@authup/server-core 1.0.0-beta.5 → 1.0.0-beta.50

package/dist/core/identity/permission/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/identity/policy/checker/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/policy/checker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/policy/checker/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/identity/policy/checker/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PolicyCheckerService } from "./service.mjs";
+export { PolicyCheckerService };

package/dist/core/identity/policy/checker/service.d.ts

@@ -0,0 +1,10 @@
+import type { Result } from '@authup/kit';
+import type { ActorContext } from '@authup/server-kit';
+import type { IPolicyCheckerService, PolicyCheckerServiceContext } from './types.ts';
+export declare class PolicyCheckerService implements IPolicyCheckerService {
+    protected ctx: PolicyCheckerServiceContext;
+    constructor(ctx: PolicyCheckerServiceContext);
+    check(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<void>;
+    safeCheck(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<Result<null>>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/identity/policy/checker/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/policy/checker/service.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EACR,qBAAqB,EACrB,2BAA2B,EAC9B,MAAM,YAAY,CAAC;AAEpB,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,GAAG,EAAE,2BAA2B,CAAC;gBAE/B,GAAG,EAAE,2BAA2B;IAItC,KAAK,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAgCV,SAAS,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ3B"}

package/dist/core/identity/policy/checker/service.mjs

@@ -0,0 +1,49 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PolicyEngine as PolicyEngine$1 } from "../../../security/policy/engine.mjs";
+import { toIdentityPolicyData } from "../../permission/identity-policy-data.mjs";
+import { isUUID } from "@authup/kit";
+import { BuiltInPolicyType, PolicyData, definePolicyEvaluationContext } from "@authup/access";
+import { EntityNotFoundError, normalizeError } from "@authup/errors";
+//#region src/core/identity/policy/checker/service.ts
+var PolicyCheckerService = class {
+	ctx;
+	constructor(ctx) {
+		this.ctx = ctx;
+	}
+	async check(idOrName, data, actor, realm) {
+		let criteria;
+		if (isUUID(idOrName)) criteria = { id: idOrName };
+		else {
+			const realmEntity = await this.ctx.realmRepository.resolve(realm);
+			criteria = {
+				name: idOrName,
+				...realmEntity ? { realm_id: realmEntity.id } : {}
+			};
+		}
+		const entity = await this.ctx.repository.findOneBy(criteria);
+		if (!entity) throw new EntityNotFoundError();
+		const input = { ...data };
+		if (!input[BuiltInPolicyType.IDENTITY] && input[BuiltInPolicyType.IDENTITY] !== null) input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);
+		await new PolicyEngine$1(this.ctx.identityPermissionProvider).evaluate(entity, definePolicyEvaluationContext({ data: new PolicyData(input) }));
+	}
+	async safeCheck(idOrName, data, actor, realm) {
+		try {
+			await this.check(idOrName, data, actor, realm);
+			return {
+				success: true,
+				data: null
+			};
+		} catch (e) {
+			return {
+				success: false,
+				error: normalizeError(e)
+			};
+		}
+	}
+};
+//#endregion
+export { PolicyCheckerService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/identity/policy/checker/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","definePolicyEvaluationContext","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PolicyCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","realmEntity","realmRepository","resolve","name","realm_id","entity","repository","findOneBy","input","IDENTITY","identity","engine","identityPermissionProvider","evaluate","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/policy/checker/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData, definePolicyEvaluationContext } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../../permission/identity-policy-data.ts';\nimport type {\n    IPolicyCheckerService,\n    PolicyCheckerServiceContext,\n} from './types.ts';\n\nexport class PolicyCheckerService implements IPolicyCheckerService {\n    protected ctx: PolicyCheckerServiceContext;\n\n    constructor(ctx: PolicyCheckerServiceContext) {\n        this.ctx = ctx;\n    }\n\n    async check(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<void> {\n        let criteria: Record<string, any>;\n        if (isUUID(idOrName)) {\n            criteria = { id: idOrName };\n        } else {\n            const realmEntity = await this.ctx.realmRepository.resolve(realm);\n            criteria = {\n                name: idOrName,\n                ...(realmEntity ? { realm_id: realmEntity.id } : {}),\n            };\n        }\n\n        const entity = await this.ctx.repository.findOneBy(criteria);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const input = { ...data };\n        if (\n            !input[BuiltInPolicyType.IDENTITY] &&\n            input[BuiltInPolicyType.IDENTITY] !== null\n        ) {\n            input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n        }\n\n        const engine = new PolicyEngine(this.ctx.identityPermissionProvider);\n        await engine.evaluate(\n            entity,\n            definePolicyEvaluationContext({ data: new PolicyData(input) }),\n        );\n    }\n\n    async safeCheck(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Result<null>> {\n        try {\n            await this.check(idOrName, data, actor, realm);\n            return { success: true, data: null };\n        } catch (e) {\n            return { success: false, error: normalizeError(e) };\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaQ,uBAAb,MAAaA;CACCC;CAEV,YAAYA,KAAkC;EAC1C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACH,MAAMM,cAAc,MAAM,KAAKR,IAAIS,gBAAgBC,QAAQL,KAAAA;GAC3DC,WAAW;IACPK,MAAMT;IACN,GAAIM,cAAc,EAAEI,UAAUJ,YAAYD,GAAG,IAAI,CAAC;GACtD;EACJ;EAEA,MAAMM,SAAS,MAAM,KAAKb,IAAIc,WAAWC,UAAUT,QAAAA;EACnD,IAAI,CAACO,QACD,MAAM,IAAIlB,oBAAAA;EAGd,MAAMqB,QAAQ,EAAE,GAAGb,KAAK;EACxB,IACI,CAACa,MAAMzB,kBAAkB0B,aACzBD,MAAMzB,kBAAkB0B,cAAc,MAEtCD,MAAMzB,kBAAkB0B,YAAYnB,qBAAqBM,MAAMc,QAAQ;EAI3E,MAAMC,IADatB,eAAa,KAAKG,IAAIoB,0BACnCD,CAAAA,CAAOE,SACTR,QACApB,8BAA8B,EAAEU,MAAM,IAAIX,WAAWwB,KAAAA,EAAO,CAAA,CAAA;CAEpE;CAEA,MAAMM,UACFpB,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAEkB,SAAS;IAAMpB,MAAM;GAAK;EACvC,SAASqB,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAO7B,eAAe4B,CAAAA;GAAG;EACtD;CACJ;AACJ"}

package/dist/core/identity/policy/checker/types.d.ts

@@ -0,0 +1,40 @@
+import type { Result } from '@authup/kit';
+import type { ActorContext } from '@authup/server-kit';
+import type { IPolicyRepository, IRealmRepository } from '../../../entities/index.ts';
+import type { IIdentityPermissionProvider } from '../../permission/types.ts';
+export type PolicyCheckerServiceContext = {
+    repository: IPolicyRepository;
+    realmRepository: IRealmRepository;
+    identityPermissionProvider: IIdentityPermissionProvider;
+};
+export interface IPolicyCheckerService {
+    /**
+     * Resolve a policy by id (UUID) or name and evaluate it against the
+     * supplied data and actor. Throws on any failure — entity not found,
+     * evaluator denial, validator error.
+     *
+     * If `data[identity]` is unset (and not explicitly `null`), the
+     * actor's identity (flattened to `IdentityPolicyData`) is injected.
+     * Passing an explicit `null` opts out of the default — useful for
+     * checking a policy as anonymous.
+     *
+     * @param idOrName Policy UUID or name. Names are resolved within the
+     *   supplied realm (or the resolved fallback realm).
+     * @param data Caller-supplied evaluation input. Mutated copy is used
+     *   internally.
+     * @param actor The caller context. `actor.identity` becomes the
+     *   default identity input when `data[identity]` is unset.
+     * @param realm Optional realm id used to disambiguate name lookups.
+     * @throws {EntityNotFoundError} When no policy matches.
+     * @throws {Error} Whatever the policy engine throws on denial.
+     */
+    check(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<void>;
+    /**
+     * Same as `check`, but never throws — collapses any failure into a
+     * `Result<null>` with `success: false` and the originating error.
+     * Use this at boundaries that want to embed denial in a response body
+     * rather than propagate it.
+     */
+    safeCheck(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<Result<null>>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/policy/checker/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/policy/checker/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EACR,iBAAiB,EACjB,gBAAgB,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAE7E,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;IAClC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,MAAM,WAAW,qBAAqB;IAClC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CACD,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;OAKG;IACH,SAAS,CACL,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;CAC5B"}

package/dist/core/identity/policy/checker/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/identity/policy/index.d.ts

@@ -0,0 +1,2 @@
+export * from './checker/index.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC"}

package/dist/core/identity/policy/index.mjs

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PolicyCheckerService } from "./checker/service.mjs";
+import "./checker/index.mjs";
+export { PolicyCheckerService };

package/dist/core/identity/provider/account/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/provider/account/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/account/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/provider/account/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderAccountManager } from "./module.mjs";
+export { IdentityProviderAccountManager };

package/dist/core/identity/provider/account/module.d.ts

@@ -0,0 +1,21 @@
+import type { IdentityProviderAccount, User } from '@authup/core-kit';
+import { UserValidator } from '@authup/core-kit';
+import type { IUserIdentityRepository } from '../../entities/index.ts';
+import type { IIdentityProviderMapper } from '../mapper/index.ts';
+import type { IdentityProviderIdentity } from '../types.ts';
+import type { IIdentityProviderAccountManager, IIdentityProviderAccountRepository, IdentityProviderAccountManagerContext } from './types.ts';
+export declare class IdentityProviderAccountManager implements IIdentityProviderAccountManager {
+    protected attributesMapper: IIdentityProviderMapper;
+    protected permissionMapper: IIdentityProviderMapper;
+    protected roleMapper: IIdentityProviderMapper;
+    protected repository: IIdentityProviderAccountRepository;
+    protected userRepository: IUserIdentityRepository;
+    protected userValidator: UserValidator;
+    constructor(ctx: IdentityProviderAccountManagerContext);
+    save(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount>;
+    saveUser(identity: IdentityProviderIdentity, user?: User): Promise<User>;
+    validateAttributes(entity: Record<string, any>, identity: IdentityProviderIdentity, attempts: number): Promise<User | null>;
+    savePermissions(identity: IdentityProviderIdentity, user: User): Promise<void>;
+    saveRoles(identity: IdentityProviderIdentity, user: User): Promise<void>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/identity/provider/account/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/account/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACH,aAAa,EAGhB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAEvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,+BAA+B,EAAE,kCAAkC,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAE7I,qBAAa,8BAA+B,YAAW,+BAA+B;IAClF,SAAS,CAAC,gBAAgB,EAAG,uBAAuB,CAAC;IAErD,SAAS,CAAC,gBAAgB,EAAG,uBAAuB,CAAC;IAErD,SAAS,CAAC,UAAU,EAAG,uBAAuB,CAAC;IAE/C,SAAS,CAAC,UAAU,EAAG,kCAAkC,CAAC;IAE1D,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;IAElD,SAAS,CAAC,aAAa,EAAG,aAAa,CAAC;gBAE5B,GAAG,EAAE,qCAAqC;IAUhD,IAAI,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAmC1E,QAAQ,CACV,QAAQ,EAAE,wBAAwB,EAClC,IAAI,CAAC,EAAE,IAAI,GACZ,OAAO,CAAC,IAAI,CAAC;IA0FV,kBAAkB,CACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,QAAQ,EAAE,wBAAwB,EAClC,QAAQ,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA+ElB,eAAe,CACjB,QAAQ,EAAE,wBAAwB,EAClC,IAAI,EAAE,IAAI;IAOR,SAAS,CACX,QAAQ,EAAE,wBAAwB,EAClC,IAAI,EAAE,IAAI;CAMjB"}

package/dist/core/identity/provider/account/module.mjs

@@ -0,0 +1,145 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderIdentityOperation } from "../constants.mjs";
+import { IdentityProviderMapperOperation } from "../mapper/constants.mjs";
+import "../mapper/index.mjs";
+import { ValidatorGroup, createNanoID, extendObject } from "@authup/kit";
+import { UserValidator, buildUserFakeEmail, isUserFakeEmail } from "@authup/core-kit";
+import { isValidupError, stringifyPath } from "validup";
+//#region src/core/identity/provider/account/module.ts
+var IdentityProviderAccountManager = class {
+	attributesMapper;
+	permissionMapper;
+	roleMapper;
+	repository;
+	userRepository;
+	userValidator;
+	constructor(ctx) {
+		this.attributesMapper = ctx.attributeMapper;
+		this.permissionMapper = ctx.permissionMapper;
+		this.roleMapper = ctx.roleMapper;
+		this.repository = ctx.repository;
+		this.userRepository = ctx.userRepository;
+		this.userValidator = new UserValidator();
+	}
+	async save(identity) {
+		let account = await this.repository.findOneByProviderIdentity(identity);
+		if (account) {
+			identity.operation = IdentityProviderIdentityOperation.UPDATE;
+			account.user = await this.saveUser(identity, account.user);
+			await this.repository.save(account);
+			await this.saveRoles(identity, account.user);
+			await this.savePermissions(identity, account.user);
+			return account;
+		}
+		identity.operation = IdentityProviderIdentityOperation.CREATE;
+		const user = await this.saveUser(identity);
+		account = await this.repository.save({
+			provider_id: identity.provider.id,
+			provider_user_id: identity.id,
+			provider_user_name: user.name,
+			provider_realm_id: identity.provider.realm_id,
+			user,
+			user_id: user.id,
+			user_realm_id: user.realm_id
+		});
+		await this.saveRoles(identity, account.user);
+		await this.savePermissions(identity, account.user);
+		return account;
+	}
+	async saveUser(identity, user) {
+		const attributes = await this.attributesMapper.execute(identity);
+		const entity = {};
+		for (const attribute of attributes) if (attribute.key && attribute.operation === IdentityProviderMapperOperation.CREATE) entity[attribute.key] = attribute.value;
+		if (!user) {
+			entity.realm_id = identity.provider.realm_id;
+			entity.active = true;
+			entity.name_locked = true;
+			entity.client_id = identity.clientId || null;
+		}
+		const attributesSelf = await this.validateAttributes(entity, identity, 10);
+		if (!attributesSelf) throw new Error("Identity provider attributes could not be validated.");
+		const attributesSelfKeys = Object.keys(attributesSelf);
+		const attributesExtra = {};
+		const entityKeys = Object.keys(entity);
+		for (const entityKey of entityKeys) {
+			if (attributesSelfKeys.indexOf(entityKey) !== -1) continue;
+			attributesExtra[entityKey] = entity[entityKey];
+		}
+		let output;
+		if (user) output = extendObject(user, attributesSelf);
+		else output = attributesSelf;
+		if (typeof output.name === "string") output.name = output.name.trim().toLowerCase();
+		let attempts = Math.max((identity.attributeCandidates?.name?.length || 0) + 1, 10);
+		while (attempts > 0) try {
+			return await this.userRepository.saveOneWithEA(output, attributesExtra);
+		} catch {
+			const names = identity.attributeCandidates?.name || [];
+			if (names.length > 0) while (names.length > 0) {
+				output.name = `${names.shift()}`.trim().toLowerCase();
+				try {
+					await this.userValidator.run(output, { group: identity.operation === IdentityProviderIdentityOperation.CREATE ? ValidatorGroup.CREATE : ValidatorGroup.UPDATE });
+					break;
+				} catch {}
+			}
+			else output.name = createNanoID("0123456789abcdefghijklmnopqrstuvwxyz-_", 10);
+			if (isUserFakeEmail(output.email)) output.email = buildUserFakeEmail(output.name);
+			attempts -= 1;
+		}
+		throw new Error("The user account could not be created due a conflict error.");
+	}
+	async validateAttributes(entity, identity, attempts) {
+		attempts--;
+		if (attempts <= 0) return null;
+		try {
+			return await this.userValidator.run(entity, { group: identity.operation === IdentityProviderIdentityOperation.CREATE ? ValidatorGroup.CREATE : ValidatorGroup.UPDATE });
+		} catch (e) {
+			if (!isValidupError(e)) return null;
+			let retry = false;
+			for (let i = 0; i < e.issues.length; i++) {
+				const child = e.issues[i];
+				const pathNormalized = stringifyPath(child.path);
+				if (Array.isArray(entity[pathNormalized]) && entity[pathNormalized].length > 0) {
+					const [first, ...rest] = entity[pathNormalized];
+					entity[pathNormalized] = first;
+					if (rest.length > 0) {
+						if (!identity.attributeCandidates) identity.attributeCandidates = {};
+						if (!identity.attributeCandidates[pathNormalized]) identity.attributeCandidates[pathNormalized] = [];
+						identity.attributeCandidates[pathNormalized].push(...rest);
+					}
+					retry = true;
+					break;
+				}
+				if (identity.attributeCandidates && identity.attributeCandidates[pathNormalized] && identity.attributeCandidates[pathNormalized].length > 0) {
+					entity[pathNormalized] = identity.attributeCandidates[pathNormalized].shift();
+					retry = true;
+					break;
+				}
+				if (entity.name && pathNormalized === "email") {
+					entity[pathNormalized] = buildUserFakeEmail(entity.name);
+					retry = true;
+					break;
+				}
+				if (entity[pathNormalized]) {
+					entity[pathNormalized] = null;
+					break;
+				}
+			}
+			if (retry) return this.validateAttributes(entity, identity, attempts);
+			return null;
+		}
+	}
+	async savePermissions(identity, user) {
+		const entities = await this.permissionMapper.execute(identity);
+		await this.userRepository.savePermissions(user, entities);
+	}
+	async saveRoles(identity, user) {
+		const entities = await this.roleMapper.execute(identity);
+		await this.userRepository.saveRoles(user, entities);
+	}
+};
+//#endregion
+export { IdentityProviderAccountManager };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/provider/account/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["UserValidator","buildUserFakeEmail","isUserFakeEmail","ValidatorGroup","createNanoID","extendObject","isValidupError","stringifyPath","IdentityProviderIdentityOperation","IdentityProviderMapperOperation","IdentityProviderAccountManager","attributesMapper","permissionMapper","roleMapper","repository","userRepository","userValidator","ctx","attributeMapper","save","identity","account","findOneByProviderIdentity","operation","UPDATE","user","saveUser","saveRoles","savePermissions","CREATE","provider_id","provider","id","provider_user_id","provider_user_name","name","provider_realm_id","realm_id","user_id","user_realm_id","attributes","execute","entity","attribute","key","value","active","name_locked","client_id","clientId","attributesSelf","validateAttributes","Error","attributesSelfKeys","Object","keys","attributesExtra","entityKeys","entityKey","index","indexOf","output","trim","toLowerCase","attempts","Math","max","attributeCandidates","length","saveOneWithEA","names","shift","run","group","email","e","retry","i","issues","child","pathNormalized","path","Array","isArray","first","rest","push","entities"],"sources":["../../../../../src/core/identity/provider/account/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderAccount, User } from '@authup/core-kit';\nimport {\n    UserValidator,\n    buildUserFakeEmail,\n    isUserFakeEmail,\n} from '@authup/core-kit';\nimport { ValidatorGroup, createNanoID, extendObject } from '@authup/kit';\nimport { isValidupError, stringifyPath } from 'validup';\nimport type { IUserIdentityRepository } from '../../entities/index.ts';\nimport { IdentityProviderIdentityOperation } from '../constants.ts';\nimport type { IIdentityProviderMapper } from '../mapper/index.ts';\nimport { IdentityProviderMapperOperation } from '../mapper/index.ts';\nimport type { IdentityProviderIdentity } from '../types.ts';\nimport type { IIdentityProviderAccountManager, IIdentityProviderAccountRepository, IdentityProviderAccountManagerContext } from './types.ts';\n\nexport class IdentityProviderAccountManager implements IIdentityProviderAccountManager {\n    protected attributesMapper : IIdentityProviderMapper;\n\n    protected permissionMapper : IIdentityProviderMapper;\n\n    protected roleMapper : IIdentityProviderMapper;\n\n    protected repository : IIdentityProviderAccountRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected userValidator : UserValidator;\n\n    constructor(ctx: IdentityProviderAccountManagerContext) {\n        this.attributesMapper = ctx.attributeMapper;\n        this.permissionMapper = ctx.permissionMapper;\n        this.roleMapper = ctx.roleMapper;\n        this.repository = ctx.repository;\n        this.userRepository = ctx.userRepository;\n\n        this.userValidator = new UserValidator();\n    }\n\n    async save(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount> {\n        let account = await this.repository.findOneByProviderIdentity(identity);\n        if (account) {\n            identity.operation = IdentityProviderIdentityOperation.UPDATE;\n\n            account.user = await this.saveUser(identity, account.user);\n\n            await this.repository.save(account);\n\n            await this.saveRoles(identity, account.user);\n            await this.savePermissions(identity, account.user);\n\n            return account;\n        }\n\n        identity.operation = IdentityProviderIdentityOperation.CREATE;\n\n        const user = await this.saveUser(identity);\n\n        account = await this.repository.save({\n            provider_id: identity.provider.id,\n            provider_user_id: identity.id,\n            provider_user_name: user.name, // todo: parse identity.name\n            provider_realm_id: identity.provider.realm_id,\n            user,\n            user_id: user.id,\n            user_realm_id: user.realm_id,\n        });\n\n        await this.saveRoles(identity, account.user);\n        await this.savePermissions(identity, account.user);\n\n        return account;\n    }\n\n    async saveUser(\n        identity: IdentityProviderIdentity,\n        user?: User,\n    ): Promise<User> {\n        const attributes = await this.attributesMapper.execute(\n            identity,\n        );\n\n        const entity : Record<string, any> = {};\n        for (const attribute of attributes) {\n            if (\n                attribute.key &&\n                attribute.operation === IdentityProviderMapperOperation.CREATE\n            ) {\n                // attribute value might be object, array, ...\n                entity[attribute.key] = attribute.value;\n            }\n        }\n\n        if (!user) {\n            entity.realm_id = identity.provider.realm_id;\n            entity.active = true;\n            entity.name_locked = true;\n            entity.client_id = identity.clientId || null;\n        }\n\n        const attributesSelf = await this.validateAttributes(entity, identity, 10);\n        if (!attributesSelf) {\n            // todo: better error name\n            throw new Error('Identity provider attributes could not be validated.');\n        }\n        const attributesSelfKeys = Object.keys(attributesSelf);\n\n        const attributesExtra : Record<string, any> = {};\n\n        const entityKeys = Object.keys(entity);\n        for (const entityKey of entityKeys) {\n            const index = attributesSelfKeys.indexOf(entityKey);\n            if (index !== -1) {\n                continue;\n            }\n\n            attributesExtra[entityKey] = entity[entityKey];\n        }\n\n        let output : User;\n        if (user) {\n            output = extendObject(user, attributesSelf);\n        } else {\n            output = attributesSelf;\n        }\n\n        if (typeof output.name === 'string') {\n            output.name = output.name.trim().toLowerCase();\n        }\n\n        let attempts = Math.max((identity.attributeCandidates?.name?.length || 0) + 1, 10);\n        while (attempts > 0) {\n            try {\n                // todo: we also need to remove existing ones via idp login flow ( but not other attributes!)\n                return await this.userRepository.saveOneWithEA(output, attributesExtra);\n            } catch {\n                const names = identity.attributeCandidates?.name || [];\n                if (names.length > 0) {\n                    while (names.length > 0) {\n                        output.name = `${names.shift()}`.trim().toLowerCase();\n\n                        try {\n                            await this.userValidator.run(output, {\n                                group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n                                    ValidatorGroup.CREATE :\n                                    ValidatorGroup.UPDATE,\n                            });\n                            break;\n                        } catch {\n                            // todo: do nothing.\n                        }\n                    }\n                } else {\n                    output.name = createNanoID('0123456789abcdefghijklmnopqrstuvwxyz-_', 10);\n                }\n\n                if (isUserFakeEmail(output.email)) {\n                    output.email = buildUserFakeEmail(output.name);\n                }\n\n                attempts -= 1;\n            }\n        }\n\n        throw new Error('The user account could not be created due a conflict error.');\n    }\n\n    async validateAttributes(\n        entity: Record<string, any>,\n        identity: IdentityProviderIdentity,\n        attempts: number,\n    ) : Promise<User | null> {\n        attempts--;\n        if (attempts <= 0) {\n            return null;\n        }\n\n        try {\n            return await this.userValidator.run(entity, {\n                group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n                    ValidatorGroup.CREATE :\n                    ValidatorGroup.UPDATE,\n            });\n        } catch (e: any) {\n            if (!isValidupError(e)) {\n                return null;\n            }\n\n            let retry = false;\n            for (let i = 0; i < e.issues.length; i++) {\n                const child = e.issues[i];\n\n                const pathNormalized = stringifyPath(child.path);\n\n                if (\n                    Array.isArray(entity[pathNormalized]) &&\n                    entity[pathNormalized].length > 0\n                ) {\n                    const [first, ...rest] = entity[pathNormalized];\n                    entity[pathNormalized] = first;\n\n                    if (rest.length > 0) {\n                        if (!identity.attributeCandidates) {\n                            identity.attributeCandidates = {};\n                        }\n\n                        if (!identity.attributeCandidates[pathNormalized]) {\n                            identity.attributeCandidates[pathNormalized] = [];\n                        }\n\n                        identity.attributeCandidates[pathNormalized]!.push(...rest);\n                    }\n\n                    retry = true;\n                    break;\n                }\n\n                if (\n                    identity.attributeCandidates &&\n                    identity.attributeCandidates[pathNormalized] &&\n                    identity.attributeCandidates[pathNormalized]!.length > 0\n                ) {\n                    entity[pathNormalized] = identity.attributeCandidates[pathNormalized]!.shift();\n                    retry = true;\n                    break;\n                }\n\n                if (\n                    entity.name &&\n                    pathNormalized === 'email'\n                ) {\n                    entity[pathNormalized] = buildUserFakeEmail(entity.name);\n                    retry = true;\n                    break;\n                }\n\n                if (entity[pathNormalized]) {\n                    entity[pathNormalized] = null;\n                    break;\n                }\n            }\n\n            if (retry) {\n                return this.validateAttributes(entity, identity, attempts);\n            }\n\n            return null;\n        }\n    }\n\n    async savePermissions(\n        identity: IdentityProviderIdentity,\n        user: User,\n    ) {\n        const entities = await this.permissionMapper.execute(identity);\n\n        await this.userRepository.savePermissions(user, entities);\n    }\n\n    async saveRoles(\n        identity: IdentityProviderIdentity,\n        user: User,\n    ) {\n        const entities = await this.roleMapper.execute(identity);\n\n        await this.userRepository.saveRoles(user, entities);\n    }\n}\n"],"mappings":";;;;;;;;;;AAsBA,IAAaU,iCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,KAAKN,mBAAmBM,IAAIC;EAC5B,KAAKN,mBAAmBK,IAAIL;EAC5B,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,iBAAiBE,IAAIF;EAE1B,KAAKC,gBAAgB,IAAIhB,cAAAA;CAC7B;CAEA,MAAMmB,KAAKC,UAAsE;EAC7E,IAAIC,UAAU,MAAM,KAAKP,WAAWQ,0BAA0BF,QAAAA;EAC9D,IAAIC,SAAS;GACTD,SAASG,YAAYf,kCAAkCgB;GAEvDH,QAAQI,OAAO,MAAM,KAAKC,SAASN,UAAUC,QAAQI,IAAI;GAEzD,MAAM,KAAKX,WAAWK,KAAKE,OAAAA;GAE3B,MAAM,KAAKM,UAAUP,UAAUC,QAAQI,IAAI;GAC3C,MAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,IAAI;GAEjD,OAAOJ;EACX;EAEAD,SAASG,YAAYf,kCAAkCqB;EAEvD,MAAMJ,OAAO,MAAM,KAAKC,SAASN,QAAAA;EAEjCC,UAAU,MAAM,KAAKP,WAAWK,KAAK;GACjCW,aAAaV,SAASW,SAASC;GAC/BC,kBAAkBb,SAASY;GAC3BE,oBAAoBT,KAAKU;GACzBC,mBAAmBhB,SAASW,SAASM;GACrCZ;GACAa,SAASb,KAAKO;GACdO,eAAed,KAAKY;EACxB,CAAA;EAEA,MAAM,KAAKV,UAAUP,UAAUC,QAAQI,IAAI;EAC3C,MAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,IAAI;EAEjD,OAAOJ;CACX;CAEA,MAAMK,SACFN,UACAK,MACa;EACb,MAAMe,aAAa,MAAM,KAAK7B,iBAAiB8B,QAC3CrB,QAAAA;EAGJ,MAAMsB,SAA+B,CAAC;EACtC,KAAK,MAAMC,aAAaH,YACpB,IACIG,UAAUC,OACVD,UAAUpB,cAAcd,gCAAgCoB,QAGxDa,OAAOC,UAAUC,OAAOD,UAAUE;EAI1C,IAAI,CAACpB,MAAM;GACPiB,OAAOL,WAAWjB,SAASW,SAASM;GACpCK,OAAOI,SAAS;GAChBJ,OAAOK,cAAc;GACrBL,OAAOM,YAAY5B,SAAS6B,YAAY;EAC5C;EAEA,MAAMC,iBAAiB,MAAM,KAAKC,mBAAmBT,QAAQtB,UAAU,EAAA;EACvE,IAAI,CAAC8B,gBAED,MAAM,IAAIE,MAAM,sDAAA;EAEpB,MAAMC,qBAAqBC,OAAOC,KAAKL,cAAAA;EAEvC,MAAMM,kBAAwC,CAAC;EAE/C,MAAMC,aAAaH,OAAOC,KAAKb,MAAAA;EAC/B,KAAK,MAAMgB,aAAaD,YAAY;GAEhC,IADcJ,mBAAmBO,QAAQF,SACrCC,MAAU,IACV;GAGJH,gBAAgBE,aAAahB,OAAOgB;EACxC;EAEA,IAAIG;EACJ,IAAIpC,MACAoC,SAASxD,aAAaoB,MAAMyB,cAAAA;OAE5BW,SAASX;EAGb,IAAI,OAAOW,OAAO1B,SAAS,UACvB0B,OAAO1B,OAAO0B,OAAO1B,KAAK2B,KAAI,CAAA,CAAGC,YAAW;EAGhD,IAAIC,WAAWC,KAAKC,KAAK9C,SAAS+C,qBAAqBhC,MAAMiC,UAAU,KAAK,GAAG,EAAA;EAC/E,OAAOJ,WAAW,GACd,IAAI;GAEA,OAAO,MAAM,KAAKjD,eAAesD,cAAcR,QAAQL,eAAAA;EAC3D,QAAQ;GACJ,MAAMc,QAAQlD,SAAS+C,qBAAqBhC,QAAQ,CAAA;GACpD,IAAImC,MAAMF,SAAS,GACf,OAAOE,MAAMF,SAAS,GAAG;IACrBP,OAAO1B,OAAO,GAAGmC,MAAMC,MAAK,IAAKT,KAAI,CAAA,CAAGC,YAAW;IAEnD,IAAI;KACA,MAAM,KAAK/C,cAAcwD,IAAIX,QAAQ,EACjCY,OAAOrD,SAASG,cAAcf,kCAAkCqB,SAC5D1B,eAAe0B,SACf1B,eAAeqB,OACvB,CAAA;KACA;IACJ,QAAQ,CAER;GACJ;QAEAqC,OAAO1B,OAAO/B,aAAa,0CAA0C,EAAA;GAGzE,IAAIF,gBAAgB2D,OAAOa,KAAK,GAC5Bb,OAAOa,QAAQzE,mBAAmB4D,OAAO1B,IAAI;GAGjD6B,YAAY;EAChB;EAGJ,MAAM,IAAIZ,MAAM,6DAAA;CACpB;CAEA,MAAMD,mBACFT,QACAtB,UACA4C,UACqB;EACrBA;EACA,IAAIA,YAAY,GACZ,OAAO;EAGX,IAAI;GACA,OAAO,MAAM,KAAKhD,cAAcwD,IAAI9B,QAAQ,EACxC+B,OAAOrD,SAASG,cAAcf,kCAAkCqB,SAC5D1B,eAAe0B,SACf1B,eAAeqB,OACvB,CAAA;EACJ,SAASmD,GAAQ;GACb,IAAI,CAACrE,eAAeqE,CAAAA,GAChB,OAAO;GAGX,IAAIC,QAAQ;GACZ,KAAK,IAAIC,IAAI,GAAGA,IAAIF,EAAEG,OAAOV,QAAQS,KAAK;IACtC,MAAME,QAAQJ,EAAEG,OAAOD;IAEvB,MAAMG,iBAAiBzE,cAAcwE,MAAME,IAAI;IAE/C,IACIC,MAAMC,QAAQzC,OAAOsC,eAAe,KACpCtC,OAAOsC,eAAe,CAACZ,SAAS,GAClC;KACE,MAAM,CAACgB,OAAO,GAAGC,QAAQ3C,OAAOsC;KAChCtC,OAAOsC,kBAAkBI;KAEzB,IAAIC,KAAKjB,SAAS,GAAG;MACjB,IAAI,CAAChD,SAAS+C,qBACV/C,SAAS+C,sBAAsB,CAAC;MAGpC,IAAI,CAAC/C,SAAS+C,oBAAoBa,iBAC9B5D,SAAS+C,oBAAoBa,kBAAkB,CAAA;MAGnD5D,SAAS+C,oBAAoBa,eAAe,CAAEM,KAAI,GAAID,IAAAA;KAC1D;KAEAT,QAAQ;KACR;IACJ;IAEA,IACIxD,SAAS+C,uBACT/C,SAAS+C,oBAAoBa,mBAC7B5D,SAAS+C,oBAAoBa,eAAe,CAAEZ,SAAS,GACzD;KACE1B,OAAOsC,kBAAkB5D,SAAS+C,oBAAoBa,eAAe,CAAET,MAAK;KAC5EK,QAAQ;KACR;IACJ;IAEA,IACIlC,OAAOP,QACP6C,mBAAmB,SACrB;KACEtC,OAAOsC,kBAAkB/E,mBAAmByC,OAAOP,IAAI;KACvDyC,QAAQ;KACR;IACJ;IAEA,IAAIlC,OAAOsC,iBAAiB;KACxBtC,OAAOsC,kBAAkB;KACzB;IACJ;GACJ;GAEA,IAAIJ,OACA,OAAO,KAAKzB,mBAAmBT,QAAQtB,UAAU4C,QAAAA;GAGrD,OAAO;EACX;CACJ;CAEA,MAAMpC,gBACFR,UACAK,MACF;EACE,MAAM8D,WAAW,MAAM,KAAK3E,iBAAiB6B,QAAQrB,QAAAA;EAErD,MAAM,KAAKL,eAAea,gBAAgBH,MAAM8D,QAAAA;CACpD;CAEA,MAAM5D,UACFP,UACAK,MACF;EACE,MAAM8D,WAAW,MAAM,KAAK1E,WAAW4B,QAAQrB,QAAAA;EAE/C,MAAM,KAAKL,eAAeY,UAAUF,MAAM8D,QAAAA;CAC9C;AACJ"}

package/dist/core/identity/provider/account/types.d.ts

@@ -0,0 +1,30 @@
+import type { IdentityProviderAccount } from '@authup/core-kit';
+import type { DeepPartial } from 'typeorm';
+import type { IUserIdentityRepository } from '../../entities/index.ts';
+import type { IIdentityProviderMapper } from '../mapper/index.ts';
+import type { IdentityProviderIdentity } from '../types.ts';
+export interface IIdentityProviderAccountRepository {
+    /**
+     * Find identity account with user relation.
+     *
+     * @param identity
+     */
+    findOneByProviderIdentity(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount | null>;
+    save(entity: DeepPartial<IdentityProviderAccount>): Promise<IdentityProviderAccount>;
+}
+export type IdentityProviderAccountManagerContext = {
+    attributeMapper: IIdentityProviderMapper;
+    permissionMapper: IIdentityProviderMapper;
+    roleMapper: IIdentityProviderMapper;
+    repository: IIdentityProviderAccountRepository;
+    userRepository: IUserIdentityRepository;
+};
+export interface IIdentityProviderAccountManager {
+    /**
+     * Create or update identity provider account by provider identity.
+     *
+     * @param identity
+     */
+    save(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/provider/account/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/account/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,MAAM,WAAW,kCAAkC;IAC/C;;;;OAIG;IACH,yBAAyB,CAAC,QAAQ,EAAE,wBAAwB,GAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAExG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,uBAAuB,CAAC,GAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACzF;AAED,MAAM,MAAM,qCAAqC,GAAG;IAChD,eAAe,EAAE,uBAAuB,CAAC;IACzC,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,UAAU,EAAE,uBAAuB,CAAC;IAEpC,UAAU,EAAE,kCAAkC,CAAC;IAC/C,cAAc,EAAE,uBAAuB,CAAA;CAC1C,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC5C;;;;OAIG;IACH,IAAI,CAAC,QAAQ,EAAE,wBAAwB,GAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/E"}

package/dist/core/identity/provider/account/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/identity/provider/authentication/constants.d.ts

@@ -0,0 +1,4 @@
+import { TypedToken } from 'eldin';
+import type { IdentityProviderLdapCollectionAuthenticator } from './protocols/ldap/index.ts';
+export declare const IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN: TypedToken<IdentityProviderLdapCollectionAuthenticator>;
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/identity/provider/authentication/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/authentication/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,2BAA2B,CAAC;AAE7F,eAAO,MAAM,qDAAqD,yDAA6G,CAAC"}

package/dist/core/identity/provider/authentication/constants.mjs

@@ -0,0 +1,10 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { TypedToken } from "eldin";
+//#region src/core/identity/provider/authentication/constants.ts
+const IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN = new TypedToken("IdentityProviderLdapCollectionAuthenticator");
+//#endregion
+export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/identity/provider/authentication/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["TypedToken","IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN"],"sources":["../../../../../src/core/identity/provider/authentication/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { IdentityProviderLdapCollectionAuthenticator } from './protocols/ldap/index.ts';\n\nexport const IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN = new TypedToken<IdentityProviderLdapCollectionAuthenticator>('IdentityProviderLdapCollectionAuthenticator');\n"],"mappings":";;;;;AAUA,MAAaC,wDAAwD,IAAID,WAAwD,6CAAA"}

package/dist/core/identity/provider/authentication/factory.d.ts

@@ -0,0 +1,4 @@
+import type { User } from '@authup/core-kit';
+import type { IOAuth2Authenticator, IdentityProviderOAuth2AuthenticatorContext } from './protocols/index.ts';
+export declare function createIdentityProviderOAuth2Authenticator(ctx: IdentityProviderOAuth2AuthenticatorContext): IOAuth2Authenticator<User>;
+//# sourceMappingURL=factory.d.ts.map

package/dist/core/identity/provider/authentication/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/authentication/factory.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,0CAA0C,EAAE,MAAM,sBAAsB,CAAC;AAU7G,wBAAgB,yCAAyC,CAAC,GAAG,EAAE,0CAA0C,GAAI,oBAAoB,CAAC,IAAI,CAAC,CA0BtI"}

package/dist/core/identity/provider/authentication/factory.mjs

@@ -0,0 +1,27 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderOAuth2Authenticator } from "./protocols/oauth2/module.mjs";
+import { IdentityProviderOpenIDAuthenticator } from "./protocols/open-id/module.mjs";
+import "./protocols/index.mjs";
+import { IdentityProviderFacebookAuthenticator } from "./presets/facebook.mjs";
+import { IdentityProviderGithubAuthenticator } from "./presets/github.mjs";
+import { IdentityProviderGoogleAuthenticator } from "./presets/google.mjs";
+import { IdentityProviderInstagramAuthenticator } from "./presets/instagram.mjs";
+import { IdentityProviderPaypalAuthenticator } from "./presets/paypal.mjs";
+import "./presets/index.mjs";
+import { IdentityProviderPreset, IdentityProviderProtocol } from "@authup/core-kit";
+//#region src/core/identity/provider/authentication/factory.ts
+function createIdentityProviderOAuth2Authenticator(ctx) {
+	if (ctx.provider.preset === IdentityProviderPreset.FACEBOOK) return new IdentityProviderFacebookAuthenticator(ctx);
+	if (ctx.provider.preset === IdentityProviderPreset.GITHUB) return new IdentityProviderGithubAuthenticator(ctx);
+	if (ctx.provider.preset === IdentityProviderPreset.GOOGLE) return new IdentityProviderGoogleAuthenticator(ctx);
+	if (ctx.provider.preset === IdentityProviderPreset.INSTAGRAM) return new IdentityProviderInstagramAuthenticator(ctx);
+	if (ctx.provider.preset === IdentityProviderPreset.PAYPAL) return new IdentityProviderPaypalAuthenticator(ctx);
+	if (ctx.provider.protocol === IdentityProviderProtocol.OIDC) return new IdentityProviderOpenIDAuthenticator(ctx);
+	return new IdentityProviderOAuth2Authenticator(ctx);
+}
+//#endregion
+export { createIdentityProviderOAuth2Authenticator };
+
+//# sourceMappingURL=factory.mjs.map

package/dist/core/identity/provider/authentication/factory.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.mjs","names":["IdentityProviderPreset","IdentityProviderProtocol","IdentityProviderOAuth2Authenticator","IdentityProviderOpenIDAuthenticator","IdentityProviderFacebookAuthenticator","IdentityProviderGithubAuthenticator","IdentityProviderGoogleAuthenticator","IdentityProviderInstagramAuthenticator","IdentityProviderPaypalAuthenticator","createIdentityProviderOAuth2Authenticator","ctx","provider","preset","FACEBOOK","GITHUB","GOOGLE","INSTAGRAM","PAYPAL","protocol","OIDC"],"sources":["../../../../../src/core/identity/provider/authentication/factory.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { IdentityProviderPreset, IdentityProviderProtocol } from '@authup/core-kit';\nimport type { IOAuth2Authenticator, IdentityProviderOAuth2AuthenticatorContext } from './protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator } from './protocols/index.ts';\nimport {\n    IdentityProviderFacebookAuthenticator,\n    IdentityProviderGithubAuthenticator,\n    IdentityProviderGoogleAuthenticator,\n    IdentityProviderInstagramAuthenticator,\n    IdentityProviderPaypalAuthenticator,\n} from './presets/index.ts';\n\nexport function createIdentityProviderOAuth2Authenticator(ctx: IdentityProviderOAuth2AuthenticatorContext) : IOAuth2Authenticator<User> {\n    if (ctx.provider.preset === IdentityProviderPreset.FACEBOOK) {\n        return new IdentityProviderFacebookAuthenticator(ctx);\n    }\n\n    if (ctx.provider.preset === IdentityProviderPreset.GITHUB) {\n        return new IdentityProviderGithubAuthenticator(ctx);\n    }\n\n    if (ctx.provider.preset === IdentityProviderPreset.GOOGLE) {\n        return new IdentityProviderGoogleAuthenticator(ctx);\n    }\n\n    if (ctx.provider.preset === IdentityProviderPreset.INSTAGRAM) {\n        return new IdentityProviderInstagramAuthenticator(ctx);\n    }\n\n    if (ctx.provider.preset === IdentityProviderPreset.PAYPAL) {\n        return new IdentityProviderPaypalAuthenticator(ctx);\n    }\n\n    if (ctx.provider.protocol === IdentityProviderProtocol.OIDC) {\n        return new IdentityProviderOpenIDAuthenticator(ctx);\n    }\n\n    return new IdentityProviderOAuth2Authenticator(ctx);\n}\n"],"mappings":";;;;;;;;;;;;;;AAmBA,SAAgBS,0CAA0CC,KAA+C;CACrG,IAAIA,IAAIC,SAASC,WAAWZ,uBAAuBa,UAC/C,OAAO,IAAIT,sCAAsCM,GAAAA;CAGrD,IAAIA,IAAIC,SAASC,WAAWZ,uBAAuBc,QAC/C,OAAO,IAAIT,oCAAoCK,GAAAA;CAGnD,IAAIA,IAAIC,SAASC,WAAWZ,uBAAuBe,QAC/C,OAAO,IAAIT,oCAAoCI,GAAAA;CAGnD,IAAIA,IAAIC,SAASC,WAAWZ,uBAAuBgB,WAC/C,OAAO,IAAIT,uCAAuCG,GAAAA;CAGtD,IAAIA,IAAIC,SAASC,WAAWZ,uBAAuBiB,QAC/C,OAAO,IAAIT,oCAAoCE,GAAAA;CAGnD,IAAIA,IAAIC,SAASO,aAAajB,yBAAyBkB,MACnD,OAAO,IAAIhB,oCAAoCO,GAAAA;CAGnD,OAAO,IAAIR,oCAAoCQ,GAAAA;AACnD"}

package/dist/core/identity/provider/authentication/index.d.ts

@@ -0,0 +1,5 @@
+export * from './protocols/index.ts';
+export * from './presets/index.ts';
+export * from './constants.ts';
+export * from './factory.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/provider/authentication/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/authentication/index.ts"],"names":[],"mappings":"AAOA,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC"}

package/dist/core/identity/provider/authentication/index.mjs

@@ -0,0 +1,17 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderLdapAuthenticator } from "./protocols/ldap/module.mjs";
+import { IdentityProviderLdapCollectionAuthenticator } from "./protocols/ldap/collection.mjs";
+import { IdentityProviderOAuth2Authenticator } from "./protocols/oauth2/module.mjs";
+import { IdentityProviderOpenIDAuthenticator } from "./protocols/open-id/module.mjs";
+import "./protocols/index.mjs";
+import { IdentityProviderFacebookAuthenticator } from "./presets/facebook.mjs";
+import { IdentityProviderGithubAuthenticator } from "./presets/github.mjs";
+import { IdentityProviderGoogleAuthenticator } from "./presets/google.mjs";
+import { IdentityProviderInstagramAuthenticator } from "./presets/instagram.mjs";
+import { IdentityProviderPaypalAuthenticator } from "./presets/paypal.mjs";
+import "./presets/index.mjs";
+import { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN } from "./constants.mjs";
+import { createIdentityProviderOAuth2Authenticator } from "./factory.mjs";
+export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, createIdentityProviderOAuth2Authenticator };

package/dist/core/identity/provider/authentication/presets/facebook.d.ts

@@ -0,0 +1,9 @@
+import type { TokenGrantResponse } from '@hapic/oauth2';
+import type { IdentityProviderIdentity } from '../../types.ts';
+import type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';
+import { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';
+export declare class IdentityProviderFacebookAuthenticator extends IdentityProviderOAuth2Authenticator {
+    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext);
+    protected buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity>;
+}
+//# sourceMappingURL=facebook.d.ts.map

package/dist/core/identity/provider/authentication/presets/facebook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facebook.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/authentication/presets/facebook.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE5E,qBAAa,qCAAsC,SAAQ,mCAAmC;gBAC9E,GAAG,EAAE,0CAA0C;cAS3C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CA6BpH"}

package/dist/core/identity/provider/authentication/presets/facebook.mjs

@@ -0,0 +1,38 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
+import "../protocols/index.mjs";
+import { extractTokenPayload } from "@authup/server-kit";
+//#region src/core/identity/provider/authentication/presets/facebook.ts
+var IdentityProviderFacebookAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	constructor(ctx) {
+		ctx.provider.scope = "email";
+		ctx.provider.authorize_url = "https://graph.facebook.com/oauth/authorize";
+		ctx.provider.token_url = "https://graph.facebook.com/oauth/access_token";
+		ctx.provider.user_info_url = "https://graph.facebook.com/me?fields=id,name,email,first_name,last_name";
+		super(ctx);
+	}
+	async buildIdentityWithTokenGrantResponse(input) {
+		const userInfo = await this.client.userInfo.get({
+			type: "Bearer",
+			token: input.access_token
+		});
+		const payload = extractTokenPayload(input.access_token);
+		return {
+			id: userInfo.id,
+			attributeCandidates: {
+				name: [userInfo.username, userInfo.id],
+				email: [userInfo.email],
+				first_name: [userInfo.first_name],
+				last_name: [userInfo.last_name]
+			},
+			data: payload,
+			provider: this.provider
+		};
+	}
+};
+//#endregion
+export { IdentityProviderFacebookAuthenticator };
+
+//# sourceMappingURL=facebook.mjs.map

package/dist/core/identity/provider/authentication/presets/facebook.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"facebook.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderFacebookAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","username","email","first_name","last_name","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/facebook.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderFacebookAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'email';\n        ctx.provider.authorize_url = 'https://graph.facebook.com/oauth/authorize';\n        ctx.provider.token_url = 'https://graph.facebook.com/oauth/access_token';\n        ctx.provider.user_info_url = 'https://graph.facebook.com/me?fields=id,name,email,first_name,last_name';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.id,\n            attributeCandidates: {\n                name: [\n                    userInfo.username,\n                    userInfo.id,\n                ],\n                email: [\n                    userInfo.email,\n                ],\n                first_name: [\n                    userInfo.first_name,\n                ],\n                last_name: [\n                    userInfo.last_name,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;AAaA,IAAaE,wCAAb,cAA2DD,oCAAAA;CACvD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQ;EACrBF,IAAIC,SAASE,gBAAgB;EAC7BH,IAAIC,SAASG,YAAY;EACzBJ,IAAIC,SAASI,gBAAgB;EAE7B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB;IACjBC,MAAM,CACFT,SAASU,UACTV,SAASO,EAAAA;IAEbI,OAAO,CACHX,SAASW,KAAAA;IAEbC,YAAY,CACRZ,SAASY,UAAAA;IAEbC,WAAW,CACPb,SAASa,SAAAA;GAEjB;GACAC,MAAMR;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/presets/github.d.ts

@@ -0,0 +1,9 @@
+import type { TokenGrantResponse } from '@hapic/oauth2';
+import type { IdentityProviderIdentity } from '../../types.ts';
+import type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';
+import { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';
+export declare class IdentityProviderGithubAuthenticator extends IdentityProviderOAuth2Authenticator {
+    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext);
+    protected buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity>;
+}
+//# sourceMappingURL=github.d.ts.map

package/dist/core/identity/provider/authentication/presets/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/authentication/presets/github.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE5E,qBAAa,mCAAoC,SAAQ,mCAAmC;gBAC5E,GAAG,EAAE,0CAA0C;cAS3C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAwBpH"}