@authup/server-core 1.0.0-beta.5 → 1.0.0-beta.51

package/dist/core/identity/password-recovery/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/constants.ts"],"names":[],"mappings":"AAOA;;;GAGG;AACH,eAAO,MAAM,iCAAiC,KAAK,CAAC"}

package/dist/core/identity/password-recovery/constants.mjs

@@ -0,0 +1,12 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/identity/password-recovery/constants.ts
+/**
+* Validity window of a password-reset code. Drives both the persisted
+* `reset_expires` timestamp and the expiry note in the reset mail.
+*/ const PASSWORD_RESET_EXPIRES_IN_MINUTES = 30;
+//#endregion
+export { PASSWORD_RESET_EXPIRES_IN_MINUTES };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/identity/password-recovery/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["PASSWORD_RESET_EXPIRES_IN_MINUTES"],"sources":["../../../../src/core/identity/password-recovery/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Validity window of a password-reset code. Drives both the persisted\n * `reset_expires` timestamp and the expiry note in the reset mail.\n */\nexport const PASSWORD_RESET_EXPIRES_IN_MINUTES = 30;\n"],"mappings":";;;;;;;GAWA,MAAaA,oCAAoC"}

package/dist/core/identity/password-recovery/disabled.d.ts

@@ -0,0 +1,6 @@
+import { BadRequestError } from '@authup/errors';
+export declare const PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE: unique symbol;
+export declare class PasswordRecoveryDisabledError extends BadRequestError {
+    constructor();
+}
+//# sourceMappingURL=disabled.d.ts.map

package/dist/core/identity/password-recovery/disabled.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disabled.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/disabled.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAA6B,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,yCAAyC,eAAkE,CAAC;AAEzH,qBAAa,6BAA8B,SAAQ,eAAe;;CAQjE"}

package/dist/core/identity/password-recovery/disabled.mjs

@@ -0,0 +1,19 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { BadRequestError, ErrorCode, markInstanceof } from "@authup/errors";
+//#region src/core/identity/password-recovery/disabled.ts
+const PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE = Symbol.for("@authup/server-core/PasswordRecoveryDisabledError");
+var PasswordRecoveryDisabledError = class extends BadRequestError {
+	constructor() {
+		super({
+			code: ErrorCode.PASSWORD_RECOVERY_DISABLED,
+			message: "Password recovery is not enabled."
+		});
+		markInstanceof(this, PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE);
+	}
+};
+//#endregion
+export { PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE, PasswordRecoveryDisabledError };
+
+//# sourceMappingURL=disabled.mjs.map

package/dist/core/identity/password-recovery/disabled.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"disabled.mjs","names":["BadRequestError","ErrorCode","markInstanceof","PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE","Symbol","for","PasswordRecoveryDisabledError","code","PASSWORD_RECOVERY_DISABLED","message"],"sources":["../../../../src/core/identity/password-recovery/disabled.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, ErrorCode, markInstanceof } from '@authup/errors';\n\nexport const PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE = Symbol.for('@authup/server-core/PasswordRecoveryDisabledError');\n\nexport class PasswordRecoveryDisabledError extends BadRequestError {\n    constructor() {\n        super({\n            code: ErrorCode.PASSWORD_RECOVERY_DISABLED,\n            message: 'Password recovery is not enabled.',\n        });\n        markInstanceof(this, PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaG,4CAA4CC,OAAOC,IAAI,mDAAA;AAEpE,IAAaC,gCAAb,cAAmDN,gBAAAA;CAC/C,cAAc;EACV,MAAM;GACFO,MAAMN,UAAUO;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,yCAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/email-verification-required.d.ts

@@ -0,0 +1,6 @@
+import { BadRequestError } from '@authup/errors';
+export declare const EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE: unique symbol;
+export declare class EmailVerificationRequiredError extends BadRequestError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=email-verification-required.d.ts.map

package/dist/core/identity/password-recovery/email-verification-required.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification-required.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/email-verification-required.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAA6B,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,0CAA0C,eAAmE,CAAC;AAE3H,qBAAa,8BAA+B,SAAQ,eAAe;gBACnD,OAAO,GAAE,MAA0C;CAOlE"}

package/dist/core/identity/password-recovery/email-verification-required.mjs

@@ -0,0 +1,19 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { BadRequestError, ErrorCode, markInstanceof } from "@authup/errors";
+//#region src/core/identity/password-recovery/email-verification-required.ts
+const EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE = Symbol.for("@authup/server-core/EmailVerificationRequiredError");
+var EmailVerificationRequiredError = class extends BadRequestError {
+	constructor(message = "Email verification is required.") {
+		super({
+			code: ErrorCode.EMAIL_VERIFICATION_REQUIRED,
+			message
+		});
+		markInstanceof(this, EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE);
+	}
+};
+//#endregion
+export { EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE, EmailVerificationRequiredError };
+
+//# sourceMappingURL=email-verification-required.mjs.map

package/dist/core/identity/password-recovery/email-verification-required.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification-required.mjs","names":["BadRequestError","ErrorCode","markInstanceof","EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE","Symbol","for","EmailVerificationRequiredError","message","code","EMAIL_VERIFICATION_REQUIRED"],"sources":["../../../../src/core/identity/password-recovery/email-verification-required.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, ErrorCode, markInstanceof } from '@authup/errors';\n\nexport const EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE = Symbol.for('@authup/server-core/EmailVerificationRequiredError');\n\nexport class EmailVerificationRequiredError extends BadRequestError {\n    constructor(message: string = 'Email verification is required.') {\n        super({\n            code: ErrorCode.EMAIL_VERIFICATION_REQUIRED,\n            message,\n        });\n        markInstanceof(this, EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaG,6CAA6CC,OAAOC,IAAI,oDAAA;AAErE,IAAaC,iCAAb,cAAoDN,gBAAAA;CAChD,YAAYO,UAAkB,mCAAmC;EAC7D,MAAM;GACFC,MAAMP,UAAUQ;GAChBF;EACJ,CAAA;EACAL,eAAe,MAAMC,0CAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/index.d.ts

@@ -0,0 +1,4 @@
+export * from './constants.ts';
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/password-recovery/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/identity/password-recovery/index.mjs

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PASSWORD_RESET_EXPIRES_IN_MINUTES } from "./constants.mjs";
+import { PasswordRecoveryService } from "./service.mjs";
+export { PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordRecoveryService };

package/dist/core/identity/password-recovery/service.d.ts

@@ -0,0 +1,17 @@
+import type { IPasswordRecoveryService, PasswordForgotResult, PasswordRecoveryServiceContext, PasswordRecoveryServiceOptions, PasswordResetResult } from './types.ts';
+import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
+import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IdentityWorkflowContext } from '../types.ts';
+export declare class PasswordRecoveryService implements IPasswordRecoveryService {
+    protected options: PasswordRecoveryServiceOptions;
+    protected repository: IUserRepository;
+    protected realmRepository: IRealmRepository;
+    protected mailClient: IMailClient;
+    protected mailTemplateRenderer: IMailTemplateRenderer;
+    constructor(ctx: PasswordRecoveryServiceContext);
+    forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult>;
+    resetPassword(data: Record<string, any>): Promise<PasswordResetResult>;
+    private runForgotPasswordValidator;
+    private runResetPasswordValidator;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/identity/password-recovery/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/service.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,mBAAmB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAG3D,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,OAAO,EAAE,8BAA8B,CAAC;IAElD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;gBAE1C,GAAG,EAAE,8BAA8B;IAQzC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAwE3G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;YA0C9D,0BAA0B;YAgC1B,yBAAyB;CAuC1C"}

package/dist/core/identity/password-recovery/service.mjs

@@ -0,0 +1,120 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { UserCredentialsService } from "../../authentication/credential/entities/user/module.mjs";
+import { MailTemplateName } from "../../mail/template/types.mjs";
+import "../../mail/index.mjs";
+import "./constants.mjs";
+import { PasswordRecoveryDisabledError } from "./disabled.mjs";
+import { EmailVerificationRequiredError } from "./email-verification-required.mjs";
+import { ResetTokenExpiredError } from "./token-expired.mjs";
+import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { Container } from "validup";
+import { createValidator } from "@validup/zod";
+import { z } from "zod";
+import { randomBytes } from "node:crypto";
+//#region src/core/identity/password-recovery/service.ts
+var PasswordRecoveryService = class {
+	options;
+	repository;
+	realmRepository;
+	mailClient;
+	mailTemplateRenderer;
+	constructor(ctx) {
+		this.options = ctx.options;
+		this.repository = ctx.repository;
+		this.realmRepository = ctx.realmRepository;
+		this.mailClient = ctx.mailClient;
+		this.mailTemplateRenderer = ctx.mailTemplateRenderer;
+	}
+	async forgotPassword(data, context) {
+		if (!this.options.passwordRecoveryEnabled) throw new PasswordRecoveryDisabledError();
+		if (!this.options.emailVerificationEnabled) throw new EmailVerificationRequiredError("Email verification is not enabled, but required to reset a password.");
+		const validated = await this.runForgotPasswordValidator(data);
+		const realm = await this.realmRepository.resolve(validated.realm_id, true);
+		const where = {
+			...validated.name ? { name: validated.name } : {},
+			...validated.email ? { email: validated.email } : {},
+			realm_id: realm.id
+		};
+		const entity = await this.repository.findOneByWithEmail(where);
+		if (!entity) throw new EntityNotFoundError();
+		const merged = this.repository.merge(entity, {
+			reset_expires: new Date(Date.now() + 1e3 * 60 * 30).toISOString(),
+			reset_hash: randomBytes(32).toString("hex")
+		});
+		await this.repository.save(merged);
+		try {
+			const resetUrl = this.options.publicUrl ? `${this.options.publicUrl.replace(/\/+$/, "")}/password-reset?token=${encodeURIComponent(merged.reset_hash)}&realm_id=${encodeURIComponent(entity.realm_id)}` : void 0;
+			const mail = await this.mailTemplateRenderer.render({
+				template: MailTemplateName.PASSWORD_RESET,
+				params: {
+					code: merged.reset_hash,
+					url: resetUrl,
+					expiresInMinutes: 30
+				},
+				locale: context?.locale
+			});
+			await this.mailClient.send({
+				to: entity.email,
+				...mail
+			});
+		} catch {
+			this.repository.merge(merged, {
+				reset_hash: null,
+				reset_expires: null
+			});
+			await this.repository.save(merged);
+			throw new BadRequestError("Password recovery failed. Could not send reset email.");
+		}
+		return { reset_expires: merged.reset_expires };
+	}
+	async resetPassword(data) {
+		if (!this.options.passwordRecoveryEnabled) throw new PasswordRecoveryDisabledError();
+		const validated = await this.runResetPasswordValidator(data);
+		await this.repository.validateJoinColumns(validated);
+		const realm = await this.realmRepository.resolve(validated.realm_id, true);
+		const where = {
+			...validated.name ? { name: validated.name } : {},
+			...validated.email ? { email: validated.email } : {},
+			reset_hash: validated.token,
+			realm_id: realm.id
+		};
+		const entity = await this.repository.findOneBy(where);
+		if (!entity) throw new EntityNotFoundError();
+		if (!entity.reset_expires || new Date(entity.reset_expires) < /* @__PURE__ */ new Date()) throw new ResetTokenExpiredError();
+		const hashedPassword = await new UserCredentialsService().protect(validated.password);
+		const merged = this.repository.merge(entity, {
+			reset_at: (/* @__PURE__ */ new Date()).toISOString(),
+			reset_hash: null,
+			reset_expires: null,
+			password: hashedPassword
+		});
+		await this.repository.save(merged);
+		return { reset_at: merged.reset_at };
+	}
+	async runForgotPasswordValidator(data) {
+		const validator = new Container({});
+		const oneOfContainer = new Container({ oneOf: true });
+		oneOfContainer.mount("email", createValidator(z.string().trim().toLowerCase().email().regex(/^[^A-Z]+$/, { message: "Email must be lowercase." })));
+		oneOfContainer.mount("name", createValidator(z.string().trim().toLowerCase().min(1)));
+		validator.mount(oneOfContainer);
+		validator.mount("realm_id", { optional: true }, createValidator(z.uuid().nullable()));
+		return validator.run(data);
+	}
+	async runResetPasswordValidator(data) {
+		const validator = new Container({});
+		const oneOfContainer = new Container({ oneOf: true });
+		oneOfContainer.mount("email", createValidator(z.string().trim().toLowerCase().email().regex(/^[^A-Z]+$/, { message: "Email must be lowercase." })));
+		oneOfContainer.mount("name", createValidator(z.string().trim().toLowerCase().min(1)));
+		validator.mount(oneOfContainer);
+		validator.mount("realm_id", { optional: true }, createValidator(z.uuid().nullable()));
+		validator.mount("token", createValidator(z.string().min(3).max(256)));
+		validator.mount("password", createValidator(z.string().min(5).max(512)));
+		return validator.run(data);
+	}
+};
+//#endregion
+export { PasswordRecoveryService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/identity/password-recovery/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BadRequestError","EntityNotFoundError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidator","randomBytes","Container","z","UserCredentialsService","MailTemplateName","PASSWORD_RESET_EXPIRES_IN_MINUTES","PasswordRecoveryService","options","repository","realmRepository","mailClient","mailTemplateRenderer","ctx","forgotPassword","data","context","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realm_id","where","name","email","id","entity","findOneByWithEmail","merged","merge","reset_expires","Date","now","toISOString","reset_hash","toString","save","resetUrl","publicUrl","replace","encodeURIComponent","undefined","mail","render","template","PASSWORD_RESET","params","code","url","expiresInMinutes","locale","send","to","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","reset_at","validator","oneOfContainer","oneOf","mount","string","trim","toLowerCase","regex","message","min","optional","uuid","nullable","run","max"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidator } from '@validup/zod';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IPasswordRecoveryService,\n    PasswordForgotResult,\n    PasswordRecoveryServiceContext,\n    PasswordRecoveryServiceOptions,\n    PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\nimport { PASSWORD_RESET_EXPIRES_IN_MINUTES } from './constants.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n    protected options: PasswordRecoveryServiceOptions;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    constructor(ctx: PasswordRecoveryServiceContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n    }\n\n    async forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        if (!this.options.emailVerificationEnabled) {\n            throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n        }\n\n        const validated = await this.runForgotPasswordValidator(data);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneByWithEmail(where);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            reset_expires: new Date(\n                Date.now() + (1000 * 60 * PASSWORD_RESET_EXPIRES_IN_MINUTES),\n            ).toISOString(),\n            reset_hash: randomBytes(32).toString('hex'),\n        });\n\n        await this.repository.save(merged);\n\n        try {\n            // realm_id MUST ride the link: resetPassword resolves the realm\n            // from the request and filters the lookup by it, so a realm-less\n            // link resolves to the master realm and never matches a\n            // non-master user.\n            const resetUrl = this.options.publicUrl ?\n                `${this.options.publicUrl.replace(/\\/+$/, '')}/password-reset` +\n                `?token=${encodeURIComponent(merged.reset_hash!)}` +\n                `&realm_id=${encodeURIComponent(entity.realm_id)}` :\n                undefined;\n\n            const mail = await this.mailTemplateRenderer.render({\n                template: MailTemplateName.PASSWORD_RESET,\n                params: {\n                    code: merged.reset_hash!,\n                    url: resetUrl,\n                    expiresInMinutes: PASSWORD_RESET_EXPIRES_IN_MINUTES,\n                },\n                locale: context?.locale,\n            });\n\n            await this.mailClient.send({\n                to: entity.email,\n                ...mail,\n            });\n        } catch {\n            this.repository.merge(merged, {\n                reset_hash: null,\n                reset_expires: null,\n            });\n            await this.repository.save(merged);\n\n            throw new BadRequestError('Password recovery failed. Could not send reset email.');\n        }\n\n        return { reset_expires: merged.reset_expires! };\n    }\n\n    async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        const validated = await this.runResetPasswordValidator(data);\n\n        await this.repository.validateJoinColumns(validated);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            reset_hash: validated.token,\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneBy(where);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!entity.reset_expires || new Date(entity.reset_expires) < new Date()) {\n            throw new ResetTokenExpiredError();\n        }\n\n        const credentialsService = new UserCredentialsService();\n        const hashedPassword = await credentialsService.protect(validated.password);\n\n        const merged = this.repository.merge(entity, {\n            reset_at: new Date().toISOString(),\n            reset_hash: null,\n            reset_expires: null,\n            password: hashedPassword,\n        });\n\n        await this.repository.save(merged);\n\n        return { reset_at: merged.reset_at! };\n    }\n\n    private async runForgotPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        return validator.run(data);\n    }\n\n    private async runResetPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        validator.mount(\n            'token',\n            createValidator(z.string().min(3).max(256)),\n        );\n\n        validator.mount(\n            'password',\n            createValidator(z.string().min(5).max(512)),\n        );\n\n        return validator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6BA,IAAaY,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKL,UAAUK,IAAIL;EACnB,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,uBAAuBC,IAAID;CACpC;CAEA,MAAME,eAAeC,MAA2BC,SAAkE;EAC9G,IAAI,CAAC,KAAKR,QAAQS,yBACd,MAAM,IAAIpB,8BAAAA;EAGd,IAAI,CAAC,KAAKW,QAAQU,0BACd,MAAM,IAAIpB,+BAA+B,sEAAA;EAG7C,MAAMqB,YAAY,MAAM,KAAKC,2BAA2BL,IAAAA;EAExD,MAAMM,QAAQ,MAAM,KAAKX,gBAAgBY,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKnB,WAAWoB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkC,SAAS,KAAKrB,WAAWsB,MAAMH,QAAQ;GACzCI,eAAe,IAAIC,KACfA,KAAKC,IAAG,IAAM,MAAO,KAAA,EAAK5B,CAAAA,CAC5B6B,YAAW;GACbC,YAAYnC,YAAY,EAAA,CAAA,CAAIoC,SAAS,KAAA;EACzC,CAAA;EAEA,MAAM,KAAK5B,WAAW6B,KAAKR,MAAAA;EAE3B,IAAI;GAKA,MAAMS,WAAW,KAAK/B,QAAQgC,YAC1B,GAAG,KAAKhC,QAAQgC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,wBACpCC,mBAAmBZ,OAAOM,UAAU,EAAA,YACjCM,mBAAmBd,OAAOL,QAAQ,MAC/CoB,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKhC,qBAAqBiC,OAAO;IAChDC,UAAUzC,iBAAiB0C;IAC3BC,QAAQ;KACJC,MAAMnB,OAAOM;KACbc,KAAKX;KACLY,kBAAAA;IACJ;IACAC,QAAQpC,SAASoC;GACrB,CAAA;GAEA,MAAM,KAAKzC,WAAW0C,KAAK;IACvBC,IAAI1B,OAAOF;IACX,GAAGkB;GACP,CAAA;EACJ,QAAQ;GACJ,KAAKnC,WAAWsB,MAAMD,QAAQ;IAC1BM,YAAY;IACZJ,eAAe;GACnB,CAAA;GACA,MAAM,KAAKvB,WAAW6B,KAAKR,MAAAA;GAE3B,MAAM,IAAInC,gBAAgB,uDAAA;EAC9B;EAEA,OAAO,EAAEqC,eAAeF,OAAOE,cAAe;CAClD;CAEA,MAAMuB,cAAcxC,MAAyD;EACzE,IAAI,CAAC,KAAKP,QAAQS,yBACd,MAAM,IAAIpB,8BAAAA;EAGd,MAAMsB,YAAY,MAAM,KAAKqC,0BAA0BzC,IAAAA;EAEvD,MAAM,KAAKN,WAAWgD,oBAAoBtC,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKX,gBAAgBY,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,YAAYjB,UAAUuC;GACtBnC,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKnB,WAAWkD,UAAUnC,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAACgC,OAAOI,iBAAiB,IAAIC,KAAKL,OAAOI,aAAa,oBAAI,IAAIC,KAAAA,GAC9D,MAAM,IAAIlC,uBAAAA;EAId,MAAM8D,iBAAiB,MAAMD,IADExD,uBACFwD,CAAAA,CAAmBE,QAAQ3C,UAAU4C,QAAQ;EAE1E,MAAMjC,SAAS,KAAKrB,WAAWsB,MAAMH,QAAQ;GACzCoC,2BAAU,IAAI/B,KAAAA,EAAAA,CAAOE,YAAW;GAChCC,YAAY;GACZJ,eAAe;GACf+B,UAAUF;EACd,CAAA;EAEA,MAAM,KAAKpD,WAAW6B,KAAKR,MAAAA;EAE3B,OAAO,EAAEkC,UAAUlC,OAAOkC,SAAU;CACxC;CAEA,MAAc5C,2BAA2BL,MAA2B;EAChE,MAAMkD,YAAY,IAAI/D,UAAe,CAAC,CAAA;EAEtC,MAAMgE,iBAAiB,IAAIhE,UAAU,EAAEiE,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MACX,SACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACX7C,MAAK,CAAA,CACL8C,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAItEP,eAAeE,MACX,QACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3E,gBAAgBG,EAAEyE,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrC,OAAOZ,UAAUa,IAAI/D,IAAAA;CACzB;CAEA,MAAcyC,0BAA0BzC,MAA2B;EAC/D,MAAMkD,YAAY,IAAI/D,UAAe,CAAC,CAAA;EAEtC,MAAMgE,iBAAiB,IAAIhE,UAAU,EAAEiE,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACX7C,MAAK,CAAA,CACL8C,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAGtEP,eAAeE,MACX,QACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3E,gBAAgBG,EAAEyE,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrCZ,UAAUG,MACN,SACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1Cd,UAAUG,MACN,YACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1C,OAAOd,UAAUa,IAAI/D,IAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/token-expired.d.ts

@@ -0,0 +1,6 @@
+import { BadRequestError } from '@authup/errors';
+export declare const RESET_TOKEN_EXPIRED_ERROR_INSTANCE: unique symbol;
+export declare class ResetTokenExpiredError extends BadRequestError {
+    constructor();
+}
+//# sourceMappingURL=token-expired.d.ts.map

package/dist/core/identity/password-recovery/token-expired.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-expired.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/token-expired.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAA6B,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,kCAAkC,eAA2D,CAAC;AAE3G,qBAAa,sBAAuB,SAAQ,eAAe;;CAQ1D"}

package/dist/core/identity/password-recovery/token-expired.mjs

@@ -0,0 +1,19 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { BadRequestError, ErrorCode, markInstanceof } from "@authup/errors";
+//#region src/core/identity/password-recovery/token-expired.ts
+const RESET_TOKEN_EXPIRED_ERROR_INSTANCE = Symbol.for("@authup/server-core/ResetTokenExpiredError");
+var ResetTokenExpiredError = class extends BadRequestError {
+	constructor() {
+		super({
+			code: ErrorCode.RESET_TOKEN_EXPIRED,
+			message: "Reset token has expired."
+		});
+		markInstanceof(this, RESET_TOKEN_EXPIRED_ERROR_INSTANCE);
+	}
+};
+//#endregion
+export { RESET_TOKEN_EXPIRED_ERROR_INSTANCE, ResetTokenExpiredError };
+
+//# sourceMappingURL=token-expired.mjs.map

package/dist/core/identity/password-recovery/token-expired.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-expired.mjs","names":["BadRequestError","ErrorCode","markInstanceof","RESET_TOKEN_EXPIRED_ERROR_INSTANCE","Symbol","for","ResetTokenExpiredError","code","RESET_TOKEN_EXPIRED","message"],"sources":["../../../../src/core/identity/password-recovery/token-expired.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, ErrorCode, markInstanceof } from '@authup/errors';\n\nexport const RESET_TOKEN_EXPIRED_ERROR_INSTANCE = Symbol.for('@authup/server-core/ResetTokenExpiredError');\n\nexport class ResetTokenExpiredError extends BadRequestError {\n    constructor() {\n        super({\n            code: ErrorCode.RESET_TOKEN_EXPIRED,\n            message: 'Reset token has expired.',\n        });\n        markInstanceof(this, RESET_TOKEN_EXPIRED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaG,qCAAqCC,OAAOC,IAAI,4CAAA;AAE7D,IAAaC,yBAAb,cAA4CN,gBAAAA;CACxC,cAAc;EACV,MAAM;GACFO,MAAMN,UAAUO;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,kCAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/types.d.ts

@@ -0,0 +1,26 @@
+import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
+import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IdentityWorkflowContext } from '../types.ts';
+export type PasswordRecoveryServiceOptions = {
+    passwordRecoveryEnabled?: boolean;
+    emailVerificationEnabled?: boolean;
+    publicUrl?: string;
+};
+export type PasswordRecoveryServiceContext = {
+    options: PasswordRecoveryServiceOptions;
+    mailClient: IMailClient;
+    mailTemplateRenderer: IMailTemplateRenderer;
+    repository: IUserRepository;
+    realmRepository: IRealmRepository;
+};
+export type PasswordForgotResult = {
+    reset_expires: string;
+};
+export type PasswordResetResult = {
+    reset_at: string;
+};
+export interface IPasswordRecoveryService {
+    forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult>;
+    resetPassword(data: Record<string, any>): Promise<PasswordResetResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/password-recovery/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,8BAA8B,GAAG;IACzC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1E"}

package/dist/core/identity/password-recovery/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/identity/permission/checker/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/permission/checker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/permission/checker/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/identity/permission/checker/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PermissionCheckerService } from "./service.mjs";
+export { PermissionCheckerService };

package/dist/core/identity/permission/checker/service.d.ts

@@ -0,0 +1,10 @@
+import type { Result } from '@authup/kit';
+import type { ActorContext } from '@authup/server-kit';
+import type { IPermissionCheckerService, PermissionCheckerServiceContext } from './types.ts';
+export declare class PermissionCheckerService implements IPermissionCheckerService {
+    protected ctx: PermissionCheckerServiceContext;
+    constructor(ctx: PermissionCheckerServiceContext);
+    check(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<void>;
+    safeCheck(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<Result<null>>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/identity/permission/checker/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/permission/checker/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EACR,yBAAyB,EACzB,+BAA+B,EAClC,MAAM,YAAY,CAAC;AAEpB,qBAAa,wBAAyB,YAAW,yBAAyB;IACtE,SAAS,CAAC,GAAG,EAAE,+BAA+B,CAAC;gBAEnC,GAAG,EAAE,+BAA+B;IAI1C,KAAK,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAiDV,SAAS,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ3B"}

package/dist/core/identity/permission/checker/service.mjs

@@ -0,0 +1,60 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PolicyEngine as PolicyEngine$1 } from "../../../security/policy/engine.mjs";
+import { toIdentityPolicyData } from "../identity-policy-data.mjs";
+import { hasOwnProperty, isUUID } from "@authup/kit";
+import { BuiltInPolicyType, PermissionEvaluator, definePolicyData } from "@authup/access";
+import { EntityNotFoundError, normalizeError } from "@authup/errors";
+//#region src/core/identity/permission/checker/service.ts
+var PermissionCheckerService = class {
+	ctx;
+	constructor(ctx) {
+		this.ctx = ctx;
+	}
+	async check(idOrName, data, actor, realm) {
+		let criteria;
+		if (isUUID(idOrName)) criteria = { id: idOrName };
+		else {
+			const realmEntity = await this.ctx.realmRepository.resolve(realm);
+			criteria = {
+				name: idOrName,
+				...realmEntity ? { realm_id: realmEntity.id } : {}
+			};
+		}
+		const entity = await this.ctx.repository.findOneBy(criteria);
+		if (!entity) throw new EntityNotFoundError();
+		const input = { ...data };
+		if (typeof input[BuiltInPolicyType.IDENTITY] === "undefined") input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);
+		const attributes = input[BuiltInPolicyType.ATTRIBUTES];
+		if (attributes && hasOwnProperty(attributes, "realm_id")) input[BuiltInPolicyType.REALM_MATCH] = attributes.realm_id ?? null;
+		const evaluationContext = {
+			name: entity.name,
+			data: definePolicyData(input)
+		};
+		const evaluator = new PermissionEvaluator({
+			provider: this.ctx.permissionProvider,
+			policyEngine: new PolicyEngine$1(this.ctx.identityPermissionProvider)
+		});
+		if (evaluationContext.data && evaluationContext.data.has(BuiltInPolicyType.ATTRIBUTES)) await evaluator.evaluate(evaluationContext);
+		else await evaluator.preEvaluate(evaluationContext);
+	}
+	async safeCheck(idOrName, data, actor, realm) {
+		try {
+			await this.check(idOrName, data, actor, realm);
+			return {
+				success: true,
+				data: null
+			};
+		} catch (e) {
+			return {
+				success: false,
+				error: normalizeError(e)
+			};
+		}
+	}
+};
+//#endregion
+export { PermissionCheckerService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/identity/permission/checker/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionEvaluator","definePolicyData","hasOwnProperty","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PermissionCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","realmEntity","realmRepository","resolve","name","realm_id","entity","repository","findOneBy","input","IDENTITY","identity","attributes","ATTRIBUTES","REALM_MATCH","evaluationContext","evaluator","provider","permissionProvider","policyEngine","identityPermissionProvider","has","evaluate","preEvaluate","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/permission/checker/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PermissionEvaluationContext } from '@authup/access';\nimport { BuiltInPolicyType, PermissionEvaluator, definePolicyData } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { hasOwnProperty, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../identity-policy-data.ts';\nimport type {\n    IPermissionCheckerService,\n    PermissionCheckerServiceContext,\n} from './types.ts';\n\nexport class PermissionCheckerService implements IPermissionCheckerService {\n    protected ctx: PermissionCheckerServiceContext;\n\n    constructor(ctx: PermissionCheckerServiceContext) {\n        this.ctx = ctx;\n    }\n\n    async check(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<void> {\n        let criteria: Record<string, any>;\n        if (isUUID(idOrName)) {\n            criteria = { id: idOrName };\n        } else {\n            const realmEntity = await this.ctx.realmRepository.resolve(realm);\n            criteria = {\n                name: idOrName,\n                ...(realmEntity ? { realm_id: realmEntity.id } : {}),\n            };\n        }\n\n        const entity = await this.ctx.repository.findOneBy(criteria);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const input = { ...data };\n        if (typeof input[BuiltInPolicyType.IDENTITY] === 'undefined') {\n            input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n        }\n        // Surface the resource realm to the realm_scope reach factor (realm-match scope mode).\n        // Only when the body carries an ATTRIBUTES realm — so a realm-less check still rides\n        // the preEvaluate path below and neutral-passes.\n        const attributes = input[BuiltInPolicyType.ATTRIBUTES] as Record<string, any> | undefined;\n        if (attributes && hasOwnProperty(attributes, 'realm_id')) {\n            input[BuiltInPolicyType.REALM_MATCH] = attributes.realm_id ?? null;\n        }\n\n        const evaluationContext: PermissionEvaluationContext = {\n            name: entity.name,\n            data: definePolicyData(input),\n        };\n\n        const evaluator = new PermissionEvaluator({\n            provider: this.ctx.permissionProvider,\n            policyEngine: new PolicyEngine(this.ctx.identityPermissionProvider),\n        });\n\n        if (\n            evaluationContext.data &&\n            evaluationContext.data.has(BuiltInPolicyType.ATTRIBUTES)\n        ) {\n            await evaluator.evaluate(evaluationContext);\n        } else {\n            await evaluator.preEvaluate(evaluationContext);\n        }\n    }\n\n    async safeCheck(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Result<null>> {\n        try {\n            await this.check(idOrName, data, actor, realm);\n            return { success: true, data: null };\n        } catch (e) {\n            return { success: false, error: normalizeError(e) };\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaS,2BAAb,MAAaA;CACCC;CAEV,YAAYA,KAAsC;EAC9C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACH,MAAMM,cAAc,MAAM,KAAKR,IAAIS,gBAAgBC,QAAQL,KAAAA;GAC3DC,WAAW;IACPK,MAAMT;IACN,GAAIM,cAAc,EAAEI,UAAUJ,YAAYD,GAAG,IAAI,CAAC;GACtD;EACJ;EAEA,MAAMM,SAAS,MAAM,KAAKb,IAAIc,WAAWC,UAAUT,QAAAA;EACnD,IAAI,CAACO,QACD,MAAM,IAAIlB,oBAAAA;EAGd,MAAMqB,QAAQ,EAAE,GAAGb,KAAK;EACxB,IAAI,OAAOa,MAAM1B,kBAAkB2B,cAAc,aAC7CD,MAAM1B,kBAAkB2B,YAAYnB,qBAAqBM,MAAMc,QAAQ;EAK3E,MAAMC,aAAaH,MAAM1B,kBAAkB8B;EAC3C,IAAID,cAAc1B,eAAe0B,YAAY,UAAA,GACzCH,MAAM1B,kBAAkB+B,eAAeF,WAAWP,YAAY;EAGlE,MAAMU,oBAAiD;GACnDX,MAAME,OAAOF;GACbR,MAAMX,iBAAiBwB,KAAAA;EAC3B;EAEA,MAAMO,YAAY,IAAIhC,oBAAoB;GACtCiC,UAAU,KAAKxB,IAAIyB;GACnBC,cAAc,IAAI7B,eAAa,KAAKG,IAAI2B,0BAA0B;EACtE,CAAA;EAEA,IACIL,kBAAkBnB,QAClBmB,kBAAkBnB,KAAKyB,IAAItC,kBAAkB8B,UAAU,GAEvD,MAAMG,UAAUM,SAASP,iBAAAA;OAEzB,MAAMC,UAAUO,YAAYR,iBAAAA;CAEpC;CAEA,MAAMS,UACF7B,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAE2B,SAAS;IAAM7B,MAAM;GAAK;EACvC,SAAS8B,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAOtC,eAAeqC,CAAAA;GAAG;EACtD;CACJ;AACJ"}

package/dist/core/identity/permission/checker/types.d.ts

@@ -0,0 +1,42 @@
+import type { IPermissionProvider } from '@authup/access';
+import type { Result } from '@authup/kit';
+import type { ActorContext } from '@authup/server-kit';
+import type { IPermissionRepository, IRealmRepository } from '../../../entities/index.ts';
+import type { IIdentityPermissionProvider } from '../types.ts';
+export type PermissionCheckerServiceContext = {
+    repository: IPermissionRepository;
+    realmRepository: IRealmRepository;
+    permissionProvider: IPermissionProvider;
+    identityPermissionProvider: IIdentityPermissionProvider;
+};
+export interface IPermissionCheckerService {
+    /**
+     * Resolve a permission by id (UUID) or name and evaluate it against
+     * the supplied data and actor. Throws on any failure — entity not
+     * found, evaluator denial, validator error.
+     *
+     * If `data[identity]` is omitted, the actor's identity (flattened to
+     * `IdentityPolicyData`) is injected. If `data[attributes]` is present,
+     * the evaluator runs a full `evaluate`; otherwise it runs a
+     * `preEvaluate` (data-less gate check).
+     *
+     * @param idOrName Permission UUID or name. Names are resolved within
+     *   the supplied realm (or the resolved fallback realm).
+     * @param data Caller-supplied evaluation input. Mutated copy is used
+     *   internally.
+     * @param actor The caller context. `actor.identity` becomes the
+     *   default identity input when `data[identity]` is unset.
+     * @param realm Optional realm id used to disambiguate name lookups.
+     * @throws {EntityNotFoundError} When no permission matches.
+     * @throws {Error} Whatever the evaluator throws on denial.
+     */
+    check(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<void>;
+    /**
+     * Same as `check`, but never throws — collapses any failure into a
+     * `Result<null>` with `success: false` and the originating error.
+     * Use this at boundaries that want to embed denial in a response body
+     * rather than propagate it.
+     */
+    safeCheck(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<Result<null>>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/permission/checker/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/permission/checker/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EACR,qBAAqB,EACrB,gBAAgB,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE/D,MAAM,MAAM,+BAA+B,GAAG;IAC1C,UAAU,EAAE,qBAAqB,CAAC;IAClC,eAAe,EAAE,gBAAgB,CAAC;IAClC,kBAAkB,EAAE,mBAAmB,CAAC;IACxC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,MAAM,WAAW,yBAAyB;IACtC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CACD,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;OAKG;IACH,SAAS,CACL,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;CAC5B"}

package/dist/core/identity/permission/checker/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/identity/permission/identity-policy-data.d.ts

@@ -0,0 +1,4 @@
+import type { IdentityPolicyData } from '@authup/access';
+import type { Identity } from '@authup/core-kit';
+export declare function toIdentityPolicyData(identity: Identity | undefined): IdentityPolicyData | undefined;
+//# sourceMappingURL=identity-policy-data.d.ts.map

package/dist/core/identity/permission/identity-policy-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-policy-data.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/identity-policy-data.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAAG,kBAAkB,GAAG,SAAS,CA4BnG"}

package/dist/core/identity/permission/identity-policy-data.mjs

@@ -0,0 +1,26 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityType } from "@authup/core-kit";
+//#region src/core/identity/permission/identity-policy-data.ts
+function toIdentityPolicyData(identity) {
+	if (!identity) return;
+	const { type, data } = identity;
+	let clientId;
+	if (type === IdentityType.CLIENT) clientId = data.id;
+	else if ("client_id" in data) clientId = data.client_id ?? null;
+	else clientId = null;
+	let realmId = data.realm_id ?? null;
+	if (!realmId && data.realm && data.realm.id) realmId = data.realm.id ?? null;
+	return {
+		type,
+		id: data.id,
+		clientId,
+		realmId,
+		realmName: data.realm?.name ?? null
+	};
+}
+//#endregion
+export { toIdentityPolicyData };
+
+//# sourceMappingURL=identity-policy-data.mjs.map

package/dist/core/identity/permission/identity-policy-data.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-policy-data.mjs","names":["IdentityType","toIdentityPolicyData","identity","undefined","type","data","clientId","CLIENT","id","client_id","realmId","realm_id","realm","realmName","name"],"sources":["../../../../src/core/identity/permission/identity-policy-data.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityPolicyData } from '@authup/access';\nimport { IdentityType } from '@authup/core-kit';\nimport type { Identity } from '@authup/core-kit';\n\nexport function toIdentityPolicyData(identity: Identity | undefined): IdentityPolicyData | undefined {\n    if (!identity) {\n        return undefined;\n    }\n\n    const { type, data } = identity;\n\n    let clientId: string | null;\n    if (type === IdentityType.CLIENT) {\n        clientId = data.id;\n    } else if ('client_id' in data) {\n        clientId = data.client_id ?? null;\n    } else {\n        clientId = null;\n    }\n\n    let realmId: string | null = data.realm_id ?? null;\n    if (!realmId && data.realm && data.realm.id) {\n        realmId = data.realm.id ?? null;\n    }\n\n    return {\n        type,\n        id: data.id,\n        clientId,\n        realmId,\n        realmName: data.realm?.name ?? null,\n    };\n}\n"],"mappings":";;;;;AAWA,SAAgBC,qBAAqBC,UAA8B;CAC/D,IAAI,CAACA,UACD;CAGJ,MAAM,EAAEE,MAAMC,SAASH;CAEvB,IAAII;CACJ,IAAIF,SAASJ,aAAaO,QACtBD,WAAWD,KAAKG;MACb,IAAI,eAAeH,MACtBC,WAAWD,KAAKI,aAAa;MAE7BH,WAAW;CAGf,IAAII,UAAyBL,KAAKM,YAAY;CAC9C,IAAI,CAACD,WAAWL,KAAKO,SAASP,KAAKO,MAAMJ,IACrCE,UAAUL,KAAKO,MAAMJ,MAAM;CAG/B,OAAO;EACHJ;EACAI,IAAIH,KAAKG;EACTF;EACAI;EACAG,WAAWR,KAAKO,OAAOE,QAAQ;CACnC;AACJ"}

package/dist/core/identity/permission/index.d.ts

@@ -0,0 +1,5 @@
+export * from './checker/index.ts';
+export * from './junction-grant.ts';
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/permission/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/permission/index.mjs

@@ -0,0 +1,8 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { applyJunctionCreateGrant, buildJunctionUpdateData } from "./junction-grant.mjs";
+import { PermissionCheckerService } from "./checker/service.mjs";
+import "./checker/index.mjs";
+import { IdentityPermissionProvider } from "./module.mjs";
+export { IdentityPermissionProvider, PermissionCheckerService, applyJunctionCreateGrant, buildJunctionUpdateData };