@authup/server-core 1.0.0-beta.5 → 1.0.0-beta.50

package/dist/core/entities/identity-provider/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/entities/identity-provider-role-mapping/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/identity-provider-role-mapping/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/entities/identity-provider-role-mapping/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderRoleMappingService } from "./service.mjs";
+export { IdentityProviderRoleMappingService };

package/dist/core/entities/identity-provider-role-mapping/service.d.ts

@@ -0,0 +1,22 @@
+import { IdentityProviderRoleMappingValidator } from '@authup/core-kit';
+import type { IdentityProviderRoleMapping } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
+import type { IIdentityProviderRoleMappingRepository, IIdentityProviderRoleMappingService } from './types.ts';
+export type IdentityProviderRoleMappingServiceContext = {
+    repository: IIdentityProviderRoleMappingRepository;
+    identityPermissionProvider: IIdentityPermissionProvider;
+};
+export declare class IdentityProviderRoleMappingService extends AbstractEntityService implements IIdentityProviderRoleMappingService {
+    protected repository: IIdentityProviderRoleMappingRepository;
+    protected identityPermissionProvider: IIdentityPermissionProvider;
+    protected validator: IdentityProviderRoleMappingValidator;
+    constructor(ctx: IdentityProviderRoleMappingServiceContext);
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<IdentityProviderRoleMapping>>;
+    getOne(id: string, actor: ActorContext): Promise<IdentityProviderRoleMapping>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<IdentityProviderRoleMapping>;
+    update(id: string, data: Record<string, any>, actor: ActorContext): Promise<IdentityProviderRoleMapping>;
+    delete(id: string, actor: ActorContext): Promise<IdentityProviderRoleMapping>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/identity-provider-role-mapping/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,oCAAoC,EAAkB,MAAM,kBAAkB,CAAC;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,sCAAsC,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAE9G,MAAM,MAAM,yCAAyC,GAAG;IACpD,UAAU,EAAE,sCAAsC,CAAC;IACnD,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,kCAAmC,SAAQ,qBAAsB,YAAW,mCAAmC;IACxH,SAAS,CAAC,UAAU,EAAE,sCAAsC,CAAC;IAE7D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,oCAAoC,CAAC;gBAE9C,GAAG,EAAE,yCAAyC;IAOpD,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,2BAA2B,CAAC,CAAC;IAajE,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;IAkBjC,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;IA2DjC,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;IAsBjC,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;CAmB1C"}

package/dist/core/entities/identity-provider-role-mapping/service.mjs

@@ -0,0 +1,99 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ValidatorGroup } from "@authup/kit";
+import { IdentityProviderRoleMappingValidator, PermissionName } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, PermissionError, PolicyData } from "@authup/access";
+import { BadRequestError, EntityConflictError, EntityNotFoundError } from "@authup/errors";
+//#region src/core/entities/identity-provider-role-mapping/service.ts
+var IdentityProviderRoleMappingService = class extends AbstractEntityService {
+	repository;
+	identityPermissionProvider;
+	validator;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.validator = new IdentityProviderRoleMappingValidator();
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.IDENTITY_PROVIDER_ROLE_READ,
+			PermissionName.IDENTITY_PROVIDER_READ,
+			PermissionName.IDENTITY_PROVIDER_UPDATE,
+			PermissionName.IDENTITY_PROVIDER_DELETE
+		] });
+		return this.repository.findMany(query);
+	}
+	async getOne(id, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.IDENTITY_PROVIDER_ROLE_READ,
+			PermissionName.IDENTITY_PROVIDER_READ,
+			PermissionName.IDENTITY_PROVIDER_UPDATE,
+			PermissionName.IDENTITY_PROVIDER_DELETE
+		] });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new EntityNotFoundError();
+		return entity;
+	}
+	async create(data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE });
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		await this.repository.validateJoinColumns(validated);
+		if (await this.repository.findOneBy({
+			provider_id: validated.provider_id,
+			role_id: validated.role_id
+		})) throw new EntityConflictError({ entity: "identity-provider-role-mapping" });
+		if (validated.provider) validated.provider_realm_id = validated.provider.realm_id;
+		if (validated.role) validated.role_realm_id = validated.role.realm_id;
+		if (validated.role_realm_id && validated.provider_realm_id && validated.role_realm_id !== validated.provider_realm_id) throw new BadRequestError("It is not possible to map an identity provider to a role of another realm.");
+		if (validated.role && actor.identity) {
+			if (!await this.identityPermissionProvider.isSuperset({
+				type: actor.identity.type,
+				id: actor.identity.data.id
+			}, {
+				type: "role",
+				id: validated.role_id,
+				clientId: validated.role.client_id
+			})) throw new PermissionError({ message: "You don't own the required permissions." });
+		}
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+		});
+		let entity = this.repository.create(validated);
+		entity = await this.repository.save(entity);
+		return entity;
+	}
+	async update(id, data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new EntityNotFoundError();
+		const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });
+		await this.repository.validateJoinColumns(validated);
+		const merged = this.repository.merge(entity, validated);
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged })
+		});
+		return this.repository.save(merged);
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new EntityNotFoundError();
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+};
+//#endregion
+export { IdentityProviderRoleMappingService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/identity-provider-role-mapping/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","PolicyData","BadRequestError","EntityConflictError","EntityNotFoundError","ValidatorGroup","IdentityProviderRoleMappingValidator","PermissionName","AbstractEntityService","IdentityProviderRoleMappingService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","IDENTITY_PROVIDER_ROLE_READ","IDENTITY_PROVIDER_READ","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","IDENTITY_PROVIDER_ROLE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","provider_id","role_id","provider","provider_realm_id","realm_id","role","role_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","message","evaluate","input","ATTRIBUTES","save","update","IDENTITY_PROVIDER_ROLE_UPDATE","UPDATE","merged","merge","delete","IDENTITY_PROVIDER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/identity-provider-role-mapping/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, PolicyData } from '@authup/access';\nimport { BadRequestError, EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { IdentityProviderRoleMappingValidator, PermissionName } from '@authup/core-kit';\nimport type { IdentityProviderRoleMapping } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IIdentityProviderRoleMappingRepository, IIdentityProviderRoleMappingService } from './types.ts';\n\nexport type IdentityProviderRoleMappingServiceContext = {\n    repository: IIdentityProviderRoleMappingRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class IdentityProviderRoleMappingService extends AbstractEntityService implements IIdentityProviderRoleMappingService {\n    protected repository: IIdentityProviderRoleMappingRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: IdentityProviderRoleMappingValidator;\n\n    constructor(ctx: IdentityProviderRoleMappingServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new IdentityProviderRoleMappingValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<IdentityProviderRoleMapping>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.IDENTITY_PROVIDER_ROLE_READ,\n                PermissionName.IDENTITY_PROVIDER_READ,\n                PermissionName.IDENTITY_PROVIDER_UPDATE,\n                PermissionName.IDENTITY_PROVIDER_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.IDENTITY_PROVIDER_ROLE_READ,\n                PermissionName.IDENTITY_PROVIDER_READ,\n                PermissionName.IDENTITY_PROVIDER_UPDATE,\n                PermissionName.IDENTITY_PROVIDER_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            provider_id: validated.provider_id,\n            role_id: validated.role_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'identity-provider-role-mapping' });\n        }\n\n        if (validated.provider) {\n            validated.provider_realm_id = validated.provider.realm_id;\n        }\n\n        if (validated.role) {\n            validated.role_realm_id = validated.role.realm_id;\n        }\n\n        if (\n            validated.role_realm_id &&\n            validated.provider_realm_id &&\n            validated.role_realm_id !== validated.provider_realm_id\n        ) {\n            throw new BadRequestError('It is not possible to map an identity provider to a role of another realm.');\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.role_id,\n                    clientId: validated.role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const merged = this.repository.merge(entity, validated);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAsBA,IAAaU,qCAAb,cAAwDD,sBAAAA;CAC1CE;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;EACxD,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIN,qCAAAA;CACzB;CAEA,MAAMQ,QACFC,OACAC,OACoE;EACpE,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAAST,KAAAA;CACpC;CAEA,MAAMU,OACFC,IACAV,OACoC;EACpC,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,OAAOuB;CACX;CAEA,MAAME,OACFC,MACAd,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAeyB,8BAA8B,CAAA;EAEjG,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO9B,eAAe+B,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,aAAaN,UAAUM;GACvBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIrC,oBAAoB,EAAEwB,QAAQ,iCAAiC,CAAA;EAG7E,IAAIM,UAAUQ,UACVR,UAAUS,oBAAoBT,UAAUQ,SAASE;EAGrD,IAAIV,UAAUW,MACVX,UAAUY,gBAAgBZ,UAAUW,KAAKD;EAG7C,IACIV,UAAUY,iBACVZ,UAAUS,qBACVT,UAAUY,kBAAkBZ,UAAUS,mBAEtC,MAAM,IAAIxC,gBAAgB,4EAAA;EAG9B,IAAI+B,UAAUW,QAAQ5B,MAAM8B;OAYpB,CAACC,MAXwB,KAAKpC,2BAA2BqC,WACzD;IACIC,MAAMjC,MAAM8B,SAASG;IACrBvB,IAAIV,MAAM8B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIO,UAAUO;IACdU,UAAUjB,UAAUW,KAAKO;GAC7B,CAAA,GAGA,MAAM,IAAInD,gBAAgB,EAAEoD,SAAS,0CAA2C,CAAA;EAAA;EAIxF,MAAMpC,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMZ,eAAeyB;GACrBsB,OAAO,IAAIrD,WAAW,GAAGF,kBAAkBwD,aAAatB,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAW8C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAI,MACAd,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAemD,8BAA8B,CAAA;EAEjG,MAAM/B,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,MAAM6B,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO9B,eAAesD,OAAO,CAAA;EAEhF,MAAM,KAAKjD,WAAW2B,oBAAoBJ,SAAAA;EAE1C,MAAM2B,SAAS,KAAKlD,WAAWmD,MAAMlC,QAAQM,SAAAA;EAE7C,MAAMjB,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMZ,eAAemD;GACrBJ,OAAO,IAAIrD,WAAW,GAAGF,kBAAkBwD,aAAaK,OAAO,CAAA;EACnE,CAAA;EAEA,OAAO,KAAKlD,WAAW8C,KAAKI,MAAAA;CAChC;CAEA,MAAME,OACFpC,IACAV,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAewD,8BAA8B,CAAA;EAEjG,MAAMpC,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMZ,eAAewD;GACrBT,OAAO,IAAIrD,WAAW,GAAGF,kBAAkBwD,aAAa5B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAIsC,aAAarC;EACzB,MAAM,KAAKjB,WAAWuD,OAAOtC,MAAAA;EAC7BA,OAAOD,KAAKsC;EAEZ,OAAOrC;CACX;AACJ"}

package/dist/core/entities/identity-provider-role-mapping/types.d.ts

@@ -0,0 +1,12 @@
+import type { IdentityProviderRoleMapping } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
+export interface IIdentityProviderRoleMappingRepository extends IEntityRepository<IdentityProviderRoleMapping> {
+}
+export interface IIdentityProviderRoleMappingService {
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<IdentityProviderRoleMapping>>;
+    getOne(id: string, actor: ActorContext): Promise<IdentityProviderRoleMapping>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<IdentityProviderRoleMapping>;
+    update(id: string, data: Record<string, any>, actor: ActorContext): Promise<IdentityProviderRoleMapping>;
+    delete(id: string, actor: ActorContext): Promise<IdentityProviderRoleMapping>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/identity-provider-role-mapping/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G,MAAM,WAAW,sCAAuC,SAAQ,iBAAiB,CAAC,2BAA2B,CAAC;CAE7G;AAED,MAAM,WAAW,mCAAmC;IAChD,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAC/H,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9E,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC7F,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACzG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;CACjF"}

package/dist/core/entities/identity-provider-role-mapping/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/entities/index.d.ts

@@ -0,0 +1,22 @@
+export * from './client/index.ts';
+export * from './client-permission/index.ts';
+export * from './client-role/index.ts';
+export * from './client-scope/index.ts';
+export * from './identity-provider/index.ts';
+export * from './permission/index.ts';
+export * from './permission-policy/index.ts';
+export * from './policy/index.ts';
+export * from './realm/index.ts';
+export * from './robot/index.ts';
+export * from './robot-permission/index.ts';
+export * from './robot-role/index.ts';
+export * from './role/index.ts';
+export * from './role-attribute/index.ts';
+export * from './role-permission/index.ts';
+export * from './scope/index.ts';
+export * from './user/index.ts';
+export * from './user-attribute/index.ts';
+export * from './user-permission/index.ts';
+export * from './user-role/index.ts';
+export * from './identity-provider-role-mapping/index.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}

package/dist/core/entities/index.mjs

@@ -0,0 +1,45 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ClientService } from "./client/service.mjs";
+import { WebClientProvisioner, buildWebClientAttributes } from "./client/web-client.mjs";
+import "./client/index.mjs";
+import { ClientPermissionService } from "./client-permission/service.mjs";
+import "./client-permission/index.mjs";
+import { ClientRoleService } from "./client-role/service.mjs";
+import "./client-role/index.mjs";
+import { ClientScopeService } from "./client-scope/service.mjs";
+import "./client-scope/index.mjs";
+import { PermissionService } from "./permission/service.mjs";
+import "./permission/index.mjs";
+import { PermissionPolicyService } from "./permission-policy/service.mjs";
+import "./permission-policy/index.mjs";
+import { PolicyService } from "./policy/service.mjs";
+import "./policy/index.mjs";
+import { RealmService } from "./realm/service.mjs";
+import "./realm/index.mjs";
+import { RobotService } from "./robot/service.mjs";
+import "./robot/index.mjs";
+import { RobotPermissionService } from "./robot-permission/service.mjs";
+import "./robot-permission/index.mjs";
+import { RobotRoleService } from "./robot-role/service.mjs";
+import "./robot-role/index.mjs";
+import { RoleService } from "./role/service.mjs";
+import "./role/index.mjs";
+import { RoleAttributeService } from "./role-attribute/service.mjs";
+import "./role-attribute/index.mjs";
+import { RolePermissionService } from "./role-permission/service.mjs";
+import "./role-permission/index.mjs";
+import { ScopeService } from "./scope/service.mjs";
+import "./scope/index.mjs";
+import { UserService } from "./user/service.mjs";
+import "./user/index.mjs";
+import { UserAttributeService } from "./user-attribute/service.mjs";
+import "./user-attribute/index.mjs";
+import { UserPermissionService } from "./user-permission/service.mjs";
+import "./user-permission/index.mjs";
+import { UserRoleService } from "./user-role/service.mjs";
+import "./user-role/index.mjs";
+import { IdentityProviderRoleMappingService } from "./identity-provider-role-mapping/service.mjs";
+import "./identity-provider-role-mapping/index.mjs";
+export { ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, IdentityProviderRoleMappingService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RobotPermissionService, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleService, ScopeService, UserAttributeService, UserPermissionService, UserRoleService, UserService, WebClientProvisioner, buildWebClientAttributes };

package/dist/core/entities/permission/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/permission/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/entities/permission/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PermissionService } from "./service.mjs";
+export { PermissionService };

package/dist/core/entities/permission/service.d.ts

@@ -0,0 +1,69 @@
+import { PermissionValidator } from '@authup/core-kit';
+import type { Permission } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { IPermissionPolicyRepository } from '../permission-policy/types.ts';
+import type { IPolicyRepository } from '../policy/types.ts';
+import type { IRealmRepository } from '../realm/types.ts';
+import type { IRoleRepository } from '../role/types.ts';
+import type { IRolePermissionRepository } from '../role-permission/types.ts';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { IPermissionRepository, IPermissionService } from './types.ts';
+export type PermissionServiceContext = {
+    repository: IPermissionRepository;
+    realmRepository: IRealmRepository;
+    roleRepository: IRoleRepository;
+    rolePermissionRepository: IRolePermissionRepository;
+    policyRepository: IPolicyRepository;
+    permissionPolicyRepository: IPermissionPolicyRepository;
+};
+export declare class PermissionService extends AbstractEntityService implements IPermissionService {
+    protected repository: IPermissionRepository;
+    protected realmRepository: IRealmRepository;
+    protected roleRepository: IRoleRepository;
+    protected rolePermissionRepository: IRolePermissionRepository;
+    protected policyRepository: IPolicyRepository;
+    protected permissionPolicyRepository: IPermissionPolicyRepository;
+    protected validator: PermissionValidator;
+    constructor(ctx: PermissionServiceContext);
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<Permission>>;
+    getOne(idOrName: string, actor: ActorContext, realm?: string): Promise<Permission>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<Permission>;
+    update(idOrName: string, data: Record<string, any>, actor: ActorContext): Promise<Permission>;
+    save(idOrName: string | undefined, data: Record<string, any>, actor: ActorContext, options?: {
+        updateOnly?: boolean;
+    }): Promise<{
+        entity: Permission;
+        created: boolean;
+    }>;
+    delete(id: string, actor: ActorContext): Promise<Permission>;
+    /**
+     * Assign the system.default policy to a newly created permission.
+     * This ensures all permissions are evaluated with the baseline security
+     * policy (identity, permission-binding, realm-match) by default.
+     */
+    private assignDefaultPolicy;
+    /**
+     * Assign a newly created permission to the global admin role.
+     * The admin role receives every permission without policy restrictions.
+     */
+    private assignToAdminRole;
+    /**
+     * Assign a newly created permission to all matching realm_admin roles.
+     *
+     * Uses differentiated junction policies:
+     * - CUD on global-capable entity types → system.realm-bound
+     * - Everything else → system.realm-or-global
+     *
+     * Eligible permissions:
+     * - Built-in authup permissions (global) — assigned to all realm_admin roles
+     * - Realm-scoped permissions — assigned to the realm_admin in the matching realm
+     *
+     * Excluded:
+     * - Realm CRUD permissions (realm_create, realm_update, realm_delete)
+     * - Custom global permissions (non-built-in with realm_id: null)
+     *
+     * Fails closed: skips assignment entirely if required policies are not found.
+     */
+    private assignToRealmAdminRoles;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/permission/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAEH,mBAAmB,EAGtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA0C5E,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,qBAAqB,CAAC;IAClC,eAAe,EAAE,gBAAgB,CAAC;IAClC,cAAc,EAAE,eAAe,CAAC;IAChC,wBAAwB,EAAE,yBAAyB,CAAC;IACpD,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,qBAAsB,YAAW,kBAAkB;IACtF,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAE5C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,wBAAwB,EAAE,yBAAyB,CAAC;IAE9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC;gBAE7B,GAAG,EAAE,wBAAwB;IAWnC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAYhD,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAiBhB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAKhB,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAKhB,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IA+FI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAwBtB;;;;OAIG;YACW,mBAAmB;IAuBjC;;;OAGG;YACW,iBAAiB;IAuB/B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;CA4CxC"}

package/dist/core/entities/permission/service.mjs

@@ -0,0 +1,240 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ValidatorGroup, isPropertySet, isUUID } from "@authup/kit";
+import { PermissionName, PermissionValidator, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, PolicyData, SystemPolicyName } from "@authup/access";
+import { AuthupError, BadRequestError, EntityNotFoundError } from "@authup/errors";
+//#region src/core/entities/permission/service.ts
+const REALM_ADMIN_EXCLUDED_PERMISSIONS = [
+	PermissionName.REALM_CREATE,
+	PermissionName.REALM_UPDATE,
+	PermissionName.REALM_DELETE
+];
+/**
+* CUD permissions that get system.realm-bound on realm_admin.
+* Covers direct entity types (both global-capable and realm-only).
+*
+* Junction entity CUD (e.g. user_role, role_permission) intentionally
+* use realm-or-global instead, because their attributes include
+* multiple realm_id fields (e.g. user_realm_id + role_realm_id).
+* With attribute_name_strict: false, realm-bound would reject
+* junctions where one side is global (realm_id: null).
+*/ const REALM_ADMIN_BOUND_PERMISSIONS = [
+	PermissionName.CLIENT_CREATE,
+	PermissionName.CLIENT_UPDATE,
+	PermissionName.CLIENT_DELETE,
+	PermissionName.IDENTITY_PROVIDER_CREATE,
+	PermissionName.IDENTITY_PROVIDER_UPDATE,
+	PermissionName.IDENTITY_PROVIDER_DELETE,
+	PermissionName.PERMISSION_CREATE,
+	PermissionName.PERMISSION_UPDATE,
+	PermissionName.PERMISSION_DELETE,
+	PermissionName.ROBOT_CREATE,
+	PermissionName.ROBOT_UPDATE,
+	PermissionName.ROBOT_DELETE,
+	PermissionName.ROLE_CREATE,
+	PermissionName.ROLE_UPDATE,
+	PermissionName.ROLE_DELETE,
+	PermissionName.SCOPE_CREATE,
+	PermissionName.SCOPE_UPDATE,
+	PermissionName.SCOPE_DELETE,
+	PermissionName.USER_CREATE,
+	PermissionName.USER_UPDATE,
+	PermissionName.USER_DELETE
+];
+var PermissionService = class extends AbstractEntityService {
+	repository;
+	realmRepository;
+	roleRepository;
+	rolePermissionRepository;
+	policyRepository;
+	permissionPolicyRepository;
+	validator;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.realmRepository = ctx.realmRepository;
+		this.roleRepository = ctx.roleRepository;
+		this.rolePermissionRepository = ctx.rolePermissionRepository;
+		this.policyRepository = ctx.policyRepository;
+		this.permissionPolicyRepository = ctx.permissionPolicyRepository;
+		this.validator = new PermissionValidator();
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.PERMISSION_READ,
+			PermissionName.PERMISSION_UPDATE,
+			PermissionName.PERMISSION_DELETE
+		] });
+		return this.repository.findMany(query);
+	}
+	async getOne(idOrName, actor, realm) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+			PermissionName.PERMISSION_READ,
+			PermissionName.PERMISSION_UPDATE,
+			PermissionName.PERMISSION_DELETE
+		] });
+		const entity = await this.repository.findOneByIdOrName(idOrName, realm);
+		if (!entity) throw new EntityNotFoundError();
+		return entity;
+	}
+	async create(data, actor) {
+		const { entity } = await this.save(void 0, data, actor);
+		return entity;
+	}
+	async update(idOrName, data, actor) {
+		const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });
+		return entity;
+	}
+	async save(idOrName, data, actor, options = {}) {
+		let group;
+		const realm = typeof data.realm_id === "string" ? await this.realmRepository.resolve(data.realm_id) : void 0;
+		let entity;
+		if (idOrName) {
+			const where = {};
+			if (isUUID(idOrName)) where.id = idOrName;
+			else where.name = idOrName;
+			if (realm) where.realm_id = realm.id;
+			entity = await this.repository.findOneBy(where);
+			if (!entity && options.updateOnly) throw new EntityNotFoundError();
+		} else if (options.updateOnly) throw new EntityNotFoundError();
+		if (entity) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });
+			group = ValidatorGroup.UPDATE;
+		} else {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });
+			group = ValidatorGroup.CREATE;
+		}
+		const validated = await this.validator.run(data, { group });
+		await this.repository.validateJoinColumns(validated);
+		if (entity) {
+			if (entity.built_in && isPropertySet(validated, "name") && entity.name !== validated.name) throw new BadRequestError("The name of a built-in permission can not be changed.");
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.PERMISSION_UPDATE,
+				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: {
+					...entity,
+					...validated
+				} })
+			});
+			await this.repository.checkUniqueness(validated, entity);
+			entity = this.repository.merge(entity, validated);
+			await this.repository.save(entity);
+			return {
+				entity,
+				created: false
+			};
+		}
+		if (!isPropertySet(validated, "realm_id") && actor.identity) validated.realm_id = this.getActorRealmId(actor) || null;
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.PERMISSION_CREATE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+		});
+		await this.repository.checkUniqueness(validated);
+		entity = this.repository.create(validated);
+		entity = await this.repository.save(entity);
+		await this.assignDefaultPolicy(entity);
+		await this.assignToAdminRole(entity);
+		await this.assignToRealmAdminRoles(entity);
+		return {
+			entity,
+			created: true
+		};
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new EntityNotFoundError();
+		if (entity.built_in) throw new BadRequestError("A built-in permission can not be deleted.");
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.PERMISSION_DELETE,
+			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+		});
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+	/**
+	* Assign the system.default policy to a newly created permission.
+	* This ensures all permissions are evaluated with the baseline security
+	* policy (identity, permission-binding, realm-match) by default.
+	*/ async assignDefaultPolicy(permission) {
+		const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);
+		if (!defaultPolicy) throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);
+		if (await this.permissionPolicyRepository.findOneBy({
+			permission_id: permission.id,
+			policy_id: defaultPolicy.id
+		})) return;
+		const entry = this.permissionPolicyRepository.create({
+			permission_id: permission.id,
+			permission_realm_id: permission.realm_id,
+			policy_id: defaultPolicy.id,
+			policy_realm_id: defaultPolicy.realm_id
+		});
+		await this.permissionPolicyRepository.save(entry);
+	}
+	/**
+	* Assign a newly created permission to the global admin role.
+	* The admin role receives every permission without policy restrictions.
+	*/ async assignToAdminRole(permission) {
+		const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);
+		if (!adminRole) return;
+		if (await this.rolePermissionRepository.findOneBy({
+			role_id: adminRole.id,
+			permission_id: permission.id
+		})) return;
+		const entry = this.rolePermissionRepository.create({
+			role_id: adminRole.id,
+			role_realm_id: adminRole.realm_id,
+			permission_id: permission.id,
+			permission_realm_id: permission.realm_id
+		});
+		await this.rolePermissionRepository.save(entry);
+	}
+	/**
+	* Assign a newly created permission to all matching realm_admin roles.
+	*
+	* Uses differentiated junction policies:
+	* - CUD on global-capable entity types → system.realm-bound
+	* - Everything else → system.realm-or-global
+	*
+	* Eligible permissions:
+	* - Built-in authup permissions (global) — assigned to all realm_admin roles
+	* - Realm-scoped permissions — assigned to the realm_admin in the matching realm
+	*
+	* Excluded:
+	* - Realm CRUD permissions (realm_create, realm_update, realm_delete)
+	* - Custom global permissions (non-built-in with realm_id: null)
+	*
+	* Fails closed: skips assignment entirely if required policies are not found.
+	*/ async assignToRealmAdminRoles(permission) {
+		if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name)) return;
+		const isBuiltIn = Object.values(PermissionName).includes(permission.name);
+		if (!permission.realm_id && !isBuiltIn) return;
+		const policyName = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name) ? SystemPolicyName.REALM_BOUND : SystemPolicyName.REALM_OR_GLOBAL;
+		const policy = await this.policyRepository.findOneByName(policyName);
+		if (!policy) return;
+		const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });
+		for (const role of realmAdminRoles) {
+			if (permission.realm_id && permission.realm_id !== role.realm_id) continue;
+			if (await this.rolePermissionRepository.findOneBy({
+				role_id: role.id,
+				permission_id: permission.id
+			})) continue;
+			const entry = this.rolePermissionRepository.create({
+				role_id: role.id,
+				role_realm_id: role.realm_id,
+				permission_id: permission.id,
+				permission_realm_id: permission.realm_id,
+				policy_id: policy.id
+			});
+			await this.rolePermissionRepository.save(entry);
+		}
+	}
+};
+//#endregion
+export { PermissionService };
+
+//# sourceMappingURL=service.mjs.map