@authup/server-core 1.0.0-beta.45 → 1.0.0-beta.47

package/dist/core/entities/realm/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ValidatorGroup","isPropertySet","isUUID","BadRequestError","EntityNotFoundError","PermissionName","REALM_MASTER_NAME","RealmValidator","AbstractEntityService","RealmService","repository","validator","ctx","getMany","query","findMany","getOne","idOrName","entity","findOneByIdOrName","create","data","actor","save","undefined","update","updateOnly","options","group","where","id","name","findOneBy","permissionEvaluator","preEvaluate","REALM_UPDATE","UPDATE","REALM_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","input","ATTRIBUTES","merge","created","delete","REALM_DELETE","built_in","entityId","remove"],"sources":["../../../../src/core/entities/realm/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    REALM_MASTER_NAME,\n    RealmValidator,\n} from '@authup/core-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRealmRepository, IRealmService } from './types.ts';\n\nexport type RealmServiceContext = {\n    repository: IRealmRepository;\n};\n\nexport class RealmService extends AbstractEntityService implements IRealmService {\n    protected repository: IRealmRepository;\n\n    protected validator: RealmValidator;\n\n    constructor(ctx: RealmServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new RealmValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n    ): Promise<EntityRepositoryFindManyResult<Realm>> {\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n    ): Promise<Realm> {\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Realm,\n        created: boolean \n    }> {\n        let group: string;\n\n        let entity: Realm | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.REALM_UPDATE,\n                input: new PolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            if (entity.name === REALM_MASTER_NAME && isPropertySet(validated, 'name') && entity.name !== validated.name) {\n                throw new BadRequestError(`The name of the ${REALM_MASTER_NAME} can not be changed.`);\n            }\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in realm can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAwBA,IAAaW,eAAb,cAAkCD,sBAAAA;CACpBE;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIJ,eAAAA;CACzB;CAEA,MAAMM,QACFC,OAC8C;EAC9C,OAAO,KAAKJ,WAAWK,SAASD,KAAAA;CACpC;CAEA,MAAME,OACFC,UACc;EACd,MAAMC,SAAS,MAAM,KAAKR,WAAWS,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAId,oBAAAA;EAGd,OAAOc;CACX;CAEA,MAAME,OACFC,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKC,KAAAA,GAAWH,MAAMC,KAAAA;EACpD,OAAOJ;CACX;CAEA,MAAMO,OACFR,UACAI,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKN,UAAUI,MAAMC,OAAO,EAAEI,YAAY,KAAK,CAAA;EAC7E,OAAOR;CACX;CAEA,MAAMK,KACFN,UACAI,MACAC,OACAK,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,IAAIV;EACJ,IAAID,UAAU;GACV,MAAMY,QAA6B,CAAC;GACpC,IAAI3B,OAAOe,QAAAA,GACPY,MAAMC,KAAKb;QAEXY,MAAME,OAAOd;GAGjBC,SAAS,MAAM,KAAKR,WAAWsB,UAAUH,KAAAA;GACzC,IAAI,CAACX,UAAUS,QAAQD,YACnB,MAAM,IAAItB,oBAAAA;EAElB,OAAO,IAAIuB,QAAQD,YACf,MAAM,IAAItB,oBAAAA;EAGd,IAAIc,QAAQ;GACR,MAAMI,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM1B,eAAe8B,aAAa,CAAA;GAChFP,QAAQ5B,eAAeoC;EAC3B,OAAO;GACH,MAAMd,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM1B,eAAegC,aAAa,CAAA;GAChFT,QAAQ5B,eAAesC;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK5B,UAAU6B,IAAInB,MAAM,EAAEO,MAAM,CAAA;EAEzD,MAAM,KAAKlB,WAAW+B,oBAAoBF,SAAAA;EAE1C,IAAIrB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBS,SAAS;IACrCX,MAAM1B,eAAe8B;IACrBQ,OAAO,IAAI5C,WAAW,GACjBD,kBAAkB8C,aAAa;KAC5B,GAAG1B;KACH,GAAGqB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,IAAIrB,OAAOa,SAASzB,qBAAqBL,cAAcsC,WAAW,MAAA,KAAWrB,OAAOa,SAASQ,UAAUR,MACnG,MAAM,IAAI5B,gBAAgB,mBAAmBG,kBAAkB,qBAAqB;GAGxFY,SAAS,KAAKR,WAAWmC,MAAM3B,QAAQqB,SAAAA;GACvC,MAAM,KAAK7B,WAAWa,KAAKL,MAAAA;GAE3B,OAAO;IACHA;IACA4B,SAAS;GACb;EACJ;EAEA,MAAMxB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM1B,eAAegC;GACrBM,OAAO,IAAI5C,WAAW,GAAGD,kBAAkB8C,aAAaL,UAAU,CAAA;EACtE,CAAA;EAEArB,SAAS,KAAKR,WAAWU,OAAOmB,SAAAA;EAChC,MAAM,KAAK7B,WAAWa,KAAKL,MAAAA;EAE3B,OAAO;GACHA;GACA4B,SAAS;EACb;CACJ;CAEA,MAAMC,OACFjB,IACAR,OACc;EACd,MAAMA,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM1B,eAAe2C,aAAa,CAAA;EAEhF,MAAM9B,SAAS,MAAM,KAAKR,WAAWsB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACZ,QACD,MAAM,IAAId,oBAAAA;EAGd,IAAIc,OAAO+B,UACP,MAAM,IAAI9C,gBAAgB,sCAAA;EAG9B,MAAMmB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM1B,eAAe2C;GACrBL,OAAO,IAAI5C,WAAW,GAAGD,kBAAkB8C,aAAa1B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEY,IAAIoB,aAAahC;EACzB,MAAM,KAAKR,WAAWyC,OAAOjC,MAAAA;EAC7BA,OAAOY,KAAKoB;EAEZ,OAAOhC;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ValidatorGroup","isPropertySet","isUUID","BadRequestError","EntityNotFoundError","PermissionName","REALM_MASTER_NAME","RealmValidator","AbstractEntityService","RealmService","repository","validator","webClientProvisioner","logger","ctx","getMany","query","findMany","getOne","idOrName","entity","findOneByIdOrName","create","data","actor","save","undefined","update","updateOnly","options","group","where","id","name","findOneBy","permissionEvaluator","preEvaluate","REALM_UPDATE","UPDATE","REALM_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","input","ATTRIBUTES","merge","created","ensureForRealm","e","warn","Error","message","String","delete","REALM_DELETE","built_in","entityId","remove"],"sources":["../../../../src/core/entities/realm/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    REALM_MASTER_NAME,\n    RealmValidator,\n} from '@authup/core-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IWebClientProvisioner } from '../client/types.ts';\nimport type { IRealmRepository, IRealmService } from './types.ts';\n\nexport type RealmServiceContext = {\n    repository: IRealmRepository;\n    webClientProvisioner?: IWebClientProvisioner;\n    logger?: Logger;\n};\n\nexport class RealmService extends AbstractEntityService implements IRealmService {\n    protected repository: IRealmRepository;\n\n    protected validator: RealmValidator;\n\n    protected webClientProvisioner?: IWebClientProvisioner;\n\n    protected logger?: Logger;\n\n    constructor(ctx: RealmServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.webClientProvisioner = ctx.webClientProvisioner;\n        this.logger = ctx.logger;\n        this.validator = new RealmValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n    ): Promise<EntityRepositoryFindManyResult<Realm>> {\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n    ): Promise<Realm> {\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Realm,\n        created: boolean \n    }> {\n        let group: string;\n\n        let entity: Realm | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.REALM_UPDATE,\n                input: new PolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            if (entity.name === REALM_MASTER_NAME && isPropertySet(validated, 'name') && entity.name !== validated.name) {\n                throw new BadRequestError(`The name of the ${REALM_MASTER_NAME} can not be changed.`);\n            }\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        // Provision the realm's public `web` client via the system-level\n        // provisioner (NOT clientService.create) — it must not be gated on\n        // the actor's CLIENT_CREATE, since a realm creator may lack it.\n        // Realm creation must stay atomic from the caller's perspective: the\n        // realm is already persisted, so a provisioning failure is logged and\n        // swallowed (startup provisioning reconciles every realm's web client).\n        if (this.webClientProvisioner) {\n            try {\n                await this.webClientProvisioner.ensureForRealm(entity);\n            } catch (e) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Failed to provision web client for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`,\n                    );\n                }\n            }\n        }\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in realm can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AA2BA,IAAaW,eAAb,cAAkCD,sBAAAA;CACpBE;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKE,uBAAuBE,IAAIF;EAChC,KAAKC,SAASC,IAAID;EAClB,KAAKF,YAAY,IAAIJ,eAAAA;CACzB;CAEA,MAAMQ,QACFC,OAC8C;EAC9C,OAAO,KAAKN,WAAWO,SAASD,KAAAA;CACpC;CAEA,MAAME,OACFC,UACc;EACd,MAAMC,SAAS,MAAM,KAAKV,WAAWW,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIhB,oBAAAA;EAGd,OAAOgB;CACX;CAEA,MAAME,OACFC,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKC,KAAAA,GAAWH,MAAMC,KAAAA;EACpD,OAAOJ;CACX;CAEA,MAAMO,OACFR,UACAI,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKN,UAAUI,MAAMC,OAAO,EAAEI,YAAY,KAAK,CAAA;EAC7E,OAAOR;CACX;CAEA,MAAMK,KACFN,UACAI,MACAC,OACAK,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,IAAIV;EACJ,IAAID,UAAU;GACV,MAAMY,QAA6B,CAAC;GACpC,IAAI7B,OAAOiB,QAAAA,GACPY,MAAMC,KAAKb;QAEXY,MAAME,OAAOd;GAGjBC,SAAS,MAAM,KAAKV,WAAWwB,UAAUH,KAAAA;GACzC,IAAI,CAACX,UAAUS,QAAQD,YACnB,MAAM,IAAIxB,oBAAAA;EAElB,OAAO,IAAIyB,QAAQD,YACf,MAAM,IAAIxB,oBAAAA;EAGd,IAAIgB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM5B,eAAegC,aAAa,CAAA;GAChFP,QAAQ9B,eAAesC;EAC3B,OAAO;GACH,MAAMd,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM5B,eAAekC,aAAa,CAAA;GAChFT,QAAQ9B,eAAewC;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK9B,UAAU+B,IAAInB,MAAM,EAAEO,MAAM,CAAA;EAEzD,MAAM,KAAKpB,WAAWiC,oBAAoBF,SAAAA;EAE1C,IAAIrB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBS,SAAS;IACrCX,MAAM5B,eAAegC;IACrBQ,OAAO,IAAI9C,WAAW,GACjBD,kBAAkBgD,aAAa;KAC5B,GAAG1B;KACH,GAAGqB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,IAAIrB,OAAOa,SAAS3B,qBAAqBL,cAAcwC,WAAW,MAAA,KAAWrB,OAAOa,SAASQ,UAAUR,MACnG,MAAM,IAAI9B,gBAAgB,mBAAmBG,kBAAkB,qBAAqB;GAGxFc,SAAS,KAAKV,WAAWqC,MAAM3B,QAAQqB,SAAAA;GACvC,MAAM,KAAK/B,WAAWe,KAAKL,MAAAA;GAE3B,OAAO;IACHA;IACA4B,SAAS;GACb;EACJ;EAEA,MAAMxB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM5B,eAAekC;GACrBM,OAAO,IAAI9C,WAAW,GAAGD,kBAAkBgD,aAAaL,UAAU,CAAA;EACtE,CAAA;EAEArB,SAAS,KAAKV,WAAWY,OAAOmB,SAAAA;EAChC,MAAM,KAAK/B,WAAWe,KAAKL,MAAAA;EAQ3B,IAAI,KAAKR,sBACL,IAAI;GACA,MAAM,KAAKA,qBAAqBqC,eAAe7B,MAAAA;EACnD,SAAS8B,GAAG;GACR,IAAI,KAAKrC,QACL,KAAKA,OAAOsC,KACR,4CAA4C/B,OAAOY,GAAG,IAAIkB,aAAaE,QAAQF,EAAEG,UAAUC,OAAOJ,CAAAA,GAAI;EAGlH;EAGJ,OAAO;GACH9B;GACA4B,SAAS;EACb;CACJ;CAEA,MAAMO,OACFvB,IACAR,OACc;EACd,MAAMA,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM5B,eAAemD,aAAa,CAAA;EAEhF,MAAMpC,SAAS,MAAM,KAAKV,WAAWwB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACZ,QACD,MAAM,IAAIhB,oBAAAA;EAGd,IAAIgB,OAAOqC,UACP,MAAM,IAAItD,gBAAgB,sCAAA;EAG9B,MAAMqB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM5B,eAAemD;GACrBX,OAAO,IAAI9C,WAAW,GAAGD,kBAAkBgD,aAAa1B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEY,IAAI0B,aAAatC;EACzB,MAAM,KAAKV,WAAWiD,OAAOvC,MAAAA;EAC7BA,OAAOY,KAAK0B;EAEZ,OAAOtC;CACX;AACJ"}

package/dist/core/identity/index.d.ts

@@ -6,4 +6,5 @@ export * from './provider/index.ts';
 export * from './registration/index.ts';
 export * from './resolver/index.ts';
 export * from './role/index.ts';
+export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/identity/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/identity/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}

package/dist/core/identity/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { PASSWORD_RESET_EXPIRES_IN_MINUTES } from "./password-recovery/constants.mjs";
 import { PasswordRecoveryService } from "./password-recovery/service.mjs";
 import "./password-recovery/index.mjs";
 import { PermissionCheckerService } from "./permission/checker/service.mjs";
@@ -31,4 +32,4 @@ import "./registration/index.mjs";
 import { IdentityResolver } from "./resolver/module.mjs";
 import "./resolver/index.mjs";
 import { IdentityRoleProvider } from "./role/module.mjs";
-export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityResolver, IdentityRoleProvider, PasswordRecoveryService, PermissionCheckerService, PolicyCheckerService, RegistrationService, createIdentityProviderOAuth2Authenticator };
+export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityResolver, IdentityRoleProvider, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordRecoveryService, PermissionCheckerService, PolicyCheckerService, RegistrationService, createIdentityProviderOAuth2Authenticator };

package/dist/core/identity/password-recovery/constants.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Validity window of a password-reset code. Drives both the persisted
+ * `reset_expires` timestamp and the expiry note in the reset mail.
+ */
+export declare const PASSWORD_RESET_EXPIRES_IN_MINUTES = 30;
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/identity/password-recovery/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/constants.ts"],"names":[],"mappings":"AAOA;;;GAGG;AACH,eAAO,MAAM,iCAAiC,KAAK,CAAC"}

package/dist/core/identity/password-recovery/constants.mjs

@@ -0,0 +1,12 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/identity/password-recovery/constants.ts
+/**
+* Validity window of a password-reset code. Drives both the persisted
+* `reset_expires` timestamp and the expiry note in the reset mail.
+*/ const PASSWORD_RESET_EXPIRES_IN_MINUTES = 30;
+//#endregion
+export { PASSWORD_RESET_EXPIRES_IN_MINUTES };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/identity/password-recovery/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["PASSWORD_RESET_EXPIRES_IN_MINUTES"],"sources":["../../../../src/core/identity/password-recovery/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Validity window of a password-reset code. Drives both the persisted\n * `reset_expires` timestamp and the expiry note in the reset mail.\n */\nexport const PASSWORD_RESET_EXPIRES_IN_MINUTES = 30;\n"],"mappings":";;;;;;;GAWA,MAAaA,oCAAoC"}

package/dist/core/identity/password-recovery/index.d.ts

@@ -1,3 +1,4 @@
+export * from './constants.ts';
 export * from './service.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/identity/password-recovery/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/identity/password-recovery/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { PASSWORD_RESET_EXPIRES_IN_MINUTES } from "./constants.mjs";
 import { PasswordRecoveryService } from "./service.mjs";
-export { PasswordRecoveryService };
+export { PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordRecoveryService };

package/dist/core/identity/password-recovery/service.d.ts

@@ -1,13 +1,15 @@
 import type { IPasswordRecoveryService, PasswordForgotResult, PasswordRecoveryServiceContext, PasswordRecoveryServiceOptions, PasswordResetResult } from './types.ts';
-import type { IMailClient } from '../../mail/types.ts';
+import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
 import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IdentityWorkflowContext } from '../types.ts';
 export declare class PasswordRecoveryService implements IPasswordRecoveryService {
     protected options: PasswordRecoveryServiceOptions;
     protected repository: IUserRepository;
     protected realmRepository: IRealmRepository;
     protected mailClient: IMailClient;
+    protected mailTemplateRenderer: IMailTemplateRenderer;
     constructor(ctx: PasswordRecoveryServiceContext);
-    forgotPassword(data: Record<string, any>): Promise<PasswordForgotResult>;
+    forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult>;
     resetPassword(data: Record<string, any>): Promise<PasswordResetResult>;
     private runForgotPasswordValidator;
     private runResetPasswordValidator;

package/dist/core/identity/password-recovery/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/service.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,mBAAmB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,OAAO,EAAE,8BAA8B,CAAC;IAElD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;gBAEtB,GAAG,EAAE,8BAA8B;IAOzC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAsDxE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;YA0C9D,0BAA0B;YAgC1B,yBAAyB;CAuC1C"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/service.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,mBAAmB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAG3D,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,OAAO,EAAE,8BAA8B,CAAC;IAElD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;gBAE1C,GAAG,EAAE,8BAA8B;IAQzC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAwE3G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;YA0C9D,0BAA0B;YAgC1B,yBAAyB;CAuC1C"}

package/dist/core/identity/password-recovery/service.mjs

@@ -2,6 +2,9 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { UserCredentialsService } from "../../authentication/credential/entities/user/module.mjs";
+import { MailTemplateName } from "../../mail/template/types.mjs";
+import "../../mail/index.mjs";
+import "./constants.mjs";
 import { PasswordRecoveryDisabledError } from "./disabled.mjs";
 import { EmailVerificationRequiredError } from "./email-verification-required.mjs";
 import { ResetTokenExpiredError } from "./token-expired.mjs";
@@ -16,13 +19,15 @@ var PasswordRecoveryService = class {
 	repository;
 	realmRepository;
 	mailClient;
+	mailTemplateRenderer;
 	constructor(ctx) {
 		this.options = ctx.options;
 		this.repository = ctx.repository;
 		this.realmRepository = ctx.realmRepository;
 		this.mailClient = ctx.mailClient;
+		this.mailTemplateRenderer = ctx.mailTemplateRenderer;
 	}
-	async forgotPassword(data) {
+	async forgotPassword(data, context) {
 		if (!this.options.passwordRecoveryEnabled) throw new PasswordRecoveryDisabledError();
 		if (!this.options.emailVerificationEnabled) throw new EmailVerificationRequiredError("Email verification is not enabled, but required to reset a password.");
 		const validated = await this.runForgotPasswordValidator(data);
@@ -40,13 +45,19 @@ var PasswordRecoveryService = class {
 		});
 		await this.repository.save(merged);
 		try {
+			const resetUrl = this.options.publicUrl ? `${this.options.publicUrl.replace(/\/+$/, "")}/password-reset?token=${encodeURIComponent(merged.reset_hash)}&realm_id=${encodeURIComponent(entity.realm_id)}` : void 0;
+			const mail = await this.mailTemplateRenderer.render({
+				template: MailTemplateName.PASSWORD_RESET,
+				params: {
+					code: merged.reset_hash,
+					url: resetUrl,
+					expiresInMinutes: 30
+				},
+				locale: context?.locale
+			});
 			await this.mailClient.send({
 				to: entity.email,
-				subject: "Forgot Password - Reset code",
-				html: `
-                <p>Please use the code below to reset your account password.</p>
-                <p>${merged.reset_hash}</p>
-                `
+				...mail
 			});
 		} catch {
 			this.repository.merge(merged, {

package/dist/core/identity/password-recovery/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BadRequestError","EntityNotFoundError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidator","randomBytes","Container","z","UserCredentialsService","PasswordRecoveryService","options","repository","realmRepository","mailClient","ctx","forgotPassword","data","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realm_id","where","name","email","id","entity","findOneByWithEmail","merged","merge","reset_expires","Date","now","toISOString","reset_hash","toString","save","send","to","subject","html","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","reset_at","validator","oneOfContainer","oneOf","mount","string","trim","toLowerCase","regex","message","min","optional","uuid","nullable","run","max"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidator } from '@validup/zod';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IPasswordRecoveryService,\n    PasswordForgotResult,\n    PasswordRecoveryServiceContext,\n    PasswordRecoveryServiceOptions,\n    PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient } from '../../mail/types.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n    protected options: PasswordRecoveryServiceOptions;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected mailClient: IMailClient;\n\n    constructor(ctx: PasswordRecoveryServiceContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.mailClient = ctx.mailClient;\n    }\n\n    async forgotPassword(data: Record<string, any>): Promise<PasswordForgotResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        if (!this.options.emailVerificationEnabled) {\n            throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n        }\n\n        const validated = await this.runForgotPasswordValidator(data);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneByWithEmail(where);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            reset_expires: new Date(Date.now() + (1000 * 60 * 30)).toISOString(),\n            reset_hash: randomBytes(32).toString('hex'),\n        });\n\n        await this.repository.save(merged);\n\n        try {\n            await this.mailClient.send({\n                to: entity.email,\n                subject: 'Forgot Password - Reset code',\n                html: `\n                <p>Please use the code below to reset your account password.</p>\n                <p>${merged.reset_hash}</p>\n                `,\n            });\n        } catch {\n            this.repository.merge(merged, {\n                reset_hash: null,\n                reset_expires: null,\n            });\n            await this.repository.save(merged);\n\n            throw new BadRequestError('Password recovery failed. Could not send reset email.');\n        }\n\n        return { reset_expires: merged.reset_expires! };\n    }\n\n    async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        const validated = await this.runResetPasswordValidator(data);\n\n        await this.repository.validateJoinColumns(validated);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            reset_hash: validated.token,\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneBy(where);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!entity.reset_expires || new Date(entity.reset_expires) < new Date()) {\n            throw new ResetTokenExpiredError();\n        }\n\n        const credentialsService = new UserCredentialsService();\n        const hashedPassword = await credentialsService.protect(validated.password);\n\n        const merged = this.repository.merge(entity, {\n            reset_at: new Date().toISOString(),\n            reset_hash: null,\n            reset_expires: null,\n            password: hashedPassword,\n        });\n\n        await this.repository.save(merged);\n\n        return { reset_at: merged.reset_at! };\n    }\n\n    private async runForgotPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        return validator.run(data);\n    }\n\n    private async runResetPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        validator.mount(\n            'token',\n            createValidator(z.string().min(3).max(256)),\n        );\n\n        validator.mount(\n            'password',\n            createValidator(z.string().min(5).max(512)),\n        );\n\n        return validator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AA0BA,IAAaU,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKJ,UAAUI,IAAIJ;EACnB,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,aAAaC,IAAID;CAC1B;CAEA,MAAME,eAAeC,MAA0D;EAC3E,IAAI,CAAC,KAAKN,QAAQO,yBACd,MAAM,IAAIhB,8BAAAA;EAGd,IAAI,CAAC,KAAKS,QAAQQ,0BACd,MAAM,IAAIhB,+BAA+B,sEAAA;EAG7C,MAAMiB,YAAY,MAAM,KAAKC,2BAA2BJ,IAAAA;EAExD,MAAMK,QAAQ,MAAM,KAAKT,gBAAgBU,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKjB,WAAWkB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAM8B,SAAS,KAAKnB,WAAWoB,MAAMH,QAAQ;GACzCI,eAAe,IAAIC,KAAKA,KAAKC,IAAG,IAAM,MAAO,KAAK,EAAA,CAAA,CAAKC,YAAW;GAClEC,YAAY/B,YAAY,EAAA,CAAA,CAAIgC,SAAS,KAAA;EACzC,CAAA;EAEA,MAAM,KAAK1B,WAAW2B,KAAKR,MAAAA;EAE3B,IAAI;GACA,MAAM,KAAKjB,WAAW0B,KAAK;IACvBC,IAAIZ,OAAOF;IACXe,SAAS;IACTC,MAAM;;qBAEDZ,OAAOM,WAAW;;GAE3B,CAAA;EACJ,QAAQ;GACJ,KAAKzB,WAAWoB,MAAMD,QAAQ;IAC1BM,YAAY;IACZJ,eAAe;GACnB,CAAA;GACA,MAAM,KAAKrB,WAAW2B,KAAKR,MAAAA;GAE3B,MAAM,IAAI/B,gBAAgB,uDAAA;EAC9B;EAEA,OAAO,EAAEiC,eAAeF,OAAOE,cAAe;CAClD;CAEA,MAAMW,cAAc3B,MAAyD;EACzE,IAAI,CAAC,KAAKN,QAAQO,yBACd,MAAM,IAAIhB,8BAAAA;EAGd,MAAMkB,YAAY,MAAM,KAAKyB,0BAA0B5B,IAAAA;EAEvD,MAAM,KAAKL,WAAWkC,oBAAoB1B,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKT,gBAAgBU,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,YAAYjB,UAAU2B;GACtBvB,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKjB,WAAWoC,UAAUvB,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAI5B,oBAAAA;EAGd,IAAI,CAAC4B,OAAOI,iBAAiB,IAAIC,KAAKL,OAAOI,aAAa,oBAAI,IAAIC,KAAAA,GAC9D,MAAM,IAAI9B,uBAAAA;EAId,MAAM8C,iBAAiB,MAAMD,IADExC,uBACFwC,CAAAA,CAAmBE,QAAQ/B,UAAUgC,QAAQ;EAE1E,MAAMrB,SAAS,KAAKnB,WAAWoB,MAAMH,QAAQ;GACzCwB,2BAAU,IAAInB,KAAAA,EAAAA,CAAOE,YAAW;GAChCC,YAAY;GACZJ,eAAe;GACfmB,UAAUF;EACd,CAAA;EAEA,MAAM,KAAKtC,WAAW2B,KAAKR,MAAAA;EAE3B,OAAO,EAAEsB,UAAUtB,OAAOsB,SAAU;CACxC;CAEA,MAAchC,2BAA2BJ,MAA2B;EAChE,MAAMqC,YAAY,IAAI/C,UAAe,CAAC,CAAA;EAEtC,MAAMgD,iBAAiB,IAAIhD,UAAU,EAAEiD,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MACX,SACApD,gBACIG,EAAEkD,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXjC,MAAK,CAAA,CACLkC,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAItEP,eAAeE,MACX,QACApD,gBAAgBG,EAAEkD,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3D,gBAAgBG,EAAEyD,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrC,OAAOZ,UAAUa,IAAIlD,IAAAA;CACzB;CAEA,MAAc4B,0BAA0B5B,MAA2B;EAC/D,MAAMqC,YAAY,IAAI/C,UAAe,CAAC,CAAA;EAEtC,MAAMgD,iBAAiB,IAAIhD,UAAU,EAAEiD,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACApD,gBACIG,EAAEkD,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXjC,MAAK,CAAA,CACLkC,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAGtEP,eAAeE,MACX,QACApD,gBAAgBG,EAAEkD,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3D,gBAAgBG,EAAEyD,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrCZ,UAAUG,MACN,SACApD,gBAAgBG,EAAEkD,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1Cd,UAAUG,MACN,YACApD,gBAAgBG,EAAEkD,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1C,OAAOd,UAAUa,IAAIlD,IAAAA;CACzB;AACJ"}
+{"version":3,"file":"service.mjs","names":["BadRequestError","EntityNotFoundError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidator","randomBytes","Container","z","UserCredentialsService","MailTemplateName","PASSWORD_RESET_EXPIRES_IN_MINUTES","PasswordRecoveryService","options","repository","realmRepository","mailClient","mailTemplateRenderer","ctx","forgotPassword","data","context","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realm_id","where","name","email","id","entity","findOneByWithEmail","merged","merge","reset_expires","Date","now","toISOString","reset_hash","toString","save","resetUrl","publicUrl","replace","encodeURIComponent","undefined","mail","render","template","PASSWORD_RESET","params","code","url","expiresInMinutes","locale","send","to","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","reset_at","validator","oneOfContainer","oneOf","mount","string","trim","toLowerCase","regex","message","min","optional","uuid","nullable","run","max"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidator } from '@validup/zod';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IPasswordRecoveryService,\n    PasswordForgotResult,\n    PasswordRecoveryServiceContext,\n    PasswordRecoveryServiceOptions,\n    PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\nimport { PASSWORD_RESET_EXPIRES_IN_MINUTES } from './constants.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n    protected options: PasswordRecoveryServiceOptions;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    constructor(ctx: PasswordRecoveryServiceContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n    }\n\n    async forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        if (!this.options.emailVerificationEnabled) {\n            throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n        }\n\n        const validated = await this.runForgotPasswordValidator(data);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneByWithEmail(where);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            reset_expires: new Date(\n                Date.now() + (1000 * 60 * PASSWORD_RESET_EXPIRES_IN_MINUTES),\n            ).toISOString(),\n            reset_hash: randomBytes(32).toString('hex'),\n        });\n\n        await this.repository.save(merged);\n\n        try {\n            // realm_id MUST ride the link: resetPassword resolves the realm\n            // from the request and filters the lookup by it, so a realm-less\n            // link resolves to the master realm and never matches a\n            // non-master user.\n            const resetUrl = this.options.publicUrl ?\n                `${this.options.publicUrl.replace(/\\/+$/, '')}/password-reset` +\n                `?token=${encodeURIComponent(merged.reset_hash!)}` +\n                `&realm_id=${encodeURIComponent(entity.realm_id)}` :\n                undefined;\n\n            const mail = await this.mailTemplateRenderer.render({\n                template: MailTemplateName.PASSWORD_RESET,\n                params: {\n                    code: merged.reset_hash!,\n                    url: resetUrl,\n                    expiresInMinutes: PASSWORD_RESET_EXPIRES_IN_MINUTES,\n                },\n                locale: context?.locale,\n            });\n\n            await this.mailClient.send({\n                to: entity.email,\n                ...mail,\n            });\n        } catch {\n            this.repository.merge(merged, {\n                reset_hash: null,\n                reset_expires: null,\n            });\n            await this.repository.save(merged);\n\n            throw new BadRequestError('Password recovery failed. Could not send reset email.');\n        }\n\n        return { reset_expires: merged.reset_expires! };\n    }\n\n    async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        const validated = await this.runResetPasswordValidator(data);\n\n        await this.repository.validateJoinColumns(validated);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            reset_hash: validated.token,\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneBy(where);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!entity.reset_expires || new Date(entity.reset_expires) < new Date()) {\n            throw new ResetTokenExpiredError();\n        }\n\n        const credentialsService = new UserCredentialsService();\n        const hashedPassword = await credentialsService.protect(validated.password);\n\n        const merged = this.repository.merge(entity, {\n            reset_at: new Date().toISOString(),\n            reset_hash: null,\n            reset_expires: null,\n            password: hashedPassword,\n        });\n\n        await this.repository.save(merged);\n\n        return { reset_at: merged.reset_at! };\n    }\n\n    private async runForgotPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        return validator.run(data);\n    }\n\n    private async runResetPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        validator.mount(\n            'token',\n            createValidator(z.string().min(3).max(256)),\n        );\n\n        validator.mount(\n            'password',\n            createValidator(z.string().min(5).max(512)),\n        );\n\n        return validator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6BA,IAAaY,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKL,UAAUK,IAAIL;EACnB,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,uBAAuBC,IAAID;CACpC;CAEA,MAAME,eAAeC,MAA2BC,SAAkE;EAC9G,IAAI,CAAC,KAAKR,QAAQS,yBACd,MAAM,IAAIpB,8BAAAA;EAGd,IAAI,CAAC,KAAKW,QAAQU,0BACd,MAAM,IAAIpB,+BAA+B,sEAAA;EAG7C,MAAMqB,YAAY,MAAM,KAAKC,2BAA2BL,IAAAA;EAExD,MAAMM,QAAQ,MAAM,KAAKX,gBAAgBY,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKnB,WAAWoB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkC,SAAS,KAAKrB,WAAWsB,MAAMH,QAAQ;GACzCI,eAAe,IAAIC,KACfA,KAAKC,IAAG,IAAM,MAAO,KAAA,EAAK5B,CAAAA,CAC5B6B,YAAW;GACbC,YAAYnC,YAAY,EAAA,CAAA,CAAIoC,SAAS,KAAA;EACzC,CAAA;EAEA,MAAM,KAAK5B,WAAW6B,KAAKR,MAAAA;EAE3B,IAAI;GAKA,MAAMS,WAAW,KAAK/B,QAAQgC,YAC1B,GAAG,KAAKhC,QAAQgC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,wBACpCC,mBAAmBZ,OAAOM,UAAU,EAAA,YACjCM,mBAAmBd,OAAOL,QAAQ,MAC/CoB,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKhC,qBAAqBiC,OAAO;IAChDC,UAAUzC,iBAAiB0C;IAC3BC,QAAQ;KACJC,MAAMnB,OAAOM;KACbc,KAAKX;KACLY,kBAAAA;IACJ;IACAC,QAAQpC,SAASoC;GACrB,CAAA;GAEA,MAAM,KAAKzC,WAAW0C,KAAK;IACvBC,IAAI1B,OAAOF;IACX,GAAGkB;GACP,CAAA;EACJ,QAAQ;GACJ,KAAKnC,WAAWsB,MAAMD,QAAQ;IAC1BM,YAAY;IACZJ,eAAe;GACnB,CAAA;GACA,MAAM,KAAKvB,WAAW6B,KAAKR,MAAAA;GAE3B,MAAM,IAAInC,gBAAgB,uDAAA;EAC9B;EAEA,OAAO,EAAEqC,eAAeF,OAAOE,cAAe;CAClD;CAEA,MAAMuB,cAAcxC,MAAyD;EACzE,IAAI,CAAC,KAAKP,QAAQS,yBACd,MAAM,IAAIpB,8BAAAA;EAGd,MAAMsB,YAAY,MAAM,KAAKqC,0BAA0BzC,IAAAA;EAEvD,MAAM,KAAKN,WAAWgD,oBAAoBtC,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKX,gBAAgBY,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,YAAYjB,UAAUuC;GACtBnC,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKnB,WAAWkD,UAAUnC,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAACgC,OAAOI,iBAAiB,IAAIC,KAAKL,OAAOI,aAAa,oBAAI,IAAIC,KAAAA,GAC9D,MAAM,IAAIlC,uBAAAA;EAId,MAAM8D,iBAAiB,MAAMD,IADExD,uBACFwD,CAAAA,CAAmBE,QAAQ3C,UAAU4C,QAAQ;EAE1E,MAAMjC,SAAS,KAAKrB,WAAWsB,MAAMH,QAAQ;GACzCoC,2BAAU,IAAI/B,KAAAA,EAAAA,CAAOE,YAAW;GAChCC,YAAY;GACZJ,eAAe;GACf+B,UAAUF;EACd,CAAA;EAEA,MAAM,KAAKpD,WAAW6B,KAAKR,MAAAA;EAE3B,OAAO,EAAEkC,UAAUlC,OAAOkC,SAAU;CACxC;CAEA,MAAc5C,2BAA2BL,MAA2B;EAChE,MAAMkD,YAAY,IAAI/D,UAAe,CAAC,CAAA;EAEtC,MAAMgE,iBAAiB,IAAIhE,UAAU,EAAEiE,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MACX,SACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACX7C,MAAK,CAAA,CACL8C,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAItEP,eAAeE,MACX,QACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3E,gBAAgBG,EAAEyE,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrC,OAAOZ,UAAUa,IAAI/D,IAAAA;CACzB;CAEA,MAAcyC,0BAA0BzC,MAA2B;EAC/D,MAAMkD,YAAY,IAAI/D,UAAe,CAAC,CAAA;EAEtC,MAAMgE,iBAAiB,IAAIhE,UAAU,EAAEiE,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACX7C,MAAK,CAAA,CACL8C,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAGtEP,eAAeE,MACX,QACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3E,gBAAgBG,EAAEyE,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrCZ,UAAUG,MACN,SACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1Cd,UAAUG,MACN,YACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1C,OAAOd,UAAUa,IAAI/D,IAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/types.d.ts

@@ -1,12 +1,15 @@
-import type { IMailClient } from '../../mail/types.ts';
+import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
 import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IdentityWorkflowContext } from '../types.ts';
 export type PasswordRecoveryServiceOptions = {
     passwordRecoveryEnabled?: boolean;
     emailVerificationEnabled?: boolean;
+    publicUrl?: string;
 };
 export type PasswordRecoveryServiceContext = {
     options: PasswordRecoveryServiceOptions;
     mailClient: IMailClient;
+    mailTemplateRenderer: IMailTemplateRenderer;
     repository: IUserRepository;
     realmRepository: IRealmRepository;
 };
@@ -17,7 +20,7 @@ export type PasswordResetResult = {
     reset_at: string;
 };
 export interface IPasswordRecoveryService {
-    forgotPassword(data: Record<string, any>): Promise<PasswordForgotResult>;
+    forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult>;
     resetPassword(data: Record<string, any>): Promise<PasswordResetResult>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/core/identity/password-recovery/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,MAAM,MAAM,8BAA8B,GAAG;IACzC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,EAAE,WAAW,CAAC;IACxB,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACzE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,8BAA8B,GAAG;IACzC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1E"}

package/dist/core/identity/registration/service.d.ts

@@ -1,13 +1,15 @@
 import type { IRegistrationService, RegistrationResult, RegistrationServiceContext, RegistrationServiceOptions } from './types.ts';
-import type { IMailClient } from '../../mail/types.ts';
+import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
 import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IdentityWorkflowContext } from '../types.ts';
 export declare class RegistrationService implements IRegistrationService {
     protected options: RegistrationServiceOptions;
     protected mailClient: IMailClient;
+    protected mailTemplateRenderer: IMailTemplateRenderer;
     protected repository: IUserRepository;
     protected realmRepository: IRealmRepository;
     constructor(ctx: RegistrationServiceContext);
-    register(data: Record<string, any>): Promise<RegistrationResult>;
+    register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult>;
     activate(data: {
         token: string;
     }): Promise<void>;

package/dist/core/identity/registration/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/service.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,0BAA0B;IAOrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgDhE,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAczD"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/service.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAEtD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,0BAA0B;IAQrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAsDnG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAczD"}

package/dist/core/identity/registration/service.mjs

@@ -2,6 +2,8 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { UserCredentialsService } from "../../authentication/credential/entities/user/module.mjs";
+import { MailTemplateName } from "../../mail/template/types.mjs";
+import "../../mail/index.mjs";
 import { RegistrationDisabledError } from "./error.mjs";
 import { UserValidator } from "@authup/core-kit";
 import { createNanoID } from "@authup/kit";
@@ -12,15 +14,17 @@ import { randomBytes } from "node:crypto";
 var RegistrationService = class {
 	options;
 	mailClient;
+	mailTemplateRenderer;
 	repository;
 	realmRepository;
 	constructor(ctx) {
 		this.options = ctx.options;
 		this.mailClient = ctx.mailClient;
+		this.mailTemplateRenderer = ctx.mailTemplateRenderer;
 		this.repository = ctx.repository;
 		this.realmRepository = ctx.realmRepository;
 	}
-	async register(data) {
+	async register(data, context) {
 		if (!this.options.registrationEnabled) throw new RegistrationDisabledError();
 		const validator = new Container({});
 		validator.mount(new UserValidator({ pathsToInclude: [
@@ -42,13 +46,18 @@ var RegistrationService = class {
 		entity.realm_id = (await this.realmRepository.resolve(entity.realm_id, true)).id;
 		await this.repository.save(entity);
 		if (this.options.emailVerificationEnabled) try {
+			const activateUrl = this.options.publicUrl ? `${this.options.publicUrl.replace(/\/+$/, "")}/activate?token=${entity.activate_hash}` : void 0;
+			const mail = await this.mailTemplateRenderer.render({
+				template: MailTemplateName.REGISTRATION_ACTIVATION,
+				params: {
+					code: entity.activate_hash,
+					url: activateUrl
+				},
+				locale: context?.locale
+			});
 			await this.mailClient.send({
 				to: entity.email,
-				subject: "Registration - Activation code",
-				html: `
-                    <p>Please use the code below to activate your account and start using the site.</p>
-                    <p>${entity.activate_hash}</p>
-                    `
+				...mail
 			});
 		} catch {
 			await this.repository.remove(entity);

package/dist/core/identity/registration/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["UserValidator","createNanoID","BadRequestError","EntityNotFoundError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","RegistrationService","options","mailClient","repository","realmRepository","ctx","register","data","registrationEnabled","validator","mount","pathsToInclude","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","send","to","email","subject","html","remove","activate","findOneBy","token","merged","merge"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserValidator } from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient } from '../../mail/types.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async register(data: Record<string, any>): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({ pathsToInclude: ['email', 'name', 'password', 'realm_id'] }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                await this.mailClient.send({\n                    to: entity.email,\n                    subject: 'Registration - Activation code',\n                    html: `\n                    <p>Please use the code below to activate your account and start using the site.</p>\n                    <p>${entity.activate_hash}</p>\n                    `,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new BadRequestError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n    }\n}\n"],"mappings":";;;;;;;;;;;AAuBA,IAAaQ,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EACnB,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,SAASC,MAAwD;EACnE,IAAI,CAAC,KAAKN,QAAQO,qBACd,MAAM,IAAIZ,0BAAAA;EAGd,MAAMa,YAAY,IAAIX,UAAU,CAAC,CAAA;EACjCW,UAAUC,MAAM,IAAIlB,cAAc,EAAEmB,gBAAgB;GAAC;GAAS;GAAQ;GAAY;IAAY,CAAA,CAAA;EAC9F,MAAMC,YAAY,MAAMH,UAAUI,IAAIN,MAAM,EAAEO,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKX,WAAWY,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKX,QAAQe,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,gBAAgBrB,YAAY,EAAA,CAAA,CAAIsB,SAAS,KAAA;EACvD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKjB,WAAWkB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAIvB,uBAAAA;EAC/BqB,OAAOG,WAAWH,OAAOG,YAAY9B,aAAa,EAAA;EAClD2B,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,YAAWF,MADE,KAAKrB,gBAAgBsB,QAAQN,OAAOO,UAAU,IAAA,EAAA,CAC1CC;EAExB,MAAM,KAAKzB,WAAW0B,KAAKT,MAAAA;EAE3B,IAAI,KAAKnB,QAAQe,0BACb,IAAI;GACA,MAAM,KAAKd,WAAW4B,KAAK;IACvBC,IAAIX,OAAOY;IACXC,SAAS;IACTC,MAAM;;yBAEDd,OAAOF,cAAc;;GAE9B,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKf,WAAWgC,OAAOf,MAAAA;GAC7B,MAAM,IAAI1B,gBAAgB,uDAAA;EAC9B;EAGJ,OAAO,EAAEuB,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAMmB,SAAS7B,MAAwC;EACnD,MAAMa,SAAS,MAAM,KAAKjB,WAAWkC,UAAU,EAAEnB,eAAeX,KAAK+B,MAAM,CAAA;EAE3E,IAAI,CAAClB,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAM4C,SAAS,KAAKpC,WAAWqC,MAAMpB,QAAQ;GACzCH,QAAQ;GACRC,eAAe;EACnB,CAAA;EAEA,MAAM,KAAKf,WAAW0B,KAAKU,MAAAA;CAC/B;AACJ"}
+{"version":3,"file":"service.mjs","names":["UserValidator","createNanoID","BadRequestError","EntityNotFoundError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","MailTemplateName","RegistrationService","options","mailClient","mailTemplateRenderer","repository","realmRepository","ctx","register","data","context","registrationEnabled","validator","mount","pathsToInclude","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","activateUrl","publicUrl","replace","undefined","mail","render","template","REGISTRATION_ACTIVATION","params","code","url","locale","send","to","email","remove","activate","findOneBy","token","merged","merge"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserValidator } from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({ pathsToInclude: ['email', 'name', 'password', 'realm_id'] }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                const activateUrl = this.options.publicUrl ?\n                    `${this.options.publicUrl.replace(/\\/+$/, '')}/activate?token=${entity.activate_hash}` :\n                    undefined;\n\n                const mail = await this.mailTemplateRenderer.render({\n                    template: MailTemplateName.REGISTRATION_ACTIVATION,\n                    params: { code: entity.activate_hash!, url: activateUrl },\n                    locale: context?.locale,\n                });\n\n                await this.mailClient.send({\n                    to: entity.email,\n                    ...mail,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new BadRequestError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAyBA,IAAaS,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKL,UAAUK,IAAIL;EACnB,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,SAASC,MAA2BC,SAAgE;EACtG,IAAI,CAAC,KAAKR,QAAQS,qBACd,MAAM,IAAIf,0BAAAA;EAGd,MAAMgB,YAAY,IAAId,UAAU,CAAC,CAAA;EACjCc,UAAUC,MAAM,IAAIrB,cAAc,EAAEsB,gBAAgB;GAAC;GAAS;GAAQ;GAAY;IAAY,CAAA,CAAA;EAC9F,MAAMC,YAAY,MAAMH,UAAUI,IAAIP,MAAM,EAAEQ,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKZ,WAAWa,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKb,QAAQiB,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,gBAAgBxB,YAAY,EAAA,CAAA,CAAIyB,SAAS,KAAA;EACvD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKlB,WAAWmB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAI1B,uBAAAA;EAC/BwB,OAAOG,WAAWH,OAAOG,YAAYjC,aAAa,EAAA;EAClD8B,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,YAAWF,MADE,KAAKtB,gBAAgBuB,QAAQN,OAAOO,UAAU,IAAA,EAAA,CAC1CC;EAExB,MAAM,KAAK1B,WAAW2B,KAAKT,MAAAA;EAE3B,IAAI,KAAKrB,QAAQiB,0BACb,IAAI;GACA,MAAMc,cAAc,KAAK/B,QAAQgC,YAC7B,GAAG,KAAKhC,QAAQgC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,kBAAkBZ,OAAOF,kBACvEe,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKjC,qBAAqBkC,OAAO;IAChDC,UAAUvC,iBAAiBwC;IAC3BC,QAAQ;KAAEC,MAAMnB,OAAOF;KAAgBsB,KAAKV;IAAY;IACxDW,QAAQlC,SAASkC;GACrB,CAAA;GAEA,MAAM,KAAKzC,WAAW0C,KAAK;IACvBC,IAAIvB,OAAOwB;IACX,GAAGV;GACP,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKhC,WAAW2C,OAAOzB,MAAAA;GAC7B,MAAM,IAAI7B,gBAAgB,uDAAA;EAC9B;EAGJ,OAAO,EAAE0B,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAM6B,SAASxC,MAAwC;EACnD,MAAMc,SAAS,MAAM,KAAKlB,WAAW6C,UAAU,EAAE7B,eAAeZ,KAAK0C,MAAM,CAAA;EAE3E,IAAI,CAAC5B,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMyD,SAAS,KAAK/C,WAAWgD,MAAM9B,QAAQ;GACzCH,QAAQ;GACRC,eAAe;EACnB,CAAA;EAEA,MAAM,KAAKhB,WAAW2B,KAAKoB,MAAAA;CAC/B;AACJ"}

package/dist/core/identity/registration/types.d.ts

@@ -1,12 +1,15 @@
-import type { IMailClient } from '../../mail/types.ts';
+import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
 import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IdentityWorkflowContext } from '../types.ts';
 export type RegistrationServiceOptions = {
     registrationEnabled?: boolean;
     emailVerificationEnabled?: boolean;
+    publicUrl?: string;
 };
 export type RegistrationServiceContext = {
     options: RegistrationServiceOptions;
     mailClient: IMailClient;
+    mailTemplateRenderer: IMailTemplateRenderer;
     repository: IUserRepository;
     realmRepository: IRealmRepository;
 };
@@ -14,7 +17,7 @@ export type RegistrationResult = {
     active: boolean;
 };
 export interface IRegistrationService {
-    register(data: Record<string, any>): Promise<RegistrationResult>;
+    register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult>;
     activate(data: {
         token: string;
     }): Promise<void>;

package/dist/core/identity/registration/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,MAAM,MAAM,0BAA0B,GAAG;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,EAAE,WAAW,CAAC;IACxB,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjE,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,0BAA0B,GAAG;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}

package/dist/core/identity/role/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAErF,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,2BAA2B;IAMtC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAkBjE,OAAO,CAAC,sBAAsB;CAUjC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAErF,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,2BAA2B;IAMtC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAkBjE,OAAO,CAAC,sBAAsB;CAiBjC"}

package/dist/core/identity/role/module.mjs

@@ -21,7 +21,7 @@ var IdentityRoleProvider = class {
 	}
 	reduceByIdentityClient(entities, identity) {
 		if (!identity.clientId) return entities;
-		return entities.filter((entity) => entity.client_id === identity.clientId);
+		return entities.filter((entity) => !entity.client_id || entity.client_id === identity.clientId);
 	}
 };
 //#endregion

package/dist/core/identity/role/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityRoleProvider","clientRepository","userRepository","robotRepository","ctx","getRolesFor","identity","type","getBoundRoles","id","then","data","reduceByIdentityClient","entities","clientId","filter","entity","client_id"],"sources":["../../../../src/core/identity/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Role } from '@authup/core-kit';\nimport type { IdentityPolicyData } from '@authup/access';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';\n\nexport class IdentityRoleProvider implements IIdentityRoleProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected robotRepository: IRobotRepository;\n\n    constructor(ctx: IdentityRoleProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async getRolesFor(identity: IdentityPolicyData) : Promise<Role[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.clientRepository.getBoundRoles(identity.id);\n            }\n            case 'user': {\n                return this.userRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n            case 'robot': {\n                return this.robotRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n        }\n\n        return [];\n    }\n\n    private reduceByIdentityClient<T extends { client_id?: string | null }>(\n        entities: T[],\n        identity: IdentityPolicyData,\n    ): T[] {\n        if (!identity.clientId) {\n            return entities;\n        }\n\n        return entities.filter((entity) => entity.client_id === identity.clientId);\n    }\n}\n"],"mappings":";;;;AAcA,IAAaA,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,YAAYC,UAAgD;EAC9D,QAAQA,SAASC,MAAjB;GACI,KAAK,UACD,OAAO,KAAKN,iBAAiBO,cAAcF,SAASG,EAAE;GAE1D,KAAK,QACD,OAAO,KAAKP,eAAeM,cAAcF,SAASG,EAAE,CAAA,CAC/CC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;GAE1D,KAAK,SACD,OAAO,KAAKH,gBAAgBK,cAAcF,SAASG,EAAE,CAAA,CAChDC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;EAE9D;EAEA,OAAO,CAAA;CACX;CAEQM,uBACJC,UACAP,UACG;EACH,IAAI,CAACA,SAASQ,UACV,OAAOD;EAGX,OAAOA,SAASE,QAAQC,WAAWA,OAAOC,cAAcX,SAASQ,QAAQ;CAC7E;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityRoleProvider","clientRepository","userRepository","robotRepository","ctx","getRolesFor","identity","type","getBoundRoles","id","then","data","reduceByIdentityClient","entities","clientId","filter","entity","client_id"],"sources":["../../../../src/core/identity/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Role } from '@authup/core-kit';\nimport type { IdentityPolicyData } from '@authup/access';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';\n\nexport class IdentityRoleProvider implements IIdentityRoleProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected robotRepository: IRobotRepository;\n\n    constructor(ctx: IdentityRoleProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async getRolesFor(identity: IdentityPolicyData) : Promise<Role[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.clientRepository.getBoundRoles(identity.id);\n            }\n            case 'user': {\n                return this.userRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n            case 'robot': {\n                return this.robotRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n        }\n\n        return [];\n    }\n\n    private reduceByIdentityClient<T extends { client_id?: string | null }>(\n        entities: T[],\n        identity: IdentityPolicyData,\n    ): T[] {\n        if (!identity.clientId) {\n            return entities;\n        }\n\n        // Keep client-agnostic (global / realm) roles — client_id null — in\n        // addition to roles scoped to the authenticating client. Dropping the\n        // null case stripped every global/realm role from a token issued via\n        // a real client (e.g. the per-realm `web` client used by the\n        // realm-selection login), leaving permissions/roles empty.\n        return entities.filter(\n            (entity) => !entity.client_id || entity.client_id === identity.clientId,\n        );\n    }\n}\n"],"mappings":";;;;AAcA,IAAaA,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,YAAYC,UAAgD;EAC9D,QAAQA,SAASC,MAAjB;GACI,KAAK,UACD,OAAO,KAAKN,iBAAiBO,cAAcF,SAASG,EAAE;GAE1D,KAAK,QACD,OAAO,KAAKP,eAAeM,cAAcF,SAASG,EAAE,CAAA,CAC/CC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;GAE1D,KAAK,SACD,OAAO,KAAKH,gBAAgBK,cAAcF,SAASG,EAAE,CAAA,CAChDC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;EAE9D;EAEA,OAAO,CAAA;CACX;CAEQM,uBACJC,UACAP,UACG;EACH,IAAI,CAACA,SAASQ,UACV,OAAOD;EAQX,OAAOA,SAASE,QACXC,WAAW,CAACA,OAAOC,aAAaD,OAAOC,cAAcX,SAASQ,QAAQ;CAE/E;AACJ"}

package/dist/core/identity/types.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Per-request ambience the HTTP adapter passes alongside the raw payload of
+ * an identity workflow (registration, password recovery, ...). Carries no
+ * business data — only context such as the requester's preferred locale,
+ * which drives outbound mail localization.
+ */
+export type IdentityWorkflowContext = {
+    locale?: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/identity/types.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/core/identity/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/index.mjs

@@ -12,6 +12,7 @@ import { CredentialsAuthenticator } from "./authentication/module.mjs";
 import { SessionManager } from "./authentication/session/module.mjs";
 import "./authentication/index.mjs";
 import { ClientService } from "./entities/client/service.mjs";
+import { WebClientProvisioner, buildWebClientAttributes } from "./entities/client/web-client.mjs";
 import { ClientPermissionService } from "./entities/client-permission/service.mjs";
 import { ClientRoleService } from "./entities/client-role/service.mjs";
 import { ClientScopeService } from "./entities/client-scope/service.mjs";
@@ -32,6 +33,11 @@ import { UserPermissionService } from "./entities/user-permission/service.mjs";
 import { UserRoleService } from "./entities/user-role/service.mjs";
 import { IdentityProviderRoleMappingService } from "./entities/identity-provider-role-mapping/service.mjs";
 import "./entities/index.mjs";
+import { defineMailTemplate } from "./mail/template/define.mjs";
+import { MailTemplateName } from "./mail/template/types.mjs";
+import { MAIL_TEMPLATE_REGISTRY } from "./mail/template/registry.mjs";
+import { MailTemplateRenderer } from "./mail/renderer.mjs";
+import "./mail/index.mjs";
 import { OAuth2AuthorizationCodeIssuer } from "./oauth2/authorization/code/issuer/module.mjs";
 import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./oauth2/authorization/helpers.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./oauth2/authorization/code/verifier/module.mjs";
@@ -56,6 +62,7 @@ import { OAuth2TokenRevoker } from "./oauth2/token/revoker/module.mjs";
 import { OAuth2TokenSigner } from "./oauth2/token/signer/module.mjs";
 import { OAuth2TokenVerifier } from "./oauth2/token/verifier/module.mjs";
 import "./oauth2/index.mjs";
+import { PASSWORD_RESET_EXPIRES_IN_MINUTES } from "./identity/password-recovery/constants.mjs";
 import { PasswordRecoveryService } from "./identity/password-recovery/service.mjs";
 import { PermissionBindingPolicyEvaluator } from "./security/policy/evaluator.mjs";
 import { PolicyEngine } from "./security/policy/engine.mjs";
@@ -107,4 +114,4 @@ import { ScopeProvisioningSynchronizer } from "./provisioning/synchronizer/scope
 import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/module.mjs";
 import "./provisioning/index.mjs";
 import "./security/index.mjs";
-export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, CredentialsAuthenticator, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, UserAttributeService, UserAuthenticator, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createIdentityProviderOAuth2Authenticator, generateOAuth2CodeVerifier, normalizeEntityProvisioningStrategy };
+export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, CredentialsAuthenticator, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, UserAttributeService, UserAuthenticator, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WebClientProvisioner, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildWebClientAttributes, createIdentityProviderOAuth2Authenticator, defineMailTemplate, generateOAuth2CodeVerifier, normalizeEntityProvisioningStrategy };

package/dist/core/mail/format/blocks.d.ts

@@ -0,0 +1,12 @@
+import type { MailActionBlock, MailCodeBlock, MailNoteBlock, MailParagraphBlock } from './types.ts';
+export declare function paragraph(text: string): MailParagraphBlock;
+export declare function code(label: string, value: string): MailCodeBlock;
+export declare function action(label: string, url: string): MailActionBlock;
+export declare function note(text: string): MailNoteBlock;
+/**
+ * Only http(s) URLs may become call-to-action links. Action URLs are built
+ * from `publicUrl` config today, so this is defense in depth against a
+ * future caller passing an attacker-influenced value (e.g. `javascript:`).
+ */
+export declare function isSafeActionURL(input: string): boolean;
+//# sourceMappingURL=blocks.d.ts.map

package/dist/core/mail/format/blocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocks.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/format/blocks.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,eAAe,EACf,aAAa,EACb,aAAa,EACb,kBAAkB,EACrB,MAAM,YAAY,CAAC;AAEpB,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAE1D;AAED,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAMhE;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,eAAe,CAMlE;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAUtD"}