npm - @authup/server-core - Versions diffs - 1.0.0-beta.42 → 1.0.0-beta.45 - Mend

@authup/server-core 1.0.0-beta.42 → 1.0.0-beta.45

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1284) hide show

package/dist/core/entities/client/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","data","entities","meta","findMany","total","entity","secret","secret_encrypted","secret_hashed","evaluateOneOf","input","ATTRIBUTES","push","getOne","idOrName","realmId","permissionNames","isMe","identity","type","id","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","is_confidential","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport {\n ClientValidator,\n PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\n\nexport type ClientServiceContext = {\n repository: IClientRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n protected repository: IClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ClientValidator;\n\n constructor(ctx: ClientServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ClientValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Client>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n const {\n data: entities, \n meta, \n } = await this.repository.findMany(query);\n let { total } = meta;\n\n const data: Client[] = [];\n for (const entity of entities) {\n if (\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n\n continue;\n }\n\n data.push(entity);\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<Client> {\n const permissionNames = [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ];\n\n let isMe = !!actor.identity &&\n actor.identity.type === 'client' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n const entity = await this.repository.findOne(idOrName, query, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n if (\n !isMe &&\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: permissionNames,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Client,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realm_id === 'string' ?\n await this.realmRepository.resolve(data.realm_id) :\n undefined;\n\n let entity: Client \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realm_id = realm.id;\n }\n\n entity = await this.repository.findOneWithSecret(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'client' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n }\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n await this.repository.validateJoinColumns(validated);\n await this.repository.checkUniqueness(validated, entity \|\| undefined);\n\n const credentialsService = new ClientCredentialsService();\n\n if (entity) {\n if (\n !isSelfEdit &&\n !validated.realm_id &&\n !entity.realm_id\n ) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SELF_MANAGE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n }\n\n if (entity.is_confidential) {\n if (!validated.secret && !entity.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n if (validated.secret) {\n entity.secret = await credentialsService.protect(validated.secret, entity);\n }\n } else {\n entity.secret = null;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realm_id) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n entity = this.repository.create(validated);\n\n if (entity.is_confidential) {\n if (!validated.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n entity.secret = await credentialsService.protect(validated.secret, validated);\n } else {\n entity.secret = null;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;AA0BA,IAAaS,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,gBAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,KAAAA;EACnC,IAAI,EAAEY,UAAUF;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMK,UAAUJ,UAAU;GAC3B,IACII,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eACV;IACE,IAAI;KACA,MAAMf,MAAMC,oBAAoBe,cAAc;MAC1Cb,MAAM;OACFb,eAAec;OACfd,eAAee;OACff,eAAegB;;MAEnBW,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,OAAO,CAAA;KACnE,CAAA;KACAL,KAAKY,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAJ,KAAKY,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHL;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACe;EACf,MAAMC,kBAAkB;GACpBjC,eAAec;GACfd,eAAee;GACff,eAAegB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMyB,YACfzB,MAAMyB,SAASC,SAAS,aAEpB1B,MAAMyB,SAASlB,KAAKoB,OAAON,YAC3BrB,MAAMyB,SAASlB,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKlB,WAAWkC,QAAQP,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAIxB,oBAAAA;EAGd,IAAIoC,QAAQxB,MAAMyB,SAAUlB,KAAKoB,OAAOf,OAAOe,IAAI;GAC/CH,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACC,QACDZ,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eAER,MAAMf,MAAMC,oBAAoBe,cAAc;GAC1Cb,MAAMoB;GACNN,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,OAAO,CAAA;EACnE,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFtB,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWxB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMoB,OACFX,UACAd,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKT,UAAUd,MAAMP,OAAO,EAAEiC,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAd,MACAP,OACAkC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO7B,KAAK8B,aAAa,WACnC,MAAM,KAAK1C,gBAAgB2C,QAAQ/B,KAAK8B,QAAQ,IAChDN,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMkB,QAA6B,CAAC;GACpC,IAAIpD,OAAOkC,QAAAA,GACPkB,MAAMZ,KAAKN;QAEXkB,MAAMpC,OAAOkB;GAGjB,IAAIe,OACAG,MAAMF,WAAWD,MAAMT;GAG3Bf,SAAS,MAAM,KAAKlB,WAAW8C,kBAAkBD,KAAAA;GACjD,IAAI,CAAC3B,UAAUsB,QAAQD,YACnB,MAAM,IAAI7C,oBAAAA;EAElB,OAAO,IAAI8C,QAAQD,YACf,MAAM,IAAI7C,oBAAAA;EAGd,IAAIqD,aAAa;EACjB,IAAI7B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAee,cAAc,CAAA;GACrF,SAASsC,GAAG;IACR,IACI,CAAC3C,MAAMyB,YACPzB,MAAMyB,SAASC,SAAS,YACxB1B,MAAMyB,SAASlB,KAAKoB,OAAOf,OAAOe,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMzC,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAesD,mBAAmB,CAAA;GAC1F;GACAT,QAAQjD,eAAe2D;EAC3B,OAAO;GACH,MAAM7C,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAewD,cAAc,CAAA;GACjFX,QAAQjD,eAAe6D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKpD,UAAUqD,IAAI1C,MAAM,EAAE4B,MAAM,CAAA;EAEzD,MAAM,KAAKzC,WAAWwD,oBAAoBF,SAAAA;EAC1C,MAAM,KAAKtD,WAAWyD,gBAAgBH,WAAWpC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMqB,qBAAqB,IAAI5D,yBAAAA;EAE/B,IAAIoB,QAAQ;GACR,IACI,CAAC6B,cACD,CAACO,UAAUX,YACX,CAACzB,OAAOyB,UACV;IACE,MAAMgB,eAAe,KAAKC,gBAAgBtD,KAAAA;IAC1C,IAAIqD,cACAL,UAAUX,WAAWgB;GAE7B;GAEA,IAAIZ,YACA,MAAMzC,MAAMC,oBAAoBsD,SAAS;IACrCpD,MAAMb,eAAesD;IACrB3B,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAa8B,UAAU,CAAA;GACtE,CAAA;GAGJpC,SAAS,KAAKlB,WAAW8D,MAAM5C,QAAQoC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMzC,MAAMC,oBAAoBsD,SAAS;IACrCpD,MAAMb,eAAee;IACrBY,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,OAAO,CAAA;GACnE,CAAA;GAGJ,IAAIA,OAAO6C,iBAAiB;IACxB,IAAI,CAACT,UAAUnC,UAAU,CAACD,OAAOC,QAC7BmC,UAAUnC,SAASuC,mBAAmBM,eAAc;IAGxD,IAAIV,UAAUnC,QACVD,OAAOC,SAAS,MAAMuC,mBAAmBO,QAAQX,UAAUnC,QAAQD,MAAAA;GAE3E,OACIA,OAAOC,SAAS;GAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAgD,SAAS;GACb;EACJ;EAEA,IAAI,CAACZ,UAAUX,UAAU;GACrB,MAAMgB,eAAe,KAAKC,gBAAgBtD,KAAAA;GAC1C,IAAIqD,cACAL,UAAUX,WAAWgB;EAE7B;EAEA,MAAMrD,MAAMC,oBAAoBsD,SAAS;GACrCpD,MAAMb,eAAewD;GACrB7B,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAa8B,UAAU,CAAA;EACtE,CAAA;EAEApC,SAAS,KAAKlB,WAAWmC,OAAOmB,SAAAA;EAEhC,IAAIpC,OAAO6C,iBAAiB;GACxB,IAAI,CAACT,UAAUnC,QACXmC,UAAUnC,SAASuC,mBAAmBM,eAAc;GAGxD9C,OAAOC,SAAS,MAAMuC,mBAAmBO,QAAQX,UAAUnC,QAAQmC,SAAAA;EACvE,OACIpC,OAAOC,SAAS;EAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAgD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFlC,IACA3B,OACe;EACf,MAAMA,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAegB,cAAc,CAAA;EAEjF,MAAMM,SAAS,MAAM,KAAKlB,WAAWoE,UAAU,EAAEnC,GAAG,CAAA;EACpD,IAAI,CAACf,QACD,MAAM,IAAIxB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBsD,SAAS;GACrCpD,MAAMb,eAAegB;GACrBW,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEe,IAAIoC,aAAanD;EACzB,MAAM,KAAKlB,WAAWsE,OAAOpD,MAAAA;EAC7BA,OAAOe,KAAKoC;EAEZ,OAAOnD;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","data","entities","meta","findMany","total","entity","secret","secret_encrypted","secret_hashed","evaluateOneOf","input","ATTRIBUTES","push","getOne","idOrName","realmId","permissionNames","isMe","identity","type","id","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","is_confidential","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport {\n ClientValidator,\n PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\n\nexport type ClientServiceContext = {\n repository: IClientRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n protected repository: IClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ClientValidator;\n\n constructor(ctx: ClientServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ClientValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Client>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n const {\n data: entities, \n meta, \n } = await this.repository.findMany(query);\n let { total } = meta;\n\n const data: Client[] = [];\n for (const entity of entities) {\n if (\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n\n continue;\n }\n\n data.push(entity);\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<Client> {\n const permissionNames = [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ];\n\n let isMe = !!actor.identity &&\n actor.identity.type === 'client' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n const entity = await this.repository.findOne(idOrName, query, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n if (\n !isMe &&\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: permissionNames,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Client,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realm_id === 'string' ?\n await this.realmRepository.resolve(data.realm_id) :\n undefined;\n\n let entity: Client \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realm_id = realm.id;\n }\n\n entity = await this.repository.findOneWithSecret(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'client' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n }\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n await this.repository.validateJoinColumns(validated);\n await this.repository.checkUniqueness(validated, entity \|\| undefined);\n\n const credentialsService = new ClientCredentialsService();\n\n if (entity) {\n if (\n !isSelfEdit &&\n !validated.realm_id &&\n !entity.realm_id\n ) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SELF_MANAGE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n }\n\n if (entity.is_confidential) {\n if (!validated.secret && !entity.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n if (validated.secret) {\n entity.secret = await credentialsService.protect(validated.secret, entity);\n }\n } else {\n entity.secret = null;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realm_id) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n entity = this.repository.create(validated);\n\n if (entity.is_confidential) {\n if (!validated.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n entity.secret = await credentialsService.protect(validated.secret, validated);\n } else {\n entity.secret = null;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;AA0BA,IAAaS,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,gBAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,KAAAA;EACnC,IAAI,EAAEY,UAAUF;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMK,UAAUJ,UAAU;GAC3B,IACII,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eACV;IACE,IAAI;KACA,MAAMf,MAAMC,oBAAoBe,cAAc;MAC1Cb,MAAM;OACFb,eAAec;OACfd,eAAee;OACff,eAAegB;;MAEnBW,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,OAAO,CAAA;KACnE,CAAA;KACAL,KAAKY,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAJ,KAAKY,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHL;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACe;EACf,MAAMC,kBAAkB;GACpBjC,eAAec;GACfd,eAAee;GACff,eAAegB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMyB,YACfzB,MAAMyB,SAASC,SAAS,aAEpB1B,MAAMyB,SAASlB,KAAKoB,OAAON,YAC3BrB,MAAMyB,SAASlB,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKlB,WAAWkC,QAAQP,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAIxB,oBAAAA;EAGd,IAAIoC,QAAQxB,MAAMyB,SAAUlB,KAAKoB,OAAOf,OAAOe,IAAI;GAC/CH,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACC,QACDZ,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eAER,MAAMf,MAAMC,oBAAoBe,cAAc;GAC1Cb,MAAMoB;GACNN,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,OAAO,CAAA;EACnE,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFtB,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWxB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMoB,OACFX,UACAd,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKT,UAAUd,MAAMP,OAAO,EAAEiC,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAd,MACAP,OACAkC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO7B,KAAK8B,aAAa,WACnC,MAAM,KAAK1C,gBAAgB2C,QAAQ/B,KAAK8B,QAAQ,IAChDN,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMkB,QAA6B,CAAC;GACpC,IAAIpD,OAAOkC,QAAAA,GACPkB,MAAMZ,KAAKN;QAEXkB,MAAMpC,OAAOkB;GAGjB,IAAIe,OACAG,MAAMF,WAAWD,MAAMT;GAG3Bf,SAAS,MAAM,KAAKlB,WAAW8C,kBAAkBD,KAAAA;GACjD,IAAI,CAAC3B,UAAUsB,QAAQD,YACnB,MAAM,IAAI7C,oBAAAA;EAElB,OAAO,IAAI8C,QAAQD,YACf,MAAM,IAAI7C,oBAAAA;EAGd,IAAIqD,aAAa;EACjB,IAAI7B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAee,cAAc,CAAA;GACrF,SAASsC,GAAG;IACR,IACI,CAAC3C,MAAMyB,YACPzB,MAAMyB,SAASC,SAAS,YACxB1B,MAAMyB,SAASlB,KAAKoB,OAAOf,OAAOe,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMzC,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAesD,mBAAmB,CAAA;GAC1F;GACAT,QAAQjD,eAAe2D;EAC3B,OAAO;GACH,MAAM7C,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAewD,cAAc,CAAA;GACjFX,QAAQjD,eAAe6D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKpD,UAAUqD,IAAI1C,MAAM,EAAE4B,MAAM,CAAA;EAEzD,MAAM,KAAKzC,WAAWwD,oBAAoBF,SAAAA;EAC1C,MAAM,KAAKtD,WAAWyD,gBAAgBH,WAAWpC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMqB,qBAAqB,IAAI5D,yBAAAA;EAE/B,IAAIoB,QAAQ;GACR,IACI,CAAC6B,cACD,CAACO,UAAUX,YACX,CAACzB,OAAOyB,UACV;IACE,MAAMgB,eAAe,KAAKC,gBAAgBtD,KAAAA;IAC1C,IAAIqD,cACAL,UAAUX,WAAWgB;GAE7B;GAEA,IAAIZ,YACA,MAAMzC,MAAMC,oBAAoBsD,SAAS;IACrCpD,MAAMb,eAAesD;IACrB3B,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAa8B,UAAU,CAAA;GACtE,CAAA;GAGJpC,SAAS,KAAKlB,WAAW8D,MAAM5C,QAAQoC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMzC,MAAMC,oBAAoBsD,SAAS;IACrCpD,MAAMb,eAAee;IACrBY,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,OAAO,CAAA;GACnE,CAAA;GAGJ,IAAIA,OAAO6C,iBAAiB;IACxB,IAAI,CAACT,UAAUnC,UAAU,CAACD,OAAOC,QAC7BmC,UAAUnC,SAASuC,mBAAmBM,eAAc;IAGxD,IAAIV,UAAUnC,QACVD,OAAOC,SAAS,MAAMuC,mBAAmBO,QAAQX,UAAUnC,QAAQD,MAAAA;GAE3E,OACIA,OAAOC,SAAS;GAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAgD,SAAS;GACb;EACJ;EAEA,IAAI,CAACZ,UAAUX,UAAU;GACrB,MAAMgB,eAAe,KAAKC,gBAAgBtD,KAAAA;GAC1C,IAAIqD,cACAL,UAAUX,WAAWgB;EAE7B;EAEA,MAAMrD,MAAMC,oBAAoBsD,SAAS;GACrCpD,MAAMb,eAAewD;GACrB7B,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAa8B,UAAU,CAAA;EACtE,CAAA;EAEApC,SAAS,KAAKlB,WAAWmC,OAAOmB,SAAAA;EAEhC,IAAIpC,OAAO6C,iBAAiB;GACxB,IAAI,CAACT,UAAUnC,QACXmC,UAAUnC,SAASuC,mBAAmBM,eAAc;GAGxD9C,OAAOC,SAAS,MAAMuC,mBAAmBO,QAAQX,UAAUnC,QAAQmC,SAAAA;EACvE,OACIpC,OAAOC,SAAS;EAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAgD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFlC,IACA3B,OACe;EACf,MAAMA,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAegB,cAAc,CAAA;EAEjF,MAAMM,SAAS,MAAM,KAAKlB,WAAWoE,UAAU,EAAEnC,GAAG,CAAA;EACpD,IAAI,CAACf,QACD,MAAM,IAAIxB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBsD,SAAS;GACrCpD,MAAMb,eAAegB;GACrBW,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEe,IAAIoC,aAAanD;EACzB,MAAM,KAAKlB,WAAWsE,OAAOpD,MAAAA;EAC7BA,OAAOe,KAAKoC;EAEZ,OAAOnD;CACX;AACJ"}

package/dist/core/entities/client/types.mjs CHANGED Viewed

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/entities/client-permission/index.mjs CHANGED Viewed

@@ -1,2 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { ClientPermissionService } from "./service.mjs";
 export { ClientPermissionService };

package/dist/core/entities/client-permission/service.mjs CHANGED Viewed

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { ClientPermissionValidator, PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { ValidatorGroup } from "@authup/kit";

package/dist/core/entities/client-permission/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientPermissionValidator","PermissionName","AbstractEntityService","ClientPermissionService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_PERMISSION_CREATE","CLIENT_PERMISSION_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","client_id","permission_id","permission","permission_realm_id","realm_id","realmId","clientId","client","client_realm_id","identity","policy_id","junctionPolicy","resolveJunctionPolicy","type","evaluate","input","ATTRIBUTES","save","update","CLIENT_PERMISSION_UPDATE","updateData","Object","prototype","hasOwnProperty","call","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-permission/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientPermissionValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientPermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IClientPermissionRepository, IClientPermissionService } from './types.ts';\n\nexport type ClientPermissionServiceContext = {\n repository: IClientPermissionRepository;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientPermissionService extends AbstractEntityService implements IClientPermissionService {\n protected repository: IClientPermissionRepository;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: ClientPermissionValidator;\n\n constructor(ctx: ClientPermissionServiceContext) {\n super();\n this.repository = ctx.repository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new ClientPermissionValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<ClientPermission>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_PERMISSION_CREATE,\n PermissionName.CLIENT_PERMISSION_DELETE,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_PERMISSION_CREATE,\n PermissionName.CLIENT_PERMISSION_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n client_id: validated.client_id,\n permission_id: validated.permission_id,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'client-permission' });\n }\n\n if (validated.permission) {\n validated.permission_realm_id = validated.permission.realm_id;\n\n await actor.permissionEvaluator.preEvaluate({\n name: validated.permission.name,\n realmId: validated.permission.realm_id,\n clientId: validated.permission.client_id,\n });\n }\n\n if (validated.client) {\n validated.client_realm_id = validated.client.realm_id;\n }\n\n if (\n validated.permission &&\n actor.identity &&\n typeof validated.policy_id === 'undefined'\n ) {\n const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n name: validated.permission.name,\n realmId: validated.permission.realm_id,\n clientId: validated.permission.client_id,\n },\n );\n if (junctionPolicy) {\n validated.policy_id = junctionPolicy.id;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_PERMISSION_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const updateData: Record<string, any> = {};\n if (Object.prototype.hasOwnProperty.call(data, 'policy_id')) {\n updateData.policy_id = data.policy_id;\n }\n\n await this.repository.validateJoinColumns(updateData);\n\n const merged = this.repository.merge(entity, updateData);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_PERMISSION_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged }),\n });\n\n return this.repository.save(merged);\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_PERMISSION_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;AAsBA,IAAaQ,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIN,0BAAAA;CACzB;CAEA,MAAMQ,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFZ,eAAea,0BACfb,eAAec,wBAAAA,EAEvB,CAAA;EAEA,OAAO,KAAKX,WAAWY,SAASP,KAAAA;CACpC;CAEA,MAAMQ,OACFC,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFZ,eAAea,0BACfb,eAAec,wBAAAA,EAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKf,WAAWgB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIrB,oBAAAA;EAGd,OAAOqB;CACX;CAEA,MAAME,OACFC,MACAZ,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMZ,eAAea,yBAAyB,CAAA;EAE5F,MAAMU,YAAY,MAAM,KAAKlB,UAAUmB,IAAIH,MAAM,EAAEI,OAAO3B,eAAe4B,OAAO,CAAA;EAEhF,MAAM,KAAKvB,WAAWwB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAKzB,WAAWgB,UAAU;GAC7CU,WAAWN,UAAUM;GACrBC,eAAeP,UAAUO;EAC7B,CAAA,GAEI,MAAM,IAAIlC,oBAAoB,EAAEsB,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YAAY;GACtBR,UAAUS,sBAAsBT,UAAUQ,WAAWE;GAErD,MAAMxB,MAAMC,oBAAoBY,YAAY;IACxCV,MAAMW,UAAUQ,WAAWnB;IAC3BsB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWF;GACnC,CAAA;EACJ;EAEA,IAAIN,UAAUa,QACVb,UAAUc,kBAAkBd,UAAUa,OAAOH;EAGjD,IACIV,UAAUQ,cACVtB,MAAM6B,YACN,OAAOf,UAAUgB,cAAc,aACjC;GACE,MAAMC,iBAAiB,MAAM,KAAKpC,2BAA2BqC,sBACzD;IACIC,MAAMjC,MAAM6B,SAASI;IACrBzB,IAAIR,MAAM6B,SAASjB,KAAKJ;GAC5B,GACA;IACIL,MAAMW,UAAUQ,WAAWnB;IAC3BsB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWF;GACnC,CAAA;GAEJ,IAAIW,gBACAjB,UAAUgB,YAAYC,eAAevB;EAE7C;EAEA,MAAMR,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMZ,eAAea;GACrB+B,OAAO,IAAIjD,WAAW,GAAGD,kBAAkBmD,aAAatB,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIL,SAAS,KAAKf,WAAWiB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKf,WAAW2C,KAAK5B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM6B,OACF9B,IACAI,MACAZ,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMZ,eAAegD,yBAAyB,CAAA;EAE5F,MAAM9B,SAAS,MAAM,KAAKf,WAAWgB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIrB,oBAAAA;EAGd,MAAMoD,aAAkC,CAAC;EACzC,IAAIC,OAAOC,UAAUC,eAAeC,KAAKhC,MAAM,WAAA,GAC3C4B,WAAWV,YAAYlB,KAAKkB;EAGhC,MAAM,KAAKpC,WAAWwB,oBAAoBsB,UAAAA;EAE1C,MAAMK,SAAS,KAAKnD,WAAWoD,MAAMrC,QAAQ+B,UAAAA;EAE7C,MAAMxC,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMZ,eAAegD;GACrBJ,OAAO,IAAIjD,WAAW,GAAGD,kBAAkBmD,aAAaS,OAAO,CAAA;EACnE,CAAA;EAEA,OAAO,KAAKnD,WAAW2C,KAAKQ,MAAAA;CAChC;CAEA,MAAME,OACFvC,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMZ,eAAec,yBAAyB,CAAA;EAE5F,MAAMI,SAAS,MAAM,KAAKf,WAAWgB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIrB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMZ,eAAec;GACrB8B,OAAO,IAAIjD,WAAW,GAAGD,kBAAkBmD,aAAa3B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAIwC,aAAavC;EACzB,MAAM,KAAKf,WAAWuD,OAAOxC,MAAAA;EAC7BA,OAAOD,KAAKwC;EAEZ,OAAOvC;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientPermissionValidator","PermissionName","AbstractEntityService","ClientPermissionService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_PERMISSION_CREATE","CLIENT_PERMISSION_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","client_id","permission_id","permission","permission_realm_id","realm_id","realmId","clientId","client","client_realm_id","identity","policy_id","junctionPolicy","resolveJunctionPolicy","type","evaluate","input","ATTRIBUTES","save","update","CLIENT_PERMISSION_UPDATE","updateData","Object","prototype","hasOwnProperty","call","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-permission/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientPermissionValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientPermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IClientPermissionRepository, IClientPermissionService } from './types.ts';\n\nexport type ClientPermissionServiceContext = {\n repository: IClientPermissionRepository;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientPermissionService extends AbstractEntityService implements IClientPermissionService {\n protected repository: IClientPermissionRepository;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: ClientPermissionValidator;\n\n constructor(ctx: ClientPermissionServiceContext) {\n super();\n this.repository = ctx.repository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new ClientPermissionValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<ClientPermission>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_PERMISSION_CREATE,\n PermissionName.CLIENT_PERMISSION_DELETE,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_PERMISSION_CREATE,\n PermissionName.CLIENT_PERMISSION_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n client_id: validated.client_id,\n permission_id: validated.permission_id,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'client-permission' });\n }\n\n if (validated.permission) {\n validated.permission_realm_id = validated.permission.realm_id;\n\n await actor.permissionEvaluator.preEvaluate({\n name: validated.permission.name,\n realmId: validated.permission.realm_id,\n clientId: validated.permission.client_id,\n });\n }\n\n if (validated.client) {\n validated.client_realm_id = validated.client.realm_id;\n }\n\n if (\n validated.permission &&\n actor.identity &&\n typeof validated.policy_id === 'undefined'\n ) {\n const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n name: validated.permission.name,\n realmId: validated.permission.realm_id,\n clientId: validated.permission.client_id,\n },\n );\n if (junctionPolicy) {\n validated.policy_id = junctionPolicy.id;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_PERMISSION_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const updateData: Record<string, any> = {};\n if (Object.prototype.hasOwnProperty.call(data, 'policy_id')) {\n updateData.policy_id = data.policy_id;\n }\n\n await this.repository.validateJoinColumns(updateData);\n\n const merged = this.repository.merge(entity, updateData);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_PERMISSION_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged }),\n });\n\n return this.repository.save(merged);\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_PERMISSION_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;AAsBA,IAAaQ,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIN,0BAAAA;CACzB;CAEA,MAAMQ,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFZ,eAAea,0BACfb,eAAec,wBAAAA,EAEvB,CAAA;EAEA,OAAO,KAAKX,WAAWY,SAASP,KAAAA;CACpC;CAEA,MAAMQ,OACFC,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFZ,eAAea,0BACfb,eAAec,wBAAAA,EAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKf,WAAWgB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIrB,oBAAAA;EAGd,OAAOqB;CACX;CAEA,MAAME,OACFC,MACAZ,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMZ,eAAea,yBAAyB,CAAA;EAE5F,MAAMU,YAAY,MAAM,KAAKlB,UAAUmB,IAAIH,MAAM,EAAEI,OAAO3B,eAAe4B,OAAO,CAAA;EAEhF,MAAM,KAAKvB,WAAWwB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAKzB,WAAWgB,UAAU;GAC7CU,WAAWN,UAAUM;GACrBC,eAAeP,UAAUO;EAC7B,CAAA,GAEI,MAAM,IAAIlC,oBAAoB,EAAEsB,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YAAY;GACtBR,UAAUS,sBAAsBT,UAAUQ,WAAWE;GAErD,MAAMxB,MAAMC,oBAAoBY,YAAY;IACxCV,MAAMW,UAAUQ,WAAWnB;IAC3BsB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWF;GACnC,CAAA;EACJ;EAEA,IAAIN,UAAUa,QACVb,UAAUc,kBAAkBd,UAAUa,OAAOH;EAGjD,IACIV,UAAUQ,cACVtB,MAAM6B,YACN,OAAOf,UAAUgB,cAAc,aACjC;GACE,MAAMC,iBAAiB,MAAM,KAAKpC,2BAA2BqC,sBACzD;IACIC,MAAMjC,MAAM6B,SAASI;IACrBzB,IAAIR,MAAM6B,SAASjB,KAAKJ;GAC5B,GACA;IACIL,MAAMW,UAAUQ,WAAWnB;IAC3BsB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWF;GACnC,CAAA;GAEJ,IAAIW,gBACAjB,UAAUgB,YAAYC,eAAevB;EAE7C;EAEA,MAAMR,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMZ,eAAea;GACrB+B,OAAO,IAAIjD,WAAW,GAAGD,kBAAkBmD,aAAatB,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIL,SAAS,KAAKf,WAAWiB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKf,WAAW2C,KAAK5B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM6B,OACF9B,IACAI,MACAZ,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMZ,eAAegD,yBAAyB,CAAA;EAE5F,MAAM9B,SAAS,MAAM,KAAKf,WAAWgB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIrB,oBAAAA;EAGd,MAAMoD,aAAkC,CAAC;EACzC,IAAIC,OAAOC,UAAUC,eAAeC,KAAKhC,MAAM,WAAA,GAC3C4B,WAAWV,YAAYlB,KAAKkB;EAGhC,MAAM,KAAKpC,WAAWwB,oBAAoBsB,UAAAA;EAE1C,MAAMK,SAAS,KAAKnD,WAAWoD,MAAMrC,QAAQ+B,UAAAA;EAE7C,MAAMxC,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMZ,eAAegD;GACrBJ,OAAO,IAAIjD,WAAW,GAAGD,kBAAkBmD,aAAaS,OAAO,CAAA;EACnE,CAAA;EAEA,OAAO,KAAKnD,WAAW2C,KAAKQ,MAAAA;CAChC;CAEA,MAAME,OACFvC,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMZ,eAAec,yBAAyB,CAAA;EAE5F,MAAMI,SAAS,MAAM,KAAKf,WAAWgB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIrB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMZ,eAAec;GACrB8B,OAAO,IAAIjD,WAAW,GAAGD,kBAAkBmD,aAAa3B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAIwC,aAAavC;EACzB,MAAM,KAAKf,WAAWuD,OAAOxC,MAAAA;EAC7BA,OAAOD,KAAKwC;EAEZ,OAAOvC;CACX;AACJ"}

package/dist/core/entities/client-permission/types.mjs CHANGED Viewed

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/entities/client-role/index.mjs CHANGED Viewed

@@ -1,2 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { ClientRoleService } from "./service.mjs";
 export { ClientRoleService };

package/dist/core/entities/client-role/service.mjs CHANGED Viewed

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { ClientRoleValidator, PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { ValidatorGroup } from "@authup/kit";

package/dist/core/entities/client-role/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","PolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientRoleValidator","PermissionName","AbstractEntityService","ClientRoleService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_ROLE_READ","CLIENT_ROLE_UPDATE","CLIENT_ROLE_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_ROLE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","role_id","client_id","role","role_realm_id","realm_id","client","client_realm_id","identity","hasPermissions","isSuperset","type","clientId","message","evaluate","input","ATTRIBUTES","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-role/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, PolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientRoleValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientRole } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IClientRoleRepository, IClientRoleService } from './types.ts';\n\nexport type ClientRoleServiceContext = {\n repository: IClientRoleRepository;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientRoleService extends AbstractEntityService implements IClientRoleService {\n protected repository: IClientRoleRepository;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: ClientRoleValidator;\n\n constructor(ctx: ClientRoleServiceContext) {\n super();\n this.repository = ctx.repository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new ClientRoleValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<ClientRole>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_ROLE_READ,\n PermissionName.CLIENT_ROLE_UPDATE,\n PermissionName.CLIENT_ROLE_DELETE,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<ClientRole> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_ROLE_READ,\n PermissionName.CLIENT_ROLE_UPDATE,\n PermissionName.CLIENT_ROLE_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientRole> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n role_id: validated.role_id,\n client_id: validated.client_id,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'client-role' });\n }\n\n if (validated.role) {\n validated.role_realm_id = validated.role.realm_id;\n }\n\n if (validated.client) {\n validated.client_realm_id = validated.client.realm_id;\n }\n\n if (validated.role && actor.identity) {\n const hasPermissions = await this.identityPermissionProvider.isSuperset(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n type: 'role',\n id: validated.role_id,\n clientId: validated.role.client_id,\n },\n );\n if (!hasPermissions) {\n throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_ROLE_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<ClientRole> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_ROLE_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":"~~;;;;;;~~AAsBA,IAAaS,oBAAb,cAAuCD,sBAAAA;CACzBE;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIN,oBAAAA;CACzB;CAEA,MAAMQ,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,IACAT,OACmB;EACnB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,OAAOsB;CACX;CAEA,MAAME,OACFC,MACAb,OACmB;EACnB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMZ,eAAewB,mBAAmB,CAAA;EAEtF,MAAMC,YAAY,MAAM,KAAKpB,UAAUqB,IAAIJ,MAAM,EAAEK,OAAO7B,eAAe8B,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWiB,UAAU;GAC7CW,SAASN,UAAUM;GACnBC,WAAWP,UAAUO;EACzB,CAAA,GAEI,MAAM,IAAIpC,oBAAoB,EAAEuB,QAAQ,cAAc,CAAA;EAG1D,IAAIM,UAAUQ,MACVR,UAAUS,gBAAgBT,UAAUQ,KAAKE;EAG7C,IAAIV,UAAUW,QACVX,UAAUY,kBAAkBZ,UAAUW,OAAOD;EAGjD,IAAIV,UAAUQ,QAAQxB,MAAM6B;OAYpB,CAACC,MAXwB,KAAKnC,2BAA2BoC,WACzD;IACIC,MAAMhC,MAAM6B,SAASG;IACrBvB,IAAIT,MAAM6B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIO,UAAUM;IACdW,UAAUjB,UAAUQ,KAAKD;GAC7B,CAAA,GAGA,MAAM,IAAItC,gBAAgB,EAAEiD,SAAS,0CAA2C,CAAA;EAAA;EAIxF,MAAMlC,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMZ,eAAewB;GACrBqB,OAAO,IAAIlD,WAAW,GAAGF,kBAAkBqD,aAAarB,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIN,SAAS,KAAKhB,WAAWkB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKhB,WAAW4C,KAAK5B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM6B,OACF9B,IACAT,OACmB;EACnB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMZ,eAAee,mBAAmB,CAAA;EAEtF,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMZ,eAAee;GACrB8B,OAAO,IAAIlD,WAAW,GAAGF,kBAAkBqD,aAAa3B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAI+B,aAAa9B;EACzB,MAAM,KAAKhB,WAAW+C,OAAO/B,MAAAA;EAC7BA,OAAOD,KAAK+B;EAEZ,OAAO9B;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","PolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientRoleValidator","PermissionName","AbstractEntityService","ClientRoleService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_ROLE_READ","CLIENT_ROLE_UPDATE","CLIENT_ROLE_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_ROLE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","role_id","client_id","role","role_realm_id","realm_id","client","client_realm_id","identity","hasPermissions","isSuperset","type","clientId","message","evaluate","input","ATTRIBUTES","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-role/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, PolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientRoleValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientRole } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IClientRoleRepository, IClientRoleService } from './types.ts';\n\nexport type ClientRoleServiceContext = {\n repository: IClientRoleRepository;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientRoleService extends AbstractEntityService implements IClientRoleService {\n protected repository: IClientRoleRepository;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: ClientRoleValidator;\n\n constructor(ctx: ClientRoleServiceContext) {\n super();\n this.repository = ctx.repository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new ClientRoleValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<ClientRole>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_ROLE_READ,\n PermissionName.CLIENT_ROLE_UPDATE,\n PermissionName.CLIENT_ROLE_DELETE,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<ClientRole> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_ROLE_READ,\n PermissionName.CLIENT_ROLE_UPDATE,\n PermissionName.CLIENT_ROLE_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientRole> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n role_id: validated.role_id,\n client_id: validated.client_id,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'client-role' });\n }\n\n if (validated.role) {\n validated.role_realm_id = validated.role.realm_id;\n }\n\n if (validated.client) {\n validated.client_realm_id = validated.client.realm_id;\n }\n\n if (validated.role && actor.identity) {\n const hasPermissions = await this.identityPermissionProvider.isSuperset(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n type: 'role',\n id: validated.role_id,\n clientId: validated.role.client_id,\n },\n );\n if (!hasPermissions) {\n throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_ROLE_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<ClientRole> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_ROLE_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;AAsBA,IAAaS,oBAAb,cAAuCD,sBAAAA;CACzBE;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIN,oBAAAA;CACzB;CAEA,MAAMQ,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,IACAT,OACmB;EACnB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,OAAOsB;CACX;CAEA,MAAME,OACFC,MACAb,OACmB;EACnB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMZ,eAAewB,mBAAmB,CAAA;EAEtF,MAAMC,YAAY,MAAM,KAAKpB,UAAUqB,IAAIJ,MAAM,EAAEK,OAAO7B,eAAe8B,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWiB,UAAU;GAC7CW,SAASN,UAAUM;GACnBC,WAAWP,UAAUO;EACzB,CAAA,GAEI,MAAM,IAAIpC,oBAAoB,EAAEuB,QAAQ,cAAc,CAAA;EAG1D,IAAIM,UAAUQ,MACVR,UAAUS,gBAAgBT,UAAUQ,KAAKE;EAG7C,IAAIV,UAAUW,QACVX,UAAUY,kBAAkBZ,UAAUW,OAAOD;EAGjD,IAAIV,UAAUQ,QAAQxB,MAAM6B;OAYpB,CAACC,MAXwB,KAAKnC,2BAA2BoC,WACzD;IACIC,MAAMhC,MAAM6B,SAASG;IACrBvB,IAAIT,MAAM6B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIO,UAAUM;IACdW,UAAUjB,UAAUQ,KAAKD;GAC7B,CAAA,GAGA,MAAM,IAAItC,gBAAgB,EAAEiD,SAAS,0CAA2C,CAAA;EAAA;EAIxF,MAAMlC,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMZ,eAAewB;GACrBqB,OAAO,IAAIlD,WAAW,GAAGF,kBAAkBqD,aAAarB,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIN,SAAS,KAAKhB,WAAWkB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKhB,WAAW4C,KAAK5B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM6B,OACF9B,IACAT,OACmB;EACnB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMZ,eAAee,mBAAmB,CAAA;EAEtF,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMZ,eAAee;GACrB8B,OAAO,IAAIlD,WAAW,GAAGF,kBAAkBqD,aAAa3B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAI+B,aAAa9B;EACzB,MAAM,KAAKhB,WAAW+C,OAAO/B,MAAAA;EAC7BA,OAAOD,KAAK+B;EAEZ,OAAO9B;CACX;AACJ"}

package/dist/core/entities/client-role/types.mjs CHANGED Viewed

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/entities/client-scope/index.mjs CHANGED Viewed

@@ -1,2 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { ClientScopeService } from "./service.mjs";
 export { ClientScopeService };

package/dist/core/entities/client-scope/service.mjs CHANGED Viewed

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { ClientScopeValidator, PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { ValidatorGroup } from "@authup/kit";

package/dist/core/entities/client-scope/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientScopeValidator","PermissionName","AbstractEntityService","ClientScopeService","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_SCOPE_READ","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_SCOPE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","client_id","scope_id","client","client_realm_id","realm_id","scope","scope_realm_id","evaluate","input","ATTRIBUTES","save","delete","CLIENT_SCOPE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/client-scope/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientScopeValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientScope } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IClientScopeRepository, IClientScopeService } from './types.ts';\n\nexport type ClientScopeServiceContext = {\n repository: IClientScopeRepository;\n};\n\nexport class ClientScopeService extends AbstractEntityService implements IClientScopeService {\n protected repository: IClientScopeRepository;\n\n protected validator: ClientScopeValidator;\n\n constructor(ctx: ClientScopeServiceContext) {\n super();\n this.repository = ctx.repository;\n this.validator = new ClientScopeValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<ClientScope>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_SCOPE_READ,\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<ClientScope> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_SCOPE_READ,\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientScope> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n client_id: validated.client_id,\n scope_id: validated.scope_id,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'client-scope' });\n }\n\n if (validated.client) {\n validated.client_realm_id = validated.client.realm_id;\n }\n\n if (validated.scope) {\n validated.scope_realm_id = validated.scope.realm_id;\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SCOPE_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<ClientScope> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SCOPE_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":"~~;;;;;;~~AAoBA,IAAaQ,qBAAb,cAAwCD,sBAAAA;CAC1BE;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIL,qBAAAA;CACzB;CAEA,MAAMO,QACFC,OACAC,OACoD;EACpD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFX,eAAeY;GACfZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAST,KAAAA;CACpC;CAEA,MAAMU,OACFC,IACAV,OACoB;EACpB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFX,eAAeY;GACfZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,OAAOsB;CACX;CAEA,MAAME,OACFC,MACAd,OACoB;EACpB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMX,eAAewB,oBAAoB,CAAA;EAEvF,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO7B,eAAe8B,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWiB,UAAU;GAC7CW,WAAWN,UAAUM;GACrBC,UAAUP,UAAUO;EACxB,CAAA,GAEI,MAAM,IAAIpC,oBAAoB,EAAEuB,QAAQ,eAAe,CAAA;EAG3D,IAAIM,UAAUQ,QACVR,UAAUS,kBAAkBT,UAAUQ,OAAOE;EAGjD,IAAIV,UAAUW,OACVX,UAAUY,iBAAiBZ,UAAUW,MAAMD;EAG/C,MAAM3B,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMX,eAAewB;GACrBe,OAAO,IAAI5C,WAAW,GAAGD,kBAAkB8C,aAAaf,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIN,SAAS,KAAKhB,WAAWkB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKhB,WAAWsC,KAAKtB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMuB,OACFxB,IACAV,OACoB;EACpB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMX,eAAe2C,oBAAoB,CAAA;EAEvF,MAAMxB,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMW,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMX,eAAe2C;GACrBJ,OAAO,IAAI5C,WAAW,GAAGD,kBAAkB8C,aAAarB,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAI0B,aAAazB;EACzB,MAAM,KAAKhB,WAAW0C,OAAO1B,MAAAA;EAC7BA,OAAOD,KAAK0B;EAEZ,OAAOzB;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientScopeValidator","PermissionName","AbstractEntityService","ClientScopeService","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_SCOPE_READ","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_SCOPE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","client_id","scope_id","client","client_realm_id","realm_id","scope","scope_realm_id","evaluate","input","ATTRIBUTES","save","delete","CLIENT_SCOPE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/client-scope/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientScopeValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientScope } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IClientScopeRepository, IClientScopeService } from './types.ts';\n\nexport type ClientScopeServiceContext = {\n repository: IClientScopeRepository;\n};\n\nexport class ClientScopeService extends AbstractEntityService implements IClientScopeService {\n protected repository: IClientScopeRepository;\n\n protected validator: ClientScopeValidator;\n\n constructor(ctx: ClientScopeServiceContext) {\n super();\n this.repository = ctx.repository;\n this.validator = new ClientScopeValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<ClientScope>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_SCOPE_READ,\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<ClientScope> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_SCOPE_READ,\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientScope> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n client_id: validated.client_id,\n scope_id: validated.scope_id,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'client-scope' });\n }\n\n if (validated.client) {\n validated.client_realm_id = validated.client.realm_id;\n }\n\n if (validated.scope) {\n validated.scope_realm_id = validated.scope.realm_id;\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SCOPE_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<ClientScope> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SCOPE_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaQ,qBAAb,cAAwCD,sBAAAA;CAC1BE;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIL,qBAAAA;CACzB;CAEA,MAAMO,QACFC,OACAC,OACoD;EACpD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFX,eAAeY;GACfZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAST,KAAAA;CACpC;CAEA,MAAMU,OACFC,IACAV,OACoB;EACpB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFX,eAAeY;GACfZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,OAAOsB;CACX;CAEA,MAAME,OACFC,MACAd,OACoB;EACpB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMX,eAAewB,oBAAoB,CAAA;EAEvF,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO7B,eAAe8B,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWiB,UAAU;GAC7CW,WAAWN,UAAUM;GACrBC,UAAUP,UAAUO;EACxB,CAAA,GAEI,MAAM,IAAIpC,oBAAoB,EAAEuB,QAAQ,eAAe,CAAA;EAG3D,IAAIM,UAAUQ,QACVR,UAAUS,kBAAkBT,UAAUQ,OAAOE;EAGjD,IAAIV,UAAUW,OACVX,UAAUY,iBAAiBZ,UAAUW,MAAMD;EAG/C,MAAM3B,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMX,eAAewB;GACrBe,OAAO,IAAI5C,WAAW,GAAGD,kBAAkB8C,aAAaf,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIN,SAAS,KAAKhB,WAAWkB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKhB,WAAWsC,KAAKtB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMuB,OACFxB,IACAV,OACoB;EACpB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMX,eAAe2C,oBAAoB,CAAA;EAEvF,MAAMxB,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMW,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMX,eAAe2C;GACrBJ,OAAO,IAAI5C,WAAW,GAAGD,kBAAkB8C,aAAarB,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAI0B,aAAazB;EACzB,MAAM,KAAKhB,WAAW0C,OAAO1B,MAAAA;EAC7BA,OAAOD,KAAK0B;EAEZ,OAAOzB;CACX;AACJ"}

package/dist/core/entities/client-scope/types.mjs CHANGED Viewed

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/entities/identity-provider/index.mjs CHANGED Viewed

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/entities/identity-provider/types.mjs CHANGED Viewed

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/entities/identity-provider-role-mapping/index.mjs CHANGED Viewed

@@ -1,2 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { IdentityProviderRoleMappingService } from "./service.mjs";
 export { IdentityProviderRoleMappingService };

package/dist/core/entities/identity-provider-role-mapping/service.mjs CHANGED Viewed

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { IdentityProviderRoleMappingValidator, PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { ValidatorGroup } from "@authup/kit";

package/dist/core/entities/identity-provider-role-mapping/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","PolicyData","BadRequestError","EntityConflictError","EntityNotFoundError","ValidatorGroup","IdentityProviderRoleMappingValidator","PermissionName","AbstractEntityService","IdentityProviderRoleMappingService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","IDENTITY_PROVIDER_ROLE_READ","IDENTITY_PROVIDER_READ","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","IDENTITY_PROVIDER_ROLE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","provider_id","role_id","provider","provider_realm_id","realm_id","role","role_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","message","evaluate","input","ATTRIBUTES","save","update","IDENTITY_PROVIDER_ROLE_UPDATE","UPDATE","merged","merge","delete","IDENTITY_PROVIDER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/identity-provider-role-mapping/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, PolicyData } from '@authup/access';\nimport { BadRequestError, EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { IdentityProviderRoleMappingValidator, PermissionName } from '@authup/core-kit';\nimport type { IdentityProviderRoleMapping } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IIdentityProviderRoleMappingRepository, IIdentityProviderRoleMappingService } from './types.ts';\n\nexport type IdentityProviderRoleMappingServiceContext = {\n repository: IIdentityProviderRoleMappingRepository;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class IdentityProviderRoleMappingService extends AbstractEntityService implements IIdentityProviderRoleMappingService {\n protected repository: IIdentityProviderRoleMappingRepository;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: IdentityProviderRoleMappingValidator;\n\n constructor(ctx: IdentityProviderRoleMappingServiceContext) {\n super();\n this.repository = ctx.repository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new IdentityProviderRoleMappingValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<IdentityProviderRoleMapping>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.IDENTITY_PROVIDER_ROLE_READ,\n PermissionName.IDENTITY_PROVIDER_READ,\n PermissionName.IDENTITY_PROVIDER_UPDATE,\n PermissionName.IDENTITY_PROVIDER_DELETE,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<IdentityProviderRoleMapping> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.IDENTITY_PROVIDER_ROLE_READ,\n PermissionName.IDENTITY_PROVIDER_READ,\n PermissionName.IDENTITY_PROVIDER_UPDATE,\n PermissionName.IDENTITY_PROVIDER_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<IdentityProviderRoleMapping> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n provider_id: validated.provider_id,\n role_id: validated.role_id,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'identity-provider-role-mapping' });\n }\n\n if (validated.provider) {\n validated.provider_realm_id = validated.provider.realm_id;\n }\n\n if (validated.role) {\n validated.role_realm_id = validated.role.realm_id;\n }\n\n if (\n validated.role_realm_id &&\n validated.provider_realm_id &&\n validated.role_realm_id !== validated.provider_realm_id\n ) {\n throw new BadRequestError('It is not possible to map an identity provider to a role of another realm.');\n }\n\n if (validated.role && actor.identity) {\n const hasPermissions = await this.identityPermissionProvider.isSuperset(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n type: 'role',\n id: validated.role_id,\n clientId: validated.role.client_id,\n },\n );\n if (!hasPermissions) {\n throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<IdentityProviderRoleMapping> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const merged = this.repository.merge(entity, validated);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged }),\n });\n\n return this.repository.save(merged);\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<IdentityProviderRoleMapping> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;AAsBA,IAAaU,qCAAb,cAAwDD,sBAAAA;CAC1CE;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;EACxD,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIN,qCAAAA;CACzB;CAEA,MAAMQ,QACFC,OACAC,OACoE;EACpE,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAAST,KAAAA;CACpC;CAEA,MAAMU,OACFC,IACAV,OACoC;EACpC,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,OAAOuB;CACX;CAEA,MAAME,OACFC,MACAd,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAeyB,8BAA8B,CAAA;EAEjG,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO9B,eAAe+B,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,aAAaN,UAAUM;GACvBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIrC,oBAAoB,EAAEwB,QAAQ,iCAAiC,CAAA;EAG7E,IAAIM,UAAUQ,UACVR,UAAUS,oBAAoBT,UAAUQ,SAASE;EAGrD,IAAIV,UAAUW,MACVX,UAAUY,gBAAgBZ,UAAUW,KAAKD;EAG7C,IACIV,UAAUY,iBACVZ,UAAUS,qBACVT,UAAUY,kBAAkBZ,UAAUS,mBAEtC,MAAM,IAAIxC,gBAAgB,4EAAA;EAG9B,IAAI+B,UAAUW,QAAQ5B,MAAM8B;OAYpB,CAACC,MAXwB,KAAKpC,2BAA2BqC,WACzD;IACIC,MAAMjC,MAAM8B,SAASG;IACrBvB,IAAIV,MAAM8B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIO,UAAUO;IACdU,UAAUjB,UAAUW,KAAKO;GAC7B,CAAA,GAGA,MAAM,IAAInD,gBAAgB,EAAEoD,SAAS,0CAA2C,CAAA;EAAA;EAIxF,MAAMpC,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMZ,eAAeyB;GACrBsB,OAAO,IAAIrD,WAAW,GAAGF,kBAAkBwD,aAAatB,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAW8C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAI,MACAd,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAemD,8BAA8B,CAAA;EAEjG,MAAM/B,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,MAAM6B,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO9B,eAAesD,OAAO,CAAA;EAEhF,MAAM,KAAKjD,WAAW2B,oBAAoBJ,SAAAA;EAE1C,MAAM2B,SAAS,KAAKlD,WAAWmD,MAAMlC,QAAQM,SAAAA;EAE7C,MAAMjB,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMZ,eAAemD;GACrBJ,OAAO,IAAIrD,WAAW,GAAGF,kBAAkBwD,aAAaK,OAAO,CAAA;EACnE,CAAA;EAEA,OAAO,KAAKlD,WAAW8C,KAAKI,MAAAA;CAChC;CAEA,MAAME,OACFpC,IACAV,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAewD,8BAA8B,CAAA;EAEjG,MAAMpC,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMZ,eAAewD;GACrBT,OAAO,IAAIrD,WAAW,GAAGF,kBAAkBwD,aAAa5B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAIsC,aAAarC;EACzB,MAAM,KAAKjB,WAAWuD,OAAOtC,MAAAA;EAC7BA,OAAOD,KAAKsC;EAEZ,OAAOrC;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","PolicyData","BadRequestError","EntityConflictError","EntityNotFoundError","ValidatorGroup","IdentityProviderRoleMappingValidator","PermissionName","AbstractEntityService","IdentityProviderRoleMappingService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","IDENTITY_PROVIDER_ROLE_READ","IDENTITY_PROVIDER_READ","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","IDENTITY_PROVIDER_ROLE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","provider_id","role_id","provider","provider_realm_id","realm_id","role","role_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","message","evaluate","input","ATTRIBUTES","save","update","IDENTITY_PROVIDER_ROLE_UPDATE","UPDATE","merged","merge","delete","IDENTITY_PROVIDER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/identity-provider-role-mapping/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, PolicyData } from '@authup/access';\nimport { BadRequestError, EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { IdentityProviderRoleMappingValidator, PermissionName } from '@authup/core-kit';\nimport type { IdentityProviderRoleMapping } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IIdentityProviderRoleMappingRepository, IIdentityProviderRoleMappingService } from './types.ts';\n\nexport type IdentityProviderRoleMappingServiceContext = {\n repository: IIdentityProviderRoleMappingRepository;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class IdentityProviderRoleMappingService extends AbstractEntityService implements IIdentityProviderRoleMappingService {\n protected repository: IIdentityProviderRoleMappingRepository;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: IdentityProviderRoleMappingValidator;\n\n constructor(ctx: IdentityProviderRoleMappingServiceContext) {\n super();\n this.repository = ctx.repository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new IdentityProviderRoleMappingValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<IdentityProviderRoleMapping>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.IDENTITY_PROVIDER_ROLE_READ,\n PermissionName.IDENTITY_PROVIDER_READ,\n PermissionName.IDENTITY_PROVIDER_UPDATE,\n PermissionName.IDENTITY_PROVIDER_DELETE,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<IdentityProviderRoleMapping> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.IDENTITY_PROVIDER_ROLE_READ,\n PermissionName.IDENTITY_PROVIDER_READ,\n PermissionName.IDENTITY_PROVIDER_UPDATE,\n PermissionName.IDENTITY_PROVIDER_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<IdentityProviderRoleMapping> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n provider_id: validated.provider_id,\n role_id: validated.role_id,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'identity-provider-role-mapping' });\n }\n\n if (validated.provider) {\n validated.provider_realm_id = validated.provider.realm_id;\n }\n\n if (validated.role) {\n validated.role_realm_id = validated.role.realm_id;\n }\n\n if (\n validated.role_realm_id &&\n validated.provider_realm_id &&\n validated.role_realm_id !== validated.provider_realm_id\n ) {\n throw new BadRequestError('It is not possible to map an identity provider to a role of another realm.');\n }\n\n if (validated.role && actor.identity) {\n const hasPermissions = await this.identityPermissionProvider.isSuperset(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n type: 'role',\n id: validated.role_id,\n clientId: validated.role.client_id,\n },\n );\n if (!hasPermissions) {\n throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<IdentityProviderRoleMapping> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const merged = this.repository.merge(entity, validated);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged }),\n });\n\n return this.repository.save(merged);\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<IdentityProviderRoleMapping> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;AAsBA,IAAaU,qCAAb,cAAwDD,sBAAAA;CAC1CE;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;EACxD,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIN,qCAAAA;CACzB;CAEA,MAAMQ,QACFC,OACAC,OACoE;EACpE,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAAST,KAAAA;CACpC;CAEA,MAAMU,OACFC,IACAV,OACoC;EACpC,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,OAAOuB;CACX;CAEA,MAAME,OACFC,MACAd,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAeyB,8BAA8B,CAAA;EAEjG,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO9B,eAAe+B,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,aAAaN,UAAUM;GACvBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIrC,oBAAoB,EAAEwB,QAAQ,iCAAiC,CAAA;EAG7E,IAAIM,UAAUQ,UACVR,UAAUS,oBAAoBT,UAAUQ,SAASE;EAGrD,IAAIV,UAAUW,MACVX,UAAUY,gBAAgBZ,UAAUW,KAAKD;EAG7C,IACIV,UAAUY,iBACVZ,UAAUS,qBACVT,UAAUY,kBAAkBZ,UAAUS,mBAEtC,MAAM,IAAIxC,gBAAgB,4EAAA;EAG9B,IAAI+B,UAAUW,QAAQ5B,MAAM8B;OAYpB,CAACC,MAXwB,KAAKpC,2BAA2BqC,WACzD;IACIC,MAAMjC,MAAM8B,SAASG;IACrBvB,IAAIV,MAAM8B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIO,UAAUO;IACdU,UAAUjB,UAAUW,KAAKO;GAC7B,CAAA,GAGA,MAAM,IAAInD,gBAAgB,EAAEoD,SAAS,0CAA2C,CAAA;EAAA;EAIxF,MAAMpC,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMZ,eAAeyB;GACrBsB,OAAO,IAAIrD,WAAW,GAAGF,kBAAkBwD,aAAatB,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAW8C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAI,MACAd,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAemD,8BAA8B,CAAA;EAEjG,MAAM/B,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,MAAM6B,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO9B,eAAesD,OAAO,CAAA;EAEhF,MAAM,KAAKjD,WAAW2B,oBAAoBJ,SAAAA;EAE1C,MAAM2B,SAAS,KAAKlD,WAAWmD,MAAMlC,QAAQM,SAAAA;EAE7C,MAAMjB,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMZ,eAAemD;GACrBJ,OAAO,IAAIrD,WAAW,GAAGF,kBAAkBwD,aAAaK,OAAO,CAAA;EACnE,CAAA;EAEA,OAAO,KAAKlD,WAAW8C,KAAKI,MAAAA;CAChC;CAEA,MAAME,OACFpC,IACAV,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAewD,8BAA8B,CAAA;EAEjG,MAAMpC,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMZ,eAAewD;GACrBT,OAAO,IAAIrD,WAAW,GAAGF,kBAAkBwD,aAAa5B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAIsC,aAAarC;EACzB,MAAM,KAAKjB,WAAWuD,OAAOtC,MAAAA;EAC7BA,OAAOD,KAAKsC;EAEZ,OAAOrC;CACX;AACJ"}

package/dist/core/entities/identity-provider-role-mapping/types.mjs CHANGED Viewed

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/entities/index.mjs CHANGED Viewed

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { ClientService } from "./client/service.mjs";
 import "./client/index.mjs";
 import { ClientPermissionService } from "./client-permission/service.mjs";

package/dist/core/entities/permission/index.mjs CHANGED Viewed

@@ -1,2 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { PermissionService } from "./service.mjs";
 export { PermissionService };

package/dist/core/entities/permission/service.mjs CHANGED Viewed

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { PermissionName, PermissionValidator, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { ValidatorGroup, isPropertySet, isUUID } from "@authup/kit";

package/dist/core/entities/permission/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","SystemPolicyName","ValidatorGroup","isPropertySet","isUUID","AuthupError","BadRequestError","EntityNotFoundError","PermissionName","PermissionValidator","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","AbstractEntityService","REALM_ADMIN_EXCLUDED_PERMISSIONS","REALM_CREATE","REALM_UPDATE","REALM_DELETE","REALM_ADMIN_BOUND_PERMISSIONS","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","PermissionService","repository","realmRepository","roleRepository","rolePermissionRepository","policyRepository","permissionPolicyRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","findMany","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","CREATE","validated","run","validateJoinColumns","built_in","evaluate","input","ATTRIBUTES","checkUniqueness","merge","created","identity","getActorRealmId","assignDefaultPolicy","assignToAdminRole","assignToRealmAdminRoles","delete","entityId","remove","permission","defaultPolicy","findOneByName","DEFAULT","existing","permission_id","policy_id","entry","permission_realm_id","policy_realm_id","adminRole","role_id","role_realm_id","includes","isBuiltIn","Object","values","policyName","REALM_BOUND","REALM_OR_GLOBAL","policy","realmAdminRoles","findManyBy","role"],"sources":["../../../../src/core/entities/permission/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, PolicyData, SystemPolicyName } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { AuthupError, BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n PermissionName,\n PermissionValidator,\n ROLE_ADMIN_NAME,\n ROLE_REALM_ADMIN_NAME,\n} from '@authup/core-kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository } from '../permission-policy/types.ts';\nimport type { IPolicyRepository } from '../policy/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport type { IRoleRepository } from '../role/types.ts';\nimport type { IRolePermissionRepository } from '../role-permission/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IPermissionRepository, IPermissionService } from './types.ts';\n\nconst REALM_ADMIN_EXCLUDED_PERMISSIONS = [\n PermissionName.REALM_CREATE,\n PermissionName.REALM_UPDATE,\n PermissionName.REALM_DELETE,\n];\n\n/\n CUD permissions that get system.realm-bound on realm_admin.\n * Covers direct entity types (both global-capable and realm-only).\n \n Junction entity CUD (e.g. user_role, role_permission) intentionally\n * use realm-or-global instead, because their attributes include\n * multiple realm_id fields (e.g. user_realm_id + role_realm_id).\n * With attribute_name_strict: false, realm-bound would reject\n * junctions where one side is global (realm_id: null).\n /\nconst REALM_ADMIN_BOUND_PERMISSIONS = [\n PermissionName.CLIENT_CREATE,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n PermissionName.IDENTITY_PROVIDER_CREATE,\n PermissionName.IDENTITY_PROVIDER_UPDATE,\n PermissionName.IDENTITY_PROVIDER_DELETE,\n PermissionName.PERMISSION_CREATE,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n PermissionName.ROBOT_CREATE,\n PermissionName.ROBOT_UPDATE,\n PermissionName.ROBOT_DELETE,\n PermissionName.ROLE_CREATE,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n PermissionName.SCOPE_CREATE,\n PermissionName.SCOPE_UPDATE,\n PermissionName.SCOPE_DELETE,\n PermissionName.USER_CREATE,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n];\n\nexport type PermissionServiceContext = {\n repository: IPermissionRepository;\n realmRepository: IRealmRepository;\n roleRepository: IRoleRepository;\n rolePermissionRepository: IRolePermissionRepository;\n policyRepository: IPolicyRepository;\n permissionPolicyRepository: IPermissionPolicyRepository;\n};\n\nexport class PermissionService extends AbstractEntityService implements IPermissionService {\n protected repository: IPermissionRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected roleRepository: IRoleRepository;\n\n protected rolePermissionRepository: IRolePermissionRepository;\n\n protected policyRepository: IPolicyRepository;\n\n protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n protected validator: PermissionValidator;\n\n constructor(ctx: PermissionServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.roleRepository = ctx.roleRepository;\n this.rolePermissionRepository = ctx.rolePermissionRepository;\n this.policyRepository = ctx.policyRepository;\n this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n this.validator = new PermissionValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Permission>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n realm?: string,\n ): Promise<Permission> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Permission> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Permission> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Permission,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realm_id === 'string' ?\n await this.realmRepository.resolve(data.realm_id) :\n undefined;\n\n let entity: Permission \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realm_id = realm.id;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n if (entity) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n await this.repository.validateJoinColumns(validated);\n\n if (entity) {\n if (\n entity.built_in &&\n isPropertySet(validated, 'name') &&\n entity.name !== validated.name\n ) {\n throw new BadRequestError('The name of a built-in permission can not be changed.');\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_UPDATE,\n input: new PolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n }),\n });\n\n await this.repository.checkUniqueness(validated, entity);\n\n entity = this.repository.merge(entity, validated);\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n validated.realm_id = this.getActorRealmId(actor) \|\| null;\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n await this.repository.checkUniqueness(validated);\n\n entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n await this.assignDefaultPolicy(entity);\n await this.assignToAdminRole(entity);\n await this.assignToRealmAdminRoles(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Permission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (entity.built_in) {\n throw new BadRequestError('A built-in permission can not be deleted.');\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n\n /\n Assign the system.default policy to a newly created permission.\n * This ensures all permissions are evaluated with the baseline security\n * policy (identity, permission-binding, realm-match) by default.\n /\n private async assignDefaultPolicy(permission: Permission): Promise<void> {\n const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n if (!defaultPolicy) {\n throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);\n }\n\n const existing = await this.permissionPolicyRepository.findOneBy({\n permission_id: permission.id,\n policy_id: defaultPolicy.id,\n });\n if (existing) {\n return;\n }\n\n const entry = this.permissionPolicyRepository.create({\n permission_id: permission.id,\n permission_realm_id: permission.realm_id,\n policy_id: defaultPolicy.id,\n policy_realm_id: defaultPolicy.realm_id,\n });\n await this.permissionPolicyRepository.save(entry);\n }\n\n /\n Assign a newly created permission to the global admin role.\n * The admin role receives every permission without policy restrictions.\n /\n private async assignToAdminRole(permission: Permission): Promise<void> {\n const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);\n if (!adminRole) {\n return;\n }\n\n const existing = await this.rolePermissionRepository.findOneBy({\n role_id: adminRole.id,\n permission_id: permission.id,\n });\n if (existing) {\n return;\n }\n\n const entry = this.rolePermissionRepository.create({\n role_id: adminRole.id,\n role_realm_id: adminRole.realm_id,\n permission_id: permission.id,\n permission_realm_id: permission.realm_id,\n });\n await this.rolePermissionRepository.save(entry);\n }\n\n /\n Assign a newly created permission to all matching realm_admin roles.\n \n Uses differentiated junction policies:\n * - CUD on global-capable entity types → system.realm-bound\n * - Everything else → system.realm-or-global\n \n Eligible permissions:\n * - Built-in authup permissions (global) — assigned to all realm_admin roles\n * - Realm-scoped permissions — assigned to the realm_admin in the matching realm\n \n Excluded:\n * - Realm CRUD permissions (realm_create, realm_update, realm_delete)\n * - Custom global permissions (non-built-in with realm_id: null)\n \n Fails closed: skips assignment entirely if required policies are not found.\n */\n private async assignToRealmAdminRoles(permission: Permission): Promise<void> {\n if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name as PermissionName)) {\n return;\n }\n\n const isBuiltIn = (Object.values(PermissionName) as string[]).includes(permission.name);\n if (!permission.realm_id && !isBuiltIn) {\n return;\n }\n\n const policyName = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name as PermissionName) ?\n SystemPolicyName.REALM_BOUND :\n SystemPolicyName.REALM_OR_GLOBAL;\n\n const policy = await this.policyRepository.findOneByName(policyName);\n if (!policy) {\n return;\n }\n\n const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });\n\n for (const role of realmAdminRoles) {\n if (permission.realm_id && permission.realm_id !== role.realm_id) {\n continue;\n }\n\n const existing = await this.rolePermissionRepository.findOneBy({\n role_id: role.id,\n permission_id: permission.id,\n });\n if (existing) {\n continue;\n }\n\n const entry = this.rolePermissionRepository.create({\n role_id: role.id,\n role_realm_id: role.realm_id,\n permission_id: permission.id,\n permission_realm_id: permission.realm_id,\n policy_id: policy.id,\n });\n await this.rolePermissionRepository.save(entry);\n }\n }\n}\n"],"mappings":";;;;;;AA0BA,MAAMc,mCAAmC;CACrCL,eAAeM;CACfN,eAAeO;CACfP,eAAeQ;;;;;;;;;;;GAanB,MAAMC,gCAAgC;CAClCT,eAAeU;CACfV,eAAeW;CACfX,eAAeY;CACfZ,eAAea;CACfb,eAAec;CACfd,eAAee;CACff,eAAegB;CACfhB,eAAeiB;CACfjB,eAAekB;CACflB,eAAemB;CACfnB,eAAeoB;CACfpB,eAAeqB;CACfrB,eAAesB;CACftB,eAAeuB;CACfvB,eAAewB;CACfxB,eAAeyB;CACfzB,eAAe0B;CACf1B,eAAe2B;CACf3B,eAAe4B;CACf5B,eAAe6B;CACf7B,eAAe8B;;AAYnB,IAAaC,oBAAb,cAAuC3B,sBAAAA;CACzB4B;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKP,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIrC,oBAAAA;CACzB;CAEA,MAAMuC,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKc,WAAWe,SAASN,KAAAA;CACpC;CAEA,MAAMO,OACFC,UACAP,OACAQ,OACmB;EACnB,MAAMR,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMiC,SAAS,MAAM,KAAKnB,WAAWoB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAIpD,oBAAAA;EAGd,OAAOoD;CACX;CAEA,MAAME,OACFC,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMZ,KAAAA;EACpD,OAAOS;CACX;CAEA,MAAMM,OACFR,UACAK,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMZ,OAAO,EAAEgB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAZ,OACAiB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,aAAa,WACnC,MAAM,KAAK5B,gBAAgB6B,QAAQR,KAAKO,QAAQ,IAChDL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAInE,OAAOqD,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMlB,OAAOI;GAGjB,IAAIC,OACAa,MAAMF,WAAWX,MAAMc;GAG3Bb,SAAS,MAAM,KAAKnB,WAAWiC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAI3D,oBAAAA;EAElB,OAAO,IAAI4D,QAAQD,YACf,MAAM,IAAI3D,oBAAAA;EAGd,IAAIoD,QAAQ;GACR,MAAMT,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAeiB,kBAAkB,CAAA;GACrF2C,QAAQlE,eAAeyE;EAC3B,OAAO;GACH,MAAMzB,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAegB,kBAAkB,CAAA;GACrF4C,QAAQlE,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK/B,UAAUgC,IAAIhB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK5B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIlB,QAAQ;GACR,IACIA,OAAOqB,YACP7E,cAAc0E,WAAW,MAAA,KACzBlB,OAAON,SAASwB,UAAUxB,MAE1B,MAAM,IAAI/C,gBAAgB,uDAAA;GAG9B,MAAM4C,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAM7C,eAAeiB;IACrByD,OAAO,IAAIlF,WAAW,GACjBD,kBAAkBoF,aAAa;KAC5B,GAAGxB;KACH,GAAGkB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,WAAWlB,MAAAA;GAEjDA,SAAS,KAAKnB,WAAW6C,MAAM1B,QAAQkB,SAAAA;GAEvC,MAAM,KAAKrC,WAAWuB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,IAAI,CAACnF,cAAc0E,WAAW,UAAA,KAAe3B,MAAMqC,UAC/CV,UAAUR,WAAW,KAAKmB,gBAAgBtC,KAAAA,KAAU;EAGxD,MAAMA,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAegB;GACrB0D,OAAO,IAAIlF,WAAW,GAAGD,kBAAkBoF,aAAaN,UAAU,CAAA;EACtE,CAAA;EAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,SAAAA;EAEtClB,SAAS,KAAKnB,WAAWqB,OAAOgB,SAAAA;EAChClB,SAAS,MAAM,KAAKnB,WAAWuB,KAAKJ,MAAAA;EAEpC,MAAM,KAAK8B,oBAAoB9B,MAAAA;EAC/B,MAAM,KAAK+B,kBAAkB/B,MAAAA;EAC7B,MAAM,KAAKgC,wBAAwBhC,MAAAA;EAEnC,OAAO;GACHA;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMM,OACFpB,IACAtB,OACmB;EACnB,MAAMA,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAekB,kBAAkB,CAAA;EAErF,MAAMiC,SAAS,MAAM,KAAKnB,WAAWiC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAIpD,oBAAAA;EAGd,IAAIoD,OAAOqB,UACP,MAAM,IAAI1E,gBAAgB,2CAAA;EAG9B,MAAM4C,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAekB;GACrBwD,OAAO,IAAIlF,WAAW,GAAGD,kBAAkBoF,aAAaxB,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEa,IAAIqB,aAAalC;EACzB,MAAM,KAAKnB,WAAWsD,OAAOnC,MAAAA;EAC7BA,OAAOa,KAAKqB;EAEZ,OAAOlC;CACX;;;;;IAOA,MAAc8B,oBAAoBM,YAAuC;EACrE,MAAMC,gBAAgB,MAAM,KAAKpD,iBAAiBqD,cAAchG,iBAAiBiG,OAAO;EACxF,IAAI,CAACF,eACD,MAAM,IAAI3F,YAAY,OAAOJ,iBAAiBiG,QAAQ,2FAA2F;EAOrJ,IAAIC,MAJmB,KAAKtD,2BAA2B4B,UAAU;GAC7D2B,eAAeL,WAAWvB;GAC1B6B,WAAWL,cAAcxB;EAC7B,CAAA,GAEI;EAGJ,MAAM8B,QAAQ,KAAKzD,2BAA2BgB,OAAO;GACjDuC,eAAeL,WAAWvB;GAC1B+B,qBAAqBR,WAAW1B;GAChCgC,WAAWL,cAAcxB;GACzBgC,iBAAiBR,cAAc3B;EACnC,CAAA;EACA,MAAM,KAAKxB,2BAA2BkB,KAAKuC,KAAAA;CAC/C;;;;IAMA,MAAcZ,kBAAkBK,YAAuC;EACnE,MAAMU,YAAY,MAAM,KAAK/D,eAAeuD,cAAcvF,eAAAA;EAC1D,IAAI,CAAC+F,WACD;EAOJ,IAAIN,MAJmB,KAAKxD,yBAAyB8B,UAAU;GAC3DiC,SAASD,UAAUjC;GACnB4B,eAAeL,WAAWvB;EAC9B,CAAA,GAEI;EAGJ,MAAM8B,QAAQ,KAAK3D,yBAAyBkB,OAAO;GAC/C6C,SAASD,UAAUjC;GACnBmC,eAAeF,UAAUpC;GACzB+B,eAAeL,WAAWvB;GAC1B+B,qBAAqBR,WAAW1B;EACpC,CAAA;EACA,MAAM,KAAK1B,yBAAyBoB,KAAKuC,KAAAA;CAC7C;;;;;;;;;;;;;;;;;IAmBA,MAAcX,wBAAwBI,YAAuC;EACzE,IAAIlF,iCAAiC+F,SAASb,WAAW1C,IAAI,GACzD;EAGJ,MAAMwD,YAAY,OAAQE,OAAOvG,cAAAA,EAA6BoG,SAASb,WAAW1C,IAAI;EACtF,IAAI,CAAC0C,WAAW1B,YAAY,CAACwC,WACzB;EAGJ,MAAMG,aAAa/F,8BAA8B2F,SAASb,WAAW1C,IAAI,IACrEpD,iBAAiBgH,cACjBhH,iBAAiBiH;EAErB,MAAMC,SAAS,MAAM,KAAKvE,iBAAiBqD,cAAce,UAAAA;EACzD,IAAI,CAACG,QACD;EAGJ,MAAMC,kBAAkB,MAAM,KAAK1E,eAAe2E,WAAW,EAAEhE,MAAM1C,sBAAsB,CAAA;EAE3F,KAAK,MAAM2G,QAAQF,iBAAiB;GAChC,IAAIrB,WAAW1B,YAAY0B,WAAW1B,aAAaiD,KAAKjD,UACpD;GAOJ,IAAI8B,MAJmB,KAAKxD,yBAAyB8B,UAAU;IAC3DiC,SAASY,KAAK9C;IACd4B,eAAeL,WAAWvB;GAC9B,CAAA,GAEI;GAGJ,MAAM8B,QAAQ,KAAK3D,yBAAyBkB,OAAO;IAC/C6C,SAASY,KAAK9C;IACdmC,eAAeW,KAAKjD;IACpB+B,eAAeL,WAAWvB;IAC1B+B,qBAAqBR,WAAW1B;IAChCgC,WAAWc,OAAO3C;GACtB,CAAA;GACA,MAAM,KAAK7B,yBAAyBoB,KAAKuC,KAAAA;EAC7C;CACJ;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","SystemPolicyName","ValidatorGroup","isPropertySet","isUUID","AuthupError","BadRequestError","EntityNotFoundError","PermissionName","PermissionValidator","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","AbstractEntityService","REALM_ADMIN_EXCLUDED_PERMISSIONS","REALM_CREATE","REALM_UPDATE","REALM_DELETE","REALM_ADMIN_BOUND_PERMISSIONS","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","PermissionService","repository","realmRepository","roleRepository","rolePermissionRepository","policyRepository","permissionPolicyRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","findMany","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","CREATE","validated","run","validateJoinColumns","built_in","evaluate","input","ATTRIBUTES","checkUniqueness","merge","created","identity","getActorRealmId","assignDefaultPolicy","assignToAdminRole","assignToRealmAdminRoles","delete","entityId","remove","permission","defaultPolicy","findOneByName","DEFAULT","existing","permission_id","policy_id","entry","permission_realm_id","policy_realm_id","adminRole","role_id","role_realm_id","includes","isBuiltIn","Object","values","policyName","REALM_BOUND","REALM_OR_GLOBAL","policy","realmAdminRoles","findManyBy","role"],"sources":["../../../../src/core/entities/permission/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, PolicyData, SystemPolicyName } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { AuthupError, BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n PermissionName,\n PermissionValidator,\n ROLE_ADMIN_NAME,\n ROLE_REALM_ADMIN_NAME,\n} from '@authup/core-kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository } from '../permission-policy/types.ts';\nimport type { IPolicyRepository } from '../policy/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport type { IRoleRepository } from '../role/types.ts';\nimport type { IRolePermissionRepository } from '../role-permission/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IPermissionRepository, IPermissionService } from './types.ts';\n\nconst REALM_ADMIN_EXCLUDED_PERMISSIONS = [\n PermissionName.REALM_CREATE,\n PermissionName.REALM_UPDATE,\n PermissionName.REALM_DELETE,\n];\n\n/\n CUD permissions that get system.realm-bound on realm_admin.\n * Covers direct entity types (both global-capable and realm-only).\n \n Junction entity CUD (e.g. user_role, role_permission) intentionally\n * use realm-or-global instead, because their attributes include\n * multiple realm_id fields (e.g. user_realm_id + role_realm_id).\n * With attribute_name_strict: false, realm-bound would reject\n * junctions where one side is global (realm_id: null).\n /\nconst REALM_ADMIN_BOUND_PERMISSIONS = [\n PermissionName.CLIENT_CREATE,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n PermissionName.IDENTITY_PROVIDER_CREATE,\n PermissionName.IDENTITY_PROVIDER_UPDATE,\n PermissionName.IDENTITY_PROVIDER_DELETE,\n PermissionName.PERMISSION_CREATE,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n PermissionName.ROBOT_CREATE,\n PermissionName.ROBOT_UPDATE,\n PermissionName.ROBOT_DELETE,\n PermissionName.ROLE_CREATE,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n PermissionName.SCOPE_CREATE,\n PermissionName.SCOPE_UPDATE,\n PermissionName.SCOPE_DELETE,\n PermissionName.USER_CREATE,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n];\n\nexport type PermissionServiceContext = {\n repository: IPermissionRepository;\n realmRepository: IRealmRepository;\n roleRepository: IRoleRepository;\n rolePermissionRepository: IRolePermissionRepository;\n policyRepository: IPolicyRepository;\n permissionPolicyRepository: IPermissionPolicyRepository;\n};\n\nexport class PermissionService extends AbstractEntityService implements IPermissionService {\n protected repository: IPermissionRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected roleRepository: IRoleRepository;\n\n protected rolePermissionRepository: IRolePermissionRepository;\n\n protected policyRepository: IPolicyRepository;\n\n protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n protected validator: PermissionValidator;\n\n constructor(ctx: PermissionServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.roleRepository = ctx.roleRepository;\n this.rolePermissionRepository = ctx.rolePermissionRepository;\n this.policyRepository = ctx.policyRepository;\n this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n this.validator = new PermissionValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Permission>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n realm?: string,\n ): Promise<Permission> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Permission> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Permission> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Permission,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realm_id === 'string' ?\n await this.realmRepository.resolve(data.realm_id) :\n undefined;\n\n let entity: Permission \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realm_id = realm.id;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n if (entity) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n await this.repository.validateJoinColumns(validated);\n\n if (entity) {\n if (\n entity.built_in &&\n isPropertySet(validated, 'name') &&\n entity.name !== validated.name\n ) {\n throw new BadRequestError('The name of a built-in permission can not be changed.');\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_UPDATE,\n input: new PolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n }),\n });\n\n await this.repository.checkUniqueness(validated, entity);\n\n entity = this.repository.merge(entity, validated);\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n validated.realm_id = this.getActorRealmId(actor) \|\| null;\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n await this.repository.checkUniqueness(validated);\n\n entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n await this.assignDefaultPolicy(entity);\n await this.assignToAdminRole(entity);\n await this.assignToRealmAdminRoles(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Permission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (entity.built_in) {\n throw new BadRequestError('A built-in permission can not be deleted.');\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n\n /\n Assign the system.default policy to a newly created permission.\n * This ensures all permissions are evaluated with the baseline security\n * policy (identity, permission-binding, realm-match) by default.\n /\n private async assignDefaultPolicy(permission: Permission): Promise<void> {\n const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n if (!defaultPolicy) {\n throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);\n }\n\n const existing = await this.permissionPolicyRepository.findOneBy({\n permission_id: permission.id,\n policy_id: defaultPolicy.id,\n });\n if (existing) {\n return;\n }\n\n const entry = this.permissionPolicyRepository.create({\n permission_id: permission.id,\n permission_realm_id: permission.realm_id,\n policy_id: defaultPolicy.id,\n policy_realm_id: defaultPolicy.realm_id,\n });\n await this.permissionPolicyRepository.save(entry);\n }\n\n /\n Assign a newly created permission to the global admin role.\n * The admin role receives every permission without policy restrictions.\n /\n private async assignToAdminRole(permission: Permission): Promise<void> {\n const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);\n if (!adminRole) {\n return;\n }\n\n const existing = await this.rolePermissionRepository.findOneBy({\n role_id: adminRole.id,\n permission_id: permission.id,\n });\n if (existing) {\n return;\n }\n\n const entry = this.rolePermissionRepository.create({\n role_id: adminRole.id,\n role_realm_id: adminRole.realm_id,\n permission_id: permission.id,\n permission_realm_id: permission.realm_id,\n });\n await this.rolePermissionRepository.save(entry);\n }\n\n /\n Assign a newly created permission to all matching realm_admin roles.\n \n Uses differentiated junction policies:\n * - CUD on global-capable entity types → system.realm-bound\n * - Everything else → system.realm-or-global\n \n Eligible permissions:\n * - Built-in authup permissions (global) — assigned to all realm_admin roles\n * - Realm-scoped permissions — assigned to the realm_admin in the matching realm\n \n Excluded:\n * - Realm CRUD permissions (realm_create, realm_update, realm_delete)\n * - Custom global permissions (non-built-in with realm_id: null)\n \n Fails closed: skips assignment entirely if required policies are not found.\n */\n private async assignToRealmAdminRoles(permission: Permission): Promise<void> {\n if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name as PermissionName)) {\n return;\n }\n\n const isBuiltIn = (Object.values(PermissionName) as string[]).includes(permission.name);\n if (!permission.realm_id && !isBuiltIn) {\n return;\n }\n\n const policyName = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name as PermissionName) ?\n SystemPolicyName.REALM_BOUND :\n SystemPolicyName.REALM_OR_GLOBAL;\n\n const policy = await this.policyRepository.findOneByName(policyName);\n if (!policy) {\n return;\n }\n\n const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });\n\n for (const role of realmAdminRoles) {\n if (permission.realm_id && permission.realm_id !== role.realm_id) {\n continue;\n }\n\n const existing = await this.rolePermissionRepository.findOneBy({\n role_id: role.id,\n permission_id: permission.id,\n });\n if (existing) {\n continue;\n }\n\n const entry = this.rolePermissionRepository.create({\n role_id: role.id,\n role_realm_id: role.realm_id,\n permission_id: permission.id,\n permission_realm_id: permission.realm_id,\n policy_id: policy.id,\n });\n await this.rolePermissionRepository.save(entry);\n }\n }\n}\n"],"mappings":";;;;;;;;;AA0BA,MAAMc,mCAAmC;CACrCL,eAAeM;CACfN,eAAeO;CACfP,eAAeQ;;;;;;;;;;;GAanB,MAAMC,gCAAgC;CAClCT,eAAeU;CACfV,eAAeW;CACfX,eAAeY;CACfZ,eAAea;CACfb,eAAec;CACfd,eAAee;CACff,eAAegB;CACfhB,eAAeiB;CACfjB,eAAekB;CACflB,eAAemB;CACfnB,eAAeoB;CACfpB,eAAeqB;CACfrB,eAAesB;CACftB,eAAeuB;CACfvB,eAAewB;CACfxB,eAAeyB;CACfzB,eAAe0B;CACf1B,eAAe2B;CACf3B,eAAe4B;CACf5B,eAAe6B;CACf7B,eAAe8B;;AAYnB,IAAaC,oBAAb,cAAuC3B,sBAAAA;CACzB4B;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKP,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIrC,oBAAAA;CACzB;CAEA,MAAMuC,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKc,WAAWe,SAASN,KAAAA;CACpC;CAEA,MAAMO,OACFC,UACAP,OACAQ,OACmB;EACnB,MAAMR,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMiC,SAAS,MAAM,KAAKnB,WAAWoB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAIpD,oBAAAA;EAGd,OAAOoD;CACX;CAEA,MAAME,OACFC,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMZ,KAAAA;EACpD,OAAOS;CACX;CAEA,MAAMM,OACFR,UACAK,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMZ,OAAO,EAAEgB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAZ,OACAiB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,aAAa,WACnC,MAAM,KAAK5B,gBAAgB6B,QAAQR,KAAKO,QAAQ,IAChDL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAInE,OAAOqD,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMlB,OAAOI;GAGjB,IAAIC,OACAa,MAAMF,WAAWX,MAAMc;GAG3Bb,SAAS,MAAM,KAAKnB,WAAWiC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAI3D,oBAAAA;EAElB,OAAO,IAAI4D,QAAQD,YACf,MAAM,IAAI3D,oBAAAA;EAGd,IAAIoD,QAAQ;GACR,MAAMT,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAeiB,kBAAkB,CAAA;GACrF2C,QAAQlE,eAAeyE;EAC3B,OAAO;GACH,MAAMzB,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAegB,kBAAkB,CAAA;GACrF4C,QAAQlE,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK/B,UAAUgC,IAAIhB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK5B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIlB,QAAQ;GACR,IACIA,OAAOqB,YACP7E,cAAc0E,WAAW,MAAA,KACzBlB,OAAON,SAASwB,UAAUxB,MAE1B,MAAM,IAAI/C,gBAAgB,uDAAA;GAG9B,MAAM4C,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAM7C,eAAeiB;IACrByD,OAAO,IAAIlF,WAAW,GACjBD,kBAAkBoF,aAAa;KAC5B,GAAGxB;KACH,GAAGkB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,WAAWlB,MAAAA;GAEjDA,SAAS,KAAKnB,WAAW6C,MAAM1B,QAAQkB,SAAAA;GAEvC,MAAM,KAAKrC,WAAWuB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,IAAI,CAACnF,cAAc0E,WAAW,UAAA,KAAe3B,MAAMqC,UAC/CV,UAAUR,WAAW,KAAKmB,gBAAgBtC,KAAAA,KAAU;EAGxD,MAAMA,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAegB;GACrB0D,OAAO,IAAIlF,WAAW,GAAGD,kBAAkBoF,aAAaN,UAAU,CAAA;EACtE,CAAA;EAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,SAAAA;EAEtClB,SAAS,KAAKnB,WAAWqB,OAAOgB,SAAAA;EAChClB,SAAS,MAAM,KAAKnB,WAAWuB,KAAKJ,MAAAA;EAEpC,MAAM,KAAK8B,oBAAoB9B,MAAAA;EAC/B,MAAM,KAAK+B,kBAAkB/B,MAAAA;EAC7B,MAAM,KAAKgC,wBAAwBhC,MAAAA;EAEnC,OAAO;GACHA;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMM,OACFpB,IACAtB,OACmB;EACnB,MAAMA,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAekB,kBAAkB,CAAA;EAErF,MAAMiC,SAAS,MAAM,KAAKnB,WAAWiC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAIpD,oBAAAA;EAGd,IAAIoD,OAAOqB,UACP,MAAM,IAAI1E,gBAAgB,2CAAA;EAG9B,MAAM4C,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAekB;GACrBwD,OAAO,IAAIlF,WAAW,GAAGD,kBAAkBoF,aAAaxB,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEa,IAAIqB,aAAalC;EACzB,MAAM,KAAKnB,WAAWsD,OAAOnC,MAAAA;EAC7BA,OAAOa,KAAKqB;EAEZ,OAAOlC;CACX;;;;;IAOA,MAAc8B,oBAAoBM,YAAuC;EACrE,MAAMC,gBAAgB,MAAM,KAAKpD,iBAAiBqD,cAAchG,iBAAiBiG,OAAO;EACxF,IAAI,CAACF,eACD,MAAM,IAAI3F,YAAY,OAAOJ,iBAAiBiG,QAAQ,2FAA2F;EAOrJ,IAAIC,MAJmB,KAAKtD,2BAA2B4B,UAAU;GAC7D2B,eAAeL,WAAWvB;GAC1B6B,WAAWL,cAAcxB;EAC7B,CAAA,GAEI;EAGJ,MAAM8B,QAAQ,KAAKzD,2BAA2BgB,OAAO;GACjDuC,eAAeL,WAAWvB;GAC1B+B,qBAAqBR,WAAW1B;GAChCgC,WAAWL,cAAcxB;GACzBgC,iBAAiBR,cAAc3B;EACnC,CAAA;EACA,MAAM,KAAKxB,2BAA2BkB,KAAKuC,KAAAA;CAC/C;;;;IAMA,MAAcZ,kBAAkBK,YAAuC;EACnE,MAAMU,YAAY,MAAM,KAAK/D,eAAeuD,cAAcvF,eAAAA;EAC1D,IAAI,CAAC+F,WACD;EAOJ,IAAIN,MAJmB,KAAKxD,yBAAyB8B,UAAU;GAC3DiC,SAASD,UAAUjC;GACnB4B,eAAeL,WAAWvB;EAC9B,CAAA,GAEI;EAGJ,MAAM8B,QAAQ,KAAK3D,yBAAyBkB,OAAO;GAC/C6C,SAASD,UAAUjC;GACnBmC,eAAeF,UAAUpC;GACzB+B,eAAeL,WAAWvB;GAC1B+B,qBAAqBR,WAAW1B;EACpC,CAAA;EACA,MAAM,KAAK1B,yBAAyBoB,KAAKuC,KAAAA;CAC7C;;;;;;;;;;;;;;;;;IAmBA,MAAcX,wBAAwBI,YAAuC;EACzE,IAAIlF,iCAAiC+F,SAASb,WAAW1C,IAAI,GACzD;EAGJ,MAAMwD,YAAY,OAAQE,OAAOvG,cAAAA,CAAAA,CAA6BoG,SAASb,WAAW1C,IAAI;EACtF,IAAI,CAAC0C,WAAW1B,YAAY,CAACwC,WACzB;EAGJ,MAAMG,aAAa/F,8BAA8B2F,SAASb,WAAW1C,IAAI,IACrEpD,iBAAiBgH,cACjBhH,iBAAiBiH;EAErB,MAAMC,SAAS,MAAM,KAAKvE,iBAAiBqD,cAAce,UAAAA;EACzD,IAAI,CAACG,QACD;EAGJ,MAAMC,kBAAkB,MAAM,KAAK1E,eAAe2E,WAAW,EAAEhE,MAAM1C,sBAAsB,CAAA;EAE3F,KAAK,MAAM2G,QAAQF,iBAAiB;GAChC,IAAIrB,WAAW1B,YAAY0B,WAAW1B,aAAaiD,KAAKjD,UACpD;GAOJ,IAAI8B,MAJmB,KAAKxD,yBAAyB8B,UAAU;IAC3DiC,SAASY,KAAK9C;IACd4B,eAAeL,WAAWvB;GAC9B,CAAA,GAEI;GAGJ,MAAM8B,QAAQ,KAAK3D,yBAAyBkB,OAAO;IAC/C6C,SAASY,KAAK9C;IACdmC,eAAeW,KAAKjD;IACpB+B,eAAeL,WAAWvB;IAC1B+B,qBAAqBR,WAAW1B;IAChCgC,WAAWc,OAAO3C;GACtB,CAAA;GACA,MAAM,KAAK7B,yBAAyBoB,KAAKuC,KAAAA;EAC7C;CACJ;AACJ"}

package/dist/core/entities/permission/types.mjs CHANGED Viewed

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/entities/permission-policy/index.mjs CHANGED Viewed

@@ -1,2 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { PermissionPolicyService } from "./service.mjs";
 export { PermissionPolicyService };

package/dist/core/entities/permission-policy/service.mjs CHANGED Viewed

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { PermissionName, PermissionPolicyValidator } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { ValidatorGroup } from "@authup/kit";

package/dist/core/entities/permission-policy/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","PermissionPolicyValidator","AbstractEntityService","PermissionPolicyService","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permission_id","policy_id","permission","permission_realm_id","realm_id","policy","policy_realm_id","evaluate","input","ATTRIBUTES","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/permission-policy/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, PermissionPolicyValidator } from '@authup/core-kit';\nimport type { PermissionPolicy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository, IPermissionPolicyService } from './types.ts';\n\nexport type PermissionPolicyServiceContext = {\n repository: IPermissionPolicyRepository;\n};\n\nexport class PermissionPolicyService extends AbstractEntityService implements IPermissionPolicyService {\n protected repository: IPermissionPolicyRepository;\n\n protected validator: PermissionPolicyValidator;\n\n constructor(ctx: PermissionPolicyServiceContext) {\n super();\n this.repository = ctx.repository;\n this.validator = new PermissionPolicyValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<PermissionPolicy>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<PermissionPolicy> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<PermissionPolicy> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n permission_id: validated.permission_id,\n policy_id: validated.policy_id,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'permission-policy' });\n }\n\n if (validated.permission) {\n validated.permission_realm_id = validated.permission.realm_id;\n }\n\n if (validated.policy) {\n validated.policy_realm_id = validated.policy.realm_id;\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<PermissionPolicy> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":"~~;;;;;;~~AAoBA,IAAaQ,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIJ,0BAAAA;CACzB;CAEA,MAAMM,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFZ,eAAea,iBACfb,eAAec,iBAAAA,EAEvB,CAAA;EAEA,OAAO,KAAKV,WAAWW,SAASP,KAAAA;CACpC;CAEA,MAAMQ,OACFC,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFZ,eAAea,iBACfb,eAAec,iBAAAA,EAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKd,WAAWe,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIpB,oBAAAA;EAGd,OAAOoB;CACX;CAEA,MAAME,OACFC,MACAZ,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMZ,eAAec,kBAAkB,CAAA;EAErF,MAAMS,YAAY,MAAM,KAAKlB,UAAUmB,IAAIH,MAAM,EAAEI,OAAO1B,eAAe2B,OAAO,CAAA;EAEhF,MAAM,KAAKtB,WAAWuB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAKxB,WAAWe,UAAU;GAC7CU,eAAeN,UAAUM;GACzBC,WAAWP,UAAUO;EACzB,CAAA,GAEI,MAAM,IAAIjC,oBAAoB,EAAEqB,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YACVR,UAAUS,sBAAsBT,UAAUQ,WAAWE;EAGzD,IAAIV,UAAUW,QACVX,UAAUY,kBAAkBZ,UAAUW,OAAOD;EAGjD,MAAMxB,MAAMC,oBAAoB0B,SAAS;GACrCxB,MAAMZ,eAAec;GACrBuB,OAAO,IAAIzC,WAAW,GAAGD,kBAAkB2C,aAAaf,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIL,SAAS,KAAKd,WAAWgB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKd,WAAWmC,KAAKrB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMsB,OACFvB,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMZ,eAAec,kBAAkB,CAAA;EAErF,MAAMI,SAAS,MAAM,KAAKd,WAAWe,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIpB,oBAAAA;EAGd,MAAMW,MAAMC,oBAAoB0B,SAAS;GACrCxB,MAAMZ,eAAec;GACrBuB,OAAO,IAAIzC,WAAW,GAAGD,kBAAkB2C,aAAapB,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAIwB,aAAavB;EACzB,MAAM,KAAKd,WAAWsC,OAAOxB,MAAAA;EAC7BA,OAAOD,KAAKwB;EAEZ,OAAOvB;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","PermissionPolicyValidator","AbstractEntityService","PermissionPolicyService","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permission_id","policy_id","permission","permission_realm_id","realm_id","policy","policy_realm_id","evaluate","input","ATTRIBUTES","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/permission-policy/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, PermissionPolicyValidator } from '@authup/core-kit';\nimport type { PermissionPolicy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository, IPermissionPolicyService } from './types.ts';\n\nexport type PermissionPolicyServiceContext = {\n repository: IPermissionPolicyRepository;\n};\n\nexport class PermissionPolicyService extends AbstractEntityService implements IPermissionPolicyService {\n protected repository: IPermissionPolicyRepository;\n\n protected validator: PermissionPolicyValidator;\n\n constructor(ctx: PermissionPolicyServiceContext) {\n super();\n this.repository = ctx.repository;\n this.validator = new PermissionPolicyValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<PermissionPolicy>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<PermissionPolicy> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<PermissionPolicy> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n permission_id: validated.permission_id,\n policy_id: validated.policy_id,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'permission-policy' });\n }\n\n if (validated.permission) {\n validated.permission_realm_id = validated.permission.realm_id;\n }\n\n if (validated.policy) {\n validated.policy_realm_id = validated.policy.realm_id;\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<PermissionPolicy> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaQ,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIJ,0BAAAA;CACzB;CAEA,MAAMM,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFZ,eAAea,iBACfb,eAAec,iBAAAA,EAEvB,CAAA;EAEA,OAAO,KAAKV,WAAWW,SAASP,KAAAA;CACpC;CAEA,MAAMQ,OACFC,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFZ,eAAea,iBACfb,eAAec,iBAAAA,EAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKd,WAAWe,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIpB,oBAAAA;EAGd,OAAOoB;CACX;CAEA,MAAME,OACFC,MACAZ,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMZ,eAAec,kBAAkB,CAAA;EAErF,MAAMS,YAAY,MAAM,KAAKlB,UAAUmB,IAAIH,MAAM,EAAEI,OAAO1B,eAAe2B,OAAO,CAAA;EAEhF,MAAM,KAAKtB,WAAWuB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAKxB,WAAWe,UAAU;GAC7CU,eAAeN,UAAUM;GACzBC,WAAWP,UAAUO;EACzB,CAAA,GAEI,MAAM,IAAIjC,oBAAoB,EAAEqB,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YACVR,UAAUS,sBAAsBT,UAAUQ,WAAWE;EAGzD,IAAIV,UAAUW,QACVX,UAAUY,kBAAkBZ,UAAUW,OAAOD;EAGjD,MAAMxB,MAAMC,oBAAoB0B,SAAS;GACrCxB,MAAMZ,eAAec;GACrBuB,OAAO,IAAIzC,WAAW,GAAGD,kBAAkB2C,aAAaf,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIL,SAAS,KAAKd,WAAWgB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKd,WAAWmC,KAAKrB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMsB,OACFvB,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMZ,eAAec,kBAAkB,CAAA;EAErF,MAAMI,SAAS,MAAM,KAAKd,WAAWe,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIpB,oBAAAA;EAGd,MAAMW,MAAMC,oBAAoB0B,SAAS;GACrCxB,MAAMZ,eAAec;GACrBuB,OAAO,IAAIzC,WAAW,GAAGD,kBAAkB2C,aAAapB,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAIwB,aAAavB;EACzB,MAAM,KAAKd,WAAWsC,OAAOxB,MAAAA;EAC7BA,OAAOD,KAAKwB;EAEZ,OAAOvB;CACX;AACJ"}

package/dist/core/entities/permission-policy/types.mjs CHANGED Viewed

@@ -1 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 export {};

package/dist/core/entities/policy/attributes-validator.mjs CHANGED Viewed

@@ -1,3 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
 import { omitRecord } from "@authup/kit";
 import { AttributeNamesPolicyValidator, AttributesPolicyValidator, BuiltInPolicyType, DatePolicyValidator, TimePolicyValidator } from "@authup/access";
 import { Container } from "validup";