@authup/server-core 1.0.0-beta.5 → 1.0.0-beta.51

package/dist/core/identity/permission/junction-grant.d.ts

@@ -0,0 +1,49 @@
+import { RealmScope } from '@authup/access';
+import type { ResolveJunctionGrantResult } from './types.ts';
+/**
+ * The privilege-escalation boundary for permission-binding junctions, shared verbatim by
+ * role/user/client/robot-permission. Kept in ONE place (rather than copied into each service)
+ * so the fail-closed cap/inherit rule is audited and changed once — see #3160 / #3158 / #3159,
+ * which each had to patch this rule across all four services.
+ *
+ * It depends on a server-core type (`ResolveJunctionGrantResult`) and so cannot live on the
+ * generic `JunctionEntityService` in `@authup/server-kit` (that would invert the layering).
+ */
+/**
+ * Cap a junction CREATE to the actor's request-relative selected grant and inherit its policy.
+ *
+ * - `realm_scope` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).
+ * - The policy follows the grant: only a genuinely unrestricted actor (an UNCAPPED `any` reach
+ *   AND no policy) may keep an explicitly-requested `policy_id`; any restricted/policy-bound
+ *   actor inherits its own grant's policy (it can neither attach an unowned policy nor detach to
+ *   widen). The check reads `grant.realmScope` UNCAPPED precisely to distinguish that case — the
+ *   grant is returned uncapped by `resolveJunctionGrant` for exactly this reason.
+ *
+ * Mutates `validated` in place (mirrors the surrounding service style).
+ */
+export declare function applyJunctionCreateGrant(validated: Record<string, any>, grant: ResolveJunctionGrantResult): void;
+export type BuildJunctionUpdateDataInput = {
+    /** The validated update payload (UPDATE group) — presence of a key signals caller intent. */
+    data: Record<string, any>;
+    /** The persisted junction's current reach (used to re-cap a policy-only edit). */
+    existingScope: `${RealmScope}`;
+    /** The actor's UNCAPPED selected reach for this permission (`any` for system context). */
+    actorScope: `${RealmScope}`;
+    /** Whether the actor's selected grant carries no policy. */
+    actorPolicyFree: boolean;
+    /** The id of the actor's selected grant policy (null when policy-free). */
+    actorPolicyId: string | null;
+};
+/**
+ * Build the `{ realm_scope?, policy_id? }` delta for a junction UPDATE, capped to the actor's
+ * request-relative grant.
+ *
+ * - An unrestricted (`any`, policy-free) actor may set/clear `policy_id` explicitly and is never
+ *   narrowed.
+ * - A restricted/policy-bound actor that touches the binding inherits its own grant's policy AND
+ *   has the reach re-capped — including the EXISTING `realm_scope` when the update omits it, so a
+ *   policy-only edit cannot leave a wider pre-existing reach standing (fail-OPEN otherwise: the
+ *   persisted binding must always be dominated by a grant the actor really holds — #3160).
+ */
+export declare function buildJunctionUpdateData(input: BuildJunctionUpdateDataInput): Record<string, any>;
+//# sourceMappingURL=junction-grant.d.ts.map

package/dist/core/identity/permission/junction-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"junction-grant.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/junction-grant.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAiB,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAE7D;;;;;;;;GAQG;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,KAAK,EAAE,0BAA0B,GAClC,IAAI,CAMN;AAED,MAAM,MAAM,4BAA4B,GAAG;IACvC,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,kFAAkF;IAClF,aAAa,EAAE,GAAG,UAAU,EAAE,CAAC;IAC/B,0FAA0F;IAC1F,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC;IAC5B,4DAA4D;IAC5D,eAAe,EAAE,OAAO,CAAC;IACzB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAkChG"}

package/dist/core/identity/permission/junction-grant.mjs

@@ -0,0 +1,57 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { hasOwnProperty } from "@authup/kit";
+import { RealmScope, minRealmScope } from "@authup/access";
+//#region src/core/identity/permission/junction-grant.ts
+/**
+* The privilege-escalation boundary for permission-binding junctions, shared verbatim by
+* role/user/client/robot-permission. Kept in ONE place (rather than copied into each service)
+* so the fail-closed cap/inherit rule is audited and changed once — see #3160 / #3158 / #3159,
+* which each had to patch this rule across all four services.
+*
+* It depends on a server-core type (`ResolveJunctionGrantResult`) and so cannot live on the
+* generic `JunctionEntityService` in `@authup/server-kit` (that would invert the layering).
+*/ /**
+* Cap a junction CREATE to the actor's request-relative selected grant and inherit its policy.
+*
+* - `realm_scope` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).
+* - The policy follows the grant: only a genuinely unrestricted actor (an UNCAPPED `any` reach
+*   AND no policy) may keep an explicitly-requested `policy_id`; any restricted/policy-bound
+*   actor inherits its own grant's policy (it can neither attach an unowned policy nor detach to
+*   widen). The check reads `grant.realmScope` UNCAPPED precisely to distinguish that case — the
+*   grant is returned uncapped by `resolveJunctionGrant` for exactly this reason.
+*
+* Mutates `validated` in place (mirrors the surrounding service style).
+*/ function applyJunctionCreateGrant(validated, grant) {
+	validated.realm_scope = minRealmScope([validated.realm_scope ?? RealmScope.OWN, grant.realmScope]);
+	if (grant.realmScope !== RealmScope.ANY || grant.policy) validated.policy_id = grant.policy ? grant.policy.id : null;
+}
+/**
+* Build the `{ realm_scope?, policy_id? }` delta for a junction UPDATE, capped to the actor's
+* request-relative grant.
+*
+* - An unrestricted (`any`, policy-free) actor may set/clear `policy_id` explicitly and is never
+*   narrowed.
+* - A restricted/policy-bound actor that touches the binding inherits its own grant's policy AND
+*   has the reach re-capped — including the EXISTING `realm_scope` when the update omits it, so a
+*   policy-only edit cannot leave a wider pre-existing reach standing (fail-OPEN otherwise: the
+*   persisted binding must always be dominated by a grant the actor really holds — #3160).
+*/ function buildJunctionUpdateData(input) {
+	const { data, existingScope, actorScope, actorPolicyFree, actorPolicyId } = input;
+	const updateData = {};
+	const touchesScope = hasOwnProperty(data, "realm_scope");
+	const touchesPolicy = hasOwnProperty(data, "policy_id");
+	if (touchesScope) updateData.realm_scope = minRealmScope([data.realm_scope, actorScope]);
+	if (actorScope === RealmScope.ANY && actorPolicyFree) {
+		if (touchesPolicy) updateData.policy_id = data.policy_id;
+	} else if (touchesScope || touchesPolicy) {
+		updateData.policy_id = actorPolicyId;
+		if (!touchesScope) updateData.realm_scope = minRealmScope([existingScope, actorScope]);
+	}
+	return updateData;
+}
+//#endregion
+export { applyJunctionCreateGrant, buildJunctionUpdateData };
+
+//# sourceMappingURL=junction-grant.mjs.map

package/dist/core/identity/permission/junction-grant.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"junction-grant.mjs","names":["RealmScope","minRealmScope","hasOwnProperty","applyJunctionCreateGrant","validated","grant","realm_scope","OWN","realmScope","ANY","policy","policy_id","id","buildJunctionUpdateData","input","data","existingScope","actorScope","actorPolicyFree","actorPolicyId","updateData","touchesScope","touchesPolicy"],"sources":["../../../../src/core/identity/permission/junction-grant.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { RealmScope, minRealmScope } from '@authup/access';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { ResolveJunctionGrantResult } from './types.ts';\n\n/**\n * The privilege-escalation boundary for permission-binding junctions, shared verbatim by\n * role/user/client/robot-permission. Kept in ONE place (rather than copied into each service)\n * so the fail-closed cap/inherit rule is audited and changed once — see #3160 / #3158 / #3159,\n * which each had to patch this rule across all four services.\n *\n * It depends on a server-core type (`ResolveJunctionGrantResult`) and so cannot live on the\n * generic `JunctionEntityService` in `@authup/server-kit` (that would invert the layering).\n */\n\n/**\n * Cap a junction CREATE to the actor's request-relative selected grant and inherit its policy.\n *\n * - `realm_scope` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).\n * - The policy follows the grant: only a genuinely unrestricted actor (an UNCAPPED `any` reach\n *   AND no policy) may keep an explicitly-requested `policy_id`; any restricted/policy-bound\n *   actor inherits its own grant's policy (it can neither attach an unowned policy nor detach to\n *   widen). The check reads `grant.realmScope` UNCAPPED precisely to distinguish that case — the\n *   grant is returned uncapped by `resolveJunctionGrant` for exactly this reason.\n *\n * Mutates `validated` in place (mirrors the surrounding service style).\n */\nexport function applyJunctionCreateGrant(\n    validated: Record<string, any>,\n    grant: ResolveJunctionGrantResult,\n): void {\n    validated.realm_scope = minRealmScope([validated.realm_scope ?? RealmScope.OWN, grant.realmScope]);\n\n    if (grant.realmScope !== RealmScope.ANY || grant.policy) {\n        validated.policy_id = grant.policy ? grant.policy.id : null;\n    }\n}\n\nexport type BuildJunctionUpdateDataInput = {\n    /** The validated update payload (UPDATE group) — presence of a key signals caller intent. */\n    data: Record<string, any>,\n    /** The persisted junction's current reach (used to re-cap a policy-only edit). */\n    existingScope: `${RealmScope}`,\n    /** The actor's UNCAPPED selected reach for this permission (`any` for system context). */\n    actorScope: `${RealmScope}`,\n    /** Whether the actor's selected grant carries no policy. */\n    actorPolicyFree: boolean,\n    /** The id of the actor's selected grant policy (null when policy-free). */\n    actorPolicyId: string | null,\n};\n\n/**\n * Build the `{ realm_scope?, policy_id? }` delta for a junction UPDATE, capped to the actor's\n * request-relative grant.\n *\n * - An unrestricted (`any`, policy-free) actor may set/clear `policy_id` explicitly and is never\n *   narrowed.\n * - A restricted/policy-bound actor that touches the binding inherits its own grant's policy AND\n *   has the reach re-capped — including the EXISTING `realm_scope` when the update omits it, so a\n *   policy-only edit cannot leave a wider pre-existing reach standing (fail-OPEN otherwise: the\n *   persisted binding must always be dominated by a grant the actor really holds — #3160).\n */\nexport function buildJunctionUpdateData(input: BuildJunctionUpdateDataInput): Record<string, any> {\n    const {\n        data, \n        existingScope, \n        actorScope, \n        actorPolicyFree, \n        actorPolicyId,\n    } = input;\n\n    const updateData: Record<string, any> = {};\n\n    const touchesScope = hasOwnProperty(data, 'realm_scope');\n    const touchesPolicy = hasOwnProperty(data, 'policy_id');\n\n    // CAP to the actor's ceiling — a restricted actor may narrow but never widen.\n    // (`data` is the validated UPDATE payload, so realm_scope is already a valid enum value;\n    // minRealmScope additionally normalizes any out-of-band input fail-closed to `own`.)\n    if (touchesScope) {\n        updateData.realm_scope = minRealmScope([data.realm_scope as `${RealmScope}`, actorScope]);\n    }\n\n    if (actorScope === RealmScope.ANY && actorPolicyFree) {\n        if (touchesPolicy) {\n            updateData.policy_id = data.policy_id;\n        }\n    } else if (touchesScope || touchesPolicy) {\n        updateData.policy_id = actorPolicyId;\n\n        if (!touchesScope) {\n            updateData.realm_scope = minRealmScope([existingScope, actorScope]);\n        }\n    }\n\n    return updateData;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;GAiCA,SAAgBG,yBACZC,WACAC,OAAiC;CAEjCD,UAAUE,cAAcL,cAAc,CAACG,UAAUE,eAAeN,WAAWO,KAAKF,MAAMG,UAAAA,CAAW;CAEjG,IAAIH,MAAMG,eAAeR,WAAWS,OAAOJ,MAAMK,QAC7CN,UAAUO,YAAYN,MAAMK,SAASL,MAAMK,OAAOE,KAAK;AAE/D;;;;;;;;;;;GA0BA,SAAgBC,wBAAwBC,OAAmC;CACvE,MAAM,EACFC,MACAC,eACAC,YACAC,iBACAC,kBACAL;CAEJ,MAAMM,aAAkC,CAAC;CAEzC,MAAMC,eAAenB,eAAea,MAAM,aAAA;CAC1C,MAAMO,gBAAgBpB,eAAea,MAAM,WAAA;CAK3C,IAAIM,cACAD,WAAWd,cAAcL,cAAc,CAACc,KAAKT,aAAgCW,UAAAA,CAAW;CAG5F,IAAIA,eAAejB,WAAWS,OAAOS;MAC7BI,eACAF,WAAWT,YAAYI,KAAKJ;CAAAA,OAE7B,IAAIU,gBAAgBC,eAAe;EACtCF,WAAWT,YAAYQ;EAEvB,IAAI,CAACE,cACDD,WAAWd,cAAcL,cAAc,CAACe,eAAeC,UAAAA,CAAW;CAE1E;CAEA,OAAOG;AACX"}

package/dist/core/identity/permission/module.d.ts

@@ -0,0 +1,25 @@
+import type { IdentityPolicyData, PermissionPolicyBinding } from '@authup/access';
+import type { IClientRepository } from '../../entities/client/types.ts';
+import type { IRobotRepository } from '../../entities/robot/types.ts';
+import type { IRoleRepository } from '../../entities/role/types.ts';
+import type { IUserRepository } from '../../entities/user/types.ts';
+import type { IIdentityRoleProvider } from '../role/types.ts';
+import type { IIdentityPermissionProvider, IdentityPermissionProviderContext, ResolveJunctionGrantResult, ResolveJunctionPolicyOptions } from './types.ts';
+export declare class IdentityPermissionProvider implements IIdentityPermissionProvider {
+    protected clientRepository: IClientRepository;
+    protected userRepository: IUserRepository;
+    protected roleRepository: IRoleRepository;
+    protected robotRepository: IRobotRepository;
+    protected roleProvider: IIdentityRoleProvider;
+    constructor(ctx: IdentityPermissionProviderContext);
+    isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData): Promise<boolean>;
+    resolveJunctionGrant(identity: IdentityPolicyData, options: ResolveJunctionPolicyOptions): Promise<ResolveJunctionGrantResult>;
+    getFor(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
+    getForClient(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
+    getForUser(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
+    getForRobot(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
+    getForRole(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
+    private combineWithRoleBindings;
+    private reduceBindingsByIdentityClient;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/identity/permission/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,kBAAkB,EAElB,uBAAuB,EAC1B,MAAM,gBAAgB,CAAC;AAWxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EACR,2BAA2B,EAC3B,iCAAiC,EACjC,0BAA0B,EAC1B,4BAA4B,EAC/B,MAAM,YAAY,CAAC;AAEpB,qBAAa,0BAA2B,YAAW,2BAA2B;IAC1E,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,YAAY,EAAE,qBAAqB,CAAC;gBAElC,GAAG,EAAE,iCAAiC;IAQ5C,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,OAAO,CAAC;IAgCpF,oBAAoB,CACtB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,4BAA4B,GACtC,OAAO,CAAC,0BAA0B,CAAC;IA6DhC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAmBzE,YAAY,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAO/E,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAQ7E,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAQ9E,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YAKrE,uBAAuB;IAmBrC,OAAO,CAAC,8BAA8B;CAUzC"}

package/dist/core/identity/permission/module.mjs

@@ -0,0 +1,123 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { isPolicy } from "@authup/core-kit";
+import { RealmScope, aggregatePermissionPolicyBindings, compareRealmScope, grantDominates, isPermissionPolicyBindingEqual, minRealmScope } from "@authup/access";
+//#region src/core/identity/permission/module.ts
+var IdentityPermissionProvider = class {
+	clientRepository;
+	userRepository;
+	roleRepository;
+	robotRepository;
+	roleProvider;
+	constructor(ctx) {
+		this.clientRepository = ctx.clientRepository;
+		this.userRepository = ctx.userRepository;
+		this.roleRepository = ctx.roleRepository;
+		this.robotRepository = ctx.robotRepository;
+		this.roleProvider = ctx.roleProvider;
+	}
+	async isSuperset(parent, child) {
+		const parentAggregated = aggregatePermissionPolicyBindings(await this.getFor(parent));
+		const childAggregated = aggregatePermissionPolicyBindings(await this.getFor(child));
+		for (const childItem of childAggregated) {
+			const parentItem = parentAggregated.find((p) => isPermissionPolicyBindingEqual(p, childItem));
+			if (!parentItem) return false;
+			for (const childGrant of childItem.grants) if (!parentItem.grants.some((parentGrant) => grantDominates(parentGrant, childGrant))) return false;
+		}
+		return true;
+	}
+	async resolveJunctionGrant(identity, options) {
+		const matching = (await this.getFor(identity)).filter((b) => {
+			if (b.permission.name !== options.name) return false;
+			if (typeof options.realmId !== "undefined") {
+				if ((b.permission.realm_id ?? null) !== (options.realmId ?? null)) return false;
+			}
+			if (typeof options.clientId !== "undefined") {
+				if ((b.permission.client_id ?? null) !== (options.clientId ?? null)) return false;
+			}
+			return true;
+		});
+		if (matching.length === 0) return { realmScope: RealmScope.OWN };
+		const grants = aggregatePermissionPolicyBindings(matching).flatMap((item) => item.grants);
+		if (grants.length === 0) return { realmScope: RealmScope.OWN };
+		const selected = selectGrantForRequest(grants, options.realmScope ?? RealmScope.OWN);
+		let policy;
+		if (selected.policy) {
+			if (!isPolicy(selected.policy)) return { realmScope: RealmScope.NONE };
+			policy = selected.policy;
+		}
+		return {
+			policy,
+			realmScope: selected.realm_scope
+		};
+	}
+	async getFor(identity) {
+		switch (identity.type) {
+			case "client": return this.getForClient(identity);
+			case "user": return this.getForUser(identity);
+			case "robot": return this.getForRobot(identity);
+			case "role": return this.getForRole(identity);
+		}
+		return [];
+	}
+	async getForClient(identity) {
+		return this.combineWithRoleBindings(this.clientRepository.getBoundPermissions(identity.id), identity);
+	}
+	async getForUser(identity) {
+		return this.combineWithRoleBindings(this.userRepository.getBoundPermissions(identity.id).then((data) => this.reduceBindingsByIdentityClient(data, identity)), identity);
+	}
+	async getForRobot(identity) {
+		return this.combineWithRoleBindings(this.robotRepository.getBoundPermissions(identity.id).then((data) => this.reduceBindingsByIdentityClient(data, identity)), identity);
+	}
+	async getForRole(identity) {
+		return this.roleRepository.getBoundPermissions(identity.id).then((data) => this.reduceBindingsByIdentityClient(data, identity));
+	}
+	async combineWithRoleBindings(bindingsPromise, identity) {
+		const [bindings, roles] = await Promise.all([bindingsPromise, this.roleProvider.getRolesFor(identity)]);
+		const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);
+		if (roleBindings.length === 0) return bindings;
+		return [...bindings, ...roleBindings];
+	}
+	reduceBindingsByIdentityClient(bindings, identity) {
+		if (!identity.clientId) return bindings;
+		return bindings.filter((binding) => binding.permission.client_id === identity.clientId);
+	}
+};
+/**
+* Select the held grant that confers the least-restrictive junction for `requested` reach.
+*
+* Each grant is ranked by the reach it can actually confer for THIS request — its own
+* `realm_scope` capped to `requested` — so a lower-scoped policy-free grant beats a
+* higher-scoped policy-bound grant when both cap to the same requested reach (the mixed-grant
+* fix, #3160). On equal capped reach, a policy-free grant wins (least restrictive). The
+* ORIGINAL (uncapped) grant is returned: the consumer applies the `min` cap itself, and its
+* uncapped `realm_scope`/`policy` drive the "actor is unrestricted-any?" check that decides
+* whether an explicitly-requested `policy_id` may stand.
+*
+* The ordering is TOTAL and deterministic (independent of grant/repository order): ties between
+* two policy-bound grants on equal capped reach are broken by higher uncapped reach, then a
+* propagatable policy (one with an id) over an id-less composite that would fail closed, then
+* lexicographic policy id.
+*/ function selectGrantForRequest(grants, requested) {
+	return grants.reduce((best, grant) => isGrantPreferred(grant, best, requested) ? grant : best);
+}
+/** True when `candidate` is a strictly better propagation source than `incumbent` for `requested`. */ function isGrantPreferred(candidate, incumbent, requested) {
+	const byCapped = compareRealmScope(minRealmScope([candidate.realm_scope, requested]), minRealmScope([incumbent.realm_scope, requested]));
+	if (byCapped !== 0) return byCapped > 0;
+	if (!candidate.policy !== !incumbent.policy) return !candidate.policy;
+	const byUncapped = compareRealmScope(candidate.realm_scope, incumbent.realm_scope);
+	if (byUncapped !== 0) return byUncapped > 0;
+	const candidateId = candidate.policy && isPolicy(candidate.policy) ? candidate.policy.id : void 0;
+	const incumbentId = incumbent.policy && isPolicy(incumbent.policy) ? incumbent.policy.id : void 0;
+	if (candidateId !== incumbentId) {
+		if (typeof candidateId === "undefined") return false;
+		if (typeof incumbentId === "undefined") return true;
+		return candidateId < incumbentId;
+	}
+	return false;
+}
+//#endregion
+export { IdentityPermissionProvider };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/identity/permission/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["RealmScope","aggregatePermissionPolicyBindings","compareRealmScope","grantDominates","isPermissionPolicyBindingEqual","minRealmScope","isPolicy","IdentityPermissionProvider","clientRepository","userRepository","roleRepository","robotRepository","roleProvider","ctx","isSuperset","parent","child","parentAggregated","getFor","childAggregated","childItem","parentItem","find","p","childGrant","grants","dominated","some","parentGrant","resolveJunctionGrant","identity","options","bindings","matching","filter","b","permission","name","realmId","realm_id","clientId","client_id","length","realmScope","OWN","flatMap","item","requested","selected","selectGrantForRequest","policy","NONE","realm_scope","type","getForClient","getForUser","getForRobot","getForRole","combineWithRoleBindings","getBoundPermissions","id","then","data","reduceBindingsByIdentityClient","bindingsPromise","roles","Promise","all","getRolesFor","roleBindings","getBoundPermissionsForMany","binding","reduce","best","grant","isGrantPreferred","candidate","incumbent","byCapped","byUncapped","candidateId","undefined","incumbentId"],"sources":["../../../../src/core/identity/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    IdentityPolicyData,\n    PermissionGrant,\n    PermissionPolicyBinding,\n} from '@authup/access';\nimport {\n    RealmScope,\n    aggregatePermissionPolicyBindings,\n    compareRealmScope,\n    grantDominates,\n    isPermissionPolicyBindingEqual,\n    minRealmScope,\n} from '@authup/access';\nimport type { Policy } from '@authup/core-kit';\nimport { isPolicy } from '@authup/core-kit';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IRoleRepository } from '../../entities/role/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider } from '../role/types.ts';\nimport type {\n    IIdentityPermissionProvider,\n    IdentityPermissionProviderContext,\n    ResolveJunctionGrantResult,\n    ResolveJunctionPolicyOptions,\n} from './types.ts';\n\nexport class IdentityPermissionProvider implements IIdentityPermissionProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected roleRepository: IRoleRepository;\n\n    protected robotRepository: IRobotRepository;\n\n    protected roleProvider: IIdentityRoleProvider;\n\n    constructor(ctx: IdentityPermissionProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.robotRepository = ctx.robotRepository;\n        this.roleProvider = ctx.roleProvider;\n    }\n\n    async isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData) : Promise<boolean> {\n        const parentAggregated = aggregatePermissionPolicyBindings(await this.getFor(parent));\n        const childAggregated = aggregatePermissionPolicyBindings(await this.getFor(child));\n\n        for (const childItem of childAggregated) {\n            const parentItem = parentAggregated.find(\n                (p) => isPermissionPolicyBindingEqual(p, childItem),\n            );\n\n            if (!parentItem) {\n                return false;\n            }\n\n            // Disjunction-aware superset: EVERY child grant must be dominated by SOME parent\n            // grant (reach >= AND the parent's policy provably covers the child's — see\n            // grantDominates). A child grant the parent cannot match — an unconditional `any`\n            // the parent only holds policy-gated, or a policy the parent does not itself hold\n            // (#3159) — fails the check; the actor cannot assign more than it holds.\n            for (const childGrant of childItem.grants) {\n                const dominated = parentItem.grants.some(\n                    (parentGrant) => grantDominates(parentGrant, childGrant),\n                );\n\n                if (!dominated) {\n                    return false;\n                }\n            }\n        }\n\n        return true;\n    }\n\n    async resolveJunctionGrant(\n        identity: IdentityPolicyData,\n        options: ResolveJunctionPolicyOptions,\n    ): Promise<ResolveJunctionGrantResult> {\n        const bindings = await this.getFor(identity);\n        const matching = bindings.filter((b) => {\n            if (b.permission.name !== options.name) {\n                return false;\n            }\n\n            if (typeof options.realmId !== 'undefined') {\n                if ((b.permission.realm_id ?? null) !== (options.realmId ?? null)) {\n                    return false;\n                }\n            }\n\n            if (typeof options.clientId !== 'undefined') {\n                if ((b.permission.client_id ?? null) !== (options.clientId ?? null)) {\n                    return false;\n                }\n            }\n\n            return true;\n        });\n\n        if (matching.length === 0) {\n            return { realmScope: RealmScope.OWN };\n        }\n\n        // Consider EVERY matching grant (a caller omitting realmId/clientId may leave more\n        // than one permission-key group); combined with the total ordering in\n        // selectGrantForRequest, the selection never depends on grant/repository order.\n        const grants = aggregatePermissionPolicyBindings(matching)\n            .flatMap((item) => item.grants);\n        if (grants.length === 0) {\n            return { realmScope: RealmScope.OWN };\n        }\n\n        // Select the actor's grant RELATIVE to the requested reach (#3160): the grant that\n        // confers the least-restrictive junction once capped to `realmScope` (highest capped\n        // reach, policy-free preferred on a tie) — NOT a global \"ceiling\". A mixed-grant actor\n        // (e.g. own+no-policy and any+policy) thus propagates its policy-free own grant for an\n        // own request instead of inheriting the wider grant's policy. The selected grant is\n        // returned UNCAPPED so the consumer's own cap (`min(requested, realmScope)`) and its\n        // \"actor is unrestricted-any?\" check (which honours an explicit policy_id) still hold.\n        const requested = options.realmScope ?? RealmScope.OWN;\n        const selected = selectGrantForRequest(grants, requested);\n\n        let policy: Policy | undefined;\n        if (selected.policy) {\n            // The selected grant is policy-restricted but its policy is not a propagatable\n            // Policy (e.g. a composite with no id). Fail CLOSED: a `none` reach blocks\n            // propagation rather than silently dropping the restriction and widening to an\n            // unrestricted grant.\n            if (!isPolicy(selected.policy)) {\n                return { realmScope: RealmScope.NONE };\n            }\n\n            policy = selected.policy;\n        }\n\n        return { policy, realmScope: selected.realm_scope };\n    }\n\n    async getFor(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.getForClient(identity);\n            }\n            case 'user': {\n                return this.getForUser(identity);\n            }\n            case 'robot': {\n                return this.getForRobot(identity);\n            }\n            case 'role': {\n                return this.getForRole(identity);\n            }\n        }\n\n        return [];\n    }\n\n    async getForClient(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.combineWithRoleBindings(\n            this.clientRepository.getBoundPermissions(identity.id),\n            identity,\n        );\n    }\n\n    async getForUser(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.combineWithRoleBindings(\n            this.userRepository.getBoundPermissions(identity.id)\n                .then((data) => this.reduceBindingsByIdentityClient(data, identity)),\n            identity,\n        );\n    }\n\n    async getForRobot(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.combineWithRoleBindings(\n            this.robotRepository.getBoundPermissions(identity.id)\n                .then((data) => this.reduceBindingsByIdentityClient(data, identity)),\n            identity,\n        );\n    }\n\n    async getForRole(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.roleRepository.getBoundPermissions(identity.id)\n            .then((data) => this.reduceBindingsByIdentityClient(data, identity));\n    }\n\n    private async combineWithRoleBindings(\n        bindingsPromise: Promise<PermissionPolicyBinding[]>,\n        identity: IdentityPolicyData,\n    ): Promise<PermissionPolicyBinding[]> {\n        const [bindings, roles] = await Promise.all([\n            bindingsPromise,\n            this.roleProvider.getRolesFor(identity),\n        ]);\n        const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);\n        if (roleBindings.length === 0) {\n            return bindings;\n        }\n\n        return [\n            ...bindings,\n            ...roleBindings,\n        ];\n    }\n\n    private reduceBindingsByIdentityClient(\n        bindings: PermissionPolicyBinding[],\n        identity: IdentityPolicyData,\n    ): PermissionPolicyBinding[] {\n        if (!identity.clientId) {\n            return bindings;\n        }\n\n        return bindings.filter((binding) => binding.permission.client_id === identity.clientId);\n    }\n}\n\n/**\n * Select the held grant that confers the least-restrictive junction for `requested` reach.\n *\n * Each grant is ranked by the reach it can actually confer for THIS request — its own\n * `realm_scope` capped to `requested` — so a lower-scoped policy-free grant beats a\n * higher-scoped policy-bound grant when both cap to the same requested reach (the mixed-grant\n * fix, #3160). On equal capped reach, a policy-free grant wins (least restrictive). The\n * ORIGINAL (uncapped) grant is returned: the consumer applies the `min` cap itself, and its\n * uncapped `realm_scope`/`policy` drive the \"actor is unrestricted-any?\" check that decides\n * whether an explicitly-requested `policy_id` may stand.\n *\n * The ordering is TOTAL and deterministic (independent of grant/repository order): ties between\n * two policy-bound grants on equal capped reach are broken by higher uncapped reach, then a\n * propagatable policy (one with an id) over an id-less composite that would fail closed, then\n * lexicographic policy id.\n */\nfunction selectGrantForRequest(\n    grants: PermissionGrant[],\n    requested: `${RealmScope}`,\n): PermissionGrant {\n    return grants.reduce((best, grant) => (isGrantPreferred(grant, best, requested) ? grant : best));\n}\n\n/** True when `candidate` is a strictly better propagation source than `incumbent` for `requested`. */\nfunction isGrantPreferred(\n    candidate: PermissionGrant,\n    incumbent: PermissionGrant,\n    requested: `${RealmScope}`,\n): boolean {\n    const byCapped = compareRealmScope(\n        minRealmScope([candidate.realm_scope, requested]),\n        minRealmScope([incumbent.realm_scope, requested]),\n    );\n    if (byCapped !== 0) {\n        return byCapped > 0;\n    }\n\n    // Least restrictive: a policy-free grant beats a policy-bound one on equal capped reach.\n    if (!candidate.policy !== !incumbent.policy) {\n        return !candidate.policy;\n    }\n\n    // Deterministic tie-break for two policy-bound grants on equal capped reach.\n    const byUncapped = compareRealmScope(candidate.realm_scope, incumbent.realm_scope);\n    if (byUncapped !== 0) {\n        return byUncapped > 0;\n    }\n\n    // Prefer a propagatable policy (has an id) over an id-less composite that would fail closed.\n    const candidateId = candidate.policy && isPolicy(candidate.policy) ? candidate.policy.id : undefined;\n    const incumbentId = incumbent.policy && isPolicy(incumbent.policy) ? incumbent.policy.id : undefined;\n    if (candidateId !== incumbentId) {\n        if (typeof candidateId === 'undefined') {\n            return false;\n        }\n        if (typeof incumbentId === 'undefined') {\n            return true;\n        }\n        return candidateId < incumbentId;\n    }\n\n    return false;\n}\n"],"mappings":";;;;;;AAkCA,IAAaO,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKL,mBAAmBK,IAAIL;EAC5B,KAAKC,iBAAiBI,IAAIJ;EAC1B,KAAKC,iBAAiBG,IAAIH;EAC1B,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,WAAWC,QAA4BC,OAA8C;EACvF,MAAMC,mBAAmBhB,kCAAkC,MAAM,KAAKiB,OAAOH,MAAAA,CAAAA;EAC7E,MAAMI,kBAAkBlB,kCAAkC,MAAM,KAAKiB,OAAOF,KAAAA,CAAAA;EAE5E,KAAK,MAAMI,aAAaD,iBAAiB;GACrC,MAAME,aAAaJ,iBAAiBK,MAC/BC,MAAMnB,+BAA+BmB,GAAGH,SAAAA,CAAAA;GAG7C,IAAI,CAACC,YACD,OAAO;GAQX,KAAK,MAAMG,cAAcJ,UAAUK,QAK/B,IAAI,CAJcJ,WAAWI,OAAOE,MAC/BC,gBAAgBzB,eAAeyB,aAAaJ,UAAAA,CAG5CE,GACD,OAAO;EAGnB;EAEA,OAAO;CACX;CAEA,MAAMG,qBACFC,UACAC,SACmC;EAEnC,MAAME,YAAWD,MADM,KAAKd,OAAOY,QAAAA,EAAAA,CACTI,QAAQC,MAAAA;GAC9B,IAAIA,EAAEC,WAAWC,SAASN,QAAQM,MAC9B,OAAO;GAGX,IAAI,OAAON,QAAQO,YAAY;SACtBH,EAAEC,WAAWG,YAAY,WAAWR,QAAQO,WAAW,OACxD,OAAO;GAAA;GAIf,IAAI,OAAOP,QAAQS,aAAa;SACvBL,EAAEC,WAAWK,aAAa,WAAWV,QAAQS,YAAY,OAC1D,OAAO;GAAA;GAIf,OAAO;EACX,CAAA;EAEA,IAAIP,SAASS,WAAW,GACpB,OAAO,EAAEC,YAAY3C,WAAW4C,IAAI;EAMxC,MAAMnB,SAASxB,kCAAkCgC,QAAAA,CAAAA,CAC5CY,SAASC,SAASA,KAAKrB,MAAM;EAClC,IAAIA,OAAOiB,WAAW,GAClB,OAAO,EAAEC,YAAY3C,WAAW4C,IAAI;EAWxC,MAAMI,WAAWC,sBAAsBxB,QADrBM,QAAQY,cAAc3C,WAAW4C,GACJG;EAE/C,IAAIG;EACJ,IAAIF,SAASE,QAAQ;GAKjB,IAAI,CAAC5C,SAAS0C,SAASE,MAAM,GACzB,OAAO,EAAEP,YAAY3C,WAAWmD,KAAK;GAGzCD,SAASF,SAASE;EACtB;EAEA,OAAO;GAAEA;GAAQP,YAAYK,SAASI;EAAY;CACtD;CAEA,MAAMlC,OAAOY,UAAmE;EAC5E,QAAQA,SAASuB,MAAjB;GACI,KAAK,UACD,OAAO,KAAKC,aAAaxB,QAAAA;GAE7B,KAAK,QACD,OAAO,KAAKyB,WAAWzB,QAAAA;GAE3B,KAAK,SACD,OAAO,KAAK0B,YAAY1B,QAAAA;GAE5B,KAAK,QACD,OAAO,KAAK2B,WAAW3B,QAAAA;EAE/B;EAEA,OAAO,CAAA;CACX;CAEA,MAAMwB,aAAaxB,UAAmE;EAClF,OAAO,KAAK4B,wBACR,KAAKlD,iBAAiBmD,oBAAoB7B,SAAS8B,EAAE,GACrD9B,QAAAA;CAER;CAEA,MAAMyB,WAAWzB,UAAmE;EAChF,OAAO,KAAK4B,wBACR,KAAKjD,eAAekD,oBAAoB7B,SAAS8B,EAAE,CAAA,CAC9CC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAMhC,QAAAA,CAAAA,GAC9DA,QAAAA;CAER;CAEA,MAAM0B,YAAY1B,UAAmE;EACjF,OAAO,KAAK4B,wBACR,KAAK/C,gBAAgBgD,oBAAoB7B,SAAS8B,EAAE,CAAA,CAC/CC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAMhC,QAAAA,CAAAA,GAC9DA,QAAAA;CAER;CAEA,MAAM2B,WAAW3B,UAAmE;EAChF,OAAO,KAAKpB,eAAeiD,oBAAoB7B,SAAS8B,EAAE,CAAA,CACrDC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAMhC,QAAAA,CAAAA;CAClE;CAEA,MAAc4B,wBACVM,iBACAlC,UACkC;EAClC,MAAM,CAACE,UAAUiC,SAAS,MAAMC,QAAQC,IAAI,CACxCH,iBACA,KAAKpD,aAAawD,YAAYtC,QAAAA,CAAAA,CACjC;EACD,MAAMuC,eAAe,MAAM,KAAK3D,eAAe4D,2BAA2BL,KAAAA;EAC1E,IAAII,aAAa3B,WAAW,GACxB,OAAOV;EAGX,OAAO,CAAA,GACAA,UAAAA,GACAqC,YAAAA;CAEX;CAEQN,+BACJ/B,UACAF,UACyB;EACzB,IAAI,CAACA,SAASU,UACV,OAAOR;EAGX,OAAOA,SAASE,QAAQqC,YAAYA,QAAQnC,WAAWK,cAAcX,SAASU,QAAQ;CAC1F;AACJ;;;;;;;;;;;;;;;;GAkBA,SAASS,sBACLxB,QACAsB,WAA0B;CAE1B,OAAOtB,OAAO+C,QAAQC,MAAMC,UAAWC,iBAAiBD,OAAOD,MAAM1B,SAAAA,IAAa2B,QAAQD,IAAAA;AAC9F;uGAGA,SAASE,iBACLC,WACAC,WACA9B,WAA0B;CAE1B,MAAM+B,WAAW5E,kBACbG,cAAc,CAACuE,UAAUxB,aAAaL,SAAAA,CAAU,GAChD1C,cAAc,CAACwE,UAAUzB,aAAaL,SAAAA,CAAU,CAAA;CAEpD,IAAI+B,aAAa,GACb,OAAOA,WAAW;CAItB,IAAI,CAACF,UAAU1B,WAAW,CAAC2B,UAAU3B,QACjC,OAAO,CAAC0B,UAAU1B;CAItB,MAAM6B,aAAa7E,kBAAkB0E,UAAUxB,aAAayB,UAAUzB,WAAW;CACjF,IAAI2B,eAAe,GACf,OAAOA,aAAa;CAIxB,MAAMC,cAAcJ,UAAU1B,UAAU5C,SAASsE,UAAU1B,MAAM,IAAI0B,UAAU1B,OAAOU,KAAKqB,KAAAA;CAC3F,MAAMC,cAAcL,UAAU3B,UAAU5C,SAASuE,UAAU3B,MAAM,IAAI2B,UAAU3B,OAAOU,KAAKqB,KAAAA;CAC3F,IAAID,gBAAgBE,aAAa;EAC7B,IAAI,OAAOF,gBAAgB,aACvB,OAAO;EAEX,IAAI,OAAOE,gBAAgB,aACvB,OAAO;EAEX,OAAOF,cAAcE;CACzB;CAEA,OAAO;AACX"}

package/dist/core/identity/permission/types.d.ts

@@ -0,0 +1,45 @@
+import type { Policy } from '@authup/core-kit';
+import type { IdentityPolicyData, PermissionPolicyBinding, RealmScope } from '@authup/access';
+import type { IClientRepository } from '../../entities/client/types.ts';
+import type { IRobotRepository } from '../../entities/robot/types.ts';
+import type { IRoleRepository } from '../../entities/role/types.ts';
+import type { IUserRepository } from '../../entities/user/types.ts';
+import type { IIdentityRoleProvider } from '../role/types.ts';
+export type ResolveJunctionPolicyOptions = {
+    name: string;
+    realmId?: string | null;
+    clientId?: string | null;
+    /**
+     * The realm reach the junction is requested to confer (default `own`). The actor's
+     * grant disjunction is selected RELATIVE to this request: the grant chosen is the one
+     * that confers the least-restrictive junction once capped to `realmScope`, not the
+     * actor's absolute most-permissive grant. Lets a mixed-grant actor propagate a
+     * policy-free `own` grant for an `own` request even while holding a wider policy-bound
+     * grant (#3160).
+     */
+    realmScope?: `${RealmScope}`;
+};
+/**
+ * The actor's grant SELECTED for the requested reach (`ResolveJunctionPolicyOptions.realmScope`):
+ * the policy to inherit (if any) and the grant's UNCAPPED `realmScope`. Returned uncapped on
+ * purpose — the consumer applies the `min(requested, realmScope)` cap itself, and the uncapped
+ * reach distinguishes a genuinely unrestricted actor (see `applyJunctionCreateGrant` /
+ * `buildJunctionUpdateData`). This is not a global ceiling; it is request-relative (#3160).
+ */
+export type ResolveJunctionGrantResult = {
+    policy?: Policy;
+    realmScope: `${RealmScope}`;
+};
+export interface IIdentityPermissionProvider {
+    getFor(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
+    isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData): Promise<boolean>;
+    resolveJunctionGrant(identity: IdentityPolicyData, options: ResolveJunctionPolicyOptions): Promise<ResolveJunctionGrantResult>;
+}
+export type IdentityPermissionProviderContext = {
+    clientRepository: IClientRepository;
+    userRepository: IUserRepository;
+    robotRepository: IRobotRepository;
+    roleRepository: IRoleRepository;
+    roleProvider: IIdentityRoleProvider;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/permission/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EACR,kBAAkB,EAClB,uBAAuB,EACvB,UAAU,EACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9D,MAAM,MAAM,4BAA4B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC;CAChC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,WAAW,2BAA2B;IACxC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACzE,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAClI;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC5C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,eAAe,EAAE,gBAAgB,CAAC;IAClC,cAAc,EAAE,eAAe,CAAC;IAChC,YAAY,EAAE,qBAAqB,CAAC;CACvC,CAAC"}

package/dist/core/identity/permission/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/identity/policy/checker/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/policy/checker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/policy/checker/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/identity/policy/checker/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PolicyCheckerService } from "./service.mjs";
+export { PolicyCheckerService };

package/dist/core/identity/policy/checker/service.d.ts

@@ -0,0 +1,10 @@
+import type { Result } from '@authup/kit';
+import type { ActorContext } from '@authup/server-kit';
+import type { IPolicyCheckerService, PolicyCheckerServiceContext } from './types.ts';
+export declare class PolicyCheckerService implements IPolicyCheckerService {
+    protected ctx: PolicyCheckerServiceContext;
+    constructor(ctx: PolicyCheckerServiceContext);
+    check(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<void>;
+    safeCheck(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<Result<null>>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/identity/policy/checker/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/policy/checker/service.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EACR,qBAAqB,EACrB,2BAA2B,EAC9B,MAAM,YAAY,CAAC;AAEpB,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,GAAG,EAAE,2BAA2B,CAAC;gBAE/B,GAAG,EAAE,2BAA2B;IAItC,KAAK,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAgCV,SAAS,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ3B"}

package/dist/core/identity/policy/checker/service.mjs

@@ -0,0 +1,49 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PolicyEngine as PolicyEngine$1 } from "../../../security/policy/engine.mjs";
+import { toIdentityPolicyData } from "../../permission/identity-policy-data.mjs";
+import { isUUID } from "@authup/kit";
+import { BuiltInPolicyType, PolicyData, definePolicyEvaluationContext } from "@authup/access";
+import { EntityNotFoundError, normalizeError } from "@authup/errors";
+//#region src/core/identity/policy/checker/service.ts
+var PolicyCheckerService = class {
+	ctx;
+	constructor(ctx) {
+		this.ctx = ctx;
+	}
+	async check(idOrName, data, actor, realm) {
+		let criteria;
+		if (isUUID(idOrName)) criteria = { id: idOrName };
+		else {
+			const realmEntity = await this.ctx.realmRepository.resolve(realm);
+			criteria = {
+				name: idOrName,
+				...realmEntity ? { realm_id: realmEntity.id } : {}
+			};
+		}
+		const entity = await this.ctx.repository.findOneBy(criteria);
+		if (!entity) throw new EntityNotFoundError();
+		const input = { ...data };
+		if (!input[BuiltInPolicyType.IDENTITY] && input[BuiltInPolicyType.IDENTITY] !== null) input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);
+		await new PolicyEngine$1(this.ctx.identityPermissionProvider).evaluate(entity, definePolicyEvaluationContext({ data: new PolicyData(input) }));
+	}
+	async safeCheck(idOrName, data, actor, realm) {
+		try {
+			await this.check(idOrName, data, actor, realm);
+			return {
+				success: true,
+				data: null
+			};
+		} catch (e) {
+			return {
+				success: false,
+				error: normalizeError(e)
+			};
+		}
+	}
+};
+//#endregion
+export { PolicyCheckerService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/identity/policy/checker/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","definePolicyEvaluationContext","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PolicyCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","realmEntity","realmRepository","resolve","name","realm_id","entity","repository","findOneBy","input","IDENTITY","identity","engine","identityPermissionProvider","evaluate","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/policy/checker/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData, definePolicyEvaluationContext } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../../permission/identity-policy-data.ts';\nimport type {\n    IPolicyCheckerService,\n    PolicyCheckerServiceContext,\n} from './types.ts';\n\nexport class PolicyCheckerService implements IPolicyCheckerService {\n    protected ctx: PolicyCheckerServiceContext;\n\n    constructor(ctx: PolicyCheckerServiceContext) {\n        this.ctx = ctx;\n    }\n\n    async check(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<void> {\n        let criteria: Record<string, any>;\n        if (isUUID(idOrName)) {\n            criteria = { id: idOrName };\n        } else {\n            const realmEntity = await this.ctx.realmRepository.resolve(realm);\n            criteria = {\n                name: idOrName,\n                ...(realmEntity ? { realm_id: realmEntity.id } : {}),\n            };\n        }\n\n        const entity = await this.ctx.repository.findOneBy(criteria);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const input = { ...data };\n        if (\n            !input[BuiltInPolicyType.IDENTITY] &&\n            input[BuiltInPolicyType.IDENTITY] !== null\n        ) {\n            input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n        }\n\n        const engine = new PolicyEngine(this.ctx.identityPermissionProvider);\n        await engine.evaluate(\n            entity,\n            definePolicyEvaluationContext({ data: new PolicyData(input) }),\n        );\n    }\n\n    async safeCheck(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Result<null>> {\n        try {\n            await this.check(idOrName, data, actor, realm);\n            return { success: true, data: null };\n        } catch (e) {\n            return { success: false, error: normalizeError(e) };\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaQ,uBAAb,MAAaA;CACCC;CAEV,YAAYA,KAAkC;EAC1C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACH,MAAMM,cAAc,MAAM,KAAKR,IAAIS,gBAAgBC,QAAQL,KAAAA;GAC3DC,WAAW;IACPK,MAAMT;IACN,GAAIM,cAAc,EAAEI,UAAUJ,YAAYD,GAAG,IAAI,CAAC;GACtD;EACJ;EAEA,MAAMM,SAAS,MAAM,KAAKb,IAAIc,WAAWC,UAAUT,QAAAA;EACnD,IAAI,CAACO,QACD,MAAM,IAAIlB,oBAAAA;EAGd,MAAMqB,QAAQ,EAAE,GAAGb,KAAK;EACxB,IACI,CAACa,MAAMzB,kBAAkB0B,aACzBD,MAAMzB,kBAAkB0B,cAAc,MAEtCD,MAAMzB,kBAAkB0B,YAAYnB,qBAAqBM,MAAMc,QAAQ;EAI3E,MAAMC,IADatB,eAAa,KAAKG,IAAIoB,0BACnCD,CAAAA,CAAOE,SACTR,QACApB,8BAA8B,EAAEU,MAAM,IAAIX,WAAWwB,KAAAA,EAAO,CAAA,CAAA;CAEpE;CAEA,MAAMM,UACFpB,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAEkB,SAAS;IAAMpB,MAAM;GAAK;EACvC,SAASqB,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAO7B,eAAe4B,CAAAA;GAAG;EACtD;CACJ;AACJ"}

package/dist/core/identity/policy/checker/types.d.ts

@@ -0,0 +1,40 @@
+import type { Result } from '@authup/kit';
+import type { ActorContext } from '@authup/server-kit';
+import type { IPolicyRepository, IRealmRepository } from '../../../entities/index.ts';
+import type { IIdentityPermissionProvider } from '../../permission/types.ts';
+export type PolicyCheckerServiceContext = {
+    repository: IPolicyRepository;
+    realmRepository: IRealmRepository;
+    identityPermissionProvider: IIdentityPermissionProvider;
+};
+export interface IPolicyCheckerService {
+    /**
+     * Resolve a policy by id (UUID) or name and evaluate it against the
+     * supplied data and actor. Throws on any failure — entity not found,
+     * evaluator denial, validator error.
+     *
+     * If `data[identity]` is unset (and not explicitly `null`), the
+     * actor's identity (flattened to `IdentityPolicyData`) is injected.
+     * Passing an explicit `null` opts out of the default — useful for
+     * checking a policy as anonymous.
+     *
+     * @param idOrName Policy UUID or name. Names are resolved within the
+     *   supplied realm (or the resolved fallback realm).
+     * @param data Caller-supplied evaluation input. Mutated copy is used
+     *   internally.
+     * @param actor The caller context. `actor.identity` becomes the
+     *   default identity input when `data[identity]` is unset.
+     * @param realm Optional realm id used to disambiguate name lookups.
+     * @throws {EntityNotFoundError} When no policy matches.
+     * @throws {Error} Whatever the policy engine throws on denial.
+     */
+    check(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<void>;
+    /**
+     * Same as `check`, but never throws — collapses any failure into a
+     * `Result<null>` with `success: false` and the originating error.
+     * Use this at boundaries that want to embed denial in a response body
+     * rather than propagate it.
+     */
+    safeCheck(idOrName: string, data: Record<string, any>, actor: ActorContext, realm?: string): Promise<Result<null>>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/identity/policy/checker/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/policy/checker/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EACR,iBAAiB,EACjB,gBAAgB,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAE7E,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;IAClC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,MAAM,WAAW,qBAAqB;IAClC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CACD,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;OAKG;IACH,SAAS,CACL,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;CAC5B"}

package/dist/core/identity/policy/checker/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/identity/policy/index.d.ts

@@ -0,0 +1,2 @@
+export * from './checker/index.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC"}

package/dist/core/identity/policy/index.mjs

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PolicyCheckerService } from "./checker/service.mjs";
+import "./checker/index.mjs";
+export { PolicyCheckerService };

package/dist/core/identity/provider/account/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/identity/provider/account/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/account/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/provider/account/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderAccountManager } from "./module.mjs";
+export { IdentityProviderAccountManager };

package/dist/core/identity/provider/account/module.d.ts

@@ -0,0 +1,21 @@
+import type { IdentityProviderAccount, User } from '@authup/core-kit';
+import { UserValidator } from '@authup/core-kit';
+import type { IUserIdentityRepository } from '../../entities/index.ts';
+import type { IIdentityProviderMapper } from '../mapper/index.ts';
+import type { IdentityProviderIdentity } from '../types.ts';
+import type { IIdentityProviderAccountManager, IIdentityProviderAccountRepository, IdentityProviderAccountManagerContext } from './types.ts';
+export declare class IdentityProviderAccountManager implements IIdentityProviderAccountManager {
+    protected attributesMapper: IIdentityProviderMapper;
+    protected permissionMapper: IIdentityProviderMapper;
+    protected roleMapper: IIdentityProviderMapper;
+    protected repository: IIdentityProviderAccountRepository;
+    protected userRepository: IUserIdentityRepository;
+    protected userValidator: UserValidator;
+    constructor(ctx: IdentityProviderAccountManagerContext);
+    save(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount>;
+    saveUser(identity: IdentityProviderIdentity, user?: User): Promise<User>;
+    validateAttributes(entity: Record<string, any>, identity: IdentityProviderIdentity, attempts: number): Promise<User | null>;
+    savePermissions(identity: IdentityProviderIdentity, user: User): Promise<void>;
+    saveRoles(identity: IdentityProviderIdentity, user: User): Promise<void>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/identity/provider/account/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/provider/account/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACH,aAAa,EAGhB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAEvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,+BAA+B,EAAE,kCAAkC,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAE7I,qBAAa,8BAA+B,YAAW,+BAA+B;IAClF,SAAS,CAAC,gBAAgB,EAAG,uBAAuB,CAAC;IAErD,SAAS,CAAC,gBAAgB,EAAG,uBAAuB,CAAC;IAErD,SAAS,CAAC,UAAU,EAAG,uBAAuB,CAAC;IAE/C,SAAS,CAAC,UAAU,EAAG,kCAAkC,CAAC;IAE1D,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;IAElD,SAAS,CAAC,aAAa,EAAG,aAAa,CAAC;gBAE5B,GAAG,EAAE,qCAAqC;IAUhD,IAAI,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAmC1E,QAAQ,CACV,QAAQ,EAAE,wBAAwB,EAClC,IAAI,CAAC,EAAE,IAAI,GACZ,OAAO,CAAC,IAAI,CAAC;IA0FV,kBAAkB,CACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,QAAQ,EAAE,wBAAwB,EAClC,QAAQ,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA+ElB,eAAe,CACjB,QAAQ,EAAE,wBAAwB,EAClC,IAAI,EAAE,IAAI;IAOR,SAAS,CACX,QAAQ,EAAE,wBAAwB,EAClC,IAAI,EAAE,IAAI;CAMjB"}