npm - @authup/server-core - Versions diffs - 1.0.0-beta.45 → 1.0.0-beta.47 - Mend

@authup/server-core 1.0.0-beta.45 → 1.0.0-beta.47

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (448) hide show

package/dist/app/modules/provisioning/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RobotEntity","RobotPermissionEntity","RobotRoleEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RobotProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RobotPermissionRepositoryAdapter","RobotRepositoryAdapter","RobotRoleRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","robotSynchronizer","robotRepository","robotRoleRepository","robotPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","find","permission","hasAnyPolicy","findOneBy","permission_id","id","save","create","permission_realm_id","realm_id","policy_id","policy_realm_id"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n Client,\n ClientPermission,\n ClientRole,\n PermissionPolicy,\n Realm,\n Robot,\n RobotPermission,\n RobotRole,\n Role,\n RolePermission,\n Scope,\n UserPermission,\n UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n ClientEntity,\n ClientPermissionEntity,\n ClientRoleEntity,\n PermissionEntity,\n RealmEntity,\n RobotEntity,\n RobotPermissionEntity,\n RobotRoleEntity,\n RoleEntity,\n RolePermissionEntity,\n ScopeEntity,\n UserPermissionEntity,\n UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n PermissionPolicyEntity,\n PolicyRepository,\n UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n ClientProvisioningSynchronizer,\n GraphProvisioningSynchronizer,\n PermissionProvisioningSynchronizer,\n PolicyProvisioningSynchronizer,\n RealmProvisioningSynchronizer,\n RobotProvisioningSynchronizer,\n RoleProvisioningSynchronizer,\n ScopeProvisioningSynchronizer,\n UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n ClientPermissionRepositoryAdapter,\n ClientRepositoryAdapter,\n ClientRoleRepositoryAdapter,\n PermissionPolicyRepositoryAdapter,\n PermissionRepositoryAdapter,\n PolicyRepositoryAdapter,\n RealmRepositoryAdapter,\n RobotPermissionRepositoryAdapter,\n RobotRepositoryAdapter,\n RobotRoleRepositoryAdapter,\n RolePermissionRepositoryAdapter,\n RoleRepositoryAdapter,\n ScopeRepositoryAdapter,\n UserPermissionRepositoryAdapter,\n UserRepositoryAdapter,\n UserRoleRepositoryAdapter,\n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n protected sources: IProvisioningSource[];\n\n constructor(sources: IProvisioningSource[] = []) {\n this.name = ModuleName.PROVISIONING;\n this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n this.sources = sources;\n }\n\n async setup(container: IContainer): Promise<void> {\n const sources = [...this.sources];\n\n const config = container.resolve(ConfigInjectionKey);\n const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n if (fs.existsSync(provisioningDir)) {\n sources.push(new FileProvisioningSource({ cwd: provisioningDir }));\n }\n\n const composite = new CompositeProvisioningSource(sources);\n const data = await composite.load(container);\n\n const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n const permissionRepository = new PermissionRepositoryAdapter({\n repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n realmRepository,\n });\n\n const policyRepository = new PolicyRepositoryAdapter({\n repository: new PolicyRepository(dataSource),\n realmRepository,\n });\n\n // ---------------------------------------------------------------\n // Synchronize all entities (policies → permissions → roles → ...)\n // ---------------------------------------------------------------\n\n const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n );\n\n const policySynchronizer = new PolicyProvisioningSynchronizer({\n repository: policyRepository,\n permissionPolicyRepository,\n });\n\n const roleRepository = new RoleRepositoryAdapter({\n repository: container.resolve<Repository<Role>>(RoleEntity),\n realmRepository,\n });\n const clientRepository = new ClientRepositoryAdapter({\n repository: container.resolve<Repository<Client>>(ClientEntity),\n realmRepository,\n });\n\n const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n repository: permissionRepository,\n policyRepository,\n permissionPolicyRepository,\n });\n\n const roleSynchronizer = new RoleProvisioningSynchronizer({\n repository: roleRepository,\n permissionRepository,\n policyRepository,\n rolePermissionRepository: new RolePermissionRepositoryAdapter(\n container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n ),\n });\n\n const clientSynchronizer = new ClientProvisioningSynchronizer({\n clientRepository,\n clientRoleRepository: new ClientRoleRepositoryAdapter(\n container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n ),\n clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n ),\n\n roleRepository,\n permissionRepository,\n\n roleSynchronizer,\n permissionSynchronizer,\n });\n\n const userSynchronizer = new UserProvisioningSynchronizer({\n userRepository: new UserRepositoryAdapter({\n repository: new UserRepository(dataSource),\n realmRepository,\n }),\n userRoleRepository: new UserRoleRepositoryAdapter(\n container.resolve<Repository<UserRole>>(UserRoleEntity),\n ),\n userPermissionRepository: new UserPermissionRepositoryAdapter(\n container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n ),\n\n clientRepository,\n roleRepository,\n permissionRepository,\n });\n\n const robotSynchronizer = new RobotProvisioningSynchronizer({\n robotRepository: new RobotRepositoryAdapter({\n repository: container.resolve<Repository<Robot>>(RobotEntity),\n realmRepository,\n }),\n robotRoleRepository: new RobotRoleRepositoryAdapter(\n container.resolve<Repository<RobotRole>>(RobotRoleEntity),\n ),\n robotPermissionRepository: new RobotPermissionRepositoryAdapter(\n container.resolve<Repository<RobotPermission>>(RobotPermissionEntity),\n ),\n\n roleRepository,\n permissionRepository,\n });\n\n const scopeRepository = new ScopeRepositoryAdapter({\n repository: container.resolve<Repository<Scope>>(ScopeEntity),\n realmRepository,\n });\n\n const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n const realmSynchronizer = new RealmProvisioningSynchronizer({\n repository: new RealmRepositoryAdapter(realmRepository),\n\n clientSynchronizer,\n roleSynchronizer,\n permissionSynchronizer,\n userSynchronizer,\n robotSynchronizer,\n scopeSynchronizer,\n });\n\n const rootSynchronizer = new GraphProvisioningSynchronizer({\n policySynchronizer,\n permissionSynchronizer,\n roleSynchronizer,\n realmSynchronizer,\n scopeSynchronizer,\n });\n\n await rootSynchronizer.synchronize(data);\n\n if (config.permissionsDefaultPolicyAssignment) {\n await this.assignDefaultPolicy(dataSource, policyRepository);\n }\n }\n\n protected async assignDefaultPolicy(\n dataSource: DataSource,\n policyRepository: PolicyRepositoryAdapter,\n ): Promise<void> {\n const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n if (!defaultPolicy) {\n return;\n }\n\n const permissionRepo = dataSource.getRepository(PermissionEntity);\n const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n const permissions = await permissionRepo.find();\n for (const permission of permissions) {\n const hasAnyPolicy = await junctionRepo.findOneBy({ permission_id: permission.id });\n\n if (!hasAnyPolicy) {\n await junctionRepo.save(junctionRepo.create({\n permission_id: permission.id,\n permission_realm_id: permission.realm_id,\n policy_id: defaultPolicy.id,\n policy_realm_id: defaultPolicy.realm_id,\n }));\n }\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFA,IAAaiD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOP,WAAWU;EACvB,KAAKF,eAAe,CAACR,WAAWW,QAAQX,WAAWY,QAAAA;EACnD,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAA,GAAI,KAAKA,OAAAA;EAEzB,MAAMM,SAASD,UAAUE,QAAQb,kBAAAA;EACjC,MAAMc,kBAAkBf,KAAKgB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIlB,GAAGmB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB,EAAEiB,KAAKL,gBAAgB,CAAA,CAAA;EAInE,MAAMO,OAAO,MAAMD,IADGnB,4BAA4BK,OAC/Bc,CAAAA,CAAUE,KAAKX,SAAAA;EAElC,MAAMY,aAAaZ,UAAUE,QAAQjB,qBAAqB4B,UAAU;EACpE,MAAMC,kBAAkBd,UAAUE,QAA2BvD,WAAAA;EAE7D,MAAMoE,uBAAuB,IAAI1C,4BAA4B;GACzD2C,YAAYhB,UAAUE,QAAsCxD,gBAAAA;GAC5DoE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI3C,wBAAwB;GACjD0C,YAAY,IAAI1D,iBAAiBsD,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAI9C,kCACnC4B,UAAUE,QAAsC7C,sBAAAA,CAAAA;EAGpD,MAAM8D,qBAAqB,IAAIxD,+BAA+B;GAC1DqD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAIxC,sBAAsB;GAC7CoC,YAAYhB,UAAUE,QAA0BnD,UAAAA;GAChD+D;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAInD,wBAAwB;GACjD8C,YAAYhB,UAAUE,QAA4B3D,YAAAA;GAClDuE;EACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI5D,mCAAmC;GAClEsD,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAIzD,6BAA6B;GACtDkD,YAAYI;GACZL;GACAE;GACAO,0BAA0B,IAAI7C,gCAC1BqB,UAAUE,QAAoClD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAMyE,qBAAqB,IAAIjE,+BAA+B;GAC1D6D;GACAK,sBAAsB,IAAIvD,4BACtB6B,UAAUE,QAAgCzD,gBAAAA,CAAAA;GAE9CkF,4BAA4B,IAAI1D,kCAC5B+B,UAAUE,QAAsC1D,sBAAAA,CAAAA;GAGpD4E;GACAL;GAEAQ;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAI5D,6BAA6B;GACtD6D,gBAAgB,IAAI9C,sBAAsB;IACtCiC,YAAY,IAAIzD,eAAeqD,UAAAA;IAC/BE;GACJ,CAAA;GACAgB,oBAAoB,IAAI9C,0BACpBgB,UAAUE,QAA8B/C,cAAAA,CAAAA;GAE5C4E,0BAA0B,IAAIjD,gCAC1BkB,UAAUE,QAAoChD,oBAAAA,CAAAA;GAGlDmE;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMiB,oBAAoB,IAAInE,8BAA8B;GACxDoE,iBAAiB,IAAIxD,uBAAuB;IACxCuC,YAAYhB,UAAUE,QAA2BtD,WAAAA;IACjDkE;GACJ,CAAA;GACAoB,qBAAqB,IAAIxD,2BACrBsB,UAAUE,QAA+BpD,eAAAA,CAAAA;GAE7CqF,2BAA2B,IAAI3D,iCAC3BwB,UAAUE,QAAqCrD,qBAAAA,CAAAA;GAGnDuE;GACAL;EACJ,CAAA;EAOA,MAAMsB,oBAAoB,IAAItE,8BAA8B,EAAEiD,YAAYoB,IAL9CvD,uBAAuB;GAC/CmC,YAAYhB,UAAUE,QAA2BjD,WAAAA;GACjD6D;EACJ,CAE0EsB,EAAgB,CAAA;EAqB1F,MAAMG,IARuB9E,8BAA8B;GACvD0D;GACAG;GACAC;GACAe,mBAAAA,IAf0B1E,8BAA8B;IACxDoD,YAAY,IAAIzC,uBAAuBuC,eAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAI;IACAK;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY9B,IAAAA;EAEnC,IAAIT,OAAOwC,oCACP,MAAM,KAAKC,oBAAoB9B,YAAYK,gBAAAA;CAEnD;CAEA,MAAgByB,oBACZ9B,YACAK,kBACa;EACb,MAAM0B,gBAAgB,MAAM1B,iBAAiB2B,cAAcxF,iBAAiByF,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBlC,WAAWmC,cAAcrG,gBAAAA;EAChD,MAAMsG,eAAepC,WAAWmC,cAAc1F,sBAAAA;EAE9C,MAAM4F,cAAc,MAAMH,eAAeI,KAAI;EAC7C,KAAK,MAAMC,cAAcF,aAGrB,IAAI,CAACG,MAFsBJ,aAAaK,UAAU,EAAEC,eAAeH,WAAWI,GAAG,CAAA,GAG7E,MAAMP,aAAaQ,KAAKR,aAAaS,OAAO;GACxCH,eAAeH,WAAWI;GAC1BG,qBAAqBP,WAAWQ;GAChCC,WAAWjB,cAAcY;GACzBM,iBAAiBlB,cAAcgB;EACnC,CAAA,CAAA;CAGZ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RobotEntity","RobotPermissionEntity","RobotRoleEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RobotProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RobotPermissionRepositoryAdapter","RobotRepositoryAdapter","RobotRoleRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","LoggerInjectionKey","WebClientProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","robotSynchronizer","robotRepository","robotRoleRepository","robotPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","logger","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permission_id","id","save","create","permission_realm_id","realm_id","policy_id","policy_realm_id"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n Client,\n ClientPermission,\n ClientRole,\n PermissionPolicy,\n Realm,\n Robot,\n RobotPermission,\n RobotRole,\n Role,\n RolePermission,\n Scope,\n UserPermission,\n UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n ClientEntity,\n ClientPermissionEntity,\n ClientRoleEntity,\n PermissionEntity,\n RealmEntity,\n RobotEntity,\n RobotPermissionEntity,\n RobotRoleEntity,\n RoleEntity,\n RolePermissionEntity,\n ScopeEntity,\n UserPermissionEntity,\n UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n PermissionPolicyEntity,\n PolicyRepository,\n UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n ClientProvisioningSynchronizer,\n GraphProvisioningSynchronizer,\n PermissionProvisioningSynchronizer,\n PolicyProvisioningSynchronizer,\n RealmProvisioningSynchronizer,\n RobotProvisioningSynchronizer,\n RoleProvisioningSynchronizer,\n ScopeProvisioningSynchronizer,\n UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n ClientPermissionRepositoryAdapter,\n ClientRepositoryAdapter,\n ClientRoleRepositoryAdapter,\n PermissionPolicyRepositoryAdapter,\n PermissionRepositoryAdapter,\n PolicyRepositoryAdapter,\n RealmRepositoryAdapter,\n RobotPermissionRepositoryAdapter,\n RobotRepositoryAdapter,\n RobotRoleRepositoryAdapter,\n RolePermissionRepositoryAdapter,\n RoleRepositoryAdapter,\n ScopeRepositoryAdapter,\n UserPermissionRepositoryAdapter,\n UserRepositoryAdapter,\n UserRoleRepositoryAdapter,\n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n protected sources: IProvisioningSource[];\n\n constructor(sources: IProvisioningSource[] = []) {\n this.name = ModuleName.PROVISIONING;\n this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n this.sources = sources;\n }\n\n async setup(container: IContainer): Promise<void> {\n const sources = [...this.sources];\n\n const config = container.resolve(ConfigInjectionKey);\n const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n if (fs.existsSync(provisioningDir)) {\n sources.push(new FileProvisioningSource({ cwd: provisioningDir }));\n }\n\n const composite = new CompositeProvisioningSource(sources);\n const data = await composite.load(container);\n\n const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n const permissionRepository = new PermissionRepositoryAdapter({\n repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n realmRepository,\n });\n\n const policyRepository = new PolicyRepositoryAdapter({\n repository: new PolicyRepository(dataSource),\n realmRepository,\n });\n\n // ---------------------------------------------------------------\n // Synchronize all entities (policies → permissions → roles → ...)\n // ---------------------------------------------------------------\n\n const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n );\n\n const policySynchronizer = new PolicyProvisioningSynchronizer({\n repository: policyRepository,\n permissionPolicyRepository,\n });\n\n const roleRepository = new RoleRepositoryAdapter({\n repository: container.resolve<Repository<Role>>(RoleEntity),\n realmRepository,\n });\n const clientRepository = new ClientRepositoryAdapter({\n repository: container.resolve<Repository<Client>>(ClientEntity),\n realmRepository,\n });\n\n const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n repository: permissionRepository,\n policyRepository,\n permissionPolicyRepository,\n });\n\n const roleSynchronizer = new RoleProvisioningSynchronizer({\n repository: roleRepository,\n permissionRepository,\n policyRepository,\n rolePermissionRepository: new RolePermissionRepositoryAdapter(\n container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n ),\n });\n\n const clientSynchronizer = new ClientProvisioningSynchronizer({\n clientRepository,\n clientRoleRepository: new ClientRoleRepositoryAdapter(\n container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n ),\n clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n ),\n\n roleRepository,\n permissionRepository,\n\n roleSynchronizer,\n permissionSynchronizer,\n });\n\n const userSynchronizer = new UserProvisioningSynchronizer({\n userRepository: new UserRepositoryAdapter({\n repository: new UserRepository(dataSource),\n realmRepository,\n }),\n userRoleRepository: new UserRoleRepositoryAdapter(\n container.resolve<Repository<UserRole>>(UserRoleEntity),\n ),\n userPermissionRepository: new UserPermissionRepositoryAdapter(\n container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n ),\n\n clientRepository,\n roleRepository,\n permissionRepository,\n });\n\n const robotSynchronizer = new RobotProvisioningSynchronizer({\n robotRepository: new RobotRepositoryAdapter({\n repository: container.resolve<Repository<Robot>>(RobotEntity),\n realmRepository,\n }),\n robotRoleRepository: new RobotRoleRepositoryAdapter(\n container.resolve<Repository<RobotRole>>(RobotRoleEntity),\n ),\n robotPermissionRepository: new RobotPermissionRepositoryAdapter(\n container.resolve<Repository<RobotPermission>>(RobotPermissionEntity),\n ),\n\n roleRepository,\n permissionRepository,\n });\n\n const scopeRepository = new ScopeRepositoryAdapter({\n repository: container.resolve<Repository<Scope>>(ScopeEntity),\n realmRepository,\n });\n\n const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n const realmSynchronizer = new RealmProvisioningSynchronizer({\n repository: new RealmRepositoryAdapter(realmRepository),\n\n clientSynchronizer,\n roleSynchronizer,\n permissionSynchronizer,\n userSynchronizer,\n robotSynchronizer,\n scopeSynchronizer,\n });\n\n const rootSynchronizer = new GraphProvisioningSynchronizer({\n policySynchronizer,\n permissionSynchronizer,\n roleSynchronizer,\n realmSynchronizer,\n scopeSynchronizer,\n });\n\n await rootSynchronizer.synchronize(data);\n\n // ---------------------------------------------------------------\n // Per-realm public `web` client. Single provisioning mechanism:\n // list every realm (incl. pre-existing) and upsert its web client.\n // Idempotent; guarded on built_in inside the provisioner.\n // ---------------------------------------------------------------\n const webClientProvisioner = new WebClientProvisioner({\n clientRepository,\n appOrigins: getAppOrigins(config),\n logger: container.resolve(LoggerInjectionKey),\n });\n\n const realms = await realmRepository.find();\n for (const realm of realms) {\n await webClientProvisioner.ensureForRealm(realm);\n }\n\n if (config.permissionsDefaultPolicyAssignment) {\n await this.assignDefaultPolicy(dataSource, policyRepository);\n }\n }\n\n protected async assignDefaultPolicy(\n dataSource: DataSource,\n policyRepository: PolicyRepositoryAdapter,\n ): Promise<void> {\n const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n if (!defaultPolicy) {\n return;\n }\n\n const permissionRepo = dataSource.getRepository(PermissionEntity);\n const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n const permissions = await permissionRepo.find();\n for (const permission of permissions) {\n const hasAnyPolicy = await junctionRepo.findOneBy({ permission_id: permission.id });\n\n if (!hasAnyPolicy) {\n await junctionRepo.save(junctionRepo.create({\n permission_id: permission.id,\n permission_realm_id: permission.realm_id,\n policy_id: defaultPolicy.id,\n policy_realm_id: defaultPolicy.realm_id,\n }));\n }\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoFA,IAAaoD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOV,WAAWa;EACvB,KAAKF,eAAe,CAACX,WAAWc,QAAQd,WAAWe,QAAAA;EACnD,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAA,GAAI,KAAKA,OAAAA;EAEzB,MAAMM,SAASD,UAAUE,QAAQhB,kBAAAA;EACjC,MAAMiB,kBAAkBlB,KAAKmB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIrB,GAAGsB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB,EAAEiB,KAAKL,gBAAgB,CAAA,CAAA;EAInE,MAAMO,OAAO,MAAMD,IADGnB,4BAA4BK,OAC/Bc,CAAAA,CAAUE,KAAKX,SAAAA;EAElC,MAAMY,aAAaZ,UAAUE,QAAQpB,qBAAqB+B,UAAU;EACpE,MAAMC,kBAAkBd,UAAUE,QAA2B1D,WAAAA;EAE7D,MAAMuE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYhB,UAAUE,QAAsC3D,gBAAAA;GAC5DuE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI7D,iBAAiByD,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC+B,UAAUE,QAAsChD,sBAAAA,CAAAA;EAGpD,MAAMiE,qBAAqB,IAAI3D,+BAA+B;GAC1DwD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI3C,sBAAsB;GAC7CuC,YAAYhB,UAAUE,QAA0BtD,UAAAA;GAChDkE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAItD,wBAAwB;GACjDiD,YAAYhB,UAAUE,QAA4B9D,YAAAA;GAClD0E;EACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI/D,mCAAmC;GAClEyD,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAI5D,6BAA6B;GACtDqD,YAAYI;GACZL;GACAE;GACAO,0BAA0B,IAAIhD,gCAC1BwB,UAAUE,QAAoCrD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM4E,qBAAqB,IAAIpE,+BAA+B;GAC1DgE;GACAK,sBAAsB,IAAI1D,4BACtBgC,UAAUE,QAAgC5D,gBAAAA,CAAAA;GAE9CqF,4BAA4B,IAAI7D,kCAC5BkC,UAAUE,QAAsC7D,sBAAAA,CAAAA;GAGpD+E;GACAL;GAEAQ;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAI/D,6BAA6B;GACtDgE,gBAAgB,IAAIjD,sBAAsB;IACtCoC,YAAY,IAAI5D,eAAewD,UAAAA;IAC/BE;GACJ,CAAA;GACAgB,oBAAoB,IAAIjD,0BACpBmB,UAAUE,QAA8BlD,cAAAA,CAAAA;GAE5C+E,0BAA0B,IAAIpD,gCAC1BqB,UAAUE,QAAoCnD,oBAAAA,CAAAA;GAGlDsE;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMiB,oBAAoB,IAAItE,8BAA8B;GACxDuE,iBAAiB,IAAI3D,uBAAuB;IACxC0C,YAAYhB,UAAUE,QAA2BzD,WAAAA;IACjDqE;GACJ,CAAA;GACAoB,qBAAqB,IAAI3D,2BACrByB,UAAUE,QAA+BvD,eAAAA,CAAAA;GAE7CwF,2BAA2B,IAAI9D,iCAC3B2B,UAAUE,QAAqCxD,qBAAAA,CAAAA;GAGnD0E;GACAL;EACJ,CAAA;EAOA,MAAMsB,oBAAoB,IAAIzE,8BAA8B,EAAEoD,YAAYoB,IAL9C1D,uBAAuB;GAC/CsC,YAAYhB,UAAUE,QAA2BpD,WAAAA;GACjDgE;EACJ,CAE0EsB,EAAgB,CAAA;EAqB1F,MAAMG,IARuBjF,8BAA8B;GACvD6D;GACAG;GACAC;GACAe,mBAAAA,IAf0B7E,8BAA8B;IACxDuD,YAAY,IAAI5C,uBAAuB0C,eAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAI;IACAK;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY9B,IAAAA;EAOnC,MAAM+B,uBAAuB,IAAIpD,qBAAqB;GAClDgC;GACAqB,YAAYvD,cAAcc,MAAAA;GAC1B0C,QAAQ3C,UAAUE,QAAQd,kBAAAA;EAC9B,CAAA;EAEA,MAAMwD,SAAS,MAAM9B,gBAAgB+B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAChB,MAAMH,qBAAqBM,eAAeD,KAAAA;EAG9C,IAAI7C,OAAO+C,oCACP,MAAM,KAAKC,oBAAoBrC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgBgC,oBACZrC,YACAK,kBACa;EACb,MAAMiC,gBAAgB,MAAMjC,iBAAiBkC,cAAclG,iBAAiBmG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBzC,WAAW0C,cAAc/G,gBAAAA;EAChD,MAAMgH,eAAe3C,WAAW0C,cAAcpG,sBAAAA;EAE9C,MAAMsG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,eAAeH,WAAWI,GAAG,CAAA,GAG7E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,eAAeH,WAAWI;GAC1BG,qBAAqBP,WAAWQ;GAChCC,WAAWhB,cAAcW;GACzBM,iBAAiBjB,cAAce;EACnC,CAAA,CAAA;CAGZ;AACJ"}

package/dist/app/modules/provisioning/sources/default/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"~~AAwBA~~,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAMxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IAuI3C,gBAAgB,IAAI,4BAA4B,EAAE;IA6BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IA4DhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IA8F/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAMxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IAuI3C,gBAAgB,IAAI,4BAA4B,EAAE;IA6BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IA4DhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IA8F/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}

package/dist/app/modules/provisioning/sources/default/module.mjs CHANGED Viewed

@@ -10,7 +10,8 @@ import "../../../../../core/index.mjs";
 import { ConfigInjectionKey } from "../../../config/constants.mjs";
 import "../../../config/index.mjs";
 import { PermissionName, REALM_MASTER_NAME, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME, ScopeName, buildUserFakeEmail } from "@authup/core-kit";
-import { BuiltInPolicyType, DecisionStrategy, SystemPolicyName } from "@authup/access";
+import { DecisionStrategy } from "@authup/kit";
+import { BuiltInPolicyType, SystemPolicyName } from "@authup/access";
 //#region src/app/modules/provisioning/sources/default/module.ts
 var DefaultProvisioningSource = class {
 	buildPolicies() {

package/dist/app/modules/provisioning/sources/default/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","DecisionStrategy","SystemPolicyName","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","RobotCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","built_in","realm_id","extraAttributes","decision_strategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","REALM_MATCH","attribute_name","attribute_name_strict","identity_master_match_all","attribute_null_match_all","REALM_BOUND","REALM_OR_GLOBAL","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","ROBOT_NAMES_SELF_MANAGE","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","ROBOT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","globalPermissionsPolicyName","globalPermissionsPolicyOverrides","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","is_confidential","secret","clientSystemSecret","secret_hashed","clientSystemEnabled","robotCredentialsService","robotStrategy","robotAdminSecretReset","robots","robotAdminSecret","robotAdminEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, DecisionStrategy, SystemPolicyName } from '@authup/access';\nimport type {\n Client, \n Permission, \n Robot, \n Role, \n Scope, \n User,\n} from '@authup/core-kit';\nimport {\n PermissionName, \n REALM_MASTER_NAME, \n ROLE_ADMIN_NAME, \n ROLE_REALM_ADMIN_NAME, \n ScopeName, \n buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n ClientCredentialsService,\n RobotCredentialsService,\n UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n buildPolicies(): PolicyProvisioningEntity[] {\n return [\n {\n attributes: {\n name: SystemPolicyName.DEFAULT,\n type: BuiltInPolicyType.COMPOSITE,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },\n children: [\n {\n attributes: {\n name: SystemPolicyName.IDENTITY,\n type: BuiltInPolicyType.IDENTITY,\n built_in: true,\n realm_id: null,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.PERMISSION_BINDING,\n type: BuiltInPolicyType.PERMISSION_BINDING,\n built_in: true,\n realm_id: null,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.REALM_MATCH,\n type: BuiltInPolicyType.REALM_MATCH,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n attribute_name: ['realm_id'],\n attribute_name_strict: false,\n identity_master_match_all: false,\n attribute_null_match_all: true,\n },\n },\n ],\n },\n {\n attributes: {\n name: SystemPolicyName.REALM_BOUND,\n type: BuiltInPolicyType.REALM_MATCH,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n attribute_name: ['realm_id'],\n attribute_name_strict: false,\n attribute_null_match_all: false,\n identity_master_match_all: false,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.REALM_OR_GLOBAL,\n type: BuiltInPolicyType.REALM_MATCH,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n attribute_name: ['realm_id'],\n attribute_name_strict: false,\n attribute_null_match_all: true,\n identity_master_match_all: false,\n },\n },\n // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n // Each `names` entry is what self-edit must REJECT; everything else\n // is permitted. New columns added to the entity are self-editable\n // by default — extend the denylist when adding admin-only state.\n {\n attributes: {\n name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n // FK + lifecycle\n 'active',\n 'realm_id',\n // Security-critical: a self-edit must not change the\n // client's confidentiality (toggling this clears the\n // secret) or downgrade the secret-storage format\n // (which would persist the secret in plaintext).\n 'is_confidential',\n 'secret_hashed',\n 'secret_encrypted',\n ],\n },\n },\n {\n attributes: {\n name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n 'active',\n 'realm_id',\n 'user_id',\n ],\n },\n },\n {\n attributes: {\n name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n 'active',\n 'name_locked',\n 'status',\n 'status_message',\n 'realm_id',\n ],\n },\n },\n ];\n }\n\n buildPermissions(): PermissionProvisioningEntity[] {\n const policiesByPermission: Partial<Record<string, string[]>> = {\n [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n [PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],\n [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n };\n\n return Object.values(PermissionName)\n .map((name) => {\n const entity: PermissionProvisioningEntity = {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Permission)[],\n },\n attributes: {\n name,\n built_in: true,\n },\n };\n\n const policies = policiesByPermission[name];\n if (policies) {\n entity.relations = { policies };\n }\n\n return entity;\n });\n }\n\n buildScopes(): ScopeProvisioningEntity[] {\n return Object.values(ScopeName)\n .map((name) => ({\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Scope)[],\n },\n attributes: {\n name,\n built_in: true,\n },\n }));\n }\n\n buildRoles(): RoleProvisioningEntity[] {\n return [\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_ADMIN_NAME,\n built_in: true,\n },\n relations: { globalPermissions: [''] },\n },\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_REALM_ADMIN_NAME,\n built_in: true,\n },\n relations: {\n globalPermissions: ['*'],\n globalPermissionsExclude: [\n PermissionName.REALM_CREATE,\n PermissionName.REALM_UPDATE,\n PermissionName.REALM_DELETE,\n ],\n globalPermissionsPolicyName: SystemPolicyName.REALM_OR_GLOBAL,\n globalPermissionsPolicyOverrides: {\n [SystemPolicyName.REALM_BOUND]: [\n PermissionName.CLIENT_CREATE,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n PermissionName.IDENTITY_PROVIDER_CREATE,\n PermissionName.IDENTITY_PROVIDER_UPDATE,\n PermissionName.IDENTITY_PROVIDER_DELETE,\n PermissionName.PERMISSION_CREATE,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n PermissionName.ROBOT_CREATE,\n PermissionName.ROBOT_UPDATE,\n PermissionName.ROBOT_DELETE,\n PermissionName.ROLE_CREATE,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n PermissionName.SCOPE_CREATE,\n PermissionName.SCOPE_UPDATE,\n PermissionName.SCOPE_DELETE,\n PermissionName.USER_CREATE,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ],\n },\n },\n },\n ];\n }\n\n async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n const masterRealm : RealmProvisioningEntity = {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'],\n },\n attributes: {\n name: REALM_MASTER_NAME,\n built_in: true,\n },\n relations: {},\n };\n\n const userCredentialsService = new UserCredentialsService();\n\n let userStrategy : ProvisioningEntityStrategy<User> \| undefined;\n if (config.userAdminPasswordReset) {\n userStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['password'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.users = [\n {\n strategy: userStrategy,\n attributes: {\n name: 'admin',\n password: await userCredentialsService.protect(config.userAdminPassword),\n email: buildUserFakeEmail('admin'),\n active: config.userAdminEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n const clientCredentialsService = new ClientCredentialsService();\n\n let clientStrategy : ProvisioningEntityStrategy<Client> \| undefined;\n if (config.clientSystemSecretReset) {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in', 'is_confidential', 'secret', 'secret_hashed', 'secret_encrypted'],\n };\n } else {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in', 'is_confidential'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.clients = [\n {\n strategy: clientStrategy,\n attributes: {\n built_in: true,\n is_confidential: true,\n name: 'system',\n secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),\n secret_hashed: false,\n active: config.clientSystemEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n const robotCredentialsService = new RobotCredentialsService();\n\n let robotStrategy : ProvisioningEntityStrategy<Robot> \| undefined;\n if (config.robotAdminSecretReset) {\n robotStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['secret'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.robots = [\n {\n strategy: robotStrategy,\n attributes: {\n name: 'system',\n secret: await robotCredentialsService.protect(config.robotAdminSecret),\n active: config.robotAdminEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n return [masterRealm];\n }\n\n async load(container: IContainer): Promise<RootProvisioningEntity> {\n const config = container.resolve(ConfigInjectionKey);\n\n return {\n policies: this.buildPolicies(),\n permissions: this.buildPermissions(),\n scopes: this.buildScopes(),\n roles: this.buildRoles(),\n realms: await this.buildRealms(config),\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;AA0CA,IAAac,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMf,iBAAiBgB;KACvBC,MAAMnB,kBAAkBoB;KACxBC,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EAAEC,mBAAmBvB,iBAAiBwB,UAAU;IACjEC,UAAU;KACN,EACIV,YAAY;MACRC,MAAMf,iBAAiByB;MACvBR,MAAMnB,kBAAkB2B;MACxBN,UAAU;MACVC,UAAU;KACd,EACJ;KACA,EACIN,YAAY;MACRC,MAAMf,iBAAiB0B;MACvBT,MAAMnB,kBAAkB4B;MACxBP,UAAU;MACVC,UAAU;KACd,EACJ;KACA;MACIN,YAAY;OACRC,MAAMf,iBAAiB2B;OACvBV,MAAMnB,kBAAkB6B;OACxBR,UAAU;OACVC,UAAU;MACd;MACAC,iBAAiB;OACbO,gBAAgB,CAAC,UAAA;OACjBC,uBAAuB;OACvBC,2BAA2B;OAC3BC,0BAA0B;MAC9B;KACJ;;GAER;GACA;IACIjB,YAAY;KACRC,MAAMf,iBAAiBgC;KACvBf,MAAMnB,kBAAkB6B;KACxBR,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB;KACbO,gBAAgB,CAAC,UAAA;KACjBC,uBAAuB;KACvBE,0BAA0B;KAC1BD,2BAA2B;IAC/B;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMf,iBAAiBiC;KACvBhB,MAAMnB,kBAAkB6B;KACxBR,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB;KACbO,gBAAgB,CAAC,UAAA;KACjBC,uBAAuB;KACvBE,0BAA0B;KAC1BD,2BAA2B;IAC/B;GACJ;GAKA;IACIhB,YAAY;KACRC,MAAMf,iBAAiBkC;KACvBjB,MAAMnB,kBAAkBqC;KACxBC,QAAQ;KACRjB,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbgB,OAAO;KAEH;KACA;KAKA;KACA;KACA;MAER;GACJ;GACA;IACIvB,YAAY;KACRC,MAAMf,iBAAiBsC;KACvBrB,MAAMnB,kBAAkBqC;KACxBC,QAAQ;KACRjB,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbgB,OAAO;KACH;KACA;KACA;MAER;GACJ;GACA;IACIvB,YAAY;KACRC,MAAMf,iBAAiBuC;KACvBtB,MAAMnB,kBAAkBqC;KACxBC,QAAQ;KACRjB,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbgB,OAAO;KACH;KACA;KACA;KACA;KACA;MAER;GACJ;;CAER;CAEAG,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3DxC,eAAeyC,qBAAqB,CAAC1C,iBAAiBgB,SAAShB,iBAAiBkC,wBAAAA;IAChFjC,eAAe0C,oBAAoB,CAAC3C,iBAAiBgB,SAAShB,iBAAiBsC,uBAAAA;IAC/ErC,eAAe2C,mBAAmB,CAAC5C,iBAAiBgB,SAAShB,iBAAiBuC,sBAAAA;EACnF;EAEA,OAAOM,OAAOC,OAAO7C,cAAAA,CAAAA,CAChB8C,KAAKhC,SAAAA;GACF,MAAMiC,SAAuC;IACzCC,UAAU;KACNhC,MAAMN,+BAA+BuC;KACrCpC,YAAY,CAAC,UAAA;IACjB;IACAA,YAAY;KACRC;KACAI,UAAU;IACd;GACJ;GAEA,MAAMgC,WAAWV,qBAAqB1B;GACtC,IAAIoC,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAOzC,SAAAA,CAAAA,CAChB0C,KAAKhC,UAAU;GACZkC,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC;IACAI,UAAU;GACd;EACJ,EAAA;CACR;CAEAmC,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMZ;IACNgB,UAAU;GACd;GACAiC,WAAW,EAAEG,mBAAmB,CAAC,GAAA,EAAK;EAC1C,GACA;GACIN,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMX;IACNe,UAAU;GACd;GACAiC,WAAW;IACPG,mBAAmB,CAAC,GAAA;IACpBC,0BAA0B;KACtBvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;;IAEnBC,6BAA6B5D,iBAAiBiC;IAC9C4B,kCAAkC,GAC7B7D,iBAAiBgC,cAAc;KAC5B/B,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;KACf/E,eAAegF;KACfhF,eAAeiF;MAEvB;GACJ;EACJ,CAAA;CAER;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1CpC,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMb;IACNiB,UAAU;GACd;GACAiC,WAAW,CAAC;EAChB;EAEA,MAAMkC,yBAAyB,IAAI7E,uBAAAA;EAEnC,IAAI8E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXtE,MAAMN,+BAA+BuC;GACrCpC,YAAY,CAAC,UAAA;EACjB;EAGJuE,YAAYjC,YAAYiC,YAAYjC,aAAa,CAAC;EAClDiC,YAAYjC,UAAUqC,QAAQ,CAC1B;GACIxC,UAAUsC;GACVzE,YAAY;IACRC,MAAM;IACN2E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOvF,mBAAmB,OAAA;IAC1BwF,QAAQV,OAAOW;GACnB;GACA3C,WAAW,EAAE4C,aAAa,CAAC7F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAM8F,2BAA2B,IAAI1F,yBAAAA;EAErC,IAAI2F;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACbjF,MAAMN,+BAA+BuC;GACrCpC,YAAY;IAAC;IAAY;IAAmB;IAAU;IAAiB;;EAC3E;OAEAoF,iBAAiB;GACbjF,MAAMN,+BAA+BuC;GACrCpC,YAAY,CAAC,YAAY,iBAAA;EAC7B;EAGJuE,YAAYjC,YAAYiC,YAAYjC,aAAa,CAAC;EAClDiC,YAAYjC,UAAUgD,UAAU,CAC5B;GACInD,UAAUiD;GACVpF,YAAY;IACRK,UAAU;IACVkF,iBAAiB;IACjBtF,MAAM;IACNuF,QAAQ,MAAML,yBAAyBN,QAAQP,OAAOmB,oBAAoB,EAAEC,eAAe,MAAM,CAAA;IACjGA,eAAe;IACfV,QAAQV,OAAOqB;GACnB;GACArD,WAAW,EAAE4C,aAAa,CAAC7F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAMuG,0BAA0B,IAAIlG,wBAAAA;EAEpC,IAAImG;EACJ,IAAIvB,OAAOwB,uBACPD,gBAAgB;GACZ1F,MAAMN,+BAA+BuC;GACrCpC,YAAY,CAAC,QAAA;EACjB;EAGJuE,YAAYjC,YAAYiC,YAAYjC,aAAa,CAAC;EAClDiC,YAAYjC,UAAUyD,SAAS,CAC3B;GACI5D,UAAU0D;GACV7F,YAAY;IACRC,MAAM;IACNuF,QAAQ,MAAMI,wBAAwBf,QAAQP,OAAO0B,gBAAgB;IACrEhB,QAAQV,OAAO2B;GACnB;GACA3D,WAAW,EAAE4C,aAAa,CAAC7F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,OAAO,CAACkF,WAAAA;CACZ;CAEA,MAAM2B,KAAKC,WAAwD;EAC/D,MAAM7B,SAAS6B,UAAUC,QAAQxG,kBAAAA;EAEjC,OAAO;GACHyC,UAAU,KAAKtC,cAAa;GAC5BsG,aAAa,KAAK3E,iBAAgB;GAClC4E,QAAQ,KAAK/D,YAAW;GACxBgE,OAAO,KAAK/D,WAAU;GACtBgE,QAAQ,MAAM,KAAKnC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","SystemPolicyName","DecisionStrategy","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","RobotCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","built_in","realm_id","extraAttributes","decision_strategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","REALM_MATCH","attribute_name","attribute_name_strict","identity_master_match_all","attribute_null_match_all","REALM_BOUND","REALM_OR_GLOBAL","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","ROBOT_NAMES_SELF_MANAGE","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","ROBOT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","globalPermissionsPolicyName","globalPermissionsPolicyOverrides","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","is_confidential","secret","clientSystemSecret","secret_hashed","clientSystemEnabled","robotCredentialsService","robotStrategy","robotAdminSecretReset","robots","robotAdminSecret","robotAdminEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n Client, \n Permission, \n Robot, \n Role, \n Scope, \n User,\n} from '@authup/core-kit';\nimport {\n PermissionName, \n REALM_MASTER_NAME, \n ROLE_ADMIN_NAME, \n ROLE_REALM_ADMIN_NAME, \n ScopeName, \n buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n ClientCredentialsService,\n RobotCredentialsService,\n UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n buildPolicies(): PolicyProvisioningEntity[] {\n return [\n {\n attributes: {\n name: SystemPolicyName.DEFAULT,\n type: BuiltInPolicyType.COMPOSITE,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },\n children: [\n {\n attributes: {\n name: SystemPolicyName.IDENTITY,\n type: BuiltInPolicyType.IDENTITY,\n built_in: true,\n realm_id: null,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.PERMISSION_BINDING,\n type: BuiltInPolicyType.PERMISSION_BINDING,\n built_in: true,\n realm_id: null,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.REALM_MATCH,\n type: BuiltInPolicyType.REALM_MATCH,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n attribute_name: ['realm_id'],\n attribute_name_strict: false,\n identity_master_match_all: false,\n attribute_null_match_all: true,\n },\n },\n ],\n },\n {\n attributes: {\n name: SystemPolicyName.REALM_BOUND,\n type: BuiltInPolicyType.REALM_MATCH,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n attribute_name: ['realm_id'],\n attribute_name_strict: false,\n attribute_null_match_all: false,\n identity_master_match_all: false,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.REALM_OR_GLOBAL,\n type: BuiltInPolicyType.REALM_MATCH,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n attribute_name: ['realm_id'],\n attribute_name_strict: false,\n attribute_null_match_all: true,\n identity_master_match_all: false,\n },\n },\n // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n // Each `names` entry is what self-edit must REJECT; everything else\n // is permitted. New columns added to the entity are self-editable\n // by default — extend the denylist when adding admin-only state.\n {\n attributes: {\n name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n // FK + lifecycle\n 'active',\n 'realm_id',\n // Security-critical: a self-edit must not change the\n // client's confidentiality (toggling this clears the\n // secret) or downgrade the secret-storage format\n // (which would persist the secret in plaintext).\n 'is_confidential',\n 'secret_hashed',\n 'secret_encrypted',\n ],\n },\n },\n {\n attributes: {\n name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n 'active',\n 'realm_id',\n 'user_id',\n ],\n },\n },\n {\n attributes: {\n name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n 'active',\n 'name_locked',\n 'status',\n 'status_message',\n 'realm_id',\n ],\n },\n },\n ];\n }\n\n buildPermissions(): PermissionProvisioningEntity[] {\n const policiesByPermission: Partial<Record<string, string[]>> = {\n [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n [PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],\n [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n };\n\n return Object.values(PermissionName)\n .map((name) => {\n const entity: PermissionProvisioningEntity = {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Permission)[],\n },\n attributes: {\n name,\n built_in: true,\n },\n };\n\n const policies = policiesByPermission[name];\n if (policies) {\n entity.relations = { policies };\n }\n\n return entity;\n });\n }\n\n buildScopes(): ScopeProvisioningEntity[] {\n return Object.values(ScopeName)\n .map((name) => ({\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Scope)[],\n },\n attributes: {\n name,\n built_in: true,\n },\n }));\n }\n\n buildRoles(): RoleProvisioningEntity[] {\n return [\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_ADMIN_NAME,\n built_in: true,\n },\n relations: { globalPermissions: [''] },\n },\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_REALM_ADMIN_NAME,\n built_in: true,\n },\n relations: {\n globalPermissions: ['*'],\n globalPermissionsExclude: [\n PermissionName.REALM_CREATE,\n PermissionName.REALM_UPDATE,\n PermissionName.REALM_DELETE,\n ],\n globalPermissionsPolicyName: SystemPolicyName.REALM_OR_GLOBAL,\n globalPermissionsPolicyOverrides: {\n [SystemPolicyName.REALM_BOUND]: [\n PermissionName.CLIENT_CREATE,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n PermissionName.IDENTITY_PROVIDER_CREATE,\n PermissionName.IDENTITY_PROVIDER_UPDATE,\n PermissionName.IDENTITY_PROVIDER_DELETE,\n PermissionName.PERMISSION_CREATE,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n PermissionName.ROBOT_CREATE,\n PermissionName.ROBOT_UPDATE,\n PermissionName.ROBOT_DELETE,\n PermissionName.ROLE_CREATE,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n PermissionName.SCOPE_CREATE,\n PermissionName.SCOPE_UPDATE,\n PermissionName.SCOPE_DELETE,\n PermissionName.USER_CREATE,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ],\n },\n },\n },\n ];\n }\n\n async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n const masterRealm : RealmProvisioningEntity = {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'],\n },\n attributes: {\n name: REALM_MASTER_NAME,\n built_in: true,\n },\n relations: {},\n };\n\n const userCredentialsService = new UserCredentialsService();\n\n let userStrategy : ProvisioningEntityStrategy<User> \| undefined;\n if (config.userAdminPasswordReset) {\n userStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['password'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.users = [\n {\n strategy: userStrategy,\n attributes: {\n name: 'admin',\n password: await userCredentialsService.protect(config.userAdminPassword),\n email: buildUserFakeEmail('admin'),\n active: config.userAdminEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n const clientCredentialsService = new ClientCredentialsService();\n\n let clientStrategy : ProvisioningEntityStrategy<Client> \| undefined;\n if (config.clientSystemSecretReset) {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in', 'is_confidential', 'secret', 'secret_hashed', 'secret_encrypted'],\n };\n } else {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in', 'is_confidential'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.clients = [\n {\n strategy: clientStrategy,\n attributes: {\n built_in: true,\n is_confidential: true,\n name: 'system',\n secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),\n secret_hashed: false,\n active: config.clientSystemEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n const robotCredentialsService = new RobotCredentialsService();\n\n let robotStrategy : ProvisioningEntityStrategy<Robot> \| undefined;\n if (config.robotAdminSecretReset) {\n robotStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['secret'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.robots = [\n {\n strategy: robotStrategy,\n attributes: {\n name: 'system',\n secret: await robotCredentialsService.protect(config.robotAdminSecret),\n active: config.robotAdminEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n return [masterRealm];\n }\n\n async load(container: IContainer): Promise<RootProvisioningEntity> {\n const config = container.resolve(ConfigInjectionKey);\n\n return {\n policies: this.buildPolicies(),\n permissions: this.buildPermissions(),\n scopes: this.buildScopes(),\n roles: this.buildRoles(),\n realms: await this.buildRealms(config),\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2CA,IAAac,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMhB,iBAAiBiB;KACvBC,MAAMnB,kBAAkBoB;KACxBC,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EAAEC,mBAAmBtB,iBAAiBuB,UAAU;IACjEC,UAAU;KACN,EACIV,YAAY;MACRC,MAAMhB,iBAAiB0B;MACvBR,MAAMnB,kBAAkB2B;MACxBN,UAAU;MACVC,UAAU;KACd,EACJ;KACA,EACIN,YAAY;MACRC,MAAMhB,iBAAiB2B;MACvBT,MAAMnB,kBAAkB4B;MACxBP,UAAU;MACVC,UAAU;KACd,EACJ;KACA;MACIN,YAAY;OACRC,MAAMhB,iBAAiB4B;OACvBV,MAAMnB,kBAAkB6B;OACxBR,UAAU;OACVC,UAAU;MACd;MACAC,iBAAiB;OACbO,gBAAgB,CAAC,UAAA;OACjBC,uBAAuB;OACvBC,2BAA2B;OAC3BC,0BAA0B;MAC9B;KACJ;;GAER;GACA;IACIjB,YAAY;KACRC,MAAMhB,iBAAiBiC;KACvBf,MAAMnB,kBAAkB6B;KACxBR,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB;KACbO,gBAAgB,CAAC,UAAA;KACjBC,uBAAuB;KACvBE,0BAA0B;KAC1BD,2BAA2B;IAC/B;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMhB,iBAAiBkC;KACvBhB,MAAMnB,kBAAkB6B;KACxBR,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB;KACbO,gBAAgB,CAAC,UAAA;KACjBC,uBAAuB;KACvBE,0BAA0B;KAC1BD,2BAA2B;IAC/B;GACJ;GAKA;IACIhB,YAAY;KACRC,MAAMhB,iBAAiBmC;KACvBjB,MAAMnB,kBAAkBqC;KACxBC,QAAQ;KACRjB,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbgB,OAAO;KAEH;KACA;KAKA;KACA;KACA;MAER;GACJ;GACA;IACIvB,YAAY;KACRC,MAAMhB,iBAAiBuC;KACvBrB,MAAMnB,kBAAkBqC;KACxBC,QAAQ;KACRjB,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbgB,OAAO;KACH;KACA;KACA;MAER;GACJ;GACA;IACIvB,YAAY;KACRC,MAAMhB,iBAAiBwC;KACvBtB,MAAMnB,kBAAkBqC;KACxBC,QAAQ;KACRjB,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbgB,OAAO;KACH;KACA;KACA;KACA;KACA;MAER;GACJ;;CAER;CAEAG,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3DxC,eAAeyC,qBAAqB,CAAC3C,iBAAiBiB,SAASjB,iBAAiBmC,wBAAAA;IAChFjC,eAAe0C,oBAAoB,CAAC5C,iBAAiBiB,SAASjB,iBAAiBuC,uBAAAA;IAC/ErC,eAAe2C,mBAAmB,CAAC7C,iBAAiBiB,SAASjB,iBAAiBwC,sBAAAA;EACnF;EAEA,OAAOM,OAAOC,OAAO7C,cAAAA,CAAAA,CAChB8C,KAAKhC,SAAAA;GACF,MAAMiC,SAAuC;IACzCC,UAAU;KACNhC,MAAMN,+BAA+BuC;KACrCpC,YAAY,CAAC,UAAA;IACjB;IACAA,YAAY;KACRC;KACAI,UAAU;IACd;GACJ;GAEA,MAAMgC,WAAWV,qBAAqB1B;GACtC,IAAIoC,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAOzC,SAAAA,CAAAA,CAChB0C,KAAKhC,UAAU;GACZkC,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC;IACAI,UAAU;GACd;EACJ,EAAA;CACR;CAEAmC,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMZ;IACNgB,UAAU;GACd;GACAiC,WAAW,EAAEG,mBAAmB,CAAC,GAAA,EAAK;EAC1C,GACA;GACIN,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMX;IACNe,UAAU;GACd;GACAiC,WAAW;IACPG,mBAAmB,CAAC,GAAA;IACpBC,0BAA0B;KACtBvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;;IAEnBC,6BAA6B7D,iBAAiBkC;IAC9C4B,kCAAkC,GAC7B9D,iBAAiBiC,cAAc;KAC5B/B,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;KACf/E,eAAegF;KACfhF,eAAeiF;MAEvB;GACJ;EACJ,CAAA;CAER;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1CpC,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMb;IACNiB,UAAU;GACd;GACAiC,WAAW,CAAC;EAChB;EAEA,MAAMkC,yBAAyB,IAAI7E,uBAAAA;EAEnC,IAAI8E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXtE,MAAMN,+BAA+BuC;GACrCpC,YAAY,CAAC,UAAA;EACjB;EAGJuE,YAAYjC,YAAYiC,YAAYjC,aAAa,CAAC;EAClDiC,YAAYjC,UAAUqC,QAAQ,CAC1B;GACIxC,UAAUsC;GACVzE,YAAY;IACRC,MAAM;IACN2E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOvF,mBAAmB,OAAA;IAC1BwF,QAAQV,OAAOW;GACnB;GACA3C,WAAW,EAAE4C,aAAa,CAAC7F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAM8F,2BAA2B,IAAI1F,yBAAAA;EAErC,IAAI2F;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACbjF,MAAMN,+BAA+BuC;GACrCpC,YAAY;IAAC;IAAY;IAAmB;IAAU;IAAiB;;EAC3E;OAEAoF,iBAAiB;GACbjF,MAAMN,+BAA+BuC;GACrCpC,YAAY,CAAC,YAAY,iBAAA;EAC7B;EAGJuE,YAAYjC,YAAYiC,YAAYjC,aAAa,CAAC;EAClDiC,YAAYjC,UAAUgD,UAAU,CAC5B;GACInD,UAAUiD;GACVpF,YAAY;IACRK,UAAU;IACVkF,iBAAiB;IACjBtF,MAAM;IACNuF,QAAQ,MAAML,yBAAyBN,QAAQP,OAAOmB,oBAAoB,EAAEC,eAAe,MAAM,CAAA;IACjGA,eAAe;IACfV,QAAQV,OAAOqB;GACnB;GACArD,WAAW,EAAE4C,aAAa,CAAC7F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAMuG,0BAA0B,IAAIlG,wBAAAA;EAEpC,IAAImG;EACJ,IAAIvB,OAAOwB,uBACPD,gBAAgB;GACZ1F,MAAMN,+BAA+BuC;GACrCpC,YAAY,CAAC,QAAA;EACjB;EAGJuE,YAAYjC,YAAYiC,YAAYjC,aAAa,CAAC;EAClDiC,YAAYjC,UAAUyD,SAAS,CAC3B;GACI5D,UAAU0D;GACV7F,YAAY;IACRC,MAAM;IACNuF,QAAQ,MAAMI,wBAAwBf,QAAQP,OAAO0B,gBAAgB;IACrEhB,QAAQV,OAAO2B;GACnB;GACA3D,WAAW,EAAE4C,aAAa,CAAC7F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,OAAO,CAACkF,WAAAA;CACZ;CAEA,MAAM2B,KAAKC,WAAwD;EAC/D,MAAM7B,SAAS6B,UAAUC,QAAQxG,kBAAAA;EAEjC,OAAO;GACHyC,UAAU,KAAKtC,cAAa;GAC5BsG,aAAa,KAAK3E,iBAAgB;GAClC4E,QAAQ,KAAK/D,YAAW;GACxBgE,OAAO,KAAK/D,WAAU;GACtBgE,QAAQ,MAAM,KAAKnC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}

package/dist/core/entities/client/index.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './web-client.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/client/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC"}

package/dist/core/entities/client/index.mjs CHANGED Viewed

@@ -2,4 +2,5 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientService } from "./service.mjs";
-export { ClientService };
+import { WebClientProvisioner, buildWebClientAttributes } from "./web-client.mjs";
+export { ClientService, WebClientProvisioner, buildWebClientAttributes };

package/dist/core/entities/client/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,~~EACH~~,eAAe,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAmD5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IA2CZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;~~IAwII~~,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAEH,eAAe,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAmD5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IA2CZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAuJI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}

package/dist/core/entities/client/service.mjs CHANGED Viewed

@@ -2,11 +2,11 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "../../authentication/credential/entities/client/module.mjs";
-import { ClientValidator, PermissionName } from "@authup/core-kit";
+import { CLIENT_RESERVED_NAMES, ClientValidator, PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { ValidatorGroup, isUUID } from "@authup/kit";
 import { BuiltInPolicyType, PolicyData } from "@authup/access";
-import { EntityNotFoundError } from "@authup/errors";
+import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/client/service.ts
 var ClientService = class extends AbstractEntityService {
 	repository;
@@ -109,6 +109,7 @@ var ClientService = class extends AbstractEntityService {
 			group = ValidatorGroup.CREATE;
 		}
 		const validated = await this.validator.run(data, { group });
+		if (typeof validated.name === "string" && CLIENT_RESERVED_NAMES.includes(validated.name) && !(entity && entity.built_in && entity.name === validated.name)) throw new BadRequestError(`The client name '${validated.name}' is reserved.`);
 		await this.repository.validateJoinColumns(validated);
 		await this.repository.checkUniqueness(validated, entity || void 0);
 		const credentialsService = new ClientCredentialsService();

package/dist/core/entities/client/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","data","entities","meta","findMany","total","entity","secret","secret_encrypted","secret_hashed","evaluateOneOf","input","ATTRIBUTES","push","getOne","idOrName","realmId","permissionNames","isMe","identity","type","id","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","is_confidential","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport {\n ClientValidator,\n PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\n\nexport type ClientServiceContext = {\n repository: IClientRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n protected repository: IClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ClientValidator;\n\n constructor(ctx: ClientServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ClientValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Client>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n const {\n data: entities, \n meta, \n } = await this.repository.findMany(query);\n let { total } = meta;\n\n const data: Client[] = [];\n for (const entity of entities) {\n if (\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n\n continue;\n }\n\n data.push(entity);\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<Client> {\n const permissionNames = [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ];\n\n let isMe = !!actor.identity &&\n actor.identity.type === 'client' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n const entity = await this.repository.findOne(idOrName, query, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n if (\n !isMe &&\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: permissionNames,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Client,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realm_id === 'string' ?\n await this.realmRepository.resolve(data.realm_id) :\n undefined;\n\n let entity: Client \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realm_id = realm.id;\n }\n\n entity = await this.repository.findOneWithSecret(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'client' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n }\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n await this.repository.validateJoinColumns(validated);\n await this.repository.checkUniqueness(validated, entity \|\| undefined);\n\n const credentialsService = new ClientCredentialsService();\n\n if (entity) {\n if (\n !isSelfEdit &&\n !validated.realm_id &&\n !entity.realm_id\n ) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SELF_MANAGE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n }\n\n if (entity.is_confidential) {\n if (!validated.secret && !entity.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n if (validated.secret) {\n entity.secret = await credentialsService.protect(validated.secret, entity);\n }\n } else {\n entity.secret = null;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realm_id) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n entity = this.repository.create(validated);\n\n if (entity.is_confidential) {\n if (!validated.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n entity.secret = await credentialsService.protect(validated.secret, validated);\n } else {\n entity.secret = null;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;AA0BA,IAAaS,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,gBAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,KAAAA;EACnC,IAAI,EAAEY,UAAUF;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMK,UAAUJ,UAAU;GAC3B,IACII,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eACV;IACE,IAAI;KACA,MAAMf,MAAMC,oBAAoBe,cAAc;MAC1Cb,MAAM;OACFb,eAAec;OACfd,eAAee;OACff,eAAegB;;MAEnBW,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,OAAO,CAAA;KACnE,CAAA;KACAL,KAAKY,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAJ,KAAKY,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHL;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACe;EACf,MAAMC,kBAAkB;GACpBjC,eAAec;GACfd,eAAee;GACff,eAAegB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMyB,YACfzB,MAAMyB,SAASC,SAAS,aAEpB1B,MAAMyB,SAASlB,KAAKoB,OAAON,YAC3BrB,MAAMyB,SAASlB,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKlB,WAAWkC,QAAQP,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAIxB,oBAAAA;EAGd,IAAIoC,QAAQxB,MAAMyB,SAAUlB,KAAKoB,OAAOf,OAAOe,IAAI;GAC/CH,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACC,QACDZ,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eAER,MAAMf,MAAMC,oBAAoBe,cAAc;GAC1Cb,MAAMoB;GACNN,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,OAAO,CAAA;EACnE,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFtB,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWxB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMoB,OACFX,UACAd,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKT,UAAUd,MAAMP,OAAO,EAAEiC,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAd,MACAP,OACAkC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO7B,KAAK8B,aAAa,WACnC,MAAM,KAAK1C,gBAAgB2C,QAAQ/B,KAAK8B,QAAQ,IAChDN,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMkB,QAA6B,CAAC;GACpC,IAAIpD,OAAOkC,QAAAA,GACPkB,MAAMZ,KAAKN;QAEXkB,MAAMpC,OAAOkB;GAGjB,IAAIe,OACAG,MAAMF,WAAWD,MAAMT;GAG3Bf,SAAS,MAAM,KAAKlB,WAAW8C,kBAAkBD,KAAAA;GACjD,IAAI,CAAC3B,UAAUsB,QAAQD,YACnB,MAAM,IAAI7C,oBAAAA;EAElB,OAAO,IAAI8C,QAAQD,YACf,MAAM,IAAI7C,oBAAAA;EAGd,IAAIqD,aAAa;EACjB,IAAI7B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAee,cAAc,CAAA;GACrF,SAASsC,GAAG;IACR,IACI,CAAC3C,MAAMyB,YACPzB,MAAMyB,SAASC,SAAS,YACxB1B,MAAMyB,SAASlB,KAAKoB,OAAOf,OAAOe,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMzC,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAesD,mBAAmB,CAAA;GAC1F;GACAT,QAAQjD,eAAe2D;EAC3B,OAAO;GACH,MAAM7C,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAewD,cAAc,CAAA;GACjFX,QAAQjD,eAAe6D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKpD,UAAUqD,IAAI1C,MAAM,EAAE4B,MAAM,CAAA;EAEzD,MAAM,KAAKzC,WAAWwD,oBAAoBF,SAAAA;EAC1C,MAAM,KAAKtD,WAAWyD,gBAAgBH,WAAWpC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMqB,qBAAqB,IAAI5D,yBAAAA;EAE/B,IAAIoB,QAAQ;GACR,IACI,CAAC6B,cACD,CAACO,UAAUX,YACX,CAACzB,OAAOyB,UACV;IACE,MAAMgB,eAAe,KAAKC,gBAAgBtD,KAAAA;IAC1C,IAAIqD,cACAL,UAAUX,WAAWgB;GAE7B;GAEA,IAAIZ,YACA,MAAMzC,MAAMC,oBAAoBsD,SAAS;IACrCpD,MAAMb,eAAesD;IACrB3B,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAa8B,UAAU,CAAA;GACtE,CAAA;GAGJpC,SAAS,KAAKlB,WAAW8D,MAAM5C,QAAQoC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMzC,MAAMC,oBAAoBsD,SAAS;IACrCpD,MAAMb,eAAee;IACrBY,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,OAAO,CAAA;GACnE,CAAA;GAGJ,IAAIA,OAAO6C,iBAAiB;IACxB,IAAI,CAACT,UAAUnC,UAAU,CAACD,OAAOC,QAC7BmC,UAAUnC,SAASuC,mBAAmBM,eAAc;IAGxD,IAAIV,UAAUnC,QACVD,OAAOC,SAAS,MAAMuC,mBAAmBO,QAAQX,UAAUnC,QAAQD,MAAAA;GAE3E,OACIA,OAAOC,SAAS;GAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAgD,SAAS;GACb;EACJ;EAEA,IAAI,CAACZ,UAAUX,UAAU;GACrB,MAAMgB,eAAe,KAAKC,gBAAgBtD,KAAAA;GAC1C,IAAIqD,cACAL,UAAUX,WAAWgB;EAE7B;EAEA,MAAMrD,MAAMC,oBAAoBsD,SAAS;GACrCpD,MAAMb,eAAewD;GACrB7B,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAa8B,UAAU,CAAA;EACtE,CAAA;EAEApC,SAAS,KAAKlB,WAAWmC,OAAOmB,SAAAA;EAEhC,IAAIpC,OAAO6C,iBAAiB;GACxB,IAAI,CAACT,UAAUnC,QACXmC,UAAUnC,SAASuC,mBAAmBM,eAAc;GAGxD9C,OAAOC,SAAS,MAAMuC,mBAAmBO,QAAQX,UAAUnC,QAAQmC,SAAAA;EACvE,OACIpC,OAAOC,SAAS;EAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAgD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFlC,IACA3B,OACe;EACf,MAAMA,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAegB,cAAc,CAAA;EAEjF,MAAMM,SAAS,MAAM,KAAKlB,WAAWoE,UAAU,EAAEnC,GAAG,CAAA;EACpD,IAAI,CAACf,QACD,MAAM,IAAIxB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBsD,SAAS;GACrCpD,MAAMb,eAAegB;GACrBW,OAAO,IAAIhC,WAAW,GAAGD,kBAAkBkC,aAAaN,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEe,IAAIoC,aAAanD;EACzB,MAAM,KAAKlB,WAAWsE,OAAOpD,MAAAA;EAC7BA,OAAOe,KAAKoC;EAEZ,OAAOnD;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ValidatorGroup","isUUID","BadRequestError","EntityNotFoundError","CLIENT_RESERVED_NAMES","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","data","entities","meta","findMany","total","entity","secret","secret_encrypted","secret_hashed","evaluateOneOf","input","ATTRIBUTES","push","getOne","idOrName","realmId","permissionNames","isMe","identity","type","id","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","built_in","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","is_confidential","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n CLIENT_RESERVED_NAMES,\n ClientValidator,\n PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\n\nexport type ClientServiceContext = {\n repository: IClientRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n protected repository: IClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ClientValidator;\n\n constructor(ctx: ClientServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ClientValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Client>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n const {\n data: entities, \n meta, \n } = await this.repository.findMany(query);\n let { total } = meta;\n\n const data: Client[] = [];\n for (const entity of entities) {\n if (\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n\n continue;\n }\n\n data.push(entity);\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<Client> {\n const permissionNames = [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ];\n\n let isMe = !!actor.identity &&\n actor.identity.type === 'client' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n const entity = await this.repository.findOne(idOrName, query, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n if (\n !isMe &&\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: permissionNames,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Client,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realm_id === 'string' ?\n await this.realmRepository.resolve(data.realm_id) :\n undefined;\n\n let entity: Client \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realm_id = realm.id;\n }\n\n entity = await this.repository.findOneWithSecret(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'client' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n }\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n // Reserve the system-provisioned client names (`system`, `web`) so an\n // API caller can't create or rename a client onto them — that would\n // collide on unique(name, realm_id) or shadow the built_in client.\n // Provisioning and runtime hooks bypass this service, so they remain\n // free to manage the reserved clients. built_in clients are exempt\n // (they ARE the provisioned ones) but API callers can never produce a\n // built_in client since the validator strips the flag.\n if (\n typeof validated.name === 'string' &&\n CLIENT_RESERVED_NAMES.includes(validated.name) &&\n !(entity && entity.built_in && entity.name === validated.name)\n ) {\n throw new BadRequestError(`The client name '${validated.name}' is reserved.`);\n }\n\n await this.repository.validateJoinColumns(validated);\n await this.repository.checkUniqueness(validated, entity \|\| undefined);\n\n const credentialsService = new ClientCredentialsService();\n\n if (entity) {\n if (\n !isSelfEdit &&\n !validated.realm_id &&\n !entity.realm_id\n ) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SELF_MANAGE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n }\n\n if (entity.is_confidential) {\n if (!validated.secret && !entity.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n if (validated.secret) {\n entity.secret = await credentialsService.protect(validated.secret, entity);\n }\n } else {\n entity.secret = null;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realm_id) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n entity = this.repository.create(validated);\n\n if (entity.is_confidential) {\n if (!validated.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n entity.secret = await credentialsService.protect(validated.secret, validated);\n } else {\n entity.secret = null;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;AA2BA,IAAaW,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,gBAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,KAAAA;EACnC,IAAI,EAAEY,UAAUF;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMK,UAAUJ,UAAU;GAC3B,IACII,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eACV;IACE,IAAI;KACA,MAAMf,MAAMC,oBAAoBe,cAAc;MAC1Cb,MAAM;OACFb,eAAec;OACfd,eAAee;OACff,eAAegB;;MAEnBW,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaN,OAAO,CAAA;KACnE,CAAA;KACAL,KAAKY,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAJ,KAAKY,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHL;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACe;EACf,MAAMC,kBAAkB;GACpBjC,eAAec;GACfd,eAAee;GACff,eAAegB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMyB,YACfzB,MAAMyB,SAASC,SAAS,aAEpB1B,MAAMyB,SAASlB,KAAKoB,OAAON,YAC3BrB,MAAMyB,SAASlB,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKlB,WAAWkC,QAAQP,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAIzB,oBAAAA;EAGd,IAAIqC,QAAQxB,MAAMyB,SAAUlB,KAAKoB,OAAOf,OAAOe,IAAI;GAC/CH,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACC,QACDZ,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eAER,MAAMf,MAAMC,oBAAoBe,cAAc;GAC1Cb,MAAMoB;GACNN,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaN,OAAO,CAAA;EACnE,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFtB,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWxB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMoB,OACFX,UACAd,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKT,UAAUd,MAAMP,OAAO,EAAEiC,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAd,MACAP,OACAkC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO7B,KAAK8B,aAAa,WACnC,MAAM,KAAK1C,gBAAgB2C,QAAQ/B,KAAK8B,QAAQ,IAChDN,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMkB,QAA6B,CAAC;GACpC,IAAItD,OAAOoC,QAAAA,GACPkB,MAAMZ,KAAKN;QAEXkB,MAAMpC,OAAOkB;GAGjB,IAAIe,OACAG,MAAMF,WAAWD,MAAMT;GAG3Bf,SAAS,MAAM,KAAKlB,WAAW8C,kBAAkBD,KAAAA;GACjD,IAAI,CAAC3B,UAAUsB,QAAQD,YACnB,MAAM,IAAI9C,oBAAAA;EAElB,OAAO,IAAI+C,QAAQD,YACf,MAAM,IAAI9C,oBAAAA;EAGd,IAAIsD,aAAa;EACjB,IAAI7B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAee,cAAc,CAAA;GACrF,SAASsC,GAAG;IACR,IACI,CAAC3C,MAAMyB,YACPzB,MAAMyB,SAASC,SAAS,YACxB1B,MAAMyB,SAASlB,KAAKoB,OAAOf,OAAOe,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMzC,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAesD,mBAAmB,CAAA;GAC1F;GACAT,QAAQnD,eAAe6D;EAC3B,OAAO;GACH,MAAM7C,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAewD,cAAc,CAAA;GACjFX,QAAQnD,eAAe+D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKpD,UAAUqD,IAAI1C,MAAM,EAAE4B,MAAM,CAAA;EASzD,IACI,OAAOa,UAAU7C,SAAS,YAC1Bf,sBAAsB8D,SAASF,UAAU7C,IAAI,KAC7C,EAAES,UAAUA,OAAOuC,YAAYvC,OAAOT,SAAS6C,UAAU7C,OAEzD,MAAM,IAAIjB,gBAAgB,oBAAoB8D,UAAU7C,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAW0D,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKtD,WAAW2D,gBAAgBL,WAAWpC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI9D,yBAAAA;EAE/B,IAAIoB,QAAQ;GACR,IACI,CAAC6B,cACD,CAACO,UAAUX,YACX,CAACzB,OAAOyB,UACV;IACE,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;IAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;GAE7B;GAEA,IAAId,YACA,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAesD;IACrB3B,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAa8B,UAAU,CAAA;GACtE,CAAA;GAGJpC,SAAS,KAAKlB,WAAWgE,MAAM9C,QAAQoC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAee;IACrBY,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaN,OAAO,CAAA;GACnE,CAAA;GAGJ,IAAIA,OAAO+C,iBAAiB;IACxB,IAAI,CAACX,UAAUnC,UAAU,CAACD,OAAOC,QAC7BmC,UAAUnC,SAASyC,mBAAmBM,eAAc;IAGxD,IAAIZ,UAAUnC,QACVD,OAAOC,SAAS,MAAMyC,mBAAmBO,QAAQb,UAAUnC,QAAQD,MAAAA;GAE3E,OACIA,OAAOC,SAAS;GAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAkD,SAAS;GACb;EACJ;EAEA,IAAI,CAACd,UAAUX,UAAU;GACrB,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;GAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;EAE7B;EAEA,MAAMvD,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAewD;GACrB7B,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAa8B,UAAU,CAAA;EACtE,CAAA;EAEApC,SAAS,KAAKlB,WAAWmC,OAAOmB,SAAAA;EAEhC,IAAIpC,OAAO+C,iBAAiB;GACxB,IAAI,CAACX,UAAUnC,QACXmC,UAAUnC,SAASyC,mBAAmBM,eAAc;GAGxDhD,OAAOC,SAAS,MAAMyC,mBAAmBO,QAAQb,UAAUnC,QAAQmC,SAAAA;EACvE,OACIpC,OAAOC,SAAS;EAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAkD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFpC,IACA3B,OACe;EACf,MAAMA,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAegB,cAAc,CAAA;EAEjF,MAAMM,SAAS,MAAM,KAAKlB,WAAWsE,UAAU,EAAErC,GAAG,CAAA;EACpD,IAAI,CAACf,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAMa,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAegB;GACrBW,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaN,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEe,IAAIsC,aAAarD;EACzB,MAAM,KAAKlB,WAAWwE,OAAOtD,MAAAA;EAC7BA,OAAOe,KAAKsC;EAEZ,OAAOrD;CACX;AACJ"}

package/dist/core/entities/client/types.d.ts CHANGED Viewed

@@ -1,6 +1,16 @@
-import type { Client, Role } from '@authup/core-kit';
+import type { Client, Realm, Role } from '@authup/core-kit';
 import type { PermissionPolicyBinding } from '@authup/access';
 import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
+/**
+ * Ensures a realm has its system-provisioned public `web` client.
+ * Used by startup provisioning (every realm) and the runtime realm-create
+ * hook (a single realm). System-level — never gated on an actor.
+ */
+export interface IWebClientProvisioner {
+    ensureForRealm(realm: Realm | {
+        id: string;
+    }): Promise<void>;
+}
 export interface IClientRepository extends IEntityRepository<Client> {
     checkUniqueness(data: Partial<Client>, existing?: Client): Promise<void>;
     findOne(id: string, query?: Record<string, any>, realm?: string): Promise<Client | null>;

package/dist/core/entities/client/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;~~AACrD~~,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB,CAAC,MAAM,CAAC;IAChE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEzF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,CACF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IAClC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB,CAAC,MAAM,CAAC;IAChE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEzF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,CACF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}

package/dist/core/entities/client/web-client.d.ts ADDED Viewed

@@ -0,0 +1,34 @@
+import type { Client, Realm } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
+import type { IClientRepository, IWebClientProvisioner } from './types.ts';
+export type WebClientProvisionerContext = {
+    clientRepository: IClientRepository;
+    appOrigins: string[];
+    logger?: Logger;
+};
+/**
+ * Build the attribute set for a realm's public `web` client.
+ *
+ * Public (PKCE) client used by authup's own client-web and any downstream
+ * UI embedding client-web-kit. `built_in` makes it auto-consent in the
+ * /authorize flow and protects it from the API reserved-name guard. The
+ * `global` scope lets the issued token drive the management API (parity
+ * with the legacy password-grant admin login); `openid` for the id-token.
+ *
+ * `grant_types` is metadata only — the auth-code grant issues a refresh
+ * token regardless — but it documents the intended flow. `redirect_uri` is
+ * one `<origin>/**` wildcard per trusted origin (matched by isSimpleMatch).
+ */
+export declare function buildWebClientAttributes(realm: Realm | {
+    id: string;
+}, appOrigins: string[]): Partial<Client>;
+export declare class WebClientProvisioner implements IWebClientProvisioner {
+    protected clientRepository: IClientRepository;
+    protected appOrigins: string[];
+    protected logger?: Logger;
+    constructor(ctx: WebClientProvisionerContext);
+    ensureForRealm(realm: Realm | {
+        id: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=web-client.d.ts.map

package/dist/core/entities/client/web-client.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAMtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAsCrE"}

package/dist/core/entities/client/web-client.mjs ADDED Viewed

@@ -0,0 +1,62 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { CLIENT_WEB_NAME, ScopeName } from "@authup/core-kit";
+//#region src/core/entities/client/web-client.ts
+/**
+* Build the attribute set for a realm's public `web` client.
+*
+* Public (PKCE) client used by authup's own client-web and any downstream
+* UI embedding client-web-kit. `built_in` makes it auto-consent in the
+* /authorize flow and protects it from the API reserved-name guard. The
+* `global` scope lets the issued token drive the management API (parity
+* with the legacy password-grant admin login); `openid` for the id-token.
+*
+* `grant_types` is metadata only — the auth-code grant issues a refresh
+* token regardless — but it documents the intended flow. `redirect_uri` is
+* one `<origin>/**` wildcard per trusted origin (matched by isSimpleMatch).
+*/ function buildWebClientAttributes(realm, appOrigins) {
+	return {
+		name: CLIENT_WEB_NAME,
+		realm_id: realm.id,
+		is_confidential: false,
+		built_in: true,
+		active: true,
+		grant_types: "authorization_code refresh_token",
+		scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,
+		redirect_uri: appOrigins.map((origin) => `${origin}/**`).join(",")
+	};
+}
+var WebClientProvisioner = class {
+	clientRepository;
+	appOrigins;
+	logger;
+	constructor(ctx) {
+		this.clientRepository = ctx.clientRepository;
+		this.appOrigins = ctx.appOrigins;
+		this.logger = ctx.logger;
+	}
+	async ensureForRealm(realm) {
+		const attributes = buildWebClientAttributes(realm, this.appOrigins);
+		const existing = await this.clientRepository.findOneBy({
+			name: CLIENT_WEB_NAME,
+			realm_id: realm.id
+		});
+		if (existing) {
+			if (!existing.built_in) {
+				if (this.logger) this.logger.warn(`Skipping web client provisioning for realm ${realm.id}: a non-built-in client named '${CLIENT_WEB_NAME}' already exists.`);
+				return;
+			}
+			if (!Object.keys(attributes).some((key) => existing[key] !== attributes[key])) return;
+			const merged = this.clientRepository.merge(existing, attributes);
+			await this.clientRepository.save(merged);
+			return;
+		}
+		const entity = this.clientRepository.create(attributes);
+		await this.clientRepository.save(entity);
+	}
+};
+//#endregion
+export { WebClientProvisioner, buildWebClientAttributes };
+//# sourceMappingURL=web-client.mjs.map

package/dist/core/entities/client/web-client.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"web-client.mjs","names":["CLIENT_WEB_NAME","ScopeName","buildWebClientAttributes","realm","appOrigins","name","realm_id","id","is_confidential","built_in","active","grant_types","scope","GLOBAL","OPEN_ID","redirect_uri","map","origin","join","WebClientProvisioner","clientRepository","logger","ctx","ensureForRealm","attributes","existing","findOneBy","warn","isDirty","Object","keys","some","key","merged","merge","save","entity","create"],"sources":["../../../../src/core/entities/client/web-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { CLIENT_WEB_NAME, ScopeName } from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientRepository, IWebClientProvisioner } from './types.ts';\n\nexport type WebClientProvisionerContext = {\n clientRepository: IClientRepository;\n appOrigins: string[];\n logger?: Logger;\n};\n\n/**\n * Build the attribute set for a realm's public `web` client.\n *\n * Public (PKCE) client used by authup's own client-web and any downstream\n * UI embedding client-web-kit. `built_in` makes it auto-consent in the\n * /authorize flow and protects it from the API reserved-name guard. The\n * `global` scope lets the issued token drive the management API (parity\n * with the legacy password-grant admin login); `openid` for the id-token.\n *\n * `grant_types` is metadata only — the auth-code grant issues a refresh\n * token regardless — but it documents the intended flow. `redirect_uri` is\n * one `<origin>/**` wildcard per trusted origin (matched by isSimpleMatch).\n */\nexport function buildWebClientAttributes(\n realm: Realm | { id: string },\n appOrigins: string[],\n): Partial<Client> {\n return {\n name: CLIENT_WEB_NAME,\n realm_id: realm.id,\n is_confidential: false,\n built_in: true,\n active: true,\n grant_types: 'authorization_code refresh_token',\n scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,\n redirect_uri: appOrigins.map((origin) => `${origin}/**`).join(','),\n };\n}\n\nexport class WebClientProvisioner implements IWebClientProvisioner {\n protected clientRepository: IClientRepository;\n\n protected appOrigins: string[];\n\n protected logger?: Logger;\n\n constructor(ctx: WebClientProvisionerContext) {\n this.clientRepository = ctx.clientRepository;\n this.appOrigins = ctx.appOrigins;\n this.logger = ctx.logger;\n }\n\n async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n const attributes = buildWebClientAttributes(realm, this.appOrigins);\n\n const existing = await this.clientRepository.findOneBy({\n name: CLIENT_WEB_NAME,\n realm_id: realm.id,\n });\n\n if (existing) {\n // Never overwrite a non-built_in client that happens to be named\n // `web` — that would be a user-owned client. Skip and warn.\n if (!existing.built_in) {\n if (this.logger) {\n this.logger.warn(\n `Skipping web client provisioning for realm ${realm.id}: a non-built-in client named '${CLIENT_WEB_NAME}' already exists.`,\n );\n }\n return;\n }\n\n // MERGE: refresh attributes (e.g. redirect_uri) when config\n // changes. Dirty-check first — the attributes are deterministic\n // from config, so a steady-state boot would otherwise issue one\n // redundant UPDATE (bumping updated_at) per realm.\n const isDirty = (Object.keys(attributes) as (keyof Client)[])\n .some((key) => existing[key] !== attributes[key]);\n if (!isDirty) {\n return;\n }\n\n const merged = this.clientRepository.merge(existing, attributes);\n await this.clientRepository.save(merged);\n return;\n }\n\n const entity = this.clientRepository.create(attributes);\n await this.clientRepository.save(entity);\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;GA+BA,SAAgBE,yBACZC,OACAC,YAAoB;CAEpB,OAAO;EACHC,MAAML;EACNM,UAAUH,MAAMI;EAChBC,iBAAiB;EACjBC,UAAU;EACVC,QAAQ;EACRC,aAAa;EACbC,OAAO,GAAGX,UAAUY,OAAO,GAAGZ,UAAUa;EACxCC,cAAcX,WAAWY,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAClE;AACJ;AAEA,IAAaC,uBAAb,MAAaA;CACCC;CAEAhB;CAEAiB;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKhB,aAAakB,IAAIlB;EACtB,KAAKiB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAepB,OAA8C;EAC/D,MAAMqB,aAAatB,yBAAyBC,OAAO,KAAKC,UAAU;EAElE,MAAMqB,WAAW,MAAM,KAAKL,iBAAiBM,UAAU;GACnDrB,MAAML;GACNM,UAAUH,MAAMI;EACpB,CAAA;EAEA,IAAIkB,UAAU;GAGV,IAAI,CAACA,SAAShB,UAAU;IACpB,IAAI,KAAKY,QACL,KAAKA,OAAOM,KACR,8CAA8CxB,MAAMI,GAAG,iCAAiCP,gBAAgB,kBAAkB;IAGlI;GACJ;GAQA,IAAI,CAFY,OAAQ8B,KAAKN,UAAAA,CAAAA,CACxBO,MAAMC,QAAQP,SAASO,SAASR,WAAWQ,IAC3CJ,GACD;GAGJ,MAAMK,SAAS,KAAKb,iBAAiBc,MAAMT,UAAUD,UAAAA;GACrD,MAAM,KAAKJ,iBAAiBe,KAAKF,MAAAA;GACjC;EACJ;EAEA,MAAMG,SAAS,KAAKhB,iBAAiBiB,OAAOb,UAAAA;EAC5C,MAAM,KAAKJ,iBAAiBe,KAAKC,MAAAA;CACrC;AACJ"}

package/dist/core/entities/index.mjs CHANGED Viewed

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientService } from "./client/service.mjs";
+import { WebClientProvisioner, buildWebClientAttributes } from "./client/web-client.mjs";
 import "./client/index.mjs";
 import { ClientPermissionService } from "./client-permission/service.mjs";
 import "./client-permission/index.mjs";
@@ -41,4 +42,4 @@ import { UserRoleService } from "./user-role/service.mjs";
 import "./user-role/index.mjs";
 import { IdentityProviderRoleMappingService } from "./identity-provider-role-mapping/service.mjs";
 import "./identity-provider-role-mapping/index.mjs";
-export { ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, IdentityProviderRoleMappingService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RobotPermissionService, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleService, ScopeService, UserAttributeService, UserPermissionService, UserRoleService, UserService };
+export { ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, IdentityProviderRoleMappingService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RobotPermissionService, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleService, ScopeService, UserAttributeService, UserPermissionService, UserRoleService, UserService, WebClientProvisioner, buildWebClientAttributes };

package/dist/core/entities/realm/service.d.ts CHANGED Viewed

@@ -1,14 +1,19 @@
 import { RealmValidator } from '@authup/core-kit';
 import type { Realm } from '@authup/core-kit';
-import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';
 import { AbstractEntityService } from '@authup/server-kit';
+import type { IWebClientProvisioner } from '../client/types.ts';
 import type { IRealmRepository, IRealmService } from './types.ts';
 export type RealmServiceContext = {
     repository: IRealmRepository;
+    webClientProvisioner?: IWebClientProvisioner;
+    logger?: Logger;
 };
 export declare class RealmService extends AbstractEntityService implements IRealmService {
     protected repository: IRealmRepository;
     protected validator: RealmValidator;
+    protected webClientProvisioner?: IWebClientProvisioner;
+    protected logger?: Logger;
     constructor(ctx: RealmServiceContext);
     getMany(query: Record<string, any>): Promise<EntityRepositoryFindManyResult<Realm>>;
     getOne(idOrName: string): Promise<Realm>;

package/dist/core/entities/realm/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/realm/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;~~AACxF~~,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;~~CAChC~~,CAAC;AAEF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC;~~gBAExB~~,GAAG,EAAE,mBAAmB;~~IAM9B~~,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAI3C,MAAM,CACR,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,KAAK,CAAC;IASX,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;~~IAsEI~~,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;CAuBpB"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/realm/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAG,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC;IAEpC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAEvD,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAQ9B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAI3C,MAAM,CACR,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,KAAK,CAAC;IASX,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAwFI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;CAuBpB"}

package/dist/core/entities/realm/service.mjs CHANGED Viewed

@@ -10,9 +10,13 @@ import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 var RealmService = class extends AbstractEntityService {
 	repository;
 	validator;
+	webClientProvisioner;
+	logger;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
+		this.webClientProvisioner = ctx.webClientProvisioner;
+		this.logger = ctx.logger;
 		this.validator = new RealmValidator();
 	}
 	async getMany(query) {
@@ -72,6 +76,11 @@ var RealmService = class extends AbstractEntityService {
 		});
 		entity = this.repository.create(validated);
 		await this.repository.save(entity);
+		if (this.webClientProvisioner) try {
+			await this.webClientProvisioner.ensureForRealm(entity);
+		} catch (e) {
+			if (this.logger) this.logger.warn(`Failed to provision web client for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`);
+		}
 		return {
 			entity,
 			created: true