJ,WACA,OAAM,KAAKX,WAAWgB,OAAOL,WAAAA;AAEjC,UAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;IACpC;;AAGJ,MAAIA,WACA,SAAQD,SAASI,MAAjB;GACI,KAAKlB,+BAA+BqB;AAChCN,iBAAa,KAAKX,WAAWkB,MACzBP,YACAD,SAASC,aACLhB,WAAWc,MAAME,YAAYD,SAASC,WAAU,GAChDF,MAAME,WAAU;AAGxBA,iBAAa,MAAM,KAAKX,WAAWmB,KAAKR,WAAAA;AACxC;GACJ,KAAKf,+BAA+BwB;AAChCX,UAAME,WAAWU,KAAKV,WAAWU;AACjCV,iBAAa,MAAM,KAAKX,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOb,MAAME,WAAU,CAAA;AAC/E;;MAGRA,cAAa,MAAM,KAAKX,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOb,MAAME,WAAU,CAAA;AAGnF,MAAIF,MAAMc,aAAad,MAAMc,UAAUC,SAAS;GAC5C,MAAMA,UAAUf,MAAMc,UAAUC,QAAQC,KACnCC,UAAAA;AACGA,UAAMf,WAAWgB,WAAWhB,WAAWU;AACvCK,UAAMf,WAAWiB,QAAQjB;AACzB,WAAOe;KACX;AAGJ,SAAM,KAAKzB,mBAAmB4B,gBAAgBL,QAAAA;;AAGlD,MAAIf,MAAMc,aAAad,MAAMc,UAAUO,aAAa;GAChD,MAAMA,cAAcrB,MAAMc,UAAUO,YAAYL,KAAKC,UAAAA;AACjDA,UAAMf,WAAWgB,WAAWhB,WAAWU;AACvCK,UAAMf,WAAWiB,QAAQjB;AACzB,WAAOe;KACX;AAEA,SAAM,KAAKxB,uBAAuB2B,gBAAgBC,YAAAA;;AAGtD,MAAIrB,MAAMc,aAAad,MAAMc,UAAUQ,OAAO;GAC1C,MAAMA,QAAQtB,MAAMc,UAAUQ,MAAMN,KAAKC,UAAAA;AACrCA,UAAMf,WAAWgB,WAAWhB,WAAWU;AACvCK,UAAMf,WAAWiB,QAAQjB;AACzB,WAAOe;KACX;AAEA,SAAM,KAAKvB,iBAAiB0B,gBAAgBE,MAAAA;;AAGhD,MAAItB,MAAMc,aAAad,MAAMc,UAAUS,OAAO;GAC1C,MAAMA,QAAQvB,MAAMc,UAAUS,MAAMP,KAAKC,UAAAA;AACrCA,UAAMf,WAAWgB,WAAWhB,WAAWU;AACvCK,UAAMf,WAAWiB,QAAQjB;AACzB,WAAOe;KACX;AAEA,SAAM,KAAKtB,iBAAiByB,gBAAgBG,MAAAA;;AAGhD,MAAIvB,MAAMc,aAAad,MAAMc,UAAUU,QAAQ;GAC3C,MAAMA,SAASxB,MAAMc,UAAUU,OAAOR,KAAKC,UAAAA;AACvCA,UAAMf,WAAWgB,WAAWhB,WAAWU;AACvCK,UAAMf,WAAWiB,QAAQjB;AACzB,WAAOe;KACX;AAEA,SAAM,KAAKrB,kBAAkBwB,gBAAgBI,OAAAA;;AAGjD,MAAIxB,MAAMc,aAAad,MAAMc,UAAUW,QAAQ;GAC3C,MAAMA,SAASzB,MAAMc,UAAUW,OAAOT,KAAKC,UAAAA;AACvCA,UAAMf,WAAWgB,WAAWhB,WAAWU;AACvCK,UAAMf,WAAWiB,QAAQjB;AACzB,WAAOe;KACX;AAEA,SAAM,KAAKpB,kBAAkBuB,gBAAgBK,OAAAA;;AAGjD,SAAO;GACH,GAAGzB;GACHE;GACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","RealmProvisioningSynchronizer","repository","clientSynchronizer","permissionSynchronizer","roleSynchronizer","userSynchronizer","robotSynchronizer","scopeSynchronizer","ctx","synchronize","input","strategy","attributes","findOneBy","name","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","clients","map","child","realm_id","realm","synchronizeMany","permissions","roles","users","robots","scopes"],"sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IRealmRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity, ScopeProvisioningEntity } from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { RealmProvisioningEntity } from '../../entities/realm/index.ts';\nimport type { RobotProvisioningEntity } from '../../entities/robot/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RealmProvisioningSynchronizerContext } from './types.ts';\n\nexport class RealmProvisioningSynchronizer extends BaseProvisioningSynchronizer<RealmProvisioningEntity> {\n    protected repository : IRealmRepository;\n\n    protected clientSynchronizer: IProvisioningSynchronizer<ClientProvisioningEntity>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    protected userSynchronizer: IProvisioningSynchronizer<UserProvisioningEntity>;\n\n    protected robotSynchronizer: IProvisioningSynchronizer<RobotProvisioningEntity>;\n\n    protected scopeSynchronizer : IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n    constructor(ctx: RealmProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.clientSynchronizer = ctx.clientSynchronizer;\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n        this.userSynchronizer = ctx.userSynchronizer;\n        this.robotSynchronizer = ctx.robotSynchronizer;\n        this.scopeSynchronizer = ctx.scopeSynchronizer;\n    }\n\n    async synchronize(input: RealmProvisioningEntity): Promise<RealmProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n        let attributes = await this.repository.findOneBy({ name: input.attributes.name });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (input.relations && input.relations.clients) {\n            const clients = input.relations.clients.map(\n                (child) => {\n                    child.attributes.realm_id = attributes.id;\n                    child.attributes.realm = attributes;\n                    return child;\n                },\n            );\n\n            await this.clientSynchronizer.synchronizeMany(clients);\n        }\n\n        if (input.relations && input.relations.permissions) {\n            const permissions = input.relations.permissions.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(permissions);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const roles = input.relations.roles.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(roles);\n        }\n\n        if (input.relations && input.relations.users) {\n            const users = input.relations.users.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.userSynchronizer.synchronizeMany(users);\n        }\n\n        if (input.relations && input.relations.robots) {\n            const robots = input.relations.robots.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.robotSynchronizer.synchronizeMany(robots);\n        }\n\n        if (input.relations && input.relations.scopes) {\n            const scopes = input.relations.scopes.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.scopeSynchronizer.synchronizeMany(scopes);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;AAoBA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKP,aAAaO,IAAIP;EACtB,KAAKC,qBAAqBM,IAAIN;EAC9B,KAAKC,yBAAyBK,IAAIL;EAClC,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,oBAAoBC,IAAID;CACjC;CAEA,MAAME,YAAYC,OAAkE;EAChF,MAAMC,WAAWb,oCAAoCY,MAAMC,QAAQ;EACnE,IAAIC,aAAa,MAAM,KAAKX,WAAWY,UAAU,EAAEC,MAAMJ,MAAME,WAAWE,KAAK,CAAA;EAE/E,IAAIH,SAASI,SAASlB,+BAA+BmB,QAAQ;GACzD,IAAIJ,YACA,MAAM,KAAKX,WAAWgB,OAAOL,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQD,SAASI,MAAjB;GACI,KAAKlB,+BAA+BqB;IAChCN,aAAa,KAAKX,WAAWkB,MACzBP,YACAD,SAASC,aACLhB,WAAWc,MAAME,YAAYD,SAASC,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKX,WAAWmB,KAAKR,UAAAA;IACxC;GACJ,KAAKf,+BAA+BwB;IAChCX,MAAME,WAAWU,KAAKV,WAAWU;IACjCV,aAAa,MAAM,KAAKX,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOb,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKX,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOb,MAAME,UAAU,CAAA;EAGnF,IAAIF,MAAMc,aAAad,MAAMc,UAAUC,SAAS;GAC5C,MAAMA,UAAUf,MAAMc,UAAUC,QAAQC,KACnCC,UAAAA;IACGA,MAAMf,WAAWgB,WAAWhB,WAAWU;IACvCK,MAAMf,WAAWiB,QAAQjB;IACzB,OAAOe;GACX,CAAA;GAGJ,MAAM,KAAKzB,mBAAmB4B,gBAAgBL,OAAAA;EAClD;EAEA,IAAIf,MAAMc,aAAad,MAAMc,UAAUO,aAAa;GAChD,MAAMA,cAAcrB,MAAMc,UAAUO,YAAYL,KAAKC,UAAAA;IACjDA,MAAMf,WAAWgB,WAAWhB,WAAWU;IACvCK,MAAMf,WAAWiB,QAAQjB;IACzB,OAAOe;GACX,CAAA;GAEA,MAAM,KAAKxB,uBAAuB2B,gBAAgBC,WAAAA;EACtD;EAEA,IAAIrB,MAAMc,aAAad,MAAMc,UAAUQ,OAAO;GAC1C,MAAMA,QAAQtB,MAAMc,UAAUQ,MAAMN,KAAKC,UAAAA;IACrCA,MAAMf,WAAWgB,WAAWhB,WAAWU;IACvCK,MAAMf,WAAWiB,QAAQjB;IACzB,OAAOe;GACX,CAAA;GAEA,MAAM,KAAKvB,iBAAiB0B,gBAAgBE,KAAAA;EAChD;EAEA,IAAItB,MAAMc,aAAad,MAAMc,UAAUS,OAAO;GAC1C,MAAMA,QAAQvB,MAAMc,UAAUS,MAAMP,KAAKC,UAAAA;IACrCA,MAAMf,WAAWgB,WAAWhB,WAAWU;IACvCK,MAAMf,WAAWiB,QAAQjB;IACzB,OAAOe;GACX,CAAA;GAEA,MAAM,KAAKtB,iBAAiByB,gBAAgBG,KAAAA;EAChD;EAEA,IAAIvB,MAAMc,aAAad,MAAMc,UAAUU,QAAQ;GAC3C,MAAMA,SAASxB,MAAMc,UAAUU,OAAOR,KAAKC,UAAAA;IACvCA,MAAMf,WAAWgB,WAAWhB,WAAWU;IACvCK,MAAMf,WAAWiB,QAAQjB;IACzB,OAAOe;GACX,CAAA;GAEA,MAAM,KAAKrB,kBAAkBwB,gBAAgBI,MAAAA;EACjD;EAEA,IAAIxB,MAAMc,aAAad,MAAMc,UAAUW,QAAQ;GAC3C,MAAMA,SAASzB,MAAMc,UAAUW,OAAOT,KAAKC,UAAAA;IACvCA,MAAMf,WAAWgB,WAAWhB,WAAWU;IACvCK,MAAMf,WAAWiB,QAAQjB;IACzB,OAAOe;GACX,CAAA;GAEA,MAAM,KAAKpB,kBAAkBuB,gBAAgBK,MAAAA;EACjD;EAEA,OAAO;GACH,GAAGzB;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/robot/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RobotProvisioningSynchronizer","robotRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","robotPermissionRepository","ownerKey","ownerRealmKey","robotRoleRepository","synchronize","input","strategy","attributes","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","length","roles","globalRoles","realmRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/robot/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Permission, \n    RobotPermission, \n    RobotRole, \n    Role,\n} from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type { IRobotRepository } from '../../../entities/index.ts';\nimport type { RobotProvisioningEntity } from '../../entities/robot/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RobotProvisioningSynchronizerContext } from './types.ts';\n\nexport class RobotProvisioningSynchronizer extends BaseProvisioningSynchronizer<RobotProvisioningEntity> {\n    protected robotRepository: IRobotRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<RobotPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<RobotRole>;\n\n    constructor(ctx: RobotProvisioningSynchronizerContext) {\n        super();\n\n        this.robotRepository = ctx.robotRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.robotPermissionRepository,\n            ownerKey: 'robot_id',\n            ownerRealmKey: 'robot_realm_id',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.robotRoleRepository,\n            ownerKey: 'robot_id',\n            ownerRealmKey: 'robot_realm_id',\n        });\n    }\n\n    async synchronize(input: RobotProvisioningEntity): Promise<RobotProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.robotRepository.findOneBy({\n            name: input.attributes.name,\n            ...(input.attributes.realm_id ? { realm_id: input.attributes.realm_id } : { realm_id: null }),\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.robotRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.robotRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.robotRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.robotRepository.save(this.robotRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.robotRepository.save(this.robotRepository.create(input.attributes));\n        }\n\n        // Permissions (Global & Realm)\n        const permissions = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realm_id ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permission_id',\n                'permission_realm_id',\n            );\n        }\n\n        // Roles (Global & Realm)\n        const roles = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realm_id ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'role_id',\n                'role_realm_id',\n            );\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAsBA,IAAaM,gCAAb,cAAmDH,6BAAAA;CACrCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2C;AACnD,SAAK;AAEL,OAAKL,kBAAkBK,IAAIL;AAE3B,OAAKC,qBAAqB,IAAIJ,2BAA2BQ,IAAIC,qBAAoB;AACjF,OAAKJ,eAAe,IAAIL,2BAA2BQ,IAAIE,eAAc;AAErE,OAAKJ,qBAAqB,IAAIL,iCAAiC;GAC3DU,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;GACnB,CAAA;AACA,OAAKP,eAAe,IAAIN,iCAAiC;GACrDU,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;GACnB,CAAA;;CAGJ,MAAME,YAAYC,OAAkE;EAChF,MAAMC,WAAWpB,oCAAoCmB,MAAMC,SAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKhB,gBAAgBiB,UAAU;GAClDC,MAAMJ,MAAME,WAAWE;GACvB,GAAIJ,MAAME,WAAWG,WAAW,EAAEA,UAAUL,MAAME,WAAWG,UAAS,GAAI,EAAEA,UAAU,MAAM;GAChG,CAAA;AAEA,MAAIJ,SAASK,SAAS1B,+BAA+B2B,QAAQ;AACzD,OAAIL,WACA,OAAM,KAAKhB,gBAAgBsB,OAAON,WAAAA;AAEtC,UAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;IACpC;;AAGJ,MAAIA,WACA,SAAQD,SAASK,MAAjB;GACI,KAAK1B,+BAA+B6B;AAChCP,iBAAa,KAAKhB,gBAAgBwB,MAC9BR,YACAD,SAASC,aACLvB,WAAWqB,MAAME,YAAYD,SAASC,WAAU,GAChDF,MAAME,WAAU;AAGxBA,iBAAa,MAAM,KAAKhB,gBAAgByB,KAAKT,WAAAA;AAC7C;GACJ,KAAKtB,+BAA+BgC;AAChCZ,UAAME,WAAWW,KAAKX,WAAWW;AACjCX,iBAAa,MAAM,KAAKhB,gBAAgByB,KAAK,KAAKzB,gBAAgB4B,OAAOd,MAAME,WAAU,CAAA;AACzF;;MAGRA,cAAa,MAAM,KAAKhB,gBAAgByB,KAAK,KAAKzB,gBAAgB4B,OAAOd,MAAME,WAAU,CAAA;EAI7F,MAAMa,cAAc,CAAA,GACb,MAAM,KAAK5B,mBAAmB6B,cAC7BhB,MAAMiB,aAAajB,MAAMiB,UAAUC,kBAAiB,EAAA,GAEpDhB,WAAWG,WACX,MAAM,KAAKlB,mBAAmBgC,aAC1BnB,MAAMiB,aAAajB,MAAMiB,UAAUG,kBACnClB,WAAWG,SAAQ,GAEvB,EAAE,CACT;AAED,MAAIU,YAAYM,SAAS,EACrB,OAAM,KAAKhC,mBAAmBU,YAC1BG,YACAa,aACA,iBACA,sBAAA;EAKR,MAAMO,QAAQ,CAAA,GACP,MAAM,KAAKlC,aAAa4B,cACvBhB,MAAMiB,aAAajB,MAAMiB,UAAUM,YAAW,EAAA,GAE9CrB,WAAWG,WACX,MAAM,KAAKjB,aAAa+B,aACpBnB,MAAMiB,aAAajB,MAAMiB,UAAUO,YACnCtB,WAAWG,SAAQ,GAEvB,EAAE,CACT;AAED,MAAIiB,MAAMD,SAAS,EACf,OAAM,KAAK/B,aAAaS,YACpBG,YACAoB,OACA,WACA,gBAAA;AAIR,SAAO;GACH,GAAGtB;GACHE;GACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RobotProvisioningSynchronizer","robotRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","robotPermissionRepository","ownerKey","ownerRealmKey","robotRoleRepository","synchronize","input","strategy","attributes","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","length","roles","globalRoles","realmRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/robot/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Permission, \n    RobotPermission, \n    RobotRole, \n    Role,\n} from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type { IRobotRepository } from '../../../entities/index.ts';\nimport type { RobotProvisioningEntity } from '../../entities/robot/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RobotProvisioningSynchronizerContext } from './types.ts';\n\nexport class RobotProvisioningSynchronizer extends BaseProvisioningSynchronizer<RobotProvisioningEntity> {\n    protected robotRepository: IRobotRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<RobotPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<RobotRole>;\n\n    constructor(ctx: RobotProvisioningSynchronizerContext) {\n        super();\n\n        this.robotRepository = ctx.robotRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.robotPermissionRepository,\n            ownerKey: 'robot_id',\n            ownerRealmKey: 'robot_realm_id',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.robotRoleRepository,\n            ownerKey: 'robot_id',\n            ownerRealmKey: 'robot_realm_id',\n        });\n    }\n\n    async synchronize(input: RobotProvisioningEntity): Promise<RobotProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.robotRepository.findOneBy({\n            name: input.attributes.name,\n            ...(input.attributes.realm_id ? { realm_id: input.attributes.realm_id } : { realm_id: null }),\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.robotRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.robotRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.robotRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.robotRepository.save(this.robotRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.robotRepository.save(this.robotRepository.create(input.attributes));\n        }\n\n        // Permissions (Global & Realm)\n        const permissions = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realm_id ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permission_id',\n                'permission_realm_id',\n            );\n        }\n\n        // Roles (Global & Realm)\n        const roles = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realm_id ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'role_id',\n                'role_realm_id',\n            );\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAsBA,IAAaM,gCAAb,cAAmDH,6BAAAA;CACrCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKL,kBAAkBK,IAAIL;EAE3B,KAAKC,qBAAqB,IAAIJ,2BAA2BQ,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIL,2BAA2BQ,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIL,iCAAiC;GAC3DU,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIN,iCAAiC;GACrDU,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAkE;EAChF,MAAMC,WAAWpB,oCAAoCmB,MAAMC,QAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKhB,gBAAgBiB,UAAU;GAClDC,MAAMJ,MAAME,WAAWE;GACvB,GAAIJ,MAAME,WAAWG,WAAW,EAAEA,UAAUL,MAAME,WAAWG,SAAS,IAAI,EAAEA,UAAU,KAAK;EAC/F,CAAA;EAEA,IAAIJ,SAASK,SAAS1B,+BAA+B2B,QAAQ;GACzD,IAAIL,YACA,MAAM,KAAKhB,gBAAgBsB,OAAON,UAAAA;GAEtC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQD,SAASK,MAAjB;GACI,KAAK1B,+BAA+B6B;IAChCP,aAAa,KAAKhB,gBAAgBwB,MAC9BR,YACAD,SAASC,aACLvB,WAAWqB,MAAME,YAAYD,SAASC,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKhB,gBAAgByB,KAAKT,UAAAA;IAC7C;GACJ,KAAKtB,+BAA+BgC;IAChCZ,MAAME,WAAWW,KAAKX,WAAWW;IACjCX,aAAa,MAAM,KAAKhB,gBAAgByB,KAAK,KAAKzB,gBAAgB4B,OAAOd,MAAME,UAAU,CAAA;IACzF;EACR;OAEAA,aAAa,MAAM,KAAKhB,gBAAgByB,KAAK,KAAKzB,gBAAgB4B,OAAOd,MAAME,UAAU,CAAA;EAI7F,MAAMa,cAAc,CAAA,GACb,MAAM,KAAK5B,mBAAmB6B,cAC7BhB,MAAMiB,aAAajB,MAAMiB,UAAUC,iBAAiB,GAAA,GAEpDhB,WAAWG,WACX,MAAM,KAAKlB,mBAAmBgC,aAC1BnB,MAAMiB,aAAajB,MAAMiB,UAAUG,kBACnClB,WAAWG,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIU,YAAYM,SAAS,GACrB,MAAM,KAAKhC,mBAAmBU,YAC1BG,YACAa,aACA,iBACA,qBAAA;EAKR,MAAMO,QAAQ,CAAA,GACP,MAAM,KAAKlC,aAAa4B,cACvBhB,MAAMiB,aAAajB,MAAMiB,UAAUM,WAAW,GAAA,GAE9CrB,WAAWG,WACX,MAAM,KAAKjB,aAAa+B,aACpBnB,MAAMiB,aAAajB,MAAMiB,UAAUO,YACnCtB,WAAWG,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIiB,MAAMD,SAAS,GACf,MAAM,KAAK/B,aAAaS,YACpBG,YACAoB,OACA,WACA,eAAA;EAIR,OAAO;GACH,GAAGtB;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/role/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RoleProvisioningSynchronizer","repository","policyRepository","permissionResolver","permissionJunction","ctx","permissionRepository","rolePermissionRepository","ownerKey","ownerRealmKey","synchronize","input","strategy","attributes","findOneBy","name","realm_id","client_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","globalPermissions","resolveGlobal","globalPermissionsExclude","length","excludeSet","Set","filter","p","has","realmPermissions","resolveRealm","permissions","policyMap","resolvePolicyMap","permission","policyId","overrides","get","defaultPolicyId","policy_id","undefined","roleName","globalPermissionsPolicyName","defaultPolicy","findOneByName","Error","Map","globalPermissionsPolicyOverrides","policyName","permissionNames","Object","entries","policy","permName","set"],"sources":["../../../../../src/core/provisioning/synchronizer/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IPolicyRepository, IRoleRepository } from '../../../entities/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RoleProvisioningSynchronizerContext } from './types.ts';\n\nexport class RoleProvisioningSynchronizer extends BaseProvisioningSynchronizer<RoleProvisioningEntity> {\n    protected repository : IRoleRepository;\n\n    protected policyRepository?: IPolicyRepository;\n\n    protected permissionResolver : ProvisioningEntityResolver<Permission>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<RolePermission>;\n\n    constructor(ctx: RoleProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.rolePermissionRepository,\n            ownerKey: 'role_id',\n            ownerRealmKey: 'role_realm_id',\n        });\n    }\n\n    async synchronize(input: RoleProvisioningEntity): Promise<RoleProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n            client_id: input.attributes.client_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (!input.relations) {\n            return {\n                ...input,\n                attributes,\n            };\n        }\n\n        let globalPermissions = await this.permissionResolver.resolveGlobal(input.relations.globalPermissions);\n\n        if (input.relations.globalPermissionsExclude && input.relations.globalPermissionsExclude.length > 0) {\n            const excludeSet = new Set(input.relations.globalPermissionsExclude);\n            globalPermissions = globalPermissions.filter((p) => !excludeSet.has(p.name));\n        }\n\n        const realmPermissions = attributes.realm_id ?\n            await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realm_id) :\n            [];\n\n        const permissions = [\n            ...globalPermissions,\n            ...realmPermissions,\n        ];\n\n        if (permissions.length > 0) {\n            const policyMap = await this.resolvePolicyMap(input, attributes.name);\n\n            if (policyMap) {\n                for (const permission of permissions) {\n                    const policyId = policyMap.overrides.get(permission.name) ?? policyMap.defaultPolicyId;\n                    await this.permissionJunction.synchronize(\n                        attributes,\n                        [permission],\n                        'permission_id',\n                        'permission_realm_id',\n                        policyId ? { policy_id: policyId } : undefined,\n                    );\n                }\n            } else {\n                await this.permissionJunction.synchronize(\n                    attributes,\n                    permissions,\n                    'permission_id',\n                    'permission_realm_id',\n                );\n            }\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n\n    private async resolvePolicyMap(\n        input: RoleProvisioningEntity,\n        roleName: string | undefined,\n    ): Promise<{\n        defaultPolicyId: string | undefined,\n        overrides: Map<string, string> \n    } | undefined> {\n        if (!input.relations?.globalPermissionsPolicyName || !this.policyRepository) {\n            return undefined;\n        }\n\n        const defaultPolicy = await this.policyRepository.findOneByName(input.relations.globalPermissionsPolicyName);\n        if (!defaultPolicy) {\n            throw new Error(\n                `Provisioning: policy '${input.relations.globalPermissionsPolicyName}' not found for role '${roleName}'.`,\n            );\n        }\n\n        const overrides = new Map<string, string>();\n\n        if (input.relations.globalPermissionsPolicyOverrides) {\n            for (const [policyName, permissionNames] of Object.entries(input.relations.globalPermissionsPolicyOverrides)) {\n                const policy = await this.policyRepository.findOneByName(policyName);\n                if (!policy) {\n                    throw new Error(\n                        `Provisioning: override policy '${policyName}' not found for role '${roleName}'.`,\n                    );\n                }\n                for (const permName of permissionNames) {\n                    overrides.set(permName, policy.id);\n                }\n            }\n        }\n\n        return {\n            defaultPolicyId: defaultPolicy.id,\n            overrides,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAiBA,IAAaM,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;AAClD,SAAK;AAEL,OAAKJ,aAAaI,IAAIJ;AACtB,OAAKC,mBAAmBG,IAAIH;AAC5B,OAAKC,qBAAqB,IAAIL,2BAA2BO,IAAIC,qBAAoB;AACjF,OAAKF,qBAAqB,IAAIL,iCAAiC;GAC3DE,YAAYI,IAAIE;GAChBC,UAAU;GACVC,eAAe;GACnB,CAAA;;CAGJ,MAAMC,YAAYC,OAAgE;EAC9E,MAAMC,WAAWhB,oCAAoCe,MAAMC,SAAQ;EACnE,IAAIC,aAAa,MAAM,KAAKZ,WAAWa,UAAU;GAC7CC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GACvCC,WAAWN,MAAME,WAAWI,aAAa;GAC7C,CAAA;AAEA,MAAIL,SAASM,SAASvB,+BAA+BwB,QAAQ;AACzD,OAAIN,WACA,OAAM,KAAKZ,WAAWmB,OAAOP,WAAAA;AAEjC,UAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;IACpC;;AAGJ,MAAIA,WACA,SAAQD,SAASM,MAAjB;GACI,KAAKvB,+BAA+B0B;AAChCR,iBAAa,KAAKZ,WAAWqB,MACzBT,YACAD,SAASC,aACLnB,WAAWiB,MAAME,YAAYD,SAASC,WAAU,GAChDF,MAAME,WAAU;AAGxBA,iBAAa,MAAM,KAAKZ,WAAWsB,KAAKV,WAAAA;AACxC;GACJ,KAAKlB,+BAA+B6B;AAChCb,UAAME,WAAWY,KAAKZ,WAAWY;AACjCZ,iBAAa,MAAM,KAAKZ,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOf,MAAME,WAAU,CAAA;AAC/E;;MAGRA,cAAa,MAAM,KAAKZ,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOf,MAAME,WAAU,CAAA;AAGnF,MAAI,CAACF,MAAMgB,UACP,QAAO;GACH,GAAGhB;GACHE;GACJ;EAGJ,IAAIe,oBAAoB,MAAM,KAAKzB,mBAAmB0B,cAAclB,MAAMgB,UAAUC,kBAAiB;AAErG,MAAIjB,MAAMgB,UAAUG,4BAA4BnB,MAAMgB,UAAUG,yBAAyBC,SAAS,GAAG;GACjG,MAAMC,aAAa,IAAIC,IAAItB,MAAMgB,UAAUG,yBAAwB;AACnEF,uBAAoBA,kBAAkBM,QAAQC,MAAM,CAACH,WAAWI,IAAID,EAAEpB,KAAI,CAAA;;EAG9E,MAAMsB,mBAAmBxB,WAAWG,WAChC,MAAM,KAAKb,mBAAmBmC,aAAa3B,MAAMgB,UAAUU,kBAAkBxB,WAAWG,SAAQ,GAChG,EAAE;EAEN,MAAMuB,cAAc,CAAA,GACbX,mBAAAA,GACAS,iBACN;AAED,MAAIE,YAAYR,SAAS,GAAG;GACxB,MAAMS,YAAY,MAAM,KAAKC,iBAAiB9B,OAAOE,WAAWE,KAAI;AAEpE,OAAIyB,UACA,MAAK,MAAME,cAAcH,aAAa;IAClC,MAAMI,WAAWH,UAAUI,UAAUC,IAAIH,WAAW3B,KAAI,IAAKyB,UAAUM;AACvE,UAAM,KAAK1C,mBAAmBM,YAC1BG,YACA,CAAC6B,WAAW,EACZ,iBACA,uBACAC,WAAW,EAAEI,WAAWJ,UAAS,GAAIK,KAAAA,EAAAA;;OAI7C,OAAM,KAAK5C,mBAAmBM,YAC1BG,YACA0B,aACA,iBACA,sBAAA;;AAKZ,SAAO;GACH,GAAG5B;GACHE;GACJ;;CAGJ,MAAc4B,iBACV9B,OACAsC,UAIW;AACX,MAAI,CAACtC,MAAMgB,WAAWuB,+BAA+B,CAAC,KAAKhD,iBACvD;EAGJ,MAAMiD,gBAAgB,MAAM,KAAKjD,iBAAiBkD,cAAczC,MAAMgB,UAAUuB,4BAA2B;AAC3G,MAAI,CAACC,cACD,OAAM,IAAIE,MACN,yBAAyB1C,MAAMgB,UAAUuB,4BAA4B,wBAAwBD,SAAS,IAAG;EAIjH,MAAML,4BAAY,IAAIU,KAAAA;AAEtB,MAAI3C,MAAMgB,UAAU4B,iCAChB,MAAK,MAAM,CAACC,YAAYC,oBAAoBC,OAAOC,QAAQhD,MAAMgB,UAAU4B,iCAAgC,EAAG;GAC1G,MAAMK,SAAS,MAAM,KAAK1D,iBAAiBkD,cAAcI,WAAAA;AACzD,OAAI,CAACI,OACD,OAAM,IAAIP,MACN,kCAAkCG,WAAW,wBAAwBP,SAAS,IAAG;AAGzF,QAAK,MAAMY,YAAYJ,gBACnBb,WAAUkB,IAAID,UAAUD,OAAOnC,GAAE;;AAK7C,SAAO;GACHqB,iBAAiBK,cAAc1B;GAC/BmB;GACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RoleProvisioningSynchronizer","repository","policyRepository","permissionResolver","permissionJunction","ctx","permissionRepository","rolePermissionRepository","ownerKey","ownerRealmKey","synchronize","input","strategy","attributes","findOneBy","name","realm_id","client_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","globalPermissions","resolveGlobal","globalPermissionsExclude","length","excludeSet","Set","filter","p","has","realmPermissions","resolveRealm","permissions","policyMap","resolvePolicyMap","permission","policyId","overrides","get","defaultPolicyId","policy_id","undefined","roleName","globalPermissionsPolicyName","defaultPolicy","findOneByName","Error","Map","globalPermissionsPolicyOverrides","policyName","permissionNames","Object","entries","policy","permName","set"],"sources":["../../../../../src/core/provisioning/synchronizer/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IPolicyRepository, IRoleRepository } from '../../../entities/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RoleProvisioningSynchronizerContext } from './types.ts';\n\nexport class RoleProvisioningSynchronizer extends BaseProvisioningSynchronizer<RoleProvisioningEntity> {\n    protected repository : IRoleRepository;\n\n    protected policyRepository?: IPolicyRepository;\n\n    protected permissionResolver : ProvisioningEntityResolver<Permission>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<RolePermission>;\n\n    constructor(ctx: RoleProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.rolePermissionRepository,\n            ownerKey: 'role_id',\n            ownerRealmKey: 'role_realm_id',\n        });\n    }\n\n    async synchronize(input: RoleProvisioningEntity): Promise<RoleProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n            client_id: input.attributes.client_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (!input.relations) {\n            return {\n                ...input,\n                attributes,\n            };\n        }\n\n        let globalPermissions = await this.permissionResolver.resolveGlobal(input.relations.globalPermissions);\n\n        if (input.relations.globalPermissionsExclude && input.relations.globalPermissionsExclude.length > 0) {\n            const excludeSet = new Set(input.relations.globalPermissionsExclude);\n            globalPermissions = globalPermissions.filter((p) => !excludeSet.has(p.name));\n        }\n\n        const realmPermissions = attributes.realm_id ?\n            await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realm_id) :\n            [];\n\n        const permissions = [\n            ...globalPermissions,\n            ...realmPermissions,\n        ];\n\n        if (permissions.length > 0) {\n            const policyMap = await this.resolvePolicyMap(input, attributes.name);\n\n            if (policyMap) {\n                for (const permission of permissions) {\n                    const policyId = policyMap.overrides.get(permission.name) ?? policyMap.defaultPolicyId;\n                    await this.permissionJunction.synchronize(\n                        attributes,\n                        [permission],\n                        'permission_id',\n                        'permission_realm_id',\n                        policyId ? { policy_id: policyId } : undefined,\n                    );\n                }\n            } else {\n                await this.permissionJunction.synchronize(\n                    attributes,\n                    permissions,\n                    'permission_id',\n                    'permission_realm_id',\n                );\n            }\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n\n    private async resolvePolicyMap(\n        input: RoleProvisioningEntity,\n        roleName: string | undefined,\n    ): Promise<{\n        defaultPolicyId: string | undefined,\n        overrides: Map<string, string> \n    } | undefined> {\n        if (!input.relations?.globalPermissionsPolicyName || !this.policyRepository) {\n            return undefined;\n        }\n\n        const defaultPolicy = await this.policyRepository.findOneByName(input.relations.globalPermissionsPolicyName);\n        if (!defaultPolicy) {\n            throw new Error(\n                `Provisioning: policy '${input.relations.globalPermissionsPolicyName}' not found for role '${roleName}'.`,\n            );\n        }\n\n        const overrides = new Map<string, string>();\n\n        if (input.relations.globalPermissionsPolicyOverrides) {\n            for (const [policyName, permissionNames] of Object.entries(input.relations.globalPermissionsPolicyOverrides)) {\n                const policy = await this.policyRepository.findOneByName(policyName);\n                if (!policy) {\n                    throw new Error(\n                        `Provisioning: override policy '${policyName}' not found for role '${roleName}'.`,\n                    );\n                }\n                for (const permName of permissionNames) {\n                    overrides.set(permName, policy.id);\n                }\n            }\n        }\n\n        return {\n            defaultPolicyId: defaultPolicy.id,\n            overrides,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAiBA,IAAaM,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,qBAAqB,IAAIL,2BAA2BO,IAAIC,oBAAoB;EACjF,KAAKF,qBAAqB,IAAIL,iCAAiC;GAC3DE,YAAYI,IAAIE;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAMC,YAAYC,OAAgE;EAC9E,MAAMC,WAAWhB,oCAAoCe,MAAMC,QAAQ;EACnE,IAAIC,aAAa,MAAM,KAAKZ,WAAWa,UAAU;GAC7CC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GACvCC,WAAWN,MAAME,WAAWI,aAAa;EAC7C,CAAA;EAEA,IAAIL,SAASM,SAASvB,+BAA+BwB,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKZ,WAAWmB,OAAOP,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQD,SAASM,MAAjB;GACI,KAAKvB,+BAA+B0B;IAChCR,aAAa,KAAKZ,WAAWqB,MACzBT,YACAD,SAASC,aACLnB,WAAWiB,MAAME,YAAYD,SAASC,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKZ,WAAWsB,KAAKV,UAAAA;IACxC;GACJ,KAAKlB,+BAA+B6B;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKZ,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOf,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKZ,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOf,MAAME,UAAU,CAAA;EAGnF,IAAI,CAACF,MAAMgB,WACP,OAAO;GACH,GAAGhB;GACHE;EACJ;EAGJ,IAAIe,oBAAoB,MAAM,KAAKzB,mBAAmB0B,cAAclB,MAAMgB,UAAUC,iBAAiB;EAErG,IAAIjB,MAAMgB,UAAUG,4BAA4BnB,MAAMgB,UAAUG,yBAAyBC,SAAS,GAAG;GACjG,MAAMC,aAAa,IAAIC,IAAItB,MAAMgB,UAAUG,wBAAwB;GACnEF,oBAAoBA,kBAAkBM,QAAQC,MAAM,CAACH,WAAWI,IAAID,EAAEpB,IAAI,CAAA;EAC9E;EAEA,MAAMsB,mBAAmBxB,WAAWG,WAChC,MAAM,KAAKb,mBAAmBmC,aAAa3B,MAAMgB,UAAUU,kBAAkBxB,WAAWG,QAAQ,IAChG,CAAA;EAEJ,MAAMuB,cAAc,CAAA,GACbX,mBAAAA,GACAS,gBAAAA;EAGP,IAAIE,YAAYR,SAAS,GAAG;GACxB,MAAMS,YAAY,MAAM,KAAKC,iBAAiB9B,OAAOE,WAAWE,IAAI;GAEpE,IAAIyB,WACA,KAAK,MAAME,cAAcH,aAAa;IAClC,MAAMI,WAAWH,UAAUI,UAAUC,IAAIH,WAAW3B,IAAI,KAAKyB,UAAUM;IACvE,MAAM,KAAK1C,mBAAmBM,YAC1BG,YACA,CAAC6B,UAAAA,GACD,iBACA,uBACAC,WAAW,EAAEI,WAAWJ,SAAS,IAAIK,KAAAA,CAAAA;GAE7C;QAEA,MAAM,KAAK5C,mBAAmBM,YAC1BG,YACA0B,aACA,iBACA,qBAAA;EAGZ;EAEA,OAAO;GACH,GAAG5B;GACHE;EACJ;CACJ;CAEA,MAAc4B,iBACV9B,OACAsC,UAIW;EACX,IAAI,CAACtC,MAAMgB,WAAWuB,+BAA+B,CAAC,KAAKhD,kBACvD;EAGJ,MAAMiD,gBAAgB,MAAM,KAAKjD,iBAAiBkD,cAAczC,MAAMgB,UAAUuB,2BAA2B;EAC3G,IAAI,CAACC,eACD,MAAM,IAAIE,MACN,yBAAyB1C,MAAMgB,UAAUuB,4BAA4B,wBAAwBD,SAAS,GAAG;EAIjH,MAAML,4BAAY,IAAIU,IAAAA;EAEtB,IAAI3C,MAAMgB,UAAU4B,kCAChB,KAAK,MAAM,CAACC,YAAYC,oBAAoBC,OAAOC,QAAQhD,MAAMgB,UAAU4B,gCAAgC,GAAG;GAC1G,MAAMK,SAAS,MAAM,KAAK1D,iBAAiBkD,cAAcI,UAAAA;GACzD,IAAI,CAACI,QACD,MAAM,IAAIP,MACN,kCAAkCG,WAAW,wBAAwBP,SAAS,GAAG;GAGzF,KAAK,MAAMY,YAAYJ,iBACnBb,UAAUkB,IAAID,UAAUD,OAAOnC,EAAE;EAEzC;EAGJ,OAAO;GACHqB,iBAAiBK,cAAc1B;GAC/BmB;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/root/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["BaseProvisioningSynchronizer","GraphProvisioningSynchronizer","policySynchronizer","realmSynchronizer","permissionSynchronizer","roleSynchronizer","scopeSynchronizer","ctx","synchronize","input","output","policies","synchronizeMany","permissions","roles","scopes","realms"],"sources":["../../../../../src/core/provisioning/synchronizer/root/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    PolicyProvisioningEntity,\n    RealmProvisioningEntity,\n    RoleProvisioningEntity,\n    RootProvisioningEntity,\n    ScopeProvisioningEntity,\n} from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RootProvisioningSynchronizerContext } from './types.ts';\n\nexport class GraphProvisioningSynchronizer extends BaseProvisioningSynchronizer<RootProvisioningEntity> {\n    protected policySynchronizer: IProvisioningSynchronizer<PolicyProvisioningEntity>;\n\n    protected realmSynchronizer: IProvisioningSynchronizer<RealmProvisioningEntity>;\n\n    protected permissionSynchronizer : IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    protected scopeSynchronizer: IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n    constructor(ctx: RootProvisioningSynchronizerContext) {\n        super();\n\n        this.policySynchronizer = ctx.policySynchronizer;\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.realmSynchronizer = ctx.realmSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n        this.scopeSynchronizer = ctx.scopeSynchronizer;\n    }\n\n    async synchronize(input: RootProvisioningEntity): Promise<RootProvisioningEntity> {\n        const output : RootProvisioningEntity = {};\n\n        if (input.policies) {\n            output.policies = await this.policySynchronizer.synchronizeMany(input.policies);\n        }\n\n        if (input.permissions) {\n            output.permissions = await this.permissionSynchronizer.synchronizeMany(input.permissions);\n        }\n\n        if (input.roles) {\n            output.roles = await this.roleSynchronizer.synchronizeMany(input.roles);\n        }\n\n        if (input.scopes) {\n            output.scopes = await this.scopeSynchronizer.synchronizeMany(input.scopes);\n        }\n\n        if (input.realms) {\n            output.realms = await this.realmSynchronizer.synchronizeMany(input.realms);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;AAmBA,IAAaC,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;AAClD,SAAK;AAEL,OAAKL,qBAAqBK,IAAIL;AAC9B,OAAKE,yBAAyBG,IAAIH;AAClC,OAAKD,oBAAoBI,IAAIJ;AAC7B,OAAKE,mBAAmBE,IAAIF;AAC5B,OAAKC,oBAAoBC,IAAID;;CAGjC,MAAME,YAAYC,OAAgE;EAC9E,MAAMC,SAAkC,EAAC;AAEzC,MAAID,MAAME,SACND,QAAOC,WAAW,MAAM,KAAKT,mBAAmBU,gBAAgBH,MAAME,SAAQ;AAGlF,MAAIF,MAAMI,YACNH,QAAOG,cAAc,MAAM,KAAKT,uBAAuBQ,gBAAgBH,MAAMI,YAAW;AAG5F,MAAIJ,MAAMK,MACNJ,QAAOI,QAAQ,MAAM,KAAKT,iBAAiBO,gBAAgBH,MAAMK,MAAK;AAG1E,MAAIL,MAAMM,OACNL,QAAOK,SAAS,MAAM,KAAKT,kBAAkBM,gBAAgBH,MAAMM,OAAM;AAG7E,MAAIN,MAAMO,OACNN,QAAOM,SAAS,MAAM,KAAKb,kBAAkBS,gBAAgBH,MAAMO,OAAM;AAG7E,SAAON"}
+{"version":3,"file":"module.mjs","names":["BaseProvisioningSynchronizer","GraphProvisioningSynchronizer","policySynchronizer","realmSynchronizer","permissionSynchronizer","roleSynchronizer","scopeSynchronizer","ctx","synchronize","input","output","policies","synchronizeMany","permissions","roles","scopes","realms"],"sources":["../../../../../src/core/provisioning/synchronizer/root/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    PolicyProvisioningEntity,\n    RealmProvisioningEntity,\n    RoleProvisioningEntity,\n    RootProvisioningEntity,\n    ScopeProvisioningEntity,\n} from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RootProvisioningSynchronizerContext } from './types.ts';\n\nexport class GraphProvisioningSynchronizer extends BaseProvisioningSynchronizer<RootProvisioningEntity> {\n    protected policySynchronizer: IProvisioningSynchronizer<PolicyProvisioningEntity>;\n\n    protected realmSynchronizer: IProvisioningSynchronizer<RealmProvisioningEntity>;\n\n    protected permissionSynchronizer : IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    protected scopeSynchronizer: IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n    constructor(ctx: RootProvisioningSynchronizerContext) {\n        super();\n\n        this.policySynchronizer = ctx.policySynchronizer;\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.realmSynchronizer = ctx.realmSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n        this.scopeSynchronizer = ctx.scopeSynchronizer;\n    }\n\n    async synchronize(input: RootProvisioningEntity): Promise<RootProvisioningEntity> {\n        const output : RootProvisioningEntity = {};\n\n        if (input.policies) {\n            output.policies = await this.policySynchronizer.synchronizeMany(input.policies);\n        }\n\n        if (input.permissions) {\n            output.permissions = await this.permissionSynchronizer.synchronizeMany(input.permissions);\n        }\n\n        if (input.roles) {\n            output.roles = await this.roleSynchronizer.synchronizeMany(input.roles);\n        }\n\n        if (input.scopes) {\n            output.scopes = await this.scopeSynchronizer.synchronizeMany(input.scopes);\n        }\n\n        if (input.realms) {\n            output.realms = await this.realmSynchronizer.synchronizeMany(input.realms);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;AAmBA,IAAaC,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKL,qBAAqBK,IAAIL;EAC9B,KAAKE,yBAAyBG,IAAIH;EAClC,KAAKD,oBAAoBI,IAAIJ;EAC7B,KAAKE,mBAAmBE,IAAIF;EAC5B,KAAKC,oBAAoBC,IAAID;CACjC;CAEA,MAAME,YAAYC,OAAgE;EAC9E,MAAMC,SAAkC,CAAC;EAEzC,IAAID,MAAME,UACND,OAAOC,WAAW,MAAM,KAAKT,mBAAmBU,gBAAgBH,MAAME,QAAQ;EAGlF,IAAIF,MAAMI,aACNH,OAAOG,cAAc,MAAM,KAAKT,uBAAuBQ,gBAAgBH,MAAMI,WAAW;EAG5F,IAAIJ,MAAMK,OACNJ,OAAOI,QAAQ,MAAM,KAAKT,iBAAiBO,gBAAgBH,MAAMK,KAAK;EAG1E,IAAIL,MAAMM,QACNL,OAAOK,SAAS,MAAM,KAAKT,kBAAkBM,gBAAgBH,MAAMM,MAAM;EAG7E,IAAIN,MAAMO,QACNN,OAAOM,SAAS,MAAM,KAAKb,kBAAkBS,gBAAgBH,MAAMO,MAAM;EAG7E,OAAON;CACX;AACJ"}

package/dist/core/provisioning/synchronizer/scope/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ScopeProvisioningSynchronizer","repository","ctx","synchronize","input","strategy","attributes","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create"],"sources":["../../../../../src/core/provisioning/synchronizer/scope/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IScopeRepository } from '../../../entities/index.ts';\nimport type { ScopeProvisioningEntity } from '../../entities/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { ScopeProvisioningSynchronizerContext } from './types.ts';\n\nexport class ScopeProvisioningSynchronizer extends BaseProvisioningSynchronizer<ScopeProvisioningEntity> {\n    protected repository : IScopeRepository;\n\n    constructor(ctx: ScopeProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n    }\n\n    async synchronize(input: ScopeProvisioningEntity): Promise<ScopeProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEV,YAAYC,KAA2C;AACnD,SAAK;AAEL,OAAKD,aAAaC,IAAID;;CAG1B,MAAME,YAAYC,OAAkE;EAChF,MAAMC,WAAWP,oCAAoCM,MAAMC,SAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKL,WAAWM,UAAU;GAC7CC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GAC3C,CAAA;AAEA,MAAIJ,SAASK,SAASb,+BAA+Bc,QAAQ;AACzD,OAAIL,WACA,OAAM,KAAKL,WAAWW,OAAON,WAAAA;AAEjC,UAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;IACpC;;AAGJ,MAAIA,WACA,SAAQD,SAASK,MAAjB;GACI,KAAKb,+BAA+BgB;AAChCP,iBAAa,KAAKL,WAAWa,MACzBR,YACAD,SAASC,aACLV,WAAWQ,MAAME,YAAYD,SAASC,WAAU,GAChDF,MAAME,WAAU;AAGxBA,iBAAa,MAAM,KAAKL,WAAWc,KAAKT,WAAAA;AACxC;GACJ,KAAKT,+BAA+BmB;AAChCZ,UAAME,WAAWW,KAAKX,WAAWW;AACjCX,iBAAa,MAAM,KAAKL,WAAWc,KAAK,KAAKd,WAAWiB,OAAOd,MAAME,WAAU,CAAA;AAC/E;;MAGRA,cAAa,MAAM,KAAKL,WAAWc,KAAK,KAAKd,WAAWiB,OAAOd,MAAME,WAAU,CAAA;AAGnF,SAAO;GACH,GAAGF;GACHE;GACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ScopeProvisioningSynchronizer","repository","ctx","synchronize","input","strategy","attributes","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create"],"sources":["../../../../../src/core/provisioning/synchronizer/scope/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IScopeRepository } from '../../../entities/index.ts';\nimport type { ScopeProvisioningEntity } from '../../entities/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { ScopeProvisioningSynchronizerContext } from './types.ts';\n\nexport class ScopeProvisioningSynchronizer extends BaseProvisioningSynchronizer<ScopeProvisioningEntity> {\n    protected repository : IScopeRepository;\n\n    constructor(ctx: ScopeProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n    }\n\n    async synchronize(input: ScopeProvisioningEntity): Promise<ScopeProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MAAME,YAAYC,OAAkE;EAChF,MAAMC,WAAWP,oCAAoCM,MAAMC,QAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKL,WAAWM,UAAU;GAC7CC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;EAC3C,CAAA;EAEA,IAAIJ,SAASK,SAASb,+BAA+Bc,QAAQ;GACzD,IAAIL,YACA,MAAM,KAAKL,WAAWW,OAAON,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQD,SAASK,MAAjB;GACI,KAAKb,+BAA+BgB;IAChCP,aAAa,KAAKL,WAAWa,MACzBR,YACAD,SAASC,aACLV,WAAWQ,MAAME,YAAYD,SAASC,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKL,WAAWc,KAAKT,UAAAA;IACxC;GACJ,KAAKT,+BAA+BmB;IAChCZ,MAAME,WAAWW,KAAKX,WAAWW;IACjCX,aAAa,MAAM,KAAKL,WAAWc,KAAK,KAAKd,WAAWiB,OAAOd,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKL,WAAWc,KAAK,KAAKd,WAAWiB,OAAOd,MAAME,UAAU,CAAA;EAGnF,OAAO;GACH,GAAGF;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/user/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["buildUserFakeEmail","pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","UserProvisioningSynchronizer","userRepository","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","userPermissionRepository","ownerKey","ownerRealmKey","userRoleRepository","synchronize","input","strategy","attributes","findOneBy","name","realm_id","client_id","type","ABSENT","remove","MERGE","includes","email","merge","save","REPLACE","undefined","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","clientPermissions","clientKeys","Object","keys","clientKey","client","entities","resolveClient","push","length","roles","globalRoles","realmRoles","clientRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Permission, \n    Role, \n    UserPermission, \n    UserRole,\n} from '@authup/core-kit';\nimport { buildUserFakeEmail } from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type {\n    IClientRepository,\n    IUserRepository,\n} from '../../../entities/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { UserProvisioningSynchronizerContext } from './types.ts';\n\nexport class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {\n    protected userRepository: IUserRepository;\n\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;\n\n    constructor(ctx: UserProvisioningSynchronizerContext) {\n        super();\n\n        this.userRepository = ctx.userRepository;\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userPermissionRepository,\n            ownerKey: 'user_id',\n            ownerRealmKey: 'user_realm_id',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userRoleRepository,\n            ownerKey: 'user_id',\n            ownerRealmKey: 'user_realm_id',\n        });\n    }\n\n    async synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.userRepository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n            client_id: input.attributes.client_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.userRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    if (\n                        strategy.attributes &&\n                        strategy.attributes.includes('email')\n                    ) {\n                        input.attributes.email = input.attributes.email ||\n                            attributes.email ||\n                            buildUserFakeEmail(input.attributes.name || attributes.name);\n                    }\n\n                    attributes = this.userRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.userRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.email = input.attributes.email ||\n                        attributes.email ||\n                        (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);\n\n                    input.attributes.id = attributes.id;\n                    attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            if (!input.attributes.email && input.attributes.name) {\n                input.attributes.email = buildUserFakeEmail(input.attributes.name);\n            }\n\n            attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n        }\n\n        // Permissions (Global, Realm & Client)\n        const permissions : Permission[] = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realm_id ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientPermissions) {\n            const clientKeys = Object.keys(input.relations.clientPermissions);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realm_id: attributes.realm_id,\n                });\n\n                if (client) {\n                    const entities = await this.permissionResolver.resolveClient(\n                        input.relations.clientPermissions[clientKey],\n                        attributes.realm_id,\n                        client.id,\n                    );\n                    permissions.push(...entities);\n                }\n            }\n        }\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permission_id',\n                'permission_realm_id',\n            );\n        }\n\n        // Roles (Global, Realm & Client)\n        const roles : Role[] = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realm_id ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientRoles) {\n            const clientKeys = Object.keys(input.relations.clientRoles);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realm_id: attributes.realm_id,\n                });\n\n                if (client) {\n                    const entities = await this.roleResolver.resolveClient(\n                        input.relations.clientRoles[clientKey],\n                        attributes.realm_id,\n                        client.id,\n                    );\n                    roles.push(...entities);\n                }\n            }\n        }\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'role_id',\n                'role_realm_id',\n            );\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AA0BA,IAAaO,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;AAClD,SAAK;AAEL,OAAKN,iBAAiBM,IAAIN;AAC1B,OAAKC,mBAAmBK,IAAIL;AAE5B,OAAKC,qBAAqB,IAAIL,2BAA2BS,IAAIC,qBAAoB;AACjF,OAAKJ,eAAe,IAAIN,2BAA2BS,IAAIE,eAAc;AAErE,OAAKJ,qBAAqB,IAAIN,iCAAiC;GAC3DW,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;GACnB,CAAA;AACA,OAAKP,eAAe,IAAIP,iCAAiC;GACrDW,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;GACnB,CAAA;;CAGJ,MAAME,YAAYC,OAAgE;EAC9E,MAAMC,WAAWrB,oCAAoCoB,MAAMC,SAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKjB,eAAekB,UAAU;GACjDC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GACvCC,WAAWN,MAAME,WAAWI,aAAa;GAC7C,CAAA;AAEA,MAAIL,SAASM,SAAS5B,+BAA+B6B,QAAQ;AACzD,OAAIN,WACA,OAAM,KAAKjB,eAAewB,OAAOP,WAAAA;AAErC,UAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;IACpC;;AAGJ,MAAIA,WACA,SAAQD,SAASM,MAAjB;GACI,KAAK5B,+BAA+B+B;AAChC,QACIT,SAASC,cACTD,SAASC,WAAWS,SAAS,QAAA,CAE7BX,OAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,SACXnC,mBAAmBuB,MAAME,WAAWE,QAAQF,WAAWE,KAAI;AAGnEF,iBAAa,KAAKjB,eAAe4B,MAC7BX,YACAD,SAASC,aACLxB,WAAWsB,MAAME,YAAYD,SAASC,WAAU,GAChDF,MAAME,WAAU;AAGxBA,iBAAa,MAAM,KAAKjB,eAAe6B,KAAKZ,WAAAA;AAC5C;GACJ,KAAKvB,+BAA+BoC;AAChCf,UAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,UACVZ,MAAME,WAAWE,OAAO3B,mBAAmBuB,MAAME,WAAWE,KAAI,GAAIY,KAAAA;AAEzEhB,UAAME,WAAWe,KAAKf,WAAWe;AACjCf,iBAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,WAAU,CAAA;AACvF;;OAEL;AACH,OAAI,CAACF,MAAME,WAAWU,SAASZ,MAAME,WAAWE,KAC5CJ,OAAME,WAAWU,QAAQnC,mBAAmBuB,MAAME,WAAWE,KAAI;AAGrEF,gBAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,WAAU,CAAA;;EAI3F,MAAMiB,cAA6B,CAAA,GAC5B,MAAM,KAAKhC,mBAAmBiC,cAC7BpB,MAAMqB,aAAarB,MAAMqB,UAAUC,kBAAiB,EAAA,GAEpDpB,WAAWG,WACX,MAAM,KAAKlB,mBAAmBoC,aAC1BvB,MAAMqB,aAAarB,MAAMqB,UAAUG,kBACnCtB,WAAWG,SAAQ,GAEvB,EAAE,CACT;AAED,MAAIL,MAAMqB,aAAarB,MAAMqB,UAAUI,mBAAmB;GACtD,MAAMC,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUI,kBAAiB;AAChE,QAAK,MAAMI,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBiB,UAAU;KACjDC,MAAMyB;KACNxB,UAAUH,WAAWG;KACzB,CAAA;AAEA,QAAIyB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK5C,mBAAmB6C,cAC3ChC,MAAMqB,UAAUI,kBAAkBI,YAClC3B,WAAWG,UACXyB,OAAOb,GAAE;AAEbE,iBAAYc,KAAI,GAAIF,SAAAA;;;;AAKhC,MAAIZ,YAAYe,SAAS,EACrB,OAAM,KAAK7C,mBAAmBU,YAC1BG,YACAiB,aACA,iBACA,sBAAA;EAKR,MAAMgB,QAAiB,CAAA,GAChB,MAAM,KAAK/C,aAAagC,cACvBpB,MAAMqB,aAAarB,MAAMqB,UAAUe,YAAW,EAAA,GAE9ClC,WAAWG,WACX,MAAM,KAAKjB,aAAamC,aACpBvB,MAAMqB,aAAarB,MAAMqB,UAAUgB,YACnCnC,WAAWG,SAAQ,GAEvB,EAAE,CACT;AAED,MAAIL,MAAMqB,aAAarB,MAAMqB,UAAUiB,aAAa;GAChD,MAAMZ,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUiB,YAAW;AAC1D,QAAK,MAAMT,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBiB,UAAU;KACjDC,MAAMyB;KACNxB,UAAUH,WAAWG;KACzB,CAAA;AAEA,QAAIyB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK3C,aAAa4C,cACrChC,MAAMqB,UAAUiB,YAAYT,YAC5B3B,WAAWG,UACXyB,OAAOb,GAAE;AAEbkB,WAAMF,KAAI,GAAIF,SAAAA;;;;AAK1B,MAAII,MAAMD,SAAS,EACf,OAAM,KAAK5C,aAAaS,YACpBG,YACAiC,OACA,WACA,gBAAA;AAIR,SAAO;GACH,GAAGnC;GACHE;GACJ"}
+{"version":3,"file":"module.mjs","names":["buildUserFakeEmail","pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","UserProvisioningSynchronizer","userRepository","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","userPermissionRepository","ownerKey","ownerRealmKey","userRoleRepository","synchronize","input","strategy","attributes","findOneBy","name","realm_id","client_id","type","ABSENT","remove","MERGE","includes","email","merge","save","REPLACE","undefined","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","clientPermissions","clientKeys","Object","keys","clientKey","client","entities","resolveClient","push","length","roles","globalRoles","realmRoles","clientRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Permission, \n    Role, \n    UserPermission, \n    UserRole,\n} from '@authup/core-kit';\nimport { buildUserFakeEmail } from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type {\n    IClientRepository,\n    IUserRepository,\n} from '../../../entities/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { UserProvisioningSynchronizerContext } from './types.ts';\n\nexport class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {\n    protected userRepository: IUserRepository;\n\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;\n\n    constructor(ctx: UserProvisioningSynchronizerContext) {\n        super();\n\n        this.userRepository = ctx.userRepository;\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userPermissionRepository,\n            ownerKey: 'user_id',\n            ownerRealmKey: 'user_realm_id',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userRoleRepository,\n            ownerKey: 'user_id',\n            ownerRealmKey: 'user_realm_id',\n        });\n    }\n\n    async synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.userRepository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n            client_id: input.attributes.client_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.userRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    if (\n                        strategy.attributes &&\n                        strategy.attributes.includes('email')\n                    ) {\n                        input.attributes.email = input.attributes.email ||\n                            attributes.email ||\n                            buildUserFakeEmail(input.attributes.name || attributes.name);\n                    }\n\n                    attributes = this.userRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.userRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.email = input.attributes.email ||\n                        attributes.email ||\n                        (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);\n\n                    input.attributes.id = attributes.id;\n                    attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            if (!input.attributes.email && input.attributes.name) {\n                input.attributes.email = buildUserFakeEmail(input.attributes.name);\n            }\n\n            attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n        }\n\n        // Permissions (Global, Realm & Client)\n        const permissions : Permission[] = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realm_id ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientPermissions) {\n            const clientKeys = Object.keys(input.relations.clientPermissions);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realm_id: attributes.realm_id,\n                });\n\n                if (client) {\n                    const entities = await this.permissionResolver.resolveClient(\n                        input.relations.clientPermissions[clientKey],\n                        attributes.realm_id,\n                        client.id,\n                    );\n                    permissions.push(...entities);\n                }\n            }\n        }\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permission_id',\n                'permission_realm_id',\n            );\n        }\n\n        // Roles (Global, Realm & Client)\n        const roles : Role[] = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realm_id ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientRoles) {\n            const clientKeys = Object.keys(input.relations.clientRoles);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realm_id: attributes.realm_id,\n                });\n\n                if (client) {\n                    const entities = await this.roleResolver.resolveClient(\n                        input.relations.clientRoles[clientKey],\n                        attributes.realm_id,\n                        client.id,\n                    );\n                    roles.push(...entities);\n                }\n            }\n        }\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'role_id',\n                'role_realm_id',\n            );\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AA0BA,IAAaO,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKN,iBAAiBM,IAAIN;EAC1B,KAAKC,mBAAmBK,IAAIL;EAE5B,KAAKC,qBAAqB,IAAIL,2BAA2BS,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIN,2BAA2BS,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIN,iCAAiC;GAC3DW,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIP,iCAAiC;GACrDW,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAgE;EAC9E,MAAMC,WAAWrB,oCAAoCoB,MAAMC,QAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKjB,eAAekB,UAAU;GACjDC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GACvCC,WAAWN,MAAME,WAAWI,aAAa;EAC7C,CAAA;EAEA,IAAIL,SAASM,SAAS5B,+BAA+B6B,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKjB,eAAewB,OAAOP,UAAAA;GAErC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQD,SAASM,MAAjB;GACI,KAAK5B,+BAA+B+B;IAChC,IACIT,SAASC,cACTD,SAASC,WAAWS,SAAS,OAAA,GAE7BX,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,SACXnC,mBAAmBuB,MAAME,WAAWE,QAAQF,WAAWE,IAAI;IAGnEF,aAAa,KAAKjB,eAAe4B,MAC7BX,YACAD,SAASC,aACLxB,WAAWsB,MAAME,YAAYD,SAASC,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKjB,eAAe6B,KAAKZ,UAAAA;IAC5C;GACJ,KAAKvB,+BAA+BoC;IAChCf,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,UACVZ,MAAME,WAAWE,OAAO3B,mBAAmBuB,MAAME,WAAWE,IAAI,IAAIY,KAAAA;IAEzEhB,MAAME,WAAWe,KAAKf,WAAWe;IACjCf,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;IACvF;EACR;OACG;GACH,IAAI,CAACF,MAAME,WAAWU,SAASZ,MAAME,WAAWE,MAC5CJ,MAAME,WAAWU,QAAQnC,mBAAmBuB,MAAME,WAAWE,IAAI;GAGrEF,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;EAC3F;EAGA,MAAMiB,cAA6B,CAAA,GAC5B,MAAM,KAAKhC,mBAAmBiC,cAC7BpB,MAAMqB,aAAarB,MAAMqB,UAAUC,iBAAiB,GAAA,GAEpDpB,WAAWG,WACX,MAAM,KAAKlB,mBAAmBoC,aAC1BvB,MAAMqB,aAAarB,MAAMqB,UAAUG,kBACnCtB,WAAWG,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIL,MAAMqB,aAAarB,MAAMqB,UAAUI,mBAAmB;GACtD,MAAMC,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUI,iBAAiB;GAChE,KAAK,MAAMI,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBiB,UAAU;KACjDC,MAAMyB;KACNxB,UAAUH,WAAWG;IACzB,CAAA;IAEA,IAAIyB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK5C,mBAAmB6C,cAC3ChC,MAAMqB,UAAUI,kBAAkBI,YAClC3B,WAAWG,UACXyB,OAAOb,EAAE;KAEbE,YAAYc,KAAI,GAAIF,QAAAA;IACxB;GACJ;EACJ;EAEA,IAAIZ,YAAYe,SAAS,GACrB,MAAM,KAAK7C,mBAAmBU,YAC1BG,YACAiB,aACA,iBACA,qBAAA;EAKR,MAAMgB,QAAiB,CAAA,GAChB,MAAM,KAAK/C,aAAagC,cACvBpB,MAAMqB,aAAarB,MAAMqB,UAAUe,WAAW,GAAA,GAE9ClC,WAAWG,WACX,MAAM,KAAKjB,aAAamC,aACpBvB,MAAMqB,aAAarB,MAAMqB,UAAUgB,YACnCnC,WAAWG,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIL,MAAMqB,aAAarB,MAAMqB,UAAUiB,aAAa;GAChD,MAAMZ,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUiB,WAAW;GAC1D,KAAK,MAAMT,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBiB,UAAU;KACjDC,MAAMyB;KACNxB,UAAUH,WAAWG;IACzB,CAAA;IAEA,IAAIyB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK3C,aAAa4C,cACrChC,MAAMqB,UAAUiB,YAAYT,YAC5B3B,WAAWG,UACXyB,OAAOb,EAAE;KAEbkB,MAAMF,KAAI,GAAIF,QAAAA;IAClB;GACJ;EACJ;EAEA,IAAII,MAAMD,SAAS,GACf,MAAM,KAAK5C,aAAaS,YACpBG,YACAiC,OACA,WACA,eAAA;EAIR,OAAO;GACH,GAAGnC;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/security/policy/engine.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"engine.mjs","names":["PolicyEngine","BasePolicyEngine","BuiltInPolicyType","PolicyDefaultEvaluators","PermissionBindingPolicyEvaluator","identityPermissionProvider","registerEvaluator","PERMISSION_BINDING"],"sources":["../../../../src/core/security/policy/engine.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { PolicyEngine as BasePolicyEngine, BuiltInPolicyType, PolicyDefaultEvaluators } from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { PermissionBindingPolicyEvaluator } from './evaluator.ts';\n\nexport class PolicyEngine extends BasePolicyEngine {\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        super(PolicyDefaultEvaluators);\n\n        this.registerEvaluator(BuiltInPolicyType.PERMISSION_BINDING, new PermissionBindingPolicyEvaluator(identityPermissionProvider));\n    }\n}\n"],"mappings":";;;AAWA,IAAaA,eAAb,cAAkCC,eAAAA;CAC9B,YAAYI,4BAAyD;AACjE,QAAMF,wBAAAA;AAEN,OAAKG,kBAAkBJ,kBAAkBK,oBAAoB,IAAIH,iCAAiCC,2BAAAA,CAAAA"}
+{"version":3,"file":"engine.mjs","names":["PolicyEngine","BasePolicyEngine","BuiltInPolicyType","PolicyDefaultEvaluators","PermissionBindingPolicyEvaluator","identityPermissionProvider","registerEvaluator","PERMISSION_BINDING"],"sources":["../../../../src/core/security/policy/engine.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { PolicyEngine as BasePolicyEngine, BuiltInPolicyType, PolicyDefaultEvaluators } from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { PermissionBindingPolicyEvaluator } from './evaluator.ts';\n\nexport class PolicyEngine extends BasePolicyEngine {\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        super(PolicyDefaultEvaluators);\n\n        this.registerEvaluator(BuiltInPolicyType.PERMISSION_BINDING, new PermissionBindingPolicyEvaluator(identityPermissionProvider));\n    }\n}\n"],"mappings":";;;AAWA,IAAaA,eAAb,cAAkCC,eAAAA;CAC9B,YAAYI,4BAAyD;EACjE,MAAMF,uBAAAA;EAEN,KAAKG,kBAAkBJ,kBAAkBK,oBAAoB,IAAIH,iCAAiCC,0BAAAA,CAAAA;CACtG;AACJ"}

package/dist/core/security/policy/evaluator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.mjs","names":["AttributesPolicyEvaluator","BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","definePolicyIssueItem","maybeInvertPolicyOutcome","mergePermissionPolicyBindings","PermissionBindingPolicyEvaluator","validator","identityEvaluator","attributesEvaluator","identityPermissionProvider","accessData","ctx","data","has","PERMISSION_BINDING","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realm_id","client_id","length","invert","bindingsMerged","policies","flatMap","b","evaluators","compositePolicy","children","type","COMPOSITE","engine","outcome"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    BasePolicy,\n    CompositePolicy,\n    IPolicyEvaluator,\n    PermissionPolicyBinding,\n    PolicyEvaluationContext,\n    PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n    AttributesPolicyEvaluator,\n    BuiltInPolicyType,\n    IdentityPolicyEvaluator,\n    PermissionBindingPolicyValidator,\n    PolicyEngine,\n    PolicyIssueCode,\n    definePolicyIssueItem,\n    maybeInvertPolicyOutcome,\n    mergePermissionPolicyBindings,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n    protected validator : PermissionBindingPolicyValidator;\n\n    protected identityEvaluator: IdentityPolicyEvaluator;\n\n    protected attributesEvaluator : AttributesPolicyEvaluator;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        this.validator = new PermissionBindingPolicyValidator();\n        this.identityEvaluator = new IdentityPolicyEvaluator();\n        this.attributesEvaluator = new AttributesPolicyEvaluator();\n        this.identityPermissionProvider = identityPermissionProvider;\n    }\n\n    async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBinding | null> {\n        if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return null;\n        }\n\n        if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n        }\n\n        const data = ctx.data.get<PermissionPolicyBinding>(BuiltInPolicyType.PERMISSION_BINDING);\n\n        ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n        ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n        return data;\n    }\n\n    async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n        const policy = await this.validator.run(value);\n\n        const identity = await this.identityEvaluator.accessData(ctx);\n        if (!identity) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property identity is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n        const binding = await this.accessData(ctx);\n        if (!binding) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property permission is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n\n        const identityBindings = await this.identityPermissionProvider.getFor(identity)\n            .then((bindings) => bindings.filter((item) => {\n                if (item.permission.name !== binding.permission.name) {\n                    return false;\n                }\n\n                return (binding.permission.realm_id ?? null) === (item.permission.realm_id ?? null) &&\n                    (binding.permission.client_id ?? null) === (item.permission.client_id ?? null);\n            }));\n\n        if (identityBindings.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const bindingsMerged = mergePermissionPolicyBindings(identityBindings);\n        if (bindingsMerged.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const policies : BasePolicy[] = bindingsMerged\n            .flatMap((b) => b.policies || []);\n\n        if (policies.length === 0) {\n            return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n        }\n\n        if (!ctx.evaluators) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const compositePolicy : CompositePolicy = {\n            children: policies,\n            type: BuiltInPolicyType.COMPOSITE,\n        };\n\n        const engine = new PolicyEngine(ctx.evaluators);\n        const outcome = await engine.evaluate(compositePolicy, {\n            ...ctx,\n            path: [\n                ...(ctx.path || []),\n                ...(compositePolicy.type ? [compositePolicy.type] : []),\n            ],\n        });\n\n        return {\n            ...outcome,\n            success: maybeInvertPolicyOutcome(outcome.success, policy.invert),\n        };\n    }\n}\n"],"mappings":";;AA4BA,IAAaS,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;AACjE,OAAKH,YAAY,IAAIP,kCAAAA;AACrB,OAAKQ,oBAAoB,IAAIT,yBAAAA;AAC7B,OAAKU,sBAAsB,IAAIZ,2BAAAA;AAC/B,OAAKa,6BAA6BA;;CAGtC,MAAMC,WAAWC,KAAwE;AACrF,MAAI,CAACA,IAAIC,KAAKC,IAAIhB,kBAAkBiB,mBAAkB,CAClD,QAAO;AAGX,MAAIH,IAAIC,KAAKG,YAAYlB,kBAAkBiB,mBAAkB,CACzD,QAAOH,IAAIC,KAAKI,IAAInB,kBAAkBiB,mBAAkB;EAG5D,MAAMF,OAAOD,IAAIC,KAAKI,IAA6BnB,kBAAkBiB,mBAAkB;AAEvFH,MAAIC,KAAKK,IAAIpB,kBAAkBiB,oBAAoBF,KAAAA;AACnDD,MAAIC,KAAKM,aAAarB,kBAAkBiB,mBAAkB;AAE1D,SAAOF;;CAGX,MAAMO,SAASC,OAA4BT,KAA+D;EACtG,MAAMU,SAAS,MAAM,KAAKf,UAAUgB,IAAIF,MAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKhB,kBAAkBG,WAAWC,IAAAA;AACzD,MAAI,CAACY,SACD,QAAO;GACHC,SAAS;GACTC,QAAQ,CACJvB,sBAAsB;IAClBwB,MAAMzB,gBAAgB0B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;IACd,CAAA,CACH;GACL;EAEJ,MAAMC,UAAU,MAAM,KAAKpB,WAAWC,IAAAA;AACtC,MAAI,CAACmB,QACD,QAAO;GACHN,SAAS;GACTC,QAAQ,CACJvB,sBAAsB;IAClBwB,MAAMzB,gBAAgB0B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;IACd,CAAA,CACH;GACL;EAGJ,MAAME,mBAAmB,MAAM,KAAKtB,2BAA2BuB,OAAOT,SAAAA,CACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;AACjC,OAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,KAC5C,QAAO;AAGX,WAAQR,QAAQO,WAAWE,YAAY,WAAWH,KAAKC,WAAWE,YAAY,UACzET,QAAQO,WAAWG,aAAa,WAAWJ,KAAKC,WAAWG,aAAa;IACjF,CAAA;AAEJ,MAAIT,iBAAiBU,WAAW,EAC5B,QAAO,EAAEjB,SAASrB,yBAAyB,OAAOkB,OAAOqB,OAAM,EAAE;EAGrE,MAAMC,iBAAiBvC,8BAA8B2B,iBAAAA;AACrD,MAAIY,eAAeF,WAAW,EAC1B,QAAO,EAAEjB,SAASrB,yBAAyB,OAAOkB,OAAOqB,OAAM,EAAE;EAGrE,MAAME,WAA0BD,eAC3BE,SAASC,MAAMA,EAAEF,YAAY,EAAE,CAAA;AAEpC,MAAIA,SAASH,WAAW,EACpB,QAAO,EAAEjB,SAASrB,yBAAyB,MAAMkB,OAAOqB,OAAM,EAAE;AAGpE,MAAI,CAAC/B,IAAIoC,WACL,QAAO,EAAEvB,SAASrB,yBAAyB,OAAOkB,OAAOqB,OAAM,EAAE;EAGrE,MAAMM,kBAAoC;GACtCC,UAAUL;GACVM,MAAMrD,kBAAkBsD;GAC5B;EAGA,MAAME,UAAU,MAAMD,IADHpD,aAAaW,IAAIoC,WACdK,CAAOjC,SAAS6B,iBAAiB;GACnD,GAAGrC;GACHkB,MAAM,CAAA,GACElB,IAAIkB,QAAQ,EAAE,EAAA,GACdmB,gBAAgBE,OAAO,CAACF,gBAAgBE,KAAK,GAAG,EAAE,CACzD;GACL,CAAA;AAEA,SAAO;GACH,GAAGG;GACH7B,SAASrB,yBAAyBkD,QAAQ7B,SAASH,OAAOqB,OAAM;GACpE"}
+{"version":3,"file":"evaluator.mjs","names":["AttributesPolicyEvaluator","BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","definePolicyIssueItem","maybeInvertPolicyOutcome","mergePermissionPolicyBindings","PermissionBindingPolicyEvaluator","validator","identityEvaluator","attributesEvaluator","identityPermissionProvider","accessData","ctx","data","has","PERMISSION_BINDING","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realm_id","client_id","length","invert","bindingsMerged","policies","flatMap","b","evaluators","compositePolicy","children","type","COMPOSITE","engine","outcome"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    BasePolicy,\n    CompositePolicy,\n    IPolicyEvaluator,\n    PermissionPolicyBinding,\n    PolicyEvaluationContext,\n    PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n    AttributesPolicyEvaluator,\n    BuiltInPolicyType,\n    IdentityPolicyEvaluator,\n    PermissionBindingPolicyValidator,\n    PolicyEngine,\n    PolicyIssueCode,\n    definePolicyIssueItem,\n    maybeInvertPolicyOutcome,\n    mergePermissionPolicyBindings,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n    protected validator : PermissionBindingPolicyValidator;\n\n    protected identityEvaluator: IdentityPolicyEvaluator;\n\n    protected attributesEvaluator : AttributesPolicyEvaluator;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        this.validator = new PermissionBindingPolicyValidator();\n        this.identityEvaluator = new IdentityPolicyEvaluator();\n        this.attributesEvaluator = new AttributesPolicyEvaluator();\n        this.identityPermissionProvider = identityPermissionProvider;\n    }\n\n    async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBinding | null> {\n        if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return null;\n        }\n\n        if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n        }\n\n        const data = ctx.data.get<PermissionPolicyBinding>(BuiltInPolicyType.PERMISSION_BINDING);\n\n        ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n        ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n        return data;\n    }\n\n    async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n        const policy = await this.validator.run(value);\n\n        const identity = await this.identityEvaluator.accessData(ctx);\n        if (!identity) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property identity is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n        const binding = await this.accessData(ctx);\n        if (!binding) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property permission is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n\n        const identityBindings = await this.identityPermissionProvider.getFor(identity)\n            .then((bindings) => bindings.filter((item) => {\n                if (item.permission.name !== binding.permission.name) {\n                    return false;\n                }\n\n                return (binding.permission.realm_id ?? null) === (item.permission.realm_id ?? null) &&\n                    (binding.permission.client_id ?? null) === (item.permission.client_id ?? null);\n            }));\n\n        if (identityBindings.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const bindingsMerged = mergePermissionPolicyBindings(identityBindings);\n        if (bindingsMerged.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const policies : BasePolicy[] = bindingsMerged\n            .flatMap((b) => b.policies || []);\n\n        if (policies.length === 0) {\n            return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n        }\n\n        if (!ctx.evaluators) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const compositePolicy : CompositePolicy = {\n            children: policies,\n            type: BuiltInPolicyType.COMPOSITE,\n        };\n\n        const engine = new PolicyEngine(ctx.evaluators);\n        const outcome = await engine.evaluate(compositePolicy, {\n            ...ctx,\n            path: [\n                ...(ctx.path || []),\n                ...(compositePolicy.type ? [compositePolicy.type] : []),\n            ],\n        });\n\n        return {\n            ...outcome,\n            success: maybeInvertPolicyOutcome(outcome.success, policy.invert),\n        };\n    }\n}\n"],"mappings":";;AA4BA,IAAaS,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;EACjE,KAAKH,YAAY,IAAIP,iCAAAA;EACrB,KAAKQ,oBAAoB,IAAIT,wBAAAA;EAC7B,KAAKU,sBAAsB,IAAIZ,0BAAAA;EAC/B,KAAKa,6BAA6BA;CACtC;CAEA,MAAMC,WAAWC,KAAwE;EACrF,IAAI,CAACA,IAAIC,KAAKC,IAAIhB,kBAAkBiB,kBAAkB,GAClD,OAAO;EAGX,IAAIH,IAAIC,KAAKG,YAAYlB,kBAAkBiB,kBAAkB,GACzD,OAAOH,IAAIC,KAAKI,IAAInB,kBAAkBiB,kBAAkB;EAG5D,MAAMF,OAAOD,IAAIC,KAAKI,IAA6BnB,kBAAkBiB,kBAAkB;EAEvFH,IAAIC,KAAKK,IAAIpB,kBAAkBiB,oBAAoBF,IAAAA;EACnDD,IAAIC,KAAKM,aAAarB,kBAAkBiB,kBAAkB;EAE1D,OAAOF;CACX;CAEA,MAAMO,SAASC,OAA4BT,KAA+D;EACtG,MAAMU,SAAS,MAAM,KAAKf,UAAUgB,IAAIF,KAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKhB,kBAAkBG,WAAWC,GAAAA;EACzD,IAAI,CAACY,UACD,OAAO;GACHC,SAAS;GACTC,QAAQ,CACJvB,sBAAsB;IAClBwB,MAAMzB,gBAAgB0B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;GACd,CAAA,CAAA;EAER;EAEJ,MAAMC,UAAU,MAAM,KAAKpB,WAAWC,GAAAA;EACtC,IAAI,CAACmB,SACD,OAAO;GACHN,SAAS;GACTC,QAAQ,CACJvB,sBAAsB;IAClBwB,MAAMzB,gBAAgB0B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;GACd,CAAA,CAAA;EAER;EAGJ,MAAME,mBAAmB,MAAM,KAAKtB,2BAA2BuB,OAAOT,QAAAA,EACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;GACjC,IAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,MAC5C,OAAO;GAGX,QAAQR,QAAQO,WAAWE,YAAY,WAAWH,KAAKC,WAAWE,YAAY,UACzET,QAAQO,WAAWG,aAAa,WAAWJ,KAAKC,WAAWG,aAAa;EACjF,CAAA,CAAA;EAEJ,IAAIT,iBAAiBU,WAAW,GAC5B,OAAO,EAAEjB,SAASrB,yBAAyB,OAAOkB,OAAOqB,MAAM,EAAE;EAGrE,MAAMC,iBAAiBvC,8BAA8B2B,gBAAAA;EACrD,IAAIY,eAAeF,WAAW,GAC1B,OAAO,EAAEjB,SAASrB,yBAAyB,OAAOkB,OAAOqB,MAAM,EAAE;EAGrE,MAAME,WAA0BD,eAC3BE,SAASC,MAAMA,EAAEF,YAAY,CAAA,CAAE;EAEpC,IAAIA,SAASH,WAAW,GACpB,OAAO,EAAEjB,SAASrB,yBAAyB,MAAMkB,OAAOqB,MAAM,EAAE;EAGpE,IAAI,CAAC/B,IAAIoC,YACL,OAAO,EAAEvB,SAASrB,yBAAyB,OAAOkB,OAAOqB,MAAM,EAAE;EAGrE,MAAMM,kBAAoC;GACtCC,UAAUL;GACVM,MAAMrD,kBAAkBsD;EAC5B;EAGA,MAAME,UAAU,MAAMD,IADHpD,aAAaW,IAAIoC,UACdK,EAAOjC,SAAS6B,iBAAiB;GACnD,GAAGrC;GACHkB,MAAM,CAAA,GACElB,IAAIkB,QAAQ,CAAA,GAAA,GACZmB,gBAAgBE,OAAO,CAACF,gBAAgBE,IAAAA,IAAQ,CAAA,CAAA;EAE5D,CAAA;EAEA,OAAO;GACH,GAAGG;GACH7B,SAASrB,yBAAyBkD,QAAQ7B,SAASH,OAAOqB,MAAM;EACpE;CACJ;AACJ"}