@authup/server-core 1.0.0-beta.5 → 1.0.0-beta.50

package/dist/core/identity/provider/mapper/role/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/mapper/role/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AAErE,qBAAa,0BAA2B,SAAQ,iCAAiC;IAC7E,SAAS,CAAC,MAAM,EAAE,kCAAkC,CAAC;gBAEzC,MAAM,EAAE,kCAAkC;IAMhD,OAAO,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,6BAA6B,EAAE,CAAC;CAgB9F"}

package/dist/core/identity/provider/mapper/role/module.mjs

@@ -0,0 +1,29 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderAccountBaseMapper } from "../base.mjs";
+//#region src/core/identity/provider/mapper/role/module.ts
+var IdentityProviderRoleMapper = class extends IdentityProviderAccountBaseMapper {
+	finder;
+	constructor(finder) {
+		super();
+		this.finder = finder;
+	}
+	async execute(identity) {
+		const entities = await this.finder.findByProviderId(identity.provider.id);
+		const items = [];
+		for (const entity of entities) {
+			const [operation] = this.resolve(identity, entity);
+			items.push({
+				value: entity.role_id,
+				realmId: entity.role_realm_id,
+				operation
+			});
+		}
+		return items;
+	}
+};
+//#endregion
+export { IdentityProviderRoleMapper };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/provider/mapper/role/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderRoleMapper","finder","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","resolve","push","value","role_id","realmId","role_realm_id"],"sources":["../../../../../../src/core/identity/provider/mapper/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderRoleMappingFinder } from './types.ts';\n\nexport class IdentityProviderRoleMapper extends IdentityProviderAccountBaseMapper {\n    protected finder: IIdentityProviderRoleMappingFinder;\n\n    constructor(finder: IIdentityProviderRoleMappingFinder) {\n        super();\n\n        this.finder = finder;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.finder.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation] = this.resolve(identity, entity);\n\n            items.push({\n                value: entity.role_id,\n                realmId: entity.role_realm_id,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,6BAAb,cAAgDD,kCAAAA;CAClCE;CAEV,YAAYA,QAA4C;EACpD,MAAK;EAEL,KAAKA,SAASA;CAClB;CAEA,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,OAAOI,iBAAiBF,SAASG,SAASC,EAAE;EAExE,MAAMC,QAA0C,CAAA;EAChD,KAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,aAAa,KAAKC,QAAQR,UAAUM,MAAAA;GAE3CD,MAAMI,KAAK;IACPC,OAAOJ,OAAOK;IACdC,SAASN,OAAOO;IAChBN;GACJ,CAAA;EACJ;EAEA,OAAOF;CACX;AACJ"}

package/dist/core/identity/provider/mapper/role/types.d.ts

@@ -0,0 +1,5 @@
+import type { IdentityProviderRoleMapping } from '@authup/core-kit';
+export interface IIdentityProviderRoleMappingFinder {
+    findByProviderId(providerId: string): Promise<IdentityProviderRoleMapping[]>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/provider/mapper/role/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/mapper/role/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAEpE,MAAM,WAAW,kCAAkC;IAC/C,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAI,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAAC;CACjF"}

package/dist/core/identity/provider/mapper/role/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/identity/provider/mapper/types.d.ts

@@ -0,0 +1,12 @@
+import type { IdentityProviderIdentity } from '../types.ts';
+import type { IdentityProviderMapperOperation } from './constants.ts';
+export type IdentityProviderMapperElement = {
+    key?: string;
+    value: unknown;
+    realmId?: string | null;
+    operation: IdentityProviderMapperOperation;
+};
+export interface IIdentityProviderMapper {
+    execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/provider/mapper/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/mapper/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AAEtE,MAAM,MAAM,6BAA6B,GAAG;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,+BAA+B,CAAA;CAC7C,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACpC,OAAO,CACH,QAAQ,EAAE,wBAAwB,GAClC,OAAO,CAAC,6BAA6B,EAAE,CAAC,CAAC;CAChD"}

package/dist/core/identity/provider/mapper/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/identity/provider/types.d.ts

@@ -0,0 +1,27 @@
+import type { IdentityProvider, User } from '@authup/core-kit';
+import type { IdentityProviderIdentityOperation } from './constants.ts';
+export type IdentityProviderIdentity = {
+    id: string;
+    /**
+     * Client used for authentication
+     */
+    clientId?: string;
+    /**
+     * Required for ldap authentication
+     */
+    roles?: string[];
+    /**
+     * Attribute candidates discovered during
+     * authentication step (ldap, oauth2, ...)
+     */
+    attributeCandidates?: {
+        [K in keyof User]?: unknown[];
+    };
+    /**
+     * Raw data received from identity provider.
+     */
+    data: Record<string, any>;
+    provider: IdentityProvider;
+    operation?: IdentityProviderIdentityOperation;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/provider/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/provider/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,gBAAgB,CAAC;AAExE,MAAM,MAAM,wBAAwB,GAAG;IACnC,EAAE,EAAE,MAAM,CAAC;IAEX;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjB;;;OAGG;IACH,mBAAmB,CAAC,EAAE;SACjB,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE;KAChC,CAAC;IAEF;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE1B,QAAQ,EAAE,gBAAgB,CAAC;IAE3B,SAAS,CAAC,EAAE,iCAAiC,CAAC;CACjD,CAAC"}

package/dist/core/identity/provider/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/identity/registration/check.d.ts

@@ -0,0 +1,3 @@
+import { type RegistrationDisabledError } from './error.ts';
+export declare function isRegistrationDisabledError(input: unknown): input is RegistrationDisabledError;
+//# sourceMappingURL=check.d.ts.map

package/dist/core/identity/registration/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/check.ts"],"names":[],"mappings":"AAQA,OAAO,EAAwC,KAAK,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAElG,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,yBAAyB,CAI9F"}

package/dist/core/identity/registration/check.mjs

@@ -0,0 +1,15 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { REGISTRATION_DISABLED_ERROR_INSTANCE } from "./error.mjs";
+import { ErrorCode, hasInstanceof, isAuthupError } from "@authup/errors";
+//#region src/core/identity/registration/check.ts
+function isRegistrationDisabledError(input) {
+	if (hasInstanceof(input, REGISTRATION_DISABLED_ERROR_INSTANCE)) return true;
+	if (!isAuthupError(input)) return false;
+	return input.code === ErrorCode.REGISTRATION_DISABLED;
+}
+//#endregion
+export { isRegistrationDisabledError };
+
+//# sourceMappingURL=check.mjs.map

package/dist/core/identity/registration/check.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.mjs","names":["ErrorCode","hasInstanceof","isAuthupError","REGISTRATION_DISABLED_ERROR_INSTANCE","isRegistrationDisabledError","input","code","REGISTRATION_DISABLED"],"sources":["../../../../src/core/identity/registration/check.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode, hasInstanceof, isAuthupError } from '@authup/errors';\nimport { REGISTRATION_DISABLED_ERROR_INSTANCE, type RegistrationDisabledError } from './error.ts';\n\nexport function isRegistrationDisabledError(input: unknown): input is RegistrationDisabledError {\n    if (hasInstanceof(input, REGISTRATION_DISABLED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.REGISTRATION_DISABLED;\n}\n"],"mappings":";;;;;;AAUA,SAAgBI,4BAA4BC,OAAc;CACtD,IAAIJ,cAAcI,OAAOF,oCAAAA,GAAuC,OAAO;CACvE,IAAI,CAACD,cAAcG,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMC,SAASN,UAAUO;AACpC"}

package/dist/core/identity/registration/error.d.ts

@@ -0,0 +1,6 @@
+import { BadRequestError } from '@authup/errors';
+export declare const REGISTRATION_DISABLED_ERROR_INSTANCE: unique symbol;
+export declare class RegistrationDisabledError extends BadRequestError {
+    constructor();
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/core/identity/registration/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/error.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAA6B,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,oCAAoC,eAA8D,CAAC;AAEhH,qBAAa,yBAA0B,SAAQ,eAAe;;CAQ7D"}

package/dist/core/identity/registration/error.mjs

@@ -0,0 +1,19 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { BadRequestError, ErrorCode, markInstanceof } from "@authup/errors";
+//#region src/core/identity/registration/error.ts
+const REGISTRATION_DISABLED_ERROR_INSTANCE = Symbol.for("@authup/server-core/RegistrationDisabledError");
+var RegistrationDisabledError = class extends BadRequestError {
+	constructor() {
+		super({
+			code: ErrorCode.REGISTRATION_DISABLED,
+			message: "User registration is not enabled."
+		});
+		markInstanceof(this, REGISTRATION_DISABLED_ERROR_INSTANCE);
+	}
+};
+//#endregion
+export { REGISTRATION_DISABLED_ERROR_INSTANCE, RegistrationDisabledError };
+
+//# sourceMappingURL=error.mjs.map

package/dist/core/identity/registration/error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.mjs","names":["BadRequestError","ErrorCode","markInstanceof","REGISTRATION_DISABLED_ERROR_INSTANCE","Symbol","for","RegistrationDisabledError","code","REGISTRATION_DISABLED","message"],"sources":["../../../../src/core/identity/registration/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, ErrorCode, markInstanceof } from '@authup/errors';\n\nexport const REGISTRATION_DISABLED_ERROR_INSTANCE = Symbol.for('@authup/server-core/RegistrationDisabledError');\n\nexport class RegistrationDisabledError extends BadRequestError {\n    constructor() {\n        super({\n            code: ErrorCode.REGISTRATION_DISABLED,\n            message: 'User registration is not enabled.',\n        });\n        markInstanceof(this, REGISTRATION_DISABLED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaG,uCAAuCC,OAAOC,IAAI,+CAAA;AAE/D,IAAaC,4BAAb,cAA+CN,gBAAAA;CAC3C,cAAc;EACV,MAAM;GACFO,MAAMN,UAAUO;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,oCAAAA;CACzB;AACJ"}

package/dist/core/identity/registration/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/registration/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/identity/registration/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RegistrationService } from "./service.mjs";
+export { RegistrationService };

package/dist/core/identity/registration/service.d.ts

@@ -0,0 +1,17 @@
+import type { IRegistrationService, RegistrationResult, RegistrationServiceContext, RegistrationServiceOptions } from './types.ts';
+import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
+import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IdentityWorkflowContext } from '../types.ts';
+export declare class RegistrationService implements IRegistrationService {
+    protected options: RegistrationServiceOptions;
+    protected mailClient: IMailClient;
+    protected mailTemplateRenderer: IMailTemplateRenderer;
+    protected repository: IUserRepository;
+    protected realmRepository: IRealmRepository;
+    constructor(ctx: RegistrationServiceContext);
+    register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult>;
+    activate(data: {
+        token: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/identity/registration/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/service.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAEtD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,0BAA0B;IAQrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAsDnG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAczD"}

package/dist/core/identity/registration/service.mjs

@@ -0,0 +1,81 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { UserCredentialsService } from "../../authentication/credential/entities/user/module.mjs";
+import { MailTemplateName } from "../../mail/template/types.mjs";
+import "../../mail/index.mjs";
+import { RegistrationDisabledError } from "./error.mjs";
+import { createNanoID } from "@authup/kit";
+import { UserValidator } from "@authup/core-kit";
+import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { Container } from "validup";
+import { randomBytes } from "node:crypto";
+//#region src/core/identity/registration/service.ts
+var RegistrationService = class {
+	options;
+	mailClient;
+	mailTemplateRenderer;
+	repository;
+	realmRepository;
+	constructor(ctx) {
+		this.options = ctx.options;
+		this.mailClient = ctx.mailClient;
+		this.mailTemplateRenderer = ctx.mailTemplateRenderer;
+		this.repository = ctx.repository;
+		this.realmRepository = ctx.realmRepository;
+	}
+	async register(data, context) {
+		if (!this.options.registrationEnabled) throw new RegistrationDisabledError();
+		const validator = new Container({});
+		validator.mount(new UserValidator({ pathsToInclude: [
+			"email",
+			"name",
+			"password",
+			"realm_id"
+		] }));
+		const validated = await validator.run(data, { group: "create" });
+		await this.repository.validateJoinColumns(validated);
+		if (this.options.emailVerificationEnabled) {
+			validated.active = false;
+			validated.activate_hash = randomBytes(32).toString("hex");
+		} else validated.active = true;
+		const entity = this.repository.create(validated);
+		const credentialsService = new UserCredentialsService();
+		entity.password = entity.password || createNanoID(64);
+		entity.password = await credentialsService.protect(entity.password);
+		entity.realm_id = (await this.realmRepository.resolve(entity.realm_id, true)).id;
+		await this.repository.save(entity);
+		if (this.options.emailVerificationEnabled) try {
+			const activateUrl = this.options.publicUrl ? `${this.options.publicUrl.replace(/\/+$/, "")}/activate?token=${entity.activate_hash}` : void 0;
+			const mail = await this.mailTemplateRenderer.render({
+				template: MailTemplateName.REGISTRATION_ACTIVATION,
+				params: {
+					code: entity.activate_hash,
+					url: activateUrl
+				},
+				locale: context?.locale
+			});
+			await this.mailClient.send({
+				to: entity.email,
+				...mail
+			});
+		} catch {
+			await this.repository.remove(entity);
+			throw new BadRequestError("Registration failed. Could not send activation email.");
+		}
+		return { active: entity.active };
+	}
+	async activate(data) {
+		const entity = await this.repository.findOneBy({ activate_hash: data.token });
+		if (!entity) throw new EntityNotFoundError();
+		const merged = this.repository.merge(entity, {
+			active: true,
+			activate_hash: null
+		});
+		await this.repository.save(merged);
+	}
+};
+//#endregion
+export { RegistrationService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/identity/registration/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["UserValidator","createNanoID","BadRequestError","EntityNotFoundError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","MailTemplateName","RegistrationService","options","mailClient","mailTemplateRenderer","repository","realmRepository","ctx","register","data","context","registrationEnabled","validator","mount","pathsToInclude","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","activateUrl","publicUrl","replace","undefined","mail","render","template","REGISTRATION_ACTIVATION","params","code","url","locale","send","to","email","remove","activate","findOneBy","token","merged","merge"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserValidator } from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({ pathsToInclude: ['email', 'name', 'password', 'realm_id'] }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                const activateUrl = this.options.publicUrl ?\n                    `${this.options.publicUrl.replace(/\\/+$/, '')}/activate?token=${entity.activate_hash}` :\n                    undefined;\n\n                const mail = await this.mailTemplateRenderer.render({\n                    template: MailTemplateName.REGISTRATION_ACTIVATION,\n                    params: { code: entity.activate_hash!, url: activateUrl },\n                    locale: context?.locale,\n                });\n\n                await this.mailClient.send({\n                    to: entity.email,\n                    ...mail,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new BadRequestError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAyBA,IAAaS,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKL,UAAUK,IAAIL;EACnB,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,SAASC,MAA2BC,SAAgE;EACtG,IAAI,CAAC,KAAKR,QAAQS,qBACd,MAAM,IAAIf,0BAAAA;EAGd,MAAMgB,YAAY,IAAId,UAAU,CAAC,CAAA;EACjCc,UAAUC,MAAM,IAAIrB,cAAc,EAAEsB,gBAAgB;GAAC;GAAS;GAAQ;GAAY;IAAY,CAAA,CAAA;EAC9F,MAAMC,YAAY,MAAMH,UAAUI,IAAIP,MAAM,EAAEQ,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKZ,WAAWa,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKb,QAAQiB,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,gBAAgBxB,YAAY,EAAA,CAAA,CAAIyB,SAAS,KAAA;EACvD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKlB,WAAWmB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAI1B,uBAAAA;EAC/BwB,OAAOG,WAAWH,OAAOG,YAAYjC,aAAa,EAAA;EAClD8B,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,YAAWF,MADE,KAAKtB,gBAAgBuB,QAAQN,OAAOO,UAAU,IAAA,EAAA,CAC1CC;EAExB,MAAM,KAAK1B,WAAW2B,KAAKT,MAAAA;EAE3B,IAAI,KAAKrB,QAAQiB,0BACb,IAAI;GACA,MAAMc,cAAc,KAAK/B,QAAQgC,YAC7B,GAAG,KAAKhC,QAAQgC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,kBAAkBZ,OAAOF,kBACvEe,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKjC,qBAAqBkC,OAAO;IAChDC,UAAUvC,iBAAiBwC;IAC3BC,QAAQ;KAAEC,MAAMnB,OAAOF;KAAgBsB,KAAKV;IAAY;IACxDW,QAAQlC,SAASkC;GACrB,CAAA;GAEA,MAAM,KAAKzC,WAAW0C,KAAK;IACvBC,IAAIvB,OAAOwB;IACX,GAAGV;GACP,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKhC,WAAW2C,OAAOzB,MAAAA;GAC7B,MAAM,IAAI7B,gBAAgB,uDAAA;EAC9B;EAGJ,OAAO,EAAE0B,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAM6B,SAASxC,MAAwC;EACnD,MAAMc,SAAS,MAAM,KAAKlB,WAAW6C,UAAU,EAAE7B,eAAeZ,KAAK0C,MAAM,CAAA;EAE3E,IAAI,CAAC5B,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMyD,SAAS,KAAK/C,WAAWgD,MAAM9B,QAAQ;GACzCH,QAAQ;GACRC,eAAe;EACnB,CAAA;EAEA,MAAM,KAAKhB,WAAW2B,KAAKoB,MAAAA;CAC/B;AACJ"}

package/dist/core/identity/registration/types.d.ts

@@ -0,0 +1,25 @@
+import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
+import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IdentityWorkflowContext } from '../types.ts';
+export type RegistrationServiceOptions = {
+    registrationEnabled?: boolean;
+    emailVerificationEnabled?: boolean;
+    publicUrl?: string;
+};
+export type RegistrationServiceContext = {
+    options: RegistrationServiceOptions;
+    mailClient: IMailClient;
+    mailTemplateRenderer: IMailTemplateRenderer;
+    repository: IUserRepository;
+    realmRepository: IRealmRepository;
+};
+export type RegistrationResult = {
+    active: boolean;
+};
+export interface IRegistrationService {
+    register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult>;
+    activate(data: {
+        token: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/registration/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,0BAA0B,GAAG;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}

package/dist/core/identity/registration/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/identity/resolver/entities/ldap/module.d.ts

@@ -0,0 +1,5 @@
+import type { IIdentityProviderRepository } from '../../../../entities/index.ts';
+export declare class LdapIdentityResolver {
+    protected repository: IIdentityProviderRepository;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/identity/resolver/entities/ldap/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/resolver/entities/ldap/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAEjF,qBAAa,oBAAoB;IAC7B,SAAS,CAAC,UAAU,EAAG,2BAA2B,CAAC;CACtD"}

package/dist/core/identity/resolver/entities/ldap/module.mjs

@@ -0,0 +1,11 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/identity/resolver/entities/ldap/module.ts
+var LdapIdentityResolver = class {
+	repository;
+};
+//#endregion
+export { LdapIdentityResolver };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/resolver/entities/ldap/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["LdapIdentityResolver","repository"],"sources":["../../../../../../src/core/identity/resolver/entities/ldap/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IIdentityProviderRepository } from '../../../../entities/index.ts';\n\nexport class LdapIdentityResolver {\n    protected repository : IIdentityProviderRepository;\n}\n"],"mappings":";;;;AASA,IAAaA,uBAAb,MAAaA;CACCC;AACd"}

package/dist/core/identity/resolver/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/resolver/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/resolver/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/resolver/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityResolver } from "./module.mjs";
+export { IdentityResolver };

package/dist/core/identity/resolver/module.d.ts

@@ -0,0 +1,15 @@
+import type { Identity } from '@authup/core-kit';
+import { IdentityType } from '@authup/core-kit';
+import type { IIdentityResolver, IdentityResolverContext } from './types.ts';
+import type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';
+export declare class IdentityResolver implements IIdentityResolver {
+    protected clientRepository: IClientIdentityRepository;
+    protected userRepository: IUserIdentityRepository;
+    protected robotRepository: IRobotIdentityRepository;
+    constructor(ctx: IdentityResolverContext);
+    resolve(type: `${IdentityType}`, key: string, realmKey?: string): Promise<Identity | null>;
+    private resolveClient;
+    private resolveRobot;
+    private resolveUser;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/identity/resolver/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/resolver/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAGR,QAAQ,EAKX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEzH,qBAAa,gBAAiB,YAAW,iBAAiB;IACtD,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,wBAAwB,CAAC;gBAExC,GAAG,EAAE,uBAAuB;IAMlC,OAAO,CACT,IAAI,EAAE,GAAG,YAAY,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YAgBb,aAAa;YAsBb,YAAY;YAsBZ,WAAW;CAqB5B"}

package/dist/core/identity/resolver/module.mjs

@@ -0,0 +1,58 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { isUUID } from "@authup/kit";
+import { IdentityType } from "@authup/core-kit";
+//#region src/core/identity/resolver/module.ts
+var IdentityResolver = class {
+	clientRepository;
+	userRepository;
+	robotRepository;
+	constructor(ctx) {
+		this.clientRepository = ctx.clientRepository;
+		this.userRepository = ctx.userRepository;
+		this.robotRepository = ctx.robotRepository;
+	}
+	async resolve(type, key, realmKey) {
+		switch (type) {
+			case IdentityType.CLIENT: return this.resolveClient(key, realmKey);
+			case IdentityType.ROBOT: return this.resolveRobot(key, realmKey);
+			case IdentityType.USER: return this.resolveUser(key, realmKey);
+		}
+		return null;
+	}
+	async resolveClient(key, realmKey) {
+		let data;
+		if (isUUID(key)) data = await this.clientRepository.findOneById(key);
+		else data = await this.clientRepository.findOneByName(key, realmKey);
+		if (data) return {
+			type: IdentityType.CLIENT,
+			data
+		};
+		return null;
+	}
+	async resolveRobot(key, realmKey) {
+		let data;
+		if (isUUID(key)) data = await this.robotRepository.findOneById(key);
+		else data = await this.robotRepository.findOneByName(key, realmKey);
+		if (data) return {
+			type: IdentityType.ROBOT,
+			data
+		};
+		return null;
+	}
+	async resolveUser(key, realmKey) {
+		let data;
+		if (isUUID(key)) data = await this.userRepository.findOneById(key);
+		else data = await this.userRepository.findOneByName(key, realmKey);
+		if (data) return {
+			type: IdentityType.USER,
+			data
+		};
+		return null;
+	}
+};
+//#endregion
+export { IdentityResolver };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/resolver/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["IdentityType","isUUID","IdentityResolver","clientRepository","userRepository","robotRepository","ctx","resolve","type","key","realmKey","CLIENT","resolveClient","ROBOT","resolveRobot","USER","resolveUser","data","findOneById","findOneByName"],"sources":["../../../../src/core/identity/resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    ClientIdentity, \n    Identity, \n    Robot, \n    RobotIdentity, \n    User, \n    UserIdentity,\n} from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { IIdentityResolver, IdentityResolverContext } from './types.ts';\nimport type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';\n\nexport class IdentityResolver implements IIdentityResolver {\n    protected clientRepository: IClientIdentityRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected robotRepository: IRobotIdentityRepository;\n\n    constructor(ctx: IdentityResolverContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async resolve(\n        type: `${IdentityType}`,\n        key: string,\n        realmKey?: string,\n    ): Promise<Identity | null> {\n        switch (type) {\n            case IdentityType.CLIENT: {\n                return this.resolveClient(key, realmKey);\n            }\n            case IdentityType.ROBOT: {\n                return this.resolveRobot(key, realmKey);\n            }\n            case IdentityType.USER: {\n                return this.resolveUser(key, realmKey);\n            }\n        }\n\n        return null;\n    }\n\n    private async resolveClient(\n        key: string,\n        realmKey?: string,\n    ) : Promise<ClientIdentity | null> {\n        let data : Client | null;\n\n        if (isUUID(key)) {\n            data = await this.clientRepository.findOneById(key);\n        } else {\n            data = await this.clientRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.CLIENT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveRobot(\n        key: string,\n        realmKey?: string,\n    ) : Promise<RobotIdentity | null> {\n        let data : Robot | null;\n\n        if (isUUID(key)) {\n            data = await this.robotRepository.findOneById(key);\n        } else {\n            data = await this.robotRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.ROBOT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveUser(\n        key: string,\n        realmKey?: string,\n    ) : Promise<UserIdentity | null> {\n        let data : User | null;\n\n        if (isUUID(key)) {\n            data = await this.userRepository.findOneById(key);\n        } else {\n            data = await this.userRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.USER,\n                data, \n            };\n        }\n\n        return null;\n    }\n}\n"],"mappings":";;;;;;AAqBA,IAAaE,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,QACFC,MACAC,KACAC,UACwB;EACxB,QAAQF,MAAR;GACI,KAAKR,aAAaW,QACd,OAAO,KAAKC,cAAcH,KAAKC,QAAAA;GAEnC,KAAKV,aAAaa,OACd,OAAO,KAAKC,aAAaL,KAAKC,QAAAA;GAElC,KAAKV,aAAae,MACd,OAAO,KAAKC,YAAYP,KAAKC,QAAAA;EAErC;EAEA,OAAO;CACX;CAEA,MAAcE,cACVH,KACAC,UAC+B;EAC/B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKd,iBAAiBe,YAAYT,GAAAA;OAE/CQ,OAAO,MAAM,KAAKd,iBAAiBgB,cAAcV,KAAKC,QAAAA;EAG1D,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaW;GACnBM;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcH,aACVL,KACAC,UAC8B;EAC9B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKZ,gBAAgBa,YAAYT,GAAAA;OAE9CQ,OAAO,MAAM,KAAKZ,gBAAgBc,cAAcV,KAAKC,QAAAA;EAGzD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaa;GACnBI;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcD,YACVP,KACAC,UAC6B;EAC7B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKb,eAAec,YAAYT,GAAAA;OAE7CQ,OAAO,MAAM,KAAKb,eAAee,cAAcV,KAAKC,QAAAA;EAGxD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAae;GACnBE;EACJ;EAGJ,OAAO;CACX;AACJ"}

package/dist/core/identity/resolver/types.d.ts

@@ -0,0 +1,11 @@
+import type { Identity, IdentityType } from '@authup/core-kit';
+import type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';
+export type IdentityResolverContext = {
+    clientRepository: IClientIdentityRepository;
+    userRepository: IUserIdentityRepository;
+    robotRepository: IRobotIdentityRepository;
+};
+export interface IIdentityResolver {
+    resolve(type: `${IdentityType}`, key: string, realmKey?: string): Promise<Identity | null>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/resolver/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/resolver/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EACR,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EAC1B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,uBAAuB,GAAG;IAClC,gBAAgB,EAAE,yBAAyB,CAAC;IAC5C,cAAc,EAAE,uBAAuB,CAAC;IACxC,eAAe,EAAE,wBAAwB,CAAA;CAC5C,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAC9B,OAAO,CAAC,IAAI,EAAE,GAAG,YAAY,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;CAC9F"}

package/dist/core/identity/resolver/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/identity/role/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/role/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/role/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityRoleProvider } from "./module.mjs";
+export { IdentityRoleProvider };

package/dist/core/identity/role/module.d.ts

@@ -0,0 +1,15 @@
+import type { Role } from '@authup/core-kit';
+import type { IdentityPolicyData } from '@authup/access';
+import type { IClientRepository } from '../../entities/client/types.ts';
+import type { IRobotRepository } from '../../entities/robot/types.ts';
+import type { IUserRepository } from '../../entities/user/types.ts';
+import type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';
+export declare class IdentityRoleProvider implements IIdentityRoleProvider {
+    protected clientRepository: IClientRepository;
+    protected userRepository: IUserRepository;
+    protected robotRepository: IRobotRepository;
+    constructor(ctx: IdentityRoleProviderContext);
+    getRolesFor(identity: IdentityPolicyData): Promise<Role[]>;
+    private reduceByIdentityClient;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/identity/role/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAErF,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,2BAA2B;IAMtC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAkBjE,OAAO,CAAC,sBAAsB;CAiBjC"}

package/dist/core/identity/role/module.mjs

@@ -0,0 +1,30 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/identity/role/module.ts
+var IdentityRoleProvider = class {
+	clientRepository;
+	userRepository;
+	robotRepository;
+	constructor(ctx) {
+		this.clientRepository = ctx.clientRepository;
+		this.userRepository = ctx.userRepository;
+		this.robotRepository = ctx.robotRepository;
+	}
+	async getRolesFor(identity) {
+		switch (identity.type) {
+			case "client": return this.clientRepository.getBoundRoles(identity.id);
+			case "user": return this.userRepository.getBoundRoles(identity.id).then((data) => this.reduceByIdentityClient(data, identity));
+			case "robot": return this.robotRepository.getBoundRoles(identity.id).then((data) => this.reduceByIdentityClient(data, identity));
+		}
+		return [];
+	}
+	reduceByIdentityClient(entities, identity) {
+		if (!identity.clientId) return entities;
+		return entities.filter((entity) => !entity.client_id || entity.client_id === identity.clientId);
+	}
+};
+//#endregion
+export { IdentityRoleProvider };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/role/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["IdentityRoleProvider","clientRepository","userRepository","robotRepository","ctx","getRolesFor","identity","type","getBoundRoles","id","then","data","reduceByIdentityClient","entities","clientId","filter","entity","client_id"],"sources":["../../../../src/core/identity/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Role } from '@authup/core-kit';\nimport type { IdentityPolicyData } from '@authup/access';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';\n\nexport class IdentityRoleProvider implements IIdentityRoleProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected robotRepository: IRobotRepository;\n\n    constructor(ctx: IdentityRoleProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async getRolesFor(identity: IdentityPolicyData) : Promise<Role[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.clientRepository.getBoundRoles(identity.id);\n            }\n            case 'user': {\n                return this.userRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n            case 'robot': {\n                return this.robotRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n        }\n\n        return [];\n    }\n\n    private reduceByIdentityClient<T extends { client_id?: string | null }>(\n        entities: T[],\n        identity: IdentityPolicyData,\n    ): T[] {\n        if (!identity.clientId) {\n            return entities;\n        }\n\n        // Keep client-agnostic (global / realm) roles — client_id null — in\n        // addition to roles scoped to the authenticating client. Dropping the\n        // null case stripped every global/realm role from a token issued via\n        // a real client (e.g. the per-realm `web` client used by the\n        // realm-selection login), leaving permissions/roles empty.\n        return entities.filter(\n            (entity) => !entity.client_id || entity.client_id === identity.clientId,\n        );\n    }\n}\n"],"mappings":";;;;AAcA,IAAaA,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,YAAYC,UAAgD;EAC9D,QAAQA,SAASC,MAAjB;GACI,KAAK,UACD,OAAO,KAAKN,iBAAiBO,cAAcF,SAASG,EAAE;GAE1D,KAAK,QACD,OAAO,KAAKP,eAAeM,cAAcF,SAASG,EAAE,CAAA,CAC/CC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;GAE1D,KAAK,SACD,OAAO,KAAKH,gBAAgBK,cAAcF,SAASG,EAAE,CAAA,CAChDC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;EAE9D;EAEA,OAAO,CAAA;CACX;CAEQM,uBACJC,UACAP,UACG;EACH,IAAI,CAACA,SAASQ,UACV,OAAOD;EAQX,OAAOA,SAASE,QACXC,WAAW,CAACA,OAAOC,aAAaD,OAAOC,cAAcX,SAASQ,QAAQ;CAE/E;AACJ"}

package/dist/core/identity/role/types.d.ts

@@ -0,0 +1,14 @@
+import type { Role } from '@authup/core-kit';
+import type { IdentityPolicyData } from '@authup/access';
+import type { IClientRepository } from '../../entities/client/types.ts';
+import type { IRobotRepository } from '../../entities/robot/types.ts';
+import type { IUserRepository } from '../../entities/user/types.ts';
+export interface IIdentityRoleProvider {
+    getRolesFor(identity: IdentityPolicyData): Promise<Role[]>;
+}
+export type IdentityRoleProviderContext = {
+    clientRepository: IClientRepository;
+    userRepository: IUserRepository;
+    robotRepository: IRobotRepository;
+};
+//# sourceMappingURL=types.d.ts.map