@authup/server-core 1.0.0-beta.5 → 1.0.0-beta.51

package/dist/app/modules/oauth2/repositories/scope/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2ScopeRepository } from "./repository.mjs";
+export { OAuth2ScopeRepository };

package/dist/app/modules/oauth2/repositories/scope/repository.d.ts

@@ -0,0 +1,9 @@
+import type { ClientScope, Scope } from '@authup/core-kit';
+import type { Repository } from 'typeorm';
+import type { IOAuth2ScopeRepository } from '../../../../../core/index.ts';
+export declare class OAuth2ScopeRepository implements IOAuth2ScopeRepository {
+    private readonly repository;
+    constructor(repository: Repository<ClientScope>);
+    findByClientId(clientId: string): Promise<Scope[]>;
+}
+//# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/oauth2/repositories/scope/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/scope/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,qBAAa,qBAAsB,YAAW,sBAAsB;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0B;gBAGjD,UAAU,EAAE,UAAU,CAAC,WAAW,CAAC;IAKjC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;CAQ3D"}

package/dist/app/modules/oauth2/repositories/scope/repository.mjs

@@ -0,0 +1,20 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/app/modules/oauth2/repositories/scope/repository.ts
+var OAuth2ScopeRepository = class {
+	repository;
+	constructor(repository) {
+		this.repository = repository;
+	}
+	async findByClientId(clientId) {
+		return (await this.repository.find({
+			where: { client_id: clientId },
+			relations: { scope: true }
+		})).map((clientScope) => clientScope.scope);
+	}
+};
+//#endregion
+export { OAuth2ScopeRepository };
+
+//# sourceMappingURL=repository.mjs.map

package/dist/app/modules/oauth2/repositories/scope/repository.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.mjs","names":["OAuth2ScopeRepository","repository","findByClientId","clientId","clientScopes","find","where","client_id","relations","scope","map","clientScope"],"sources":["../../../../../../src/app/modules/oauth2/repositories/scope/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ClientScope, Scope } from '@authup/core-kit';\nimport type { Repository } from 'typeorm';\nimport type { IOAuth2ScopeRepository } from '../../../../../core/index.ts';\n\nexport class OAuth2ScopeRepository implements IOAuth2ScopeRepository {\n    private readonly repository: Repository<ClientScope>;\n\n    constructor(\n        repository: Repository<ClientScope>,\n    ) {\n        this.repository = repository;\n    }\n\n    async findByClientId(clientId: string): Promise<Scope[]> {\n        const clientScopes = await this.repository.find({\n            where: { client_id: clientId },\n            relations: { scope: true },\n        });\n\n        return clientScopes.map((clientScope) => clientScope.scope);\n    }\n}\n"],"mappings":";;;;AAWA,IAAaA,wBAAb,MAAaA;CACQC;CAEjB,YACIA,YACF;EACE,KAAKA,aAAaA;CACtB;CAEA,MAAMC,eAAeC,UAAoC;EAMrD,QAAOC,MALoB,KAAKH,WAAWI,KAAK;GAC5CC,OAAO,EAAEC,WAAWJ,SAAS;GAC7BK,WAAW,EAAEC,OAAO,KAAK;EAC7B,CAAA,EAAA,CAEoBC,KAAKC,gBAAgBA,YAAYF,KAAK;CAC9D;AACJ"}

package/dist/app/modules/oauth2/repositories/token/index.d.ts

@@ -0,0 +1,2 @@
+export * from './repository.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/app/modules/oauth2/repositories/token/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/token/index.ts"],"names":[],"mappings":"AAOA,cAAc,iBAAiB,CAAC"}

package/dist/app/modules/oauth2/repositories/token/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2TokenRepository } from "./repository.mjs";
+export { OAuth2TokenRepository };

package/dist/app/modules/oauth2/repositories/token/repository.d.ts

@@ -0,0 +1,23 @@
+import type { ICache } from '@authup/server-kit';
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { IOAuth2TokenRepository } from '../../../../../core/index.ts';
+export declare class OAuth2TokenRepository implements IOAuth2TokenRepository {
+    protected cache: ICache;
+    constructor(cache: ICache);
+    findOneBySignature(signature: string): Promise<OAuth2TokenPayload | null>;
+    findOneById(id: string): Promise<OAuth2TokenPayload | null>;
+    removeById(id: string): Promise<void>;
+    insert(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload>;
+    save(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload>;
+    saveWithSignature(data: OAuth2TokenPayload, signature: string): Promise<OAuth2TokenPayload>;
+    isInactive(key: string): Promise<boolean>;
+    setInactive(key: string, exp?: number): Promise<void>;
+    /**
+     * Transform timestamp in seconds to ttl in ms.
+     *
+     * @param utc
+     * @protected
+     */
+    protected buildTTL(utc?: number): number;
+}
+//# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/oauth2/repositories/token/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/token/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAG3E,qBAAa,qBAAsB,YAAW,sBAAsB;IAChE,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;gBAEb,KAAK,EAAE,MAAM;IAMnB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IASzE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAW3D,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBrC,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAehE,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ9D,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiB3F,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWzC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB3D;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;CAUlC"}

package/dist/app/modules/oauth2/repositories/token/repository.mjs

@@ -0,0 +1,86 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { CacheOAuth2Prefix } from "../constants.mjs";
+import { buildCacheKey } from "@authup/server-kit";
+import { randomUUID } from "node:crypto";
+//#region src/app/modules/oauth2/repositories/token/repository.ts
+var OAuth2TokenRepository = class {
+	cache;
+	constructor(cache) {
+		this.cache = cache;
+	}
+	async findOneBySignature(signature) {
+		return this.cache.get(buildCacheKey({
+			prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,
+			key: signature
+		}));
+	}
+	async findOneById(id) {
+		return this.cache.get(buildCacheKey({
+			prefix: CacheOAuth2Prefix.TOKEN,
+			key: id
+		}));
+	}
+	async removeById(id) {
+		const token = await this.findOneById(id);
+		if (!token) return;
+		const key = buildCacheKey({
+			prefix: CacheOAuth2Prefix.TOKEN,
+			key: id
+		});
+		await this.cache.drop(key);
+		await this.setInactive(id, token.exp);
+	}
+	async insert(payload) {
+		payload.jti = randomUUID();
+		await this.cache.set(buildCacheKey({
+			prefix: CacheOAuth2Prefix.TOKEN,
+			key: payload.jti
+		}), payload, { ttl: this.buildTTL(payload.exp) });
+		return payload;
+	}
+	async save(payload) {
+		if (payload.jti) return payload;
+		return this.insert(payload);
+	}
+	async saveWithSignature(data, signature) {
+		const normalized = await this.save(data);
+		await this.cache.set(buildCacheKey({
+			prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,
+			key: signature
+		}), normalized, { ttl: this.buildTTL(data.exp) });
+		return normalized;
+	}
+	async isInactive(key) {
+		const cacheKey = buildCacheKey({
+			prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,
+			key
+		});
+		return !!await this.cache.get(cacheKey);
+	}
+	async setInactive(key, exp) {
+		const ttl = this.buildTTL(exp);
+		const cacheKey = buildCacheKey({
+			prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,
+			key
+		});
+		await this.cache.set(cacheKey, true, { ttl });
+	}
+	/**
+	* Transform timestamp in seconds to ttl in ms.
+	*
+	* @param utc
+	* @protected
+	*/ buildTTL(utc) {
+		if (typeof utc === "number") {
+			const ttl = utc * 1e3 - Date.now();
+			if (ttl > 0) return ttl;
+		}
+		return 3600 * 1e3;
+	}
+};
+//#endregion
+export { OAuth2TokenRepository };
+
+//# sourceMappingURL=repository.mjs.map

package/dist/app/modules/oauth2/repositories/token/repository.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.mjs","names":["buildCacheKey","randomUUID","CacheOAuth2Prefix","OAuth2TokenRepository","cache","findOneBySignature","signature","get","prefix","TOKEN_CLAIMS","key","findOneById","id","TOKEN","removeById","token","drop","setInactive","exp","insert","payload","jti","set","ttl","buildTTL","save","saveWithSignature","data","normalized","isInactive","cacheKey","TOKEN_INACTIVE","response","utc","Date","now"],"sources":["../../../../../../src/app/modules/oauth2/repositories/token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { randomUUID } from 'node:crypto';\nimport type { IOAuth2TokenRepository } from '../../../../../core/index.ts';\nimport { CacheOAuth2Prefix } from '../constants.ts';\n\nexport class OAuth2TokenRepository implements IOAuth2TokenRepository {\n    protected cache : ICache;\n\n    constructor(cache: ICache) {\n        this.cache = cache;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneBySignature(signature: string): Promise<OAuth2TokenPayload | null> {\n        return this.cache.get<OAuth2TokenPayload>(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,\n                key: signature, \n            }),\n        );\n    }\n\n    async findOneById(id: string): Promise<OAuth2TokenPayload | null> {\n        return this.cache.get<OAuth2TokenPayload>(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN,\n                key: id, \n            }),\n        );\n    }\n\n    // -----------------------------------------------------\n\n    async removeById(id: string): Promise<void> {\n        const token = await this.findOneById(id);\n        if (!token) {\n            return;\n        }\n\n        const key = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN,\n            key: id, \n        });\n        await this.cache.drop(key);\n\n        await this.setInactive(id, token.exp);\n    }\n\n    // -----------------------------------------------------\n\n    async insert(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload> {\n        payload.jti = randomUUID();\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN,\n                key: payload.jti, \n            }),\n            payload,\n            { ttl: this.buildTTL(payload.exp) },\n        );\n\n        return payload;\n    }\n\n    async save(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload> {\n        if (payload.jti) {\n            return payload;\n        }\n\n        return this.insert(payload);\n    }\n\n    async saveWithSignature(data: OAuth2TokenPayload, signature: string): Promise<OAuth2TokenPayload> {\n        const normalized = await this.save(data);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,\n                key: signature, \n            }),\n            normalized,\n            { ttl: this.buildTTL(data.exp) },\n        );\n\n        return normalized;\n    }\n\n    // -----------------------------------------------------\n\n    async isInactive(key: string): Promise<boolean> {\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        const response = await this.cache.get(cacheKey);\n\n        return !!response;\n    }\n\n    async setInactive(key: string, exp?: number): Promise<void> {\n        const ttl = this.buildTTL(exp);\n\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        await this.cache.set(\n            cacheKey,\n            true,\n            { ttl },\n        );\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Transform timestamp in seconds to ttl in ms.\n     *\n     * @param utc\n     * @protected\n     */\n    protected buildTTL(utc?: number) {\n        if (typeof utc === 'number') {\n            const ttl = (utc * 1000) - Date.now();\n            if (ttl > 0) {\n                return ttl;\n            }\n        }\n\n        return 3_600 * 1000;\n    }\n}\n"],"mappings":";;;;;;;AAcA,IAAaG,wBAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAIA,MAAMC,mBAAmBC,WAAuD;EAC5E,OAAO,KAAKF,MAAMG,IACdP,cAAc;GACVQ,QAAQN,kBAAkBO;GAC1BC,KAAKJ;EACT,CAAA,CAAA;CAER;CAEA,MAAMK,YAAYC,IAAgD;EAC9D,OAAO,KAAKR,MAAMG,IACdP,cAAc;GACVQ,QAAQN,kBAAkBW;GAC1BH,KAAKE;EACT,CAAA,CAAA;CAER;CAIA,MAAME,WAAWF,IAA2B;EACxC,MAAMG,QAAQ,MAAM,KAAKJ,YAAYC,EAAAA;EACrC,IAAI,CAACG,OACD;EAGJ,MAAML,MAAMV,cAAc;GACtBQ,QAAQN,kBAAkBW;GAC1BH,KAAKE;EACT,CAAA;EACA,MAAM,KAAKR,MAAMY,KAAKN,GAAAA;EAEtB,MAAM,KAAKO,YAAYL,IAAIG,MAAMG,GAAG;CACxC;CAIA,MAAMC,OAAOC,SAA0D;EACnEA,QAAQC,MAAMpB,WAAAA;EAEd,MAAM,KAAKG,MAAMkB,IACbtB,cAAc;GACVQ,QAAQN,kBAAkBW;GAC1BH,KAAKU,QAAQC;EACjB,CAAA,GACAD,SACA,EAAEG,KAAK,KAAKC,SAASJ,QAAQF,GAAG,EAAE,CAAA;EAGtC,OAAOE;CACX;CAEA,MAAMK,KAAKL,SAA0D;EACjE,IAAIA,QAAQC,KACR,OAAOD;EAGX,OAAO,KAAKD,OAAOC,OAAAA;CACvB;CAEA,MAAMM,kBAAkBC,MAA0BrB,WAAgD;EAC9F,MAAMsB,aAAa,MAAM,KAAKH,KAAKE,IAAAA;EAEnC,MAAM,KAAKvB,MAAMkB,IACbtB,cAAc;GACVQ,QAAQN,kBAAkBO;GAC1BC,KAAKJ;EACT,CAAA,GACAsB,YACA,EAAEL,KAAK,KAAKC,SAASG,KAAKT,GAAG,EAAE,CAAA;EAGnC,OAAOU;CACX;CAIA,MAAMC,WAAWnB,KAA+B;EAC5C,MAAMoB,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAIA,OAAO,CAAC,CAACsB,MAFc,KAAK5B,MAAMG,IAAIuB,QAAAA;CAG1C;CAEA,MAAMb,YAAYP,KAAaQ,KAA6B;EACxD,MAAMK,MAAM,KAAKC,SAASN,GAAAA;EAE1B,MAAMY,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAEA,MAAM,KAAKN,MAAMkB,IACbQ,UACA,MACA,EAAEP,IAAI,CAAA;CAEd;;;;;;IAUA,SAAmBU,KAAc;EAC7B,IAAI,OAAOA,QAAQ,UAAU;GACzB,MAAMV,MAAM,MAAO,MAAQW,KAAKC,IAAG;GACnC,IAAIZ,MAAM,GACN,OAAOA;EAEf;EAEA,OAAO,OAAQ;CACnB;AACJ"}

package/dist/app/modules/provisioning/index.d.ts

@@ -0,0 +1,3 @@
+export * from './sources/index.ts';
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/app/modules/provisioning/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC"}

package/dist/app/modules/provisioning/index.mjs

@@ -0,0 +1,9 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { DefaultProvisioningSource } from "./sources/default/module.mjs";
+import { CompositeProvisioningSource } from "./sources/composite/module.mjs";
+import { FileProvisioningSource } from "./sources/file/module.mjs";
+import "./sources/index.mjs";
+import { ProvisionerModule } from "./module.mjs";
+export { CompositeProvisioningSource, DefaultProvisioningSource, FileProvisioningSource, ProvisionerModule };

package/dist/app/modules/provisioning/module.d.ts

@@ -0,0 +1,14 @@
+import type { DataSource } from 'typeorm';
+import type { IContainer } from 'eldin';
+import type { IProvisioningSource } from '../../../core/provisioning/types.ts';
+import { PolicyRepositoryAdapter } from '../database/repositories/index.ts';
+import type { IModule } from 'orkos';
+export declare class ProvisionerModule implements IModule {
+    readonly name: string;
+    readonly dependencies: string[];
+    protected sources: IProvisioningSource[];
+    constructor(sources?: IProvisioningSource[]);
+    setup(container: IContainer): Promise<void>;
+    protected assignDefaultPolicy(dataSource: DataSource, policyRepository: PolicyRepositoryAdapter): Promise<void>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/app/modules/provisioning/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAsBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAYxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAMH,uBAAuB,EAW1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AASrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cA+JjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}

package/dist/app/modules/provisioning/module.mjs

@@ -0,0 +1,189 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RealmEntity } from "../../../adapters/database/domains/realm/entity.mjs";
+import { ClientEntity } from "../../../adapters/database/domains/client/entity.mjs";
+import { RoleEntity } from "../../../adapters/database/domains/role/entity.mjs";
+import { ClientRoleEntity } from "../../../adapters/database/domains/client-role/entity.mjs";
+import { PermissionEntity } from "../../../adapters/database/domains/permission/entity.mjs";
+import { PolicyRepository } from "../../../adapters/database/domains/policy/repository.mjs";
+import { ClientPermissionEntity } from "../../../adapters/database/domains/client-permission/entity.mjs";
+import { ScopeEntity } from "../../../adapters/database/domains/scope/entity.mjs";
+import { UserRepository } from "../../../adapters/database/domains/user/repository.mjs";
+import { RobotEntity } from "../../../adapters/database/domains/robot/entity.mjs";
+import { PermissionPolicyEntity } from "../../../adapters/database/domains/permission-policy/entity.mjs";
+import { RobotPermissionEntity } from "../../../adapters/database/domains/robot-permission/entity.mjs";
+import { RobotRoleEntity } from "../../../adapters/database/domains/robot-role/entity.mjs";
+import { RolePermissionEntity } from "../../../adapters/database/domains/role-permission/entity.mjs";
+import { UserPermissionEntity } from "../../../adapters/database/domains/user-permission/entity.mjs";
+import { UserRoleEntity } from "../../../adapters/database/domains/user-role/entity.mjs";
+import "../../../adapters/database/domains/index.mjs";
+import { WebClientProvisioner } from "../../../core/entities/client/web-client.mjs";
+import "../../../core/entities/client/index.mjs";
+import { ClientProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/client/module.mjs";
+import { PermissionProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/permission/module.mjs";
+import { PolicyProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/policy/module.mjs";
+import { RealmProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/realm/module.mjs";
+import { RoleProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/role/module.mjs";
+import { GraphProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/root/module.mjs";
+import { RobotProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/robot/module.mjs";
+import { ScopeProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/scope/module.mjs";
+import { UserProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/user/module.mjs";
+import "../../../core/provisioning/synchronizer/index.mjs";
+import { ModuleName } from "../constants.mjs";
+import { ConfigInjectionKey } from "../config/constants.mjs";
+import { getAppOrigins } from "../config/origins.mjs";
+import "../config/index.mjs";
+import { DatabaseInjectionKey } from "../database/constants.mjs";
+import "../../../adapters/database/index.mjs";
+import { LoggerInjectionKey } from "../logger/constants.mjs";
+import "../logger/index.mjs";
+import { RealmRepositoryAdapter } from "../database/repositories/realm/repository.mjs";
+import { ClientRepositoryAdapter } from "../database/repositories/client/repository.mjs";
+import { ClientPermissionRepositoryAdapter } from "../database/repositories/client-permission/repository.mjs";
+import { ClientRoleRepositoryAdapter } from "../database/repositories/client-role/repository.mjs";
+import { PermissionRepositoryAdapter } from "../database/repositories/permission/repository.mjs";
+import { PermissionPolicyRepositoryAdapter } from "../database/repositories/permission-policy/repository.mjs";
+import { PolicyRepositoryAdapter } from "../database/repositories/policy/repository.mjs";
+import { RobotRepositoryAdapter } from "../database/repositories/robot/repository.mjs";
+import { RobotPermissionRepositoryAdapter } from "../database/repositories/robot-permission/repository.mjs";
+import { RobotRoleRepositoryAdapter } from "../database/repositories/robot-role/repository.mjs";
+import { RoleRepositoryAdapter } from "../database/repositories/role/repository.mjs";
+import { RolePermissionRepositoryAdapter } from "../database/repositories/role-permission/repository.mjs";
+import { ScopeRepositoryAdapter } from "../database/repositories/scope/repository.mjs";
+import { UserRepositoryAdapter } from "../database/repositories/user/repository.mjs";
+import { UserPermissionRepositoryAdapter } from "../database/repositories/user-permission/repository.mjs";
+import { UserRoleRepositoryAdapter } from "../database/repositories/user-role/repository.mjs";
+import "../database/repositories/index.mjs";
+import "../database/index.mjs";
+import { CompositeProvisioningSource } from "./sources/composite/module.mjs";
+import { FileProvisioningSource } from "./sources/file/module.mjs";
+import "./sources/index.mjs";
+import { SystemPolicyName } from "@authup/access";
+import path from "node:path";
+import fs from "node:fs";
+//#region src/app/modules/provisioning/module.ts
+var ProvisionerModule = class {
+	name;
+	dependencies;
+	sources;
+	constructor(sources = []) {
+		this.name = ModuleName.PROVISIONING;
+		this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];
+		this.sources = sources;
+	}
+	async setup(container) {
+		const sources = [...this.sources];
+		const config = container.resolve(ConfigInjectionKey);
+		const provisioningDir = path.join(config.writableDirectoryPath, "provisioning");
+		if (fs.existsSync(provisioningDir)) sources.push(new FileProvisioningSource({ cwd: provisioningDir }));
+		const data = await new CompositeProvisioningSource(sources).load(container);
+		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
+		const realmRepository = container.resolve(RealmEntity);
+		const permissionRepository = new PermissionRepositoryAdapter({
+			repository: container.resolve(PermissionEntity),
+			realmRepository
+		});
+		const policyRepository = new PolicyRepositoryAdapter({
+			repository: new PolicyRepository(dataSource),
+			realmRepository
+		});
+		const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(container.resolve(PermissionPolicyEntity));
+		const policySynchronizer = new PolicyProvisioningSynchronizer({
+			repository: policyRepository,
+			permissionPolicyRepository
+		});
+		const roleRepository = new RoleRepositoryAdapter({
+			repository: container.resolve(RoleEntity),
+			realmRepository
+		});
+		const clientRepository = new ClientRepositoryAdapter({
+			repository: container.resolve(ClientEntity),
+			realmRepository
+		});
+		const permissionSynchronizer = new PermissionProvisioningSynchronizer({
+			repository: permissionRepository,
+			policyRepository,
+			permissionPolicyRepository
+		});
+		const roleSynchronizer = new RoleProvisioningSynchronizer({
+			repository: roleRepository,
+			permissionRepository,
+			rolePermissionRepository: new RolePermissionRepositoryAdapter(container.resolve(RolePermissionEntity))
+		});
+		const clientSynchronizer = new ClientProvisioningSynchronizer({
+			clientRepository,
+			clientRoleRepository: new ClientRoleRepositoryAdapter(container.resolve(ClientRoleEntity)),
+			clientPermissionRepository: new ClientPermissionRepositoryAdapter(container.resolve(ClientPermissionEntity)),
+			roleRepository,
+			permissionRepository,
+			roleSynchronizer,
+			permissionSynchronizer
+		});
+		const userSynchronizer = new UserProvisioningSynchronizer({
+			userRepository: new UserRepositoryAdapter({
+				repository: new UserRepository(dataSource),
+				realmRepository
+			}),
+			userRoleRepository: new UserRoleRepositoryAdapter(container.resolve(UserRoleEntity)),
+			userPermissionRepository: new UserPermissionRepositoryAdapter(container.resolve(UserPermissionEntity)),
+			clientRepository,
+			roleRepository,
+			permissionRepository
+		});
+		const robotSynchronizer = new RobotProvisioningSynchronizer({
+			robotRepository: new RobotRepositoryAdapter({
+				repository: container.resolve(RobotEntity),
+				realmRepository
+			}),
+			robotRoleRepository: new RobotRoleRepositoryAdapter(container.resolve(RobotRoleEntity)),
+			robotPermissionRepository: new RobotPermissionRepositoryAdapter(container.resolve(RobotPermissionEntity)),
+			roleRepository,
+			permissionRepository
+		});
+		const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: new ScopeRepositoryAdapter({
+			repository: container.resolve(ScopeEntity),
+			realmRepository
+		}) });
+		await new GraphProvisioningSynchronizer({
+			policySynchronizer,
+			permissionSynchronizer,
+			roleSynchronizer,
+			realmSynchronizer: new RealmProvisioningSynchronizer({
+				repository: new RealmRepositoryAdapter(realmRepository),
+				clientSynchronizer,
+				roleSynchronizer,
+				permissionSynchronizer,
+				userSynchronizer,
+				robotSynchronizer,
+				scopeSynchronizer
+			}),
+			scopeSynchronizer
+		}).synchronize(data);
+		const webClientProvisioner = new WebClientProvisioner({
+			clientRepository,
+			appOrigins: getAppOrigins(config),
+			logger: container.resolve(LoggerInjectionKey)
+		});
+		const realms = await realmRepository.find();
+		for (const realm of realms) await webClientProvisioner.ensureForRealm(realm);
+		if (config.permissionsDefaultPolicyAssignment) await this.assignDefaultPolicy(dataSource, policyRepository);
+	}
+	async assignDefaultPolicy(dataSource, policyRepository) {
+		const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);
+		if (!defaultPolicy) return;
+		const permissionRepo = dataSource.getRepository(PermissionEntity);
+		const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);
+		const permissions = await permissionRepo.find();
+		for (const permission of permissions) if (!await junctionRepo.findOneBy({ permission_id: permission.id })) await junctionRepo.save(junctionRepo.create({
+			permission_id: permission.id,
+			permission_realm_id: permission.realm_id,
+			policy_id: defaultPolicy.id,
+			policy_realm_id: defaultPolicy.realm_id
+		}));
+	}
+};
+//#endregion
+export { ProvisionerModule };
+
+//# sourceMappingURL=module.mjs.map

package/dist/app/modules/provisioning/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RobotEntity","RobotPermissionEntity","RobotRoleEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RobotProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RobotPermissionRepositoryAdapter","RobotRepositoryAdapter","RobotRoleRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","LoggerInjectionKey","WebClientProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","robotSynchronizer","robotRepository","robotRoleRepository","robotPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","logger","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permission_id","id","save","create","permission_realm_id","realm_id","policy_id","policy_realm_id"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    PermissionPolicy,\n    Realm,\n    Robot,\n    RobotPermission,\n    RobotRole,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    PermissionEntity,\n    RealmEntity,\n    RobotEntity,\n    RobotPermissionEntity,\n    RobotRoleEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RobotProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RobotPermissionRepositoryAdapter,\n    RobotRepositoryAdapter,\n    RobotRoleRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter,\n    UserRoleRepositoryAdapter,\n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({ cwd: provisioningDir }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const robotSynchronizer = new RobotProvisioningSynchronizer({\n            robotRepository: new RobotRepositoryAdapter({\n                repository: container.resolve<Repository<Robot>>(RobotEntity),\n                realmRepository,\n            }),\n            robotRoleRepository: new RobotRoleRepositoryAdapter(\n                container.resolve<Repository<RobotRole>>(RobotRoleEntity),\n            ),\n            robotPermissionRepository: new RobotPermissionRepositoryAdapter(\n                container.resolve<Repository<RobotPermission>>(RobotPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            robotSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm public `web` client. Single provisioning mechanism:\n        // list every realm (incl. pre-existing) and upsert its web client.\n        // Idempotent; guarded on built_in inside the provisioner.\n        // ---------------------------------------------------------------\n        const webClientProvisioner = new WebClientProvisioner({\n            clientRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await webClientProvisioner.ensureForRealm(realm);\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permission_id: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permission_id: permission.id,\n                    permission_realm_id: permission.realm_id,\n                    policy_id: defaultPolicy.id,\n                    policy_realm_id: defaultPolicy.realm_id,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoFA,IAAaoD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOV,WAAWa;EACvB,KAAKF,eAAe,CAACX,WAAWc,QAAQd,WAAWe,QAAAA;EACnD,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAA,GAAI,KAAKA,OAAAA;EAEzB,MAAMM,SAASD,UAAUE,QAAQhB,kBAAAA;EACjC,MAAMiB,kBAAkBlB,KAAKmB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIrB,GAAGsB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB,EAAEiB,KAAKL,gBAAgB,CAAA,CAAA;EAInE,MAAMO,OAAO,MAAMD,IADGnB,4BAA4BK,OAC/Bc,CAAAA,CAAUE,KAAKX,SAAAA;EAElC,MAAMY,aAAaZ,UAAUE,QAAQpB,qBAAqB+B,UAAU;EACpE,MAAMC,kBAAkBd,UAAUE,QAA2B1D,WAAAA;EAE7D,MAAMuE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYhB,UAAUE,QAAsC3D,gBAAAA;GAC5DuE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI7D,iBAAiByD,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC+B,UAAUE,QAAsChD,sBAAAA,CAAAA;EAGpD,MAAMiE,qBAAqB,IAAI3D,+BAA+B;GAC1DwD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI3C,sBAAsB;GAC7CuC,YAAYhB,UAAUE,QAA0BtD,UAAAA;GAChDkE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAItD,wBAAwB;GACjDiD,YAAYhB,UAAUE,QAA4B9D,YAAAA;GAClD0E;EACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI/D,mCAAmC;GAClEyD,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAI5D,6BAA6B;GACtDqD,YAAYI;GACZL;GACAS,0BAA0B,IAAIhD,gCAC1BwB,UAAUE,QAAoCrD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM4E,qBAAqB,IAAIpE,+BAA+B;GAC1DgE;GACAK,sBAAsB,IAAI1D,4BACtBgC,UAAUE,QAAgC5D,gBAAAA,CAAAA;GAE9CqF,4BAA4B,IAAI7D,kCAC5BkC,UAAUE,QAAsC7D,sBAAAA,CAAAA;GAGpD+E;GACAL;GAEAQ;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAI/D,6BAA6B;GACtDgE,gBAAgB,IAAIjD,sBAAsB;IACtCoC,YAAY,IAAI5D,eAAewD,UAAAA;IAC/BE;GACJ,CAAA;GACAgB,oBAAoB,IAAIjD,0BACpBmB,UAAUE,QAA8BlD,cAAAA,CAAAA;GAE5C+E,0BAA0B,IAAIpD,gCAC1BqB,UAAUE,QAAoCnD,oBAAAA,CAAAA;GAGlDsE;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMiB,oBAAoB,IAAItE,8BAA8B;GACxDuE,iBAAiB,IAAI3D,uBAAuB;IACxC0C,YAAYhB,UAAUE,QAA2BzD,WAAAA;IACjDqE;GACJ,CAAA;GACAoB,qBAAqB,IAAI3D,2BACrByB,UAAUE,QAA+BvD,eAAAA,CAAAA;GAE7CwF,2BAA2B,IAAI9D,iCAC3B2B,UAAUE,QAAqCxD,qBAAAA,CAAAA;GAGnD0E;GACAL;EACJ,CAAA;EAOA,MAAMsB,oBAAoB,IAAIzE,8BAA8B,EAAEoD,YAAYoB,IAL9C1D,uBAAuB;GAC/CsC,YAAYhB,UAAUE,QAA2BpD,WAAAA;GACjDgE;EACJ,CAE0EsB,EAAgB,CAAA;EAqB1F,MAAMG,IARuBjF,8BAA8B;GACvD6D;GACAG;GACAC;GACAe,mBAAAA,IAf0B7E,8BAA8B;IACxDuD,YAAY,IAAI5C,uBAAuB0C,eAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAI;IACAK;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY9B,IAAAA;EAOnC,MAAM+B,uBAAuB,IAAIpD,qBAAqB;GAClDgC;GACAqB,YAAYvD,cAAcc,MAAAA;GAC1B0C,QAAQ3C,UAAUE,QAAQd,kBAAAA;EAC9B,CAAA;EAEA,MAAMwD,SAAS,MAAM9B,gBAAgB+B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAChB,MAAMH,qBAAqBM,eAAeD,KAAAA;EAG9C,IAAI7C,OAAO+C,oCACP,MAAM,KAAKC,oBAAoBrC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgBgC,oBACZrC,YACAK,kBACa;EACb,MAAMiC,gBAAgB,MAAMjC,iBAAiBkC,cAAclG,iBAAiBmG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBzC,WAAW0C,cAAc/G,gBAAAA;EAChD,MAAMgH,eAAe3C,WAAW0C,cAAcpG,sBAAAA;EAE9C,MAAMsG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,eAAeH,WAAWI,GAAG,CAAA,GAG7E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,eAAeH,WAAWI;GAC1BG,qBAAqBP,WAAWQ;GAChCC,WAAWhB,cAAcW;GACzBM,iBAAiBjB,cAAce;EACnC,CAAA,CAAA;CAGZ;AACJ"}

package/dist/app/modules/provisioning/sources/composite/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/app/modules/provisioning/sources/composite/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/composite/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/app/modules/provisioning/sources/composite/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { CompositeProvisioningSource } from "./module.mjs";
+export { CompositeProvisioningSource };

package/dist/app/modules/provisioning/sources/composite/module.d.ts

@@ -0,0 +1,12 @@
+import type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';
+import type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';
+import type { IContainer } from 'eldin';
+export declare class CompositeProvisioningSource implements IProvisioningSource {
+    protected sources: IProvisioningSource[];
+    constructor(sources: IProvisioningSource[]);
+    load(container: IContainer): Promise<RootProvisioningEntity>;
+    merge(target: RootProvisioningEntity, source: RootProvisioningEntity): void;
+    private buildEntityKey;
+    private mergeEntities;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/app/modules/provisioning/sources/composite/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,SAAS,CAAC,OAAO,EAAG,mBAAmB,EAAE,CAAC;gBAE9B,OAAO,EAAG,mBAAmB,EAAE;IAIrC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAYlE,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB;IAQpE,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,aAAa;CAgCxB"}

package/dist/app/modules/provisioning/sources/composite/module.mjs

@@ -0,0 +1,46 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/app/modules/provisioning/sources/composite/module.ts
+var CompositeProvisioningSource = class {
+	sources;
+	constructor(sources) {
+		this.sources = sources;
+	}
+	async load(container) {
+		const output = {};
+		(await Promise.all(this.sources.map((source) => source.load(container)))).map((sourceData) => this.merge(output, sourceData));
+		return output;
+	}
+	merge(target, source) {
+		target.policies = this.mergeEntities(target.policies, source.policies);
+		target.permissions = this.mergeEntities(target.permissions, source.permissions);
+		target.roles = this.mergeEntities(target.roles, source.roles);
+		target.scopes = this.mergeEntities(target.scopes, source.scopes);
+		target.realms = this.mergeEntities(target.realms, source.realms);
+	}
+	buildEntityKey(attributes) {
+		if (!attributes.name) return void 0;
+		return `${attributes.name}:${attributes.realm_id || ""}:${attributes.client_id || ""}`;
+	}
+	mergeEntities(target, source) {
+		if (!source) return target;
+		if (!target) return [...source];
+		const result = [...target];
+		source.forEach((item) => {
+			const key = this.buildEntityKey(item.attributes);
+			if (!key) {
+				result.push(item);
+				return;
+			}
+			const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);
+			if (idx !== -1) result[idx] = item;
+			else result.push(item);
+		});
+		return result;
+	}
+};
+//#endregion
+export { CompositeProvisioningSource };
+
+//# sourceMappingURL=module.mjs.map

package/dist/app/modules/provisioning/sources/composite/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["CompositeProvisioningSource","sources","load","container","output","sourcesData","Promise","all","map","source","sourceData","merge","target","policies","mergeEntities","permissions","roles","scopes","realms","buildEntityKey","attributes","name","undefined","realm_id","client_id","result","forEach","item","key","push","idx","findIndex","r"],"sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport type { IContainer } from 'eldin';\n\nexport class CompositeProvisioningSource implements IProvisioningSource {\n    protected sources : IProvisioningSource[];\n\n    constructor(sources : IProvisioningSource[]) {\n        this.sources = sources;\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const output : RootProvisioningEntity = {};\n\n        const sourcesData = await Promise.all(\n            (this.sources).map((source) => source.load(container)),\n        );\n\n        sourcesData.map((sourceData) => this.merge(output, sourceData));\n\n        return output;\n    }\n\n    merge(target: RootProvisioningEntity, source: RootProvisioningEntity) {\n        target.policies = this.mergeEntities(target.policies, source.policies);\n        target.permissions = this.mergeEntities(target.permissions, source.permissions);\n        target.roles = this.mergeEntities(target.roles, source.roles);\n        target.scopes = this.mergeEntities(target.scopes, source.scopes);\n        target.realms = this.mergeEntities(target.realms, source.realms);\n    }\n\n    private buildEntityKey(\n        attributes: {\n            name?: string,\n            realm_id?: string | null,\n            client_id?: string | null\n        },\n    ): string | undefined {\n        if (!attributes.name) return undefined;\n        return `${attributes.name}:${attributes.realm_id || ''}:${attributes.client_id || ''}`;\n    }\n\n    private mergeEntities<\n        T extends {\n            attributes: {\n                name?: string,\n                realm_id?: string | null,\n                client_id?: string | null\n            }\n        },\n    >(\n        target: T[] | undefined,\n        source: T[] | undefined,\n    ): T[] | undefined {\n        if (!source) return target;\n        if (!target) return [...source];\n\n        const result = [...target];\n        source.forEach((item) => {\n            const key = this.buildEntityKey(item.attributes);\n            if (!key) {\n                result.push(item);\n                return;\n            }\n\n            const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);\n            if (idx !== -1) {\n                result[idx] = item;\n            } else {\n                result.push(item);\n            }\n        });\n        return result;\n    }\n}\n"],"mappings":";;;;AAWA,IAAaA,8BAAb,MAAaA;CACCC;CAEV,YAAYA,SAAiC;EACzC,KAAKA,UAAUA;CACnB;CAEA,MAAMC,KAAKC,WAAwD;EAC/D,MAAMC,SAAkC,CAAC;EAMzCC,CAAAA,MAJ0BC,QAAQC,IAC9B,KAAMN,QAASO,KAAKC,WAAWA,OAAOP,KAAKC,SAAAA,CAAAA,CAAAA,EAAAA,CAGnCK,KAAKE,eAAe,KAAKC,MAAMP,QAAQM,UAAAA,CAAAA;EAEnD,OAAON;CACX;CAEAO,MAAMC,QAAgCH,QAAgC;EAClEG,OAAOC,WAAW,KAAKC,cAAcF,OAAOC,UAAUJ,OAAOI,QAAQ;EACrED,OAAOG,cAAc,KAAKD,cAAcF,OAAOG,aAAaN,OAAOM,WAAW;EAC9EH,OAAOI,QAAQ,KAAKF,cAAcF,OAAOI,OAAOP,OAAOO,KAAK;EAC5DJ,OAAOK,SAAS,KAAKH,cAAcF,OAAOK,QAAQR,OAAOQ,MAAM;EAC/DL,OAAOM,SAAS,KAAKJ,cAAcF,OAAOM,QAAQT,OAAOS,MAAM;CACnE;CAEQC,eACJC,YAKkB;EAClB,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;EAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,YAAY,GAAG,GAAGH,WAAWI,aAAa;CACtF;CAEQV,cASJF,QACAH,QACe;EACf,IAAI,CAACA,QAAQ,OAAOG;EACpB,IAAI,CAACA,QAAQ,OAAO,CAAA,GAAIH,MAAAA;EAExB,MAAMgB,SAAS,CAAA,GAAIb,MAAAA;EACnBH,OAAOiB,SAASC,SAAAA;GACZ,MAAMC,MAAM,KAAKT,eAAeQ,KAAKP,UAAU;GAC/C,IAAI,CAACQ,KAAK;IACNH,OAAOI,KAAKF,IAAAA;IACZ;GACJ;GAEA,MAAMG,MAAML,OAAOM,WAAWC,MAAM,KAAKb,eAAea,EAAEZ,UAAU,MAAMQ,GAAAA;GAC1E,IAAIE,QAAQ,IACRL,OAAOK,OAAOH;QAEdF,OAAOI,KAAKF,IAAAA;EAEpB,CAAA;EACA,OAAOF;CACX;AACJ"}

package/dist/app/modules/provisioning/sources/default/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/app/modules/provisioning/sources/default/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/app/modules/provisioning/sources/default/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { DefaultProvisioningSource } from "./module.mjs";
+export { DefaultProvisioningSource };

package/dist/app/modules/provisioning/sources/default/module.d.ts

@@ -0,0 +1,18 @@
+import type { IContainer } from 'eldin';
+import type { Config } from '../../../config/index.ts';
+import type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';
+import type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';
+import type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';
+import type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';
+import type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';
+import type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';
+import type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';
+export declare class DefaultProvisioningSource implements IProvisioningSource {
+    buildPolicies(): PolicyProvisioningEntity[];
+    buildPermissions(): PermissionProvisioningEntity[];
+    buildScopes(): ScopeProvisioningEntity[];
+    buildRoles(): RoleProvisioningEntity[];
+    buildRealms(config: Config): Promise<RealmProvisioningEntity[]>;
+    load(container: IContainer): Promise<RootProvisioningEntity>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/app/modules/provisioning/sources/default/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAMxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IA6F3C,gBAAgB,IAAI,4BAA4B,EAAE;IA6BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IAmEhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IA8F/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}