npm - @authup/server-core - Versions diffs - 1.0.0-beta.50 → 1.0.0-beta.51 - Mend

@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.51

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (230) hide show

package/dist/core/entities/user-attribute/service.mjs CHANGED Viewed

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
-import { BuiltInPolicyType, PermissionError, PolicyData } from "@authup/access";
+import { BuiltInPolicyType, PermissionError, definePolicyData } from "@authup/access";
 import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 import { buildErrorMessageForAttribute } from "validup";
 //#region src/core/entities/user-attribute/service.ts
@@ -58,11 +58,14 @@ var UserAttributeService = class extends AbstractEntityService {
 		const entity = this.repository.create(data);
 		if (isSelfFallback) await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_SELF_MANAGE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } })
+			data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } })
 		});
 		else await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_UPDATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
 		});
 		await this.repository.save(entity);
 		return entity;
@@ -81,14 +84,20 @@ var UserAttributeService = class extends AbstractEntityService {
 			isSelfFallback = true;
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });
 		}
+		delete data.user_id;
+		delete data.user;
+		delete data.realm_id;
 		entity = this.repository.merge(entity, data);
 		if (isSelfFallback) await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_SELF_MANAGE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } })
+			data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } })
 		});
 		else await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_UPDATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
 		});
 		await this.repository.save(entity);
 		return entity;
@@ -108,7 +117,10 @@ var UserAttributeService = class extends AbstractEntityService {
 		try {
 			await actor.permissionEvaluator.evaluate({
 				name: PermissionName.USER_UPDATE,
-				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
 			});
 			return true;
 		} catch {

package/dist/core/entities/user-attribute/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","PolicyData","BadRequestError","EntityNotFoundError","PermissionName","buildErrorMessageForAttribute","AbstractEntityService","UserAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_UPDATE","USER_SELF_MANAGE","data","entities","meta","findMany","total","entity","canRead","canReadUserAttribute","push","getOne","id","findOneBy","create","targetUserId","user_id","user","isSelfTarget","identity","type","isSelfFallback","preEvaluate","e","validateJoinColumns","has","realm_id","evaluate","input","ATTRIBUTES","value","save","update","merge","delete","entityId","remove","isMe"],"sources":["../../../../src/core/entities/user-attribute/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, PolicyData } from '@authup/access';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PermissionName } from '@authup/core-kit';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { buildErrorMessageForAttribute } from 'validup';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IUserAttributeRepository, IUserAttributeService } from './types.ts';\n\nexport type UserAttributeServiceContext = {\n repository: IUserAttributeRepository;\n reservedNames?: ReadonlySet<string>;\n};\n\nexport class UserAttributeService extends AbstractEntityService implements IUserAttributeService {\n protected repository: IUserAttributeRepository;\n\n protected reservedNames: ReadonlySet<string>;\n\n constructor(ctx: UserAttributeServiceContext) {\n super();\n this.repository = ctx.repository;\n this.reservedNames = ctx.reservedNames ?? new Set();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<UserAttribute>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_UPDATE,\n PermissionName.USER_SELF_MANAGE,\n ],\n });\n\n const {\n data: entities,\n meta,\n } = await this.repository.findMany(query);\n\n const data: UserAttribute[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n const canRead = await this.canReadUserAttribute(actor, entity);\n if (canRead) {\n data.push(entity);\n } else {\n total--;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total,\n },\n };\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_UPDATE,\n PermissionName.USER_SELF_MANAGE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const canRead = await this.canReadUserAttribute(actor, entity);\n if (!canRead) {\n throw new PermissionError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n const targetUserId: string \| undefined = data.user_id \|\|\n (data.user && data.user.id);\n\n const isSelfTarget = !!actor.identity &&\n actor.identity.type === 'user' &&\n (!targetUserId \|\| targetUserId === actor.identity.data.id);\n\n let isSelfFallback = false;\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n } catch (e) {\n if (!isSelfTarget) {\n throw e;\n }\n isSelfFallback = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n }\n\n await this.repository.validateJoinColumns(data);\n\n if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n }\n\n if (data.user) {\n data.realm_id = data.user.realm_id;\n } else if (\n actor.identity &&\n actor.identity.type === 'user'\n ) {\n data.user_id = actor.identity.data.id;\n data.realm_id = actor.identity.data.realm_id;\n } else {\n throw new BadRequestError(buildErrorMessageForAttribute('user_id'));\n }\n\n const entity = this.repository.create(data);\n\n if (isSelfFallback) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_SELF_MANAGE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } }),\n });\n } else {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n }\n\n await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n await this.repository.validateJoinColumns(data);\n\n if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n }\n\n let entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const isSelfTarget = !!actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === entity.user_id;\n\n let isSelfFallback = false;\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n } catch (e) {\n if (!isSelfTarget) {\n throw e;\n }\n isSelfFallback = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n }\n\n entity = this.repository.merge(entity, data);\n\n if (isSelfFallback) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_SELF_MANAGE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } }),\n });\n } else {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n }\n\n await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_UPDATE,\n PermissionName.USER_SELF_MANAGE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const canRead = await this.canReadUserAttribute(actor, entity);\n if (!canRead) {\n throw new PermissionError();\n }\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n\n private async canReadUserAttribute(\n actor: ActorContext,\n entity: UserAttribute,\n ): Promise<boolean> {\n const isMe = actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === entity.user_id;\n\n if (isMe) {\n return true;\n }\n\n try {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n return true;\n } catch {\n return false;\n }\n }\n}\n"],"mappings":";;;;;;;;;AAqBA,IAAaQ,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKd,WAAWe,SAASV,KAAAA;EAEnC,MAAMO,OAAwB,CAAA;EAC9B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UAEjB,IAAIK,MADkB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnDL,KAAKQ,KAAKH,MAAAA;OAEVD;EAIR,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMK,OACFC,IACAhB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAId,IAAI,CAACuB,MADiB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnD,MAAM,IAAIzB,gBAAAA;EAGd,OAAOyB;CACX;CAEA,MAAMO,OACFZ,MACAN,OACsB;EACtB,MAAMmB,eAAmCb,KAAKc,WACzCd,KAAKe,QAAQf,KAAKe,KAAKL;EAE5B,MAAMM,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,WACvB,CAACL,gBAAgBA,iBAAiBnB,MAAMuB,SAASjB,KAAKU;EAE3D,IAAIS,iBAAiB;EACrB,IAAI;GACA,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,YAAY,CAAA;EACnF,SAASuB,GAAG;GACR,IAAI,CAACL,cACD,MAAMK;GAEVF,iBAAiB;GACjB,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,iBAAiB,CAAA;EACxF;EAEA,MAAM,KAAKX,WAAWkC,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,IAAI,GACjE,MAAM,IAAIf,gBAAgB,4BAA4BkB,KAAKH,KAAK,sCAAsC;EAG1G,IAAIG,KAAKe,MACLf,KAAKwB,WAAWxB,KAAKe,KAAKS;OACvB,IACH9B,MAAMuB,YACNvB,MAAMuB,SAASC,SAAS,QAC1B;GACElB,KAAKc,UAAUpB,MAAMuB,SAASjB,KAAKU;GACnCV,KAAKwB,WAAW9B,MAAMuB,SAASjB,KAAKwB;EACxC,OACI,MAAM,IAAI1C,gBAAgBG,8BAA8B,SAAA,CAAA;EAG5D,MAAMoB,SAAS,KAAKjB,WAAWwB,OAAOZ,IAAAA;EAEtC,IAAImB,gBACA,MAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrB2B,OAAO,IAAI7C,WAAW,GAAGF,kBAAkBgD,aAAa,GAAG3B,KAAKH,OAAOG,KAAK4B,MAAM,EAAE,CAAA;EACxF,CAAA;OAEA,MAAMlC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrB4B,OAAO,IAAI7C,WAAW,GAAGF,kBAAkBgD,aAAatB,OAAO,CAAA;EACnE,CAAA;EAGJ,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMyB,OACFpB,IACAV,MACAN,OACsB;EACtB,MAAM,KAAKN,WAAWkC,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,IAAI,GACjE,MAAM,IAAIf,gBAAgB,4BAA4BkB,KAAKH,KAAK,sCAAsC;EAG1G,IAAIQ,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EAClD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMiC,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS;EAEtC,IAAIK,iBAAiB;EACrB,IAAI;GACA,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,YAAY,CAAA;EACnF,SAASuB,GAAG;GACR,IAAI,CAACL,cACD,MAAMK;GAEVF,iBAAiB;GACjB,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,iBAAiB,CAAA;EACxF;EAEAM,SAAS,KAAKjB,WAAW2C,MAAM1B,QAAQL,IAAAA;EAEvC,IAAImB,gBACA,MAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrB2B,OAAO,IAAI7C,WAAW,GAAGF,kBAAkBgD,aAAa,GAAGtB,OAAOR,OAAOQ,OAAOuB,MAAM,EAAE,CAAA;EAC5F,CAAA;OAEA,MAAMlC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrB4B,OAAO,IAAI7C,WAAW,GAAGF,kBAAkBgD,aAAatB,OAAO,CAAA;EACnE,CAAA;EAGJ,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAM2B,OACFtB,IACAhB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAId,IAAI,CAACuB,MADiB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnD,MAAM,IAAIzB,gBAAAA;EAGd,MAAM,EAAE8B,IAAIuB,aAAa5B;EACzB,MAAM,KAAKjB,WAAW8C,OAAO7B,MAAAA;EAC7BA,OAAOK,KAAKuB;EAEZ,OAAO5B;CACX;CAEA,MAAcE,qBACVb,OACAW,QACgB;EAKhB,IAJaX,MAAMuB,YACfvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS,SAGlC,OAAO;EAGX,IAAI;GACA,MAAMpB,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAMb,eAAec;IACrB4B,OAAO,IAAI7C,WAAW,GAAGF,kBAAkBgD,aAAatB,OAAO,CAAA;GACnE,CAAA;GAEA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","BadRequestError","EntityNotFoundError","PermissionName","buildErrorMessageForAttribute","AbstractEntityService","UserAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_UPDATE","USER_SELF_MANAGE","data","entities","meta","findMany","total","entity","canRead","canReadUserAttribute","push","getOne","id","findOneBy","create","targetUserId","user_id","user","isSelfTarget","identity","type","isSelfFallback","preEvaluate","e","validateJoinColumns","has","realm_id","evaluate","ATTRIBUTES","value","resourceRealmMatch","save","update","merge","delete","entityId","remove","isMe"],"sources":["../../../../src/core/entities/user-attribute/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PermissionName } from '@authup/core-kit';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { buildErrorMessageForAttribute } from 'validup';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IUserAttributeRepository, IUserAttributeService } from './types.ts';\n\nexport type UserAttributeServiceContext = {\n repository: IUserAttributeRepository;\n reservedNames?: ReadonlySet<string>;\n};\n\nexport class UserAttributeService extends AbstractEntityService implements IUserAttributeService {\n protected repository: IUserAttributeRepository;\n\n protected reservedNames: ReadonlySet<string>;\n\n constructor(ctx: UserAttributeServiceContext) {\n super();\n this.repository = ctx.repository;\n this.reservedNames = ctx.reservedNames ?? new Set();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<UserAttribute>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_UPDATE,\n PermissionName.USER_SELF_MANAGE,\n ],\n });\n\n const {\n data: entities,\n meta,\n } = await this.repository.findMany(query);\n\n const data: UserAttribute[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n const canRead = await this.canReadUserAttribute(actor, entity);\n if (canRead) {\n data.push(entity);\n } else {\n total--;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total,\n },\n };\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_UPDATE,\n PermissionName.USER_SELF_MANAGE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const canRead = await this.canReadUserAttribute(actor, entity);\n if (!canRead) {\n throw new PermissionError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n const targetUserId: string \| undefined = data.user_id \|\|\n (data.user && data.user.id);\n\n const isSelfTarget = !!actor.identity &&\n actor.identity.type === 'user' &&\n (!targetUserId \|\| targetUserId === actor.identity.data.id);\n\n let isSelfFallback = false;\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n } catch (e) {\n if (!isSelfTarget) {\n throw e;\n }\n isSelfFallback = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n }\n\n await this.repository.validateJoinColumns(data);\n\n if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n }\n\n if (data.user) {\n data.realm_id = data.user.realm_id;\n } else if (\n actor.identity &&\n actor.identity.type === 'user'\n ) {\n data.user_id = actor.identity.data.id;\n data.realm_id = actor.identity.data.realm_id;\n } else {\n throw new BadRequestError(buildErrorMessageForAttribute('user_id'));\n }\n\n const entity = this.repository.create(data);\n\n if (isSelfFallback) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } }),\n });\n } else {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n await this.repository.validateJoinColumns(data);\n\n if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n }\n\n let entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const isSelfTarget = !!actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === entity.user_id;\n\n let isSelfFallback = false;\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n } catch (e) {\n if (!isSelfTarget) {\n throw e;\n }\n isSelfFallback = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n }\n\n // An attribute belongs to a fixed user; its owner (and the user-derived realm_id) is\n // IMMUTABLE on update — strip both from the body. This blocks a self-manage or admin\n // caller from reassigning the attribute to another user (isSelfTarget was decided from\n // the ORIGINAL owner), and blocks a caller-supplied realm_id that would gate USER_UPDATE\n // against a realm of their choosing. To move an attribute, delete + recreate.\n delete data.user_id;\n delete data.user;\n delete data.realm_id;\n\n entity = this.repository.merge(entity, data);\n\n if (isSelfFallback) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } }),\n });\n } else {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_UPDATE,\n PermissionName.USER_SELF_MANAGE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const canRead = await this.canReadUserAttribute(actor, entity);\n if (!canRead) {\n throw new PermissionError();\n }\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n\n private async canReadUserAttribute(\n actor: ActorContext,\n entity: UserAttribute,\n ): Promise<boolean> {\n const isMe = actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === entity.user_id;\n\n if (isMe) {\n return true;\n }\n\n try {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n return true;\n } catch {\n return false;\n }\n }\n}\n"],"mappings":";;;;;;;;;AAqBA,IAAaQ,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKd,WAAWe,SAASV,KAAAA;EAEnC,MAAMO,OAAwB,CAAA;EAC9B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UAEjB,IAAIK,MADkB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnDL,KAAKQ,KAAKH,MAAAA;OAEVD;EAIR,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMK,OACFC,IACAhB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAId,IAAI,CAACuB,MADiB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnD,MAAM,IAAIzB,gBAAAA;EAGd,OAAOyB;CACX;CAEA,MAAMO,OACFZ,MACAN,OACsB;EACtB,MAAMmB,eAAmCb,KAAKc,WACzCd,KAAKe,QAAQf,KAAKe,KAAKL;EAE5B,MAAMM,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,WACvB,CAACL,gBAAgBA,iBAAiBnB,MAAMuB,SAASjB,KAAKU;EAE3D,IAAIS,iBAAiB;EACrB,IAAI;GACA,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,YAAY,CAAA;EACnF,SAASuB,GAAG;GACR,IAAI,CAACL,cACD,MAAMK;GAEVF,iBAAiB;GACjB,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,iBAAiB,CAAA;EACxF;EAEA,MAAM,KAAKX,WAAWkC,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,IAAI,GACjE,MAAM,IAAIf,gBAAgB,4BAA4BkB,KAAKH,KAAK,sCAAsC;EAG1G,IAAIG,KAAKe,MACLf,KAAKwB,WAAWxB,KAAKe,KAAKS;OACvB,IACH9B,MAAMuB,YACNvB,MAAMuB,SAASC,SAAS,QAC1B;GACElB,KAAKc,UAAUpB,MAAMuB,SAASjB,KAAKU;GACnCV,KAAKwB,WAAW9B,MAAMuB,SAASjB,KAAKwB;EACxC,OACI,MAAM,IAAI1C,gBAAgBG,8BAA8B,SAAA,CAAA;EAG5D,MAAMoB,SAAS,KAAKjB,WAAWwB,OAAOZ,IAAAA;EAEtC,IAAImB,gBACA,MAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrBC,MAAMnB,iBAAiB,GAAGF,kBAAkB+C,aAAa,GAAG1B,KAAKH,OAAOG,KAAK2B,MAAM,EAAE,CAAA;EACzF,CAAA;OAEA,MAAMjC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrBE,MAAMnB,iBAAiB;KAAGF,kBAAkB+C,aAAarB;IAAQ,GAAG,KAAKuB,mBAAmBvB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMyB,OACFpB,IACAV,MACAN,OACsB;EACtB,MAAM,KAAKN,WAAWkC,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,IAAI,GACjE,MAAM,IAAIf,gBAAgB,4BAA4BkB,KAAKH,KAAK,sCAAsC;EAG1G,IAAIQ,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EAClD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMiC,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS;EAEtC,IAAIK,iBAAiB;EACrB,IAAI;GACA,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,YAAY,CAAA;EACnF,SAASuB,GAAG;GACR,IAAI,CAACL,cACD,MAAMK;GAEVF,iBAAiB;GACjB,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,iBAAiB,CAAA;EACxF;EAOA,OAAOC,KAAKc;EACZ,OAAOd,KAAKe;EACZ,OAAOf,KAAKwB;EAEZnB,SAAS,KAAKjB,WAAW2C,MAAM1B,QAAQL,IAAAA;EAEvC,IAAImB,gBACA,MAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrBC,MAAMnB,iBAAiB,GAAGF,kBAAkB+C,aAAa,GAAGrB,OAAOR,OAAOQ,OAAOsB,MAAM,EAAE,CAAA;EAC7F,CAAA;OAEA,MAAMjC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrBE,MAAMnB,iBAAiB;KAAGF,kBAAkB+C,aAAarB;IAAQ,GAAG,KAAKuB,mBAAmBvB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAM2B,OACFtB,IACAhB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAId,IAAI,CAACuB,MADiB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnD,MAAM,IAAIzB,gBAAAA;EAGd,MAAM,EAAE8B,IAAIuB,aAAa5B;EACzB,MAAM,KAAKjB,WAAW8C,OAAO7B,MAAAA;EAC7BA,OAAOK,KAAKuB;EAEZ,OAAO5B;CACX;CAEA,MAAcE,qBACVb,OACAW,QACgB;EAKhB,IAJaX,MAAMuB,YACfvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS,SAGlC,OAAO;EAGX,IAAI;GACA,MAAMpB,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAMb,eAAec;IACrBE,MAAMnB,iBAAiB;MAAGF,kBAAkB+C,aAAarB;KAAQ,GAAG,KAAKuB,mBAAmBvB,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAEA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ"}

package/dist/core/entities/user-permission/service.d.ts CHANGED Viewed

@@ -1,15 +1,18 @@
 import { UserPermissionValidator } from '@authup/core-kit';
-import type { UserPermission } from '@authup/core-kit';
+import type { Permission, UserPermission } from '@authup/core-kit';
 import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
-import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
-import { AbstractEntityService } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
+import { JunctionEntityService } from '@authup/server-kit';
 import type { IUserPermissionRepository, IUserPermissionService } from './types.ts';
 export type UserPermissionServiceContext = {
     repository: IUserPermissionRepository;
+    permissionRepository: IEntityRepository<Permission>;
     identityPermissionProvider: IIdentityPermissionProvider;
 };
-export declare class UserPermissionService extends AbstractEntityService implements IUserPermissionService {
+export declare class UserPermissionService extends JunctionEntityService implements IUserPermissionService {
+    protected readonly ownerRealmKey = "user_realm_id";
     protected repository: IUserPermissionRepository;
+    protected permissionRepository: IEntityRepository<Permission>;
     protected identityPermissionProvider: IIdentityPermissionProvider;
     protected validator: UserPermissionValidator;
     constructor(ctx: UserPermissionServiceContext);

package/dist/core/entities/user-permission/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-permission/service.ts"],"names":[],"mappings":"~~AAUA~~,OAAO,EAAkB,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;~~AACvD~~,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;~~AACtF~~,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,~~EAAG~~,MAAM,oBAAoB,CAAC;~~AACxF~~,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpF,MAAM,MAAM,4BAA4B,GAAG;IACvC,UAAU,EAAE,yBAAyB,CAAC;IACtC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,qBAAsB,SAAQ,qBAAsB,YAAW,sBAAsB;IAC9F,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAEhD,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,uBAAuB,CAAC;gBAEjC,GAAG,EAAE,4BAA4B;~~IAOvC~~,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,cAAc,CAAC,CAAC;IAYpD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAiBpB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;~~IA6DpB~~,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;~~IAyBpB~~,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;~~CAmB7B~~"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-permission/service.ts"],"names":[],"mappings":"AAcA,OAAO,EAAkB,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpF,MAAM,MAAM,4BAA4B,GAAG;IACvC,UAAU,EAAE,yBAAyB,CAAC;IACtC,oBAAoB,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACpD,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,qBAAsB,SAAQ,qBAAsB,YAAW,sBAAsB;IAC9F,SAAS,CAAC,QAAQ,CAAC,aAAa,mBAAmB;IAEnD,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAEhD,SAAS,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE9D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,uBAAuB,CAAC;gBAEjC,GAAG,EAAE,4BAA4B;IAQvC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,cAAc,CAAC,CAAC;IAYpD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAiBpB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IA4DpB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAgEpB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;CAsB7B"}

package/dist/core/entities/user-permission/service.mjs CHANGED Viewed

@@ -1,19 +1,23 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { applyJunctionCreateGrant, buildJunctionUpdateData } from "../../identity/permission/junction-grant.mjs";
 import { ValidatorGroup } from "@authup/kit";
 import { PermissionName, UserPermissionValidator } from "@authup/core-kit";
-import { AbstractEntityService } from "@authup/server-kit";
-import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { JunctionEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, RealmScope, definePolicyData } from "@authup/access";
 import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/user-permission/service.ts
-var UserPermissionService = class extends AbstractEntityService {
+var UserPermissionService = class extends JunctionEntityService {
+	ownerRealmKey = "user_realm_id";
 	repository;
+	permissionRepository;
 	identityPermissionProvider;
 	validator;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
+		this.permissionRepository = ctx.permissionRepository;
 		this.identityPermissionProvider = ctx.identityPermissionProvider;
 		this.validator = new UserPermissionValidator();
 	}
@@ -52,20 +56,21 @@ var UserPermissionService = class extends AbstractEntityService {
 			});
 		}
 		if (validated.user) validated.user_realm_id = validated.user.realm_id;
-		if (validated.permission && actor.identity && typeof validated.policy_id === "undefined") {
-			const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy({
-				type: actor.identity.type,
-				id: actor.identity.data.id
-			}, {
-				name: validated.permission.name,
-				realmId: validated.permission.realm_id,
-				clientId: validated.permission.client_id
-			});
-			if (junctionPolicy) validated.policy_id = junctionPolicy.id;
-		}
+		if (validated.permission && actor.identity) applyJunctionCreateGrant(validated, await this.identityPermissionProvider.resolveJunctionGrant({
+			type: actor.identity.type,
+			id: actor.identity.data.id
+		}, {
+			name: validated.permission.name,
+			realmId: validated.permission.realm_id,
+			clientId: validated.permission.client_id,
+			realmScope: validated.realm_scope ?? RealmScope.OWN
+		}));
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_PERMISSION_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),
+				[BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated)
+			})
 		});
 		let entity = this.repository.create(validated);
 		entity = await this.repository.save(entity);
@@ -75,13 +80,45 @@ var UserPermissionService = class extends AbstractEntityService {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_UPDATE });
 		const entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
-		const updateData = {};
-		if (Object.prototype.hasOwnProperty.call(data, "policy_id")) updateData.policy_id = data.policy_id;
+		const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });
+		const permission = await this.permissionRepository.findOneById(entity.permission_id);
+		if (permission) await actor.permissionEvaluator.preEvaluate({
+			name: permission.name,
+			realmId: permission.realm_id,
+			clientId: permission.client_id
+		});
+		let actorScope = RealmScope.ANY;
+		let actorPolicyFree = true;
+		let actorPolicyId = null;
+		if (actor.identity && permission) {
+			const grant = await this.identityPermissionProvider.resolveJunctionGrant({
+				type: actor.identity.type,
+				id: actor.identity.data.id
+			}, {
+				name: permission.name,
+				realmId: permission.realm_id,
+				clientId: permission.client_id,
+				realmScope: validated.realm_scope ?? entity.realm_scope
+			});
+			actorScope = grant.realmScope;
+			actorPolicyFree = !grant.policy;
+			actorPolicyId = grant.policy ? grant.policy.id : null;
+		} else if (actor.identity) actorScope = RealmScope.OWN;
+		const updateData = buildJunctionUpdateData({
+			data: validated,
+			existingScope: entity.realm_scope,
+			actorScope,
+			actorPolicyFree,
+			actorPolicyId
+		});
 		await this.repository.validateJoinColumns(updateData);
 		const merged = this.repository.merge(entity, updateData);
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_PERMISSION_UPDATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),
+				[BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged)
+			})
 		});
 		return this.repository.save(merged);
 	}
@@ -91,7 +128,10 @@ var UserPermissionService = class extends AbstractEntityService {
 		if (!entity) throw new EntityNotFoundError();
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_PERMISSION_DELETE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),
+				[BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity)
+			})
 		});
 		const { id: entityId } = entity;
 		await this.repository.remove(entity);

package/dist/core/entities/user-permission/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","UserPermissionValidator","AbstractEntityService","UserPermissionService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_PERMISSION_CREATE","USER_PERMISSION_DELETE","USER_PERMISSION_READ","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permission_id","user_id","permission","permission_realm_id","realm_id","realmId","clientId","client_id","user","user_realm_id","identity","policy_id","junctionPolicy","resolveJunctionPolicy","type","evaluate","input","ATTRIBUTES","save","update","USER_PERMISSION_UPDATE","updateData","Object","prototype","hasOwnProperty","call","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/user-permission/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, UserPermissionValidator } from '@authup/core-kit';\nimport type { UserPermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IUserPermissionRepository, IUserPermissionService } from './types.ts';\n\nexport type UserPermissionServiceContext = {\n repository: IUserPermissionRepository;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserPermissionService extends AbstractEntityService implements IUserPermissionService {\n protected repository: IUserPermissionRepository;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: UserPermissionValidator;\n\n constructor(ctx: UserPermissionServiceContext) {\n super();\n this.repository = ctx.repository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new UserPermissionValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<UserPermission>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_PERMISSION_CREATE,\n PermissionName.USER_PERMISSION_DELETE,\n PermissionName.USER_PERMISSION_READ,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<UserPermission> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_PERMISSION_CREATE,\n PermissionName.USER_PERMISSION_DELETE,\n PermissionName.USER_PERMISSION_READ,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<UserPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n permission_id: validated.permission_id,\n user_id: validated.user_id,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'user-permission' });\n }\n\n if (validated.permission) {\n validated.permission_realm_id = validated.permission.realm_id;\n\n await actor.permissionEvaluator.preEvaluate({\n name: validated.permission.name,\n realmId: validated.permission.realm_id,\n clientId: validated.permission.client_id,\n });\n }\n\n if (validated.user) {\n validated.user_realm_id = validated.user.realm_id;\n }\n\n if (\n validated.permission &&\n actor.identity &&\n typeof validated.policy_id === 'undefined'\n ) {\n const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n name: validated.permission.name,\n realmId: validated.permission.realm_id,\n clientId: validated.permission.client_id,\n },\n );\n if (junctionPolicy) {\n validated.policy_id = junctionPolicy.id;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_PERMISSION_CREATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<UserPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const updateData: Record<string, any> = {};\n if (Object.prototype.hasOwnProperty.call(data, 'policy_id')) {\n updateData.policy_id = data.policy_id;\n }\n\n await this.repository.validateJoinColumns(updateData);\n\n const merged = this.repository.merge(entity, updateData);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_PERMISSION_UPDATE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged }),\n });\n\n return this.repository.save(merged);\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<UserPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_PERMISSION_DELETE,\n input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;AAsBA,IAAaQ,wBAAb,cAA2CD,sBAAAA;CAC7BE;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIL,wBAAAA;CACzB;CAEA,MAAMO,QACFC,OACAC,OACuD;EACvD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,OAAOsB;CACX;CAEA,MAAME,OACFC,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMb,eAAec,uBAAuB,CAAA;EAE1F,MAAMW,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAO5B,eAAe6B,OAAO,CAAA;EAEhF,MAAM,KAAKxB,WAAWyB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK1B,WAAWiB,UAAU;GAC7CU,eAAeN,UAAUM;GACzBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAInC,oBAAoB,EAAEuB,QAAQ,kBAAkB,CAAA;EAG9D,IAAIK,UAAUQ,YAAY;GACtBR,UAAUS,sBAAsBT,UAAUQ,WAAWE;GAErD,MAAMzB,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMY,UAAUQ,WAAWpB;IAC3BuB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWK;GACnC,CAAA;EACJ;EAEA,IAAIb,UAAUc,MACVd,UAAUe,gBAAgBf,UAAUc,KAAKJ;EAG7C,IACIV,UAAUQ,cACVvB,MAAM+B,YACN,OAAOhB,UAAUiB,cAAc,aACjC;GACE,MAAMC,iBAAiB,MAAM,KAAKtC,2BAA2BuC,sBACzD;IACIC,MAAMnC,MAAM+B,SAASI;IACrB1B,IAAIT,MAAM+B,SAASlB,KAAKJ;GAC5B,GACA;IACIN,MAAMY,UAAUQ,WAAWpB;IAC3BuB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWK;GACnC,CAAA;GAEJ,IAAIK,gBACAlB,UAAUiB,YAAYC,eAAexB;EAE7C;EAEA,MAAMT,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMb,eAAec;GACrBiC,OAAO,IAAInD,WAAW,GAAGD,kBAAkBqD,aAAavB,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIL,SAAS,KAAKhB,WAAWkB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKhB,WAAW6C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAI,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMb,eAAemD,uBAAuB,CAAA;EAE1F,MAAM/B,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMsD,aAAkC,CAAC;EACzC,IAAIC,OAAOC,UAAUC,eAAeC,KAAKjC,MAAM,WAAA,GAC3C6B,WAAWV,YAAYnB,KAAKmB;EAGhC,MAAM,KAAKtC,WAAWyB,oBAAoBuB,UAAAA;EAE1C,MAAMK,SAAS,KAAKrD,WAAWsD,MAAMtC,QAAQgC,UAAAA;EAE7C,MAAM1C,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMb,eAAemD;GACrBJ,OAAO,IAAInD,WAAW,GAAGD,kBAAkBqD,aAAaS,OAAO,CAAA;EACnE,CAAA;EAEA,OAAO,KAAKrD,WAAW6C,KAAKQ,MAAAA;CAChC;CAEA,MAAME,OACFxC,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMb,eAAee,uBAAuB,CAAA;EAE1F,MAAMK,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMb,eAAee;GACrBgC,OAAO,IAAInD,WAAW,GAAGD,kBAAkBqD,aAAa5B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAIyC,aAAaxC;EACzB,MAAM,KAAKhB,WAAWyD,OAAOzC,MAAAA;EAC7BA,OAAOD,KAAKyC;EAEZ,OAAOxC;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","UserPermissionValidator","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","UserPermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_PERMISSION_CREATE","USER_PERMISSION_DELETE","USER_PERMISSION_READ","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permission_id","user_id","permission","permission_realm_id","realm_id","realmId","clientId","client_id","user","user_realm_id","identity","grant","resolveJunctionGrant","type","realmScope","realm_scope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","USER_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/user-permission/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n BuiltInPolicyType,\n RealmScope,\n definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, UserPermissionValidator } from '@authup/core-kit';\nimport type { Permission, UserPermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IUserPermissionRepository, IUserPermissionService } from './types.ts';\n\nexport type UserPermissionServiceContext = {\n repository: IUserPermissionRepository;\n permissionRepository: IEntityRepository<Permission>;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserPermissionService extends JunctionEntityService implements IUserPermissionService {\n protected readonly ownerRealmKey = 'user_realm_id';\n\n protected repository: IUserPermissionRepository;\n\n protected permissionRepository: IEntityRepository<Permission>;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: UserPermissionValidator;\n\n constructor(ctx: UserPermissionServiceContext) {\n super();\n this.repository = ctx.repository;\n this.permissionRepository = ctx.permissionRepository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new UserPermissionValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<UserPermission>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_PERMISSION_CREATE,\n PermissionName.USER_PERMISSION_DELETE,\n PermissionName.USER_PERMISSION_READ,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<UserPermission> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_PERMISSION_CREATE,\n PermissionName.USER_PERMISSION_DELETE,\n PermissionName.USER_PERMISSION_READ,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<UserPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n permission_id: validated.permission_id,\n user_id: validated.user_id,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'user-permission' });\n }\n\n if (validated.permission) {\n validated.permission_realm_id = validated.permission.realm_id;\n\n await actor.permissionEvaluator.preEvaluate({\n name: validated.permission.name,\n realmId: validated.permission.realm_id,\n clientId: validated.permission.client_id,\n });\n }\n\n if (validated.user) {\n validated.user_realm_id = validated.user.realm_id;\n }\n\n if (validated.permission && actor.identity) {\n const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n name: validated.permission.name,\n realmId: validated.permission.realm_id,\n clientId: validated.permission.client_id,\n realmScope: validated.realm_scope ?? RealmScope.OWN,\n },\n );\n\n applyJunctionCreateGrant(validated, grant);\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_PERMISSION_CREATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<UserPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n const permission = await this.permissionRepository.findOneById(entity.permission_id);\n if (permission) {\n // Member-permission gate: an actor may only modify a binding for a permission it\n // holds (mirrors create()).\n await actor.permissionEvaluator.preEvaluate({\n name: permission.name,\n realmId: permission.realm_id,\n clientId: permission.client_id,\n });\n }\n\n let actorScope: `${RealmScope}` = RealmScope.ANY;\n let actorPolicyFree = true;\n let actorPolicyId: string \| null = null;\n if (actor.identity && permission) {\n const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n { type: actor.identity.type, id: actor.identity.data.id },\n {\n name: permission.name,\n realmId: permission.realm_id,\n clientId: permission.client_id,\n realmScope: validated.realm_scope ?? entity.realm_scope,\n },\n );\n actorScope = grant.realmScope;\n actorPolicyFree = !grant.policy;\n actorPolicyId = grant.policy ? grant.policy.id : null;\n } else if (actor.identity) {\n actorScope = RealmScope.OWN;\n }\n\n const updateData = buildJunctionUpdateData({\n data: validated,\n existingScope: entity.realm_scope,\n actorScope,\n actorPolicyFree,\n actorPolicyId,\n });\n\n await this.repository.validateJoinColumns(updateData);\n\n const merged = this.repository.merge(entity, updateData);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_PERMISSION_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n }),\n });\n\n return this.repository.save(merged);\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<UserPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_PERMISSION_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;AA4BA,IAAaW,wBAAb,cAA2CD,sBAAAA;CACpBE,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIT,wBAAAA;CACzB;CAEA,MAAMW,QACFC,OACAC,OACuD;EACvD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFjB,eAAekB;GACflB,eAAemB;GACfnB,eAAeoB;IAEvB,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFjB,eAAekB;GACflB,eAAemB;GACfnB,eAAeoB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMjB,eAAekB,uBAAuB,CAAA;EAE1F,MAAMW,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOhC,eAAeiC,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWkB,UAAU;GAC7CU,eAAeN,UAAUM;GACzBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIvC,oBAAoB,EAAE2B,QAAQ,kBAAkB,CAAA;EAG9D,IAAIK,UAAUQ,YAAY;GACtBR,UAAUS,sBAAsBT,UAAUQ,WAAWE;GAErD,MAAMzB,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMY,UAAUQ,WAAWpB;IAC3BuB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWK;GACnC,CAAA;EACJ;EAEA,IAAIb,UAAUc,MACVd,UAAUe,gBAAgBf,UAAUc,KAAKJ;EAG7C,IAAIV,UAAUQ,cAAcvB,MAAM+B,UAc9B3C,yBAAyB2B,WAAWiB,MAbhB,KAAKrC,2BAA2BsC,qBAChD;GACIC,MAAMlC,MAAM+B,SAASG;GACrBzB,IAAIT,MAAM+B,SAASlB,KAAKJ;EAC5B,GACA;GACIN,MAAMY,UAAUQ,WAAWpB;GAC3BuB,SAASX,UAAUQ,WAAWE;GAC9BE,UAAUZ,UAAUQ,WAAWK;GAC/BO,YAAYpB,UAAUqB,eAAevD,WAAWwD;EACpD,CAAA,CAGgCL;EAGxC,MAAMhC,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAekB;GACrBS,MAAM/B,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBzB,SAAAA;KACvDnC,kBAAkB6D,cAAc,KAAKC,sBAAsB3B,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKjB,WAAWmB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKjB,WAAWkD,KAAKjC,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMkC,OACFnC,IACAI,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMjB,eAAe2D,uBAAuB,CAAA;EAE1F,MAAMnC,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,MAAM+B,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOhC,eAAe6D,OAAO,CAAA;EAEhF,MAAMvB,aAAa,MAAM,KAAK7B,qBAAqBqD,YAAYrC,OAAOW,aAAa;EACnF,IAAIE,YAGA,MAAMvB,MAAMC,oBAAoBa,YAAY;GACxCX,MAAMoB,WAAWpB;GACjBuB,SAASH,WAAWE;GACpBE,UAAUJ,WAAWK;EACzB,CAAA;EAGJ,IAAIoB,aAA8BnE,WAAWoE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAInD,MAAM+B,YAAYR,YAAY;GAC9B,MAAMS,QAAQ,MAAM,KAAKrC,2BAA2BsC,qBAChD;IAAEC,MAAMlC,MAAM+B,SAASG;IAAMzB,IAAIT,MAAM+B,SAASlB,KAAKJ;GAAG,GACxD;IACIN,MAAMoB,WAAWpB;IACjBuB,SAASH,WAAWE;IACpBE,UAAUJ,WAAWK;IACrBO,YAAYpB,UAAUqB,eAAe1B,OAAO0B;GAChD,CAAA;GAEJY,aAAahB,MAAMG;GACnBe,kBAAkB,CAAClB,MAAMoB;GACzBD,gBAAgBnB,MAAMoB,SAASpB,MAAMoB,OAAO3C,KAAK;EACrD,OAAO,IAAIT,MAAM+B,UACbiB,aAAanE,WAAWwD;EAG5B,MAAMgB,aAAahE,wBAAwB;GACvCwB,MAAME;GACNuC,eAAe5C,OAAO0B;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAK1D,WAAW0B,oBAAoBkC,UAAAA;EAE1C,MAAME,SAAS,KAAK9D,WAAW+D,MAAM9C,QAAQ2C,UAAAA;EAE7C,MAAMrD,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAe2D;GACrBhC,MAAM/B,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBe,MAAAA;KACvD3E,kBAAkB6D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK9D,WAAWkD,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACFhD,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMjB,eAAemB,uBAAuB,CAAA;EAE1F,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,MAAMgB,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAemB;GACrBQ,MAAM/B,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmB9B,MAAAA;KACvD9B,kBAAkB6D,cAAc,KAAKC,sBAAsBhC,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIiD,aAAahD;EACzB,MAAM,KAAKjB,WAAWkE,OAAOjD,MAAAA;EAC7BA,OAAOD,KAAKiD;EAEZ,OAAOhD;CACX;AACJ"}

package/dist/core/entities/user-role/service.d.ts CHANGED Viewed

@@ -1,14 +1,15 @@
 import { UserRoleValidator } from '@authup/core-kit';
 import type { UserRole } from '@authup/core-kit';
 import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
-import { AbstractEntityService } from '@authup/server-kit';
+import { JunctionEntityService } from '@authup/server-kit';
 import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
 import type { IUserRoleRepository, IUserRoleService } from './types.ts';
 export type UserRoleServiceContext = {
     repository: IUserRoleRepository;
     identityPermissionProvider: IIdentityPermissionProvider;
 };
-export declare class UserRoleService extends AbstractEntityService implements IUserRoleService {
+export declare class UserRoleService extends JunctionEntityService implements IUserRoleService {
+    protected readonly ownerRealmKey = "user_realm_id";
     protected repository: IUserRoleRepository;
     protected identityPermissionProvider: IIdentityPermissionProvider;
     protected validator: UserRoleValidator;

package/dist/core/entities/user-role/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,MAAM,sBAAsB,GAAG;IACjC,UAAU,EAAE,mBAAmB,CAAC;IAChC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,eAAgB,SAAQ,qBAAsB,YAAW,gBAAgB;IAClF,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAE1C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,iBAAiB,CAAC;gBAE3B,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IAY9C,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAiBd,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;~~IAmDd~~,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;~~CAmBvB~~"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,MAAM,sBAAsB,GAAG;IACjC,UAAU,EAAE,mBAAmB,CAAC;IAChC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,eAAgB,SAAQ,qBAAsB,YAAW,gBAAgB;IAClF,SAAS,CAAC,QAAQ,CAAC,aAAa,mBAAmB;IAEnD,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAE1C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,iBAAiB,CAAC;gBAE3B,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IAY9C,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAiBd,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAuDd,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;CAuBvB"}

package/dist/core/entities/user-role/service.mjs CHANGED Viewed

@@ -3,11 +3,12 @@ import "node:url";
 import.meta.url;
 import { ValidatorGroup } from "@authup/kit";
 import { PermissionName, UserRoleValidator } from "@authup/core-kit";
-import { AbstractEntityService } from "@authup/server-kit";
-import { BuiltInPolicyType, PermissionError, PolicyData } from "@authup/access";
+import { JunctionEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, PermissionError, definePolicyData } from "@authup/access";
 import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/user-role/service.ts
-var UserRoleService = class extends AbstractEntityService {
+var UserRoleService = class extends JunctionEntityService {
+	ownerRealmKey = "user_realm_id";
 	repository;
 	identityPermissionProvider;
 	validator;
@@ -57,7 +58,10 @@ var UserRoleService = class extends AbstractEntityService {
 		}
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_ROLE_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),
+				[BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated)
+			})
 		});
 		let entity = this.repository.create(validated);
 		entity = await this.repository.save(entity);
@@ -69,7 +73,10 @@ var UserRoleService = class extends AbstractEntityService {
 		if (!entity) throw new EntityNotFoundError();
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_ROLE_DELETE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),
+				[BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity)
+			})
 		});
 		const { id: entityId } = entity;
 		await this.repository.remove(entity);

package/dist/core/entities/user-role/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","~~PolicyData~~","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","UserRoleValidator","~~AbstractEntityService~~","UserRoleService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_ROLE_READ","USER_ROLE_CREATE","USER_ROLE_UPDATE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","role_id","user_id","role","role_realm_id","realm_id","user","user_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","message","evaluate","~~input~~","~~ATTRIBUTES~~","save","delete","USER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/user-role/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, ~~PolicyData~~ } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, UserRoleValidator } from '@authup/core-kit';\nimport type { UserRole } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { ~~AbstractEntityService~~ } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IUserRoleRepository, IUserRoleService } from './types.ts';\n\nexport type UserRoleServiceContext = {\n repository: IUserRoleRepository;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserRoleService extends ~~AbstractEntityService~~ implements IUserRoleService {\n protected repository: IUserRoleRepository;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: UserRoleValidator;\n\n constructor(ctx: UserRoleServiceContext) {\n super();\n this.repository = ctx.repository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new UserRoleValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<UserRole>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_ROLE_READ,\n PermissionName.USER_ROLE_CREATE,\n PermissionName.USER_ROLE_UPDATE,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<UserRole> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_ROLE_READ,\n PermissionName.USER_ROLE_CREATE,\n PermissionName.USER_ROLE_UPDATE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<UserRole> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n role_id: validated.role_id,\n user_id: validated.user_id,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'user-role' });\n }\n\n if (validated.role) {\n validated.role_realm_id = validated.role.realm_id;\n }\n\n if (validated.user) {\n validated.user_realm_id = validated.user.realm_id;\n }\n\n if (validated.role && actor.identity) {\n const hasPermissions = await this.identityPermissionProvider.isSuperset(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n type: 'role',\n id: validated.role_id,\n clientId: validated.role.client_id,\n },\n );\n if (!hasPermissions) {\n throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_ROLE_CREATE,\n ~~input~~: ~~new PolicyData~~({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<UserRole> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_ROLE_DELETE,\n ~~input~~: ~~new PolicyData~~({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;AAsBA,IAAaS,kBAAb,cAAqCD,sBAAAA;~~CACvBE~~;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;EACrC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,~~IAAIL~~,kBAAAA;CACzB;CAEA,~~MAAMO~~,QACFC,OACAC,OACiD;EACjD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;~~GACFb~~,~~eAAec;GACfd,~~eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,IACAT,OACiB;EACjB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;~~GACFb~~,~~eAAec;GACfd,~~eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,~~IAAItB~~,oBAAAA;EAGd,~~OAAOsB~~;CACX;CAEA,MAAME,OACFC,MACAb,OACiB;EACjB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,~~MAAMb~~,~~eAAee~~,iBAAiB,CAAA;EAEpF,MAAMU,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,~~OAAO5B~~,~~eAAe6B~~,OAAO,CAAA;EAEhF,MAAM,KAAKxB,WAAWyB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK1B,WAAWiB,UAAU;GAC7CU,SAASN,UAAUM;GACnBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,~~IAAInC~~,oBAAoB,~~EAAEuB~~,QAAQ,YAAY,CAAA;EAGxD,IAAIK,UAAUQ,MACVR,UAAUS,gBAAgBT,UAAUQ,KAAKE;EAG7C,IAAIV,UAAUW,MACVX,UAAUY,gBAAgBZ,UAAUW,KAAKD;EAG7C,IAAIV,UAAUQ,QAAQvB,MAAM4B;OAYpB,CAACC,MAXwB,KAAKlC,2BAA2BmC,WACzD;IACIC,MAAM/B,MAAM4B,SAASG;IACrBtB,IAAIT,MAAM4B,SAASf,KAAKJ;GAC5B,GACA;IACIsB,MAAM;IACNtB,IAAIM,UAAUM;IACdW,UAAUjB,UAAUQ,KAAKU;GAC7B,CAAA,GAGA,MAAM,~~IAAIhD~~,gBAAgB,~~EAAEiD~~,SAAS,0CAA2C,CAAA;EAAA;~~EAIxF~~,MAAMlC,MAAMC,oBAAoBkC,SAAS;GACrChC,~~MAAMb~~,~~eAAee~~;~~GACrB+B~~,~~OAAO~~,~~IAAIlD~~,~~WAAW~~,~~GAAGF~~,~~kBAAkBqD~~,~~aAAatB~~,~~UAAU~~,CAAA;~~EACtE~~,CAAA;EAEA,IAAIL,SAAS,KAAKhB,WAAWkB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKhB,~~WAAW4C~~,~~KAAK5B~~,MAAAA;EAEpC,OAAOA;CACX;CAEA,~~MAAM6B~~,~~OACF9B~~,IACAT,OACiB;EACjB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,~~MAAMb~~,~~eAAekD~~,iBAAiB,CAAA;EAEpF,~~MAAM9B~~,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,~~IAAItB~~,oBAAAA;~~EAGd~~,~~MAAMY~~,MAAMC,oBAAoBkC,SAAS;GACrChC,~~MAAMb~~,~~eAAekD~~;~~GACrBJ~~,~~OAAO~~,~~IAAIlD~~,~~WAAW~~,~~GAAGF~~,~~kBAAkBqD~~,~~aAAa3B~~,~~OAAO~~,CAAA;~~EACnE~~,CAAA;EAEA,MAAM,EAAED,~~IAAIgC~~,~~aAAa/B~~;EACzB,MAAM,KAAKhB,~~WAAWgD~~,~~OAAOhC~~,MAAAA;EAC7BA,OAAOD,~~KAAKgC~~;EAEZ,~~OAAO/B~~;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","UserRoleValidator","JunctionEntityService","UserRoleService","ownerRealmKey","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_ROLE_READ","USER_ROLE_CREATE","USER_ROLE_UPDATE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","role_id","user_id","role","role_realm_id","realm_id","user","user_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","message","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","USER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/user-role/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, UserRoleValidator } from '@authup/core-kit';\nimport type { UserRole } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IUserRoleRepository, IUserRoleService } from './types.ts';\n\nexport type UserRoleServiceContext = {\n repository: IUserRoleRepository;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserRoleService extends JunctionEntityService implements IUserRoleService {\n protected readonly ownerRealmKey = 'user_realm_id';\n\n protected repository: IUserRoleRepository;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: UserRoleValidator;\n\n constructor(ctx: UserRoleServiceContext) {\n super();\n this.repository = ctx.repository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new UserRoleValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<UserRole>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_ROLE_READ,\n PermissionName.USER_ROLE_CREATE,\n PermissionName.USER_ROLE_UPDATE,\n ],\n });\n\n return this.repository.findMany(query);\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<UserRole> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_ROLE_READ,\n PermissionName.USER_ROLE_CREATE,\n PermissionName.USER_ROLE_UPDATE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<UserRole> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n role_id: validated.role_id,\n user_id: validated.user_id,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'user-role' });\n }\n\n if (validated.role) {\n validated.role_realm_id = validated.role.realm_id;\n }\n\n if (validated.user) {\n validated.user_realm_id = validated.user.realm_id;\n }\n\n if (validated.role && actor.identity) {\n const hasPermissions = await this.identityPermissionProvider.isSuperset(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n type: 'role',\n id: validated.role_id,\n clientId: validated.role.client_id,\n },\n );\n if (!hasPermissions) {\n throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n }\n }\n\n // Stamp the owner (user) realm so the realm_scope factor gates cross-realm writes.\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_ROLE_CREATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<UserRole> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n // Stamp the owner (user) realm so the realm_scope factor gates cross-realm writes.\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_ROLE_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;AAsBA,IAAaS,kBAAb,cAAqCD,sBAAAA;CACdE,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;EACrC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIN,kBAAAA;CACzB;CAEA,MAAMQ,QACFC,OACAC,OACiD;EACjD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,IACAT,OACiB;EACjB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,OAAOuB;CACX;CAEA,MAAME,OACFC,MACAb,OACiB;EACjB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAegB,iBAAiB,CAAA;EAEpF,MAAMU,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAO7B,eAAe8B,OAAO,CAAA;EAEhF,MAAM,KAAKxB,WAAWyB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK1B,WAAWiB,UAAU;GAC7CU,SAASN,UAAUM;GACnBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIpC,oBAAoB,EAAEwB,QAAQ,YAAY,CAAA;EAGxD,IAAIK,UAAUQ,MACVR,UAAUS,gBAAgBT,UAAUQ,KAAKE;EAG7C,IAAIV,UAAUW,MACVX,UAAUY,gBAAgBZ,UAAUW,KAAKD;EAG7C,IAAIV,UAAUQ,QAAQvB,MAAM4B;OAYpB,CAACC,MAXwB,KAAKlC,2BAA2BmC,WACzD;IACIC,MAAM/B,MAAM4B,SAASG;IACrBtB,IAAIT,MAAM4B,SAASf,KAAKJ;GAC5B,GACA;IACIsB,MAAM;IACNtB,IAAIM,UAAUM;IACdW,UAAUjB,UAAUQ,KAAKU;GAC7B,CAAA,GAGA,MAAM,IAAIjD,gBAAgB,EAAEkD,SAAS,0CAA2C,CAAA;EAAA;EAKxF,MAAMlC,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMd,eAAegB;GACrBQ,MAAM5B,iBAAiB;KAClBF,kBAAkBqD,aAAa,KAAKC,mBAAmBtB,SAAAA;KACvDhC,kBAAkBuD,cAAc,KAAKC,sBAAsBxB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKhB,WAAWkB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKhB,WAAW8C,KAAK9B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM+B,OACFhC,IACAT,OACiB;EACjB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAeqD,iBAAiB,CAAA;EAEpF,MAAMhC,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAId,MAAMa,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMd,eAAeqD;GACrB7B,MAAM5B,iBAAiB;KAClBF,kBAAkBqD,aAAa,KAAKC,mBAAmB3B,MAAAA;KACvD3B,kBAAkBuD,cAAc,KAAKC,sBAAsB7B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIkC,aAAajC;EACzB,MAAM,KAAKhB,WAAWkD,OAAOlC,MAAAA;EAC7BA,OAAOD,KAAKkC;EAEZ,OAAOjC;CACX;AACJ"}

package/dist/core/identity/index.mjs CHANGED Viewed

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { applyJunctionCreateGrant, buildJunctionUpdateData } from "./permission/junction-grant.mjs";
 import { PASSWORD_RESET_EXPIRES_IN_MINUTES } from "./password-recovery/constants.mjs";
 import { PasswordRecoveryService } from "./password-recovery/service.mjs";
 import "./password-recovery/index.mjs";
@@ -32,4 +33,4 @@ import "./registration/index.mjs";
 import { IdentityResolver } from "./resolver/module.mjs";
 import "./resolver/index.mjs";
 import { IdentityRoleProvider } from "./role/module.mjs";
-export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityResolver, IdentityRoleProvider, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordRecoveryService, PermissionCheckerService, PolicyCheckerService, RegistrationService, createIdentityProviderOAuth2Authenticator };
+export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityResolver, IdentityRoleProvider, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordRecoveryService, PermissionCheckerService, PolicyCheckerService, RegistrationService, applyJunctionCreateGrant, buildJunctionUpdateData, createIdentityProviderOAuth2Authenticator };

package/dist/core/identity/permission/checker/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/permission/checker/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EACR,yBAAyB,EACzB,+BAA+B,EAClC,MAAM,YAAY,CAAC;AAEpB,qBAAa,wBAAyB,YAAW,yBAAyB;IACtE,SAAS,CAAC,GAAG,EAAE,+BAA+B,CAAC;gBAEnC,GAAG,EAAE,+BAA+B;IAI1C,KAAK,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;~~IA0CV~~,SAAS,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ3B"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/permission/checker/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EACR,yBAAyB,EACzB,+BAA+B,EAClC,MAAM,YAAY,CAAC;AAEpB,qBAAa,wBAAyB,YAAW,yBAAyB;IACtE,SAAS,CAAC,GAAG,EAAE,+BAA+B,CAAC;gBAEnC,GAAG,EAAE,+BAA+B;IAI1C,KAAK,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAiDV,SAAS,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ3B"}

package/dist/core/identity/permission/checker/service.mjs CHANGED Viewed

@@ -3,8 +3,8 @@ import "node:url";
 import.meta.url;
 import { PolicyEngine as PolicyEngine$1 } from "../../../security/policy/engine.mjs";
 import { toIdentityPolicyData } from "../identity-policy-data.mjs";
-import { isUUID } from "@authup/kit";
-import { BuiltInPolicyType, PermissionEvaluator, PolicyData } from "@authup/access";
+import { hasOwnProperty, isUUID } from "@authup/kit";
+import { BuiltInPolicyType, PermissionEvaluator, definePolicyData } from "@authup/access";
 import { EntityNotFoundError, normalizeError } from "@authup/errors";
 //#region src/core/identity/permission/checker/service.ts
 var PermissionCheckerService = class {
@@ -26,15 +26,17 @@ var PermissionCheckerService = class {
 		if (!entity) throw new EntityNotFoundError();
 		const input = { ...data };
 		if (typeof input[BuiltInPolicyType.IDENTITY] === "undefined") input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);
+		const attributes = input[BuiltInPolicyType.ATTRIBUTES];
+		if (attributes && hasOwnProperty(attributes, "realm_id")) input[BuiltInPolicyType.REALM_MATCH] = attributes.realm_id ?? null;
 		const evaluationContext = {
 			name: entity.name,
-			input: new PolicyData(input)
+			data: definePolicyData(input)
 		};
 		const evaluator = new PermissionEvaluator({
 			provider: this.ctx.permissionProvider,
 			policyEngine: new PolicyEngine$1(this.ctx.identityPermissionProvider)
 		});
-		if (evaluationContext.input && evaluationContext.input.has(BuiltInPolicyType.ATTRIBUTES)) await evaluator.evaluate(evaluationContext);
+		if (evaluationContext.data && evaluationContext.data.has(BuiltInPolicyType.ATTRIBUTES)) await evaluator.evaluate(evaluationContext);
 		else await evaluator.preEvaluate(evaluationContext);
 	}
 	async safeCheck(idOrName, data, actor, realm) {

package/dist/core/identity/permission/checker/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionEvaluator","~~PolicyData~~","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PermissionCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","realmEntity","realmRepository","resolve","name","realm_id","entity","repository","findOneBy","input","IDENTITY","identity","evaluationContext","evaluator","provider","permissionProvider","policyEngine","identityPermissionProvider","has","~~ATTRIBUTES","~~evaluate","preEvaluate","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/permission/checker/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PermissionEvaluationContext } from '@authup/access';\nimport { BuiltInPolicyType, PermissionEvaluator, ~~PolicyData~~ } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../identity-policy-data.ts';\nimport type {\n IPermissionCheckerService,\n PermissionCheckerServiceContext,\n} from './types.ts';\n\nexport class PermissionCheckerService implements IPermissionCheckerService {\n protected ctx: PermissionCheckerServiceContext;\n\n constructor(ctx: PermissionCheckerServiceContext) {\n this.ctx = ctx;\n }\n\n async check(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realm?: string,\n ): Promise<void> {\n let criteria: Record<string, any>;\n if (isUUID(idOrName)) {\n criteria = { id: idOrName };\n } else {\n const realmEntity = await this.ctx.realmRepository.resolve(realm);\n criteria = {\n name: idOrName,\n ...(realmEntity ? { realm_id: realmEntity.id } : {}),\n };\n }\n\n const entity = await this.ctx.repository.findOneBy(criteria);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const input = { ...data };\n if (typeof input[BuiltInPolicyType.IDENTITY] === 'undefined') {\n input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n }\n\n const evaluationContext: PermissionEvaluationContext = {\n name: entity.name,\n ~~input~~: ~~new PolicyData~~(input),\n };\n\n const evaluator = new PermissionEvaluator({\n provider: this.ctx.permissionProvider,\n policyEngine: new PolicyEngine(this.ctx.identityPermissionProvider),\n });\n\n if (\n evaluationContext.~~input~~ &&\n evaluationContext.~~input~~.has(BuiltInPolicyType.ATTRIBUTES)\n ) {\n await evaluator.evaluate(evaluationContext);\n } else {\n await evaluator.preEvaluate(evaluationContext);\n }\n }\n\n async safeCheck(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realm?: string,\n ): Promise<Result<null>> {\n try {\n await this.check(idOrName, data, actor, realm);\n return { success: true, data: null };\n } catch (e) {\n return { success: false, error: normalizeError(e) };\n }\n }\n}\n"],"mappings":";;;;;;;;;AAoBA,~~IAAaQ~~,2BAAb,MAAaA;CACCC;CAEV,YAAYA,KAAsC;EAC9C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACH,MAAMM,cAAc,MAAM,KAAKR,IAAIS,gBAAgBC,QAAQL,KAAAA;GAC3DC,WAAW;IACPK,MAAMT;IACN,GAAIM,cAAc,EAAEI,UAAUJ,YAAYD,GAAG,IAAI,CAAC;GACtD;EACJ;EAEA,MAAMM,SAAS,MAAM,KAAKb,IAAIc,WAAWC,UAAUT,QAAAA;EACnD,IAAI,CAACO,QACD,MAAM,IAAIlB,oBAAAA;EAGd,MAAMqB,QAAQ,EAAE,GAAGb,KAAK;EACxB,IAAI,OAAOa,~~MAAMzB~~,~~kBAAkB0B~~,cAAc,aAC7CD,~~MAAMzB~~,~~kBAAkB0B~~,YAAYnB,qBAAqBM,MAAMc,QAAQ;~~EAG3E~~,MAAMC,oBAAiD;~~GACnDR~~,MAAME,OAAOF;~~GACbK~~,~~OAAO~~,~~IAAIvB~~,~~WAAWuB,~~KAAAA;~~EAC1B~~;EAEA,~~MAAMI~~,YAAY,~~IAAI5B~~,oBAAoB;~~GACtC6B~~,UAAU,~~KAAKrB~~,~~IAAIsB~~;GACnBC,cAAc,~~IAAI1B~~,eAAa,KAAKG,~~IAAIwB~~,0BAA0B;EACtE,CAAA;EAEA,IACIL,~~kBAAkBH~~,~~SAClBG~~,~~kBAAkBH~~,~~MAAMS~~,~~IAAIlC~~,~~kBAAkBmC~~,UAAU,~~GAExD~~,~~MAAMN~~,~~UAAUO~~,~~SAASR~~,iBAAAA;OAEzB,MAAMC,~~UAAUQ~~,~~YAAYT~~,iBAAAA;CAEpC;CAEA,~~MAAMU~~,~~UACF3B~~,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;~~IAAEyB~~,SAAS;~~IAAM3B~~,MAAM;GAAK;EACvC,~~SAAS4B~~,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,~~OAAOpC~~,~~eAAemC~~,CAAAA;GAAG;EACtD;CACJ;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionEvaluator","definePolicyData","hasOwnProperty","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PermissionCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","realmEntity","realmRepository","resolve","name","realm_id","entity","repository","findOneBy","input","IDENTITY","identity","attributes","ATTRIBUTES","REALM_MATCH","evaluationContext","evaluator","provider","permissionProvider","policyEngine","identityPermissionProvider","has","evaluate","preEvaluate","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/permission/checker/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PermissionEvaluationContext } from '@authup/access';\nimport { BuiltInPolicyType, PermissionEvaluator, definePolicyData } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { hasOwnProperty, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../identity-policy-data.ts';\nimport type {\n IPermissionCheckerService,\n PermissionCheckerServiceContext,\n} from './types.ts';\n\nexport class PermissionCheckerService implements IPermissionCheckerService {\n protected ctx: PermissionCheckerServiceContext;\n\n constructor(ctx: PermissionCheckerServiceContext) {\n this.ctx = ctx;\n }\n\n async check(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realm?: string,\n ): Promise<void> {\n let criteria: Record<string, any>;\n if (isUUID(idOrName)) {\n criteria = { id: idOrName };\n } else {\n const realmEntity = await this.ctx.realmRepository.resolve(realm);\n criteria = {\n name: idOrName,\n ...(realmEntity ? { realm_id: realmEntity.id } : {}),\n };\n }\n\n const entity = await this.ctx.repository.findOneBy(criteria);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const input = { ...data };\n if (typeof input[BuiltInPolicyType.IDENTITY] === 'undefined') {\n input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n }\n // Surface the resource realm to the realm_scope reach factor (realm-match scope mode).\n // Only when the body carries an ATTRIBUTES realm — so a realm-less check still rides\n // the preEvaluate path below and neutral-passes.\n const attributes = input[BuiltInPolicyType.ATTRIBUTES] as Record<string, any> \| undefined;\n if (attributes && hasOwnProperty(attributes, 'realm_id')) {\n input[BuiltInPolicyType.REALM_MATCH] = attributes.realm_id ?? null;\n }\n\n const evaluationContext: PermissionEvaluationContext = {\n name: entity.name,\n data: definePolicyData(input),\n };\n\n const evaluator = new PermissionEvaluator({\n provider: this.ctx.permissionProvider,\n policyEngine: new PolicyEngine(this.ctx.identityPermissionProvider),\n });\n\n if (\n evaluationContext.data &&\n evaluationContext.data.has(BuiltInPolicyType.ATTRIBUTES)\n ) {\n await evaluator.evaluate(evaluationContext);\n } else {\n await evaluator.preEvaluate(evaluationContext);\n }\n }\n\n async safeCheck(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realm?: string,\n ): Promise<Result<null>> {\n try {\n await this.check(idOrName, data, actor, realm);\n return { success: true, data: null };\n } catch (e) {\n return { success: false, error: normalizeError(e) };\n }\n }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaS,2BAAb,MAAaA;CACCC;CAEV,YAAYA,KAAsC;EAC9C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACH,MAAMM,cAAc,MAAM,KAAKR,IAAIS,gBAAgBC,QAAQL,KAAAA;GAC3DC,WAAW;IACPK,MAAMT;IACN,GAAIM,cAAc,EAAEI,UAAUJ,YAAYD,GAAG,IAAI,CAAC;GACtD;EACJ;EAEA,MAAMM,SAAS,MAAM,KAAKb,IAAIc,WAAWC,UAAUT,QAAAA;EACnD,IAAI,CAACO,QACD,MAAM,IAAIlB,oBAAAA;EAGd,MAAMqB,QAAQ,EAAE,GAAGb,KAAK;EACxB,IAAI,OAAOa,MAAM1B,kBAAkB2B,cAAc,aAC7CD,MAAM1B,kBAAkB2B,YAAYnB,qBAAqBM,MAAMc,QAAQ;EAK3E,MAAMC,aAAaH,MAAM1B,kBAAkB8B;EAC3C,IAAID,cAAc1B,eAAe0B,YAAY,UAAA,GACzCH,MAAM1B,kBAAkB+B,eAAeF,WAAWP,YAAY;EAGlE,MAAMU,oBAAiD;GACnDX,MAAME,OAAOF;GACbR,MAAMX,iBAAiBwB,KAAAA;EAC3B;EAEA,MAAMO,YAAY,IAAIhC,oBAAoB;GACtCiC,UAAU,KAAKxB,IAAIyB;GACnBC,cAAc,IAAI7B,eAAa,KAAKG,IAAI2B,0BAA0B;EACtE,CAAA;EAEA,IACIL,kBAAkBnB,QAClBmB,kBAAkBnB,KAAKyB,IAAItC,kBAAkB8B,UAAU,GAEvD,MAAMG,UAAUM,SAASP,iBAAAA;OAEzB,MAAMC,UAAUO,YAAYR,iBAAAA;CAEpC;CAEA,MAAMS,UACF7B,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAE2B,SAAS;IAAM7B,MAAM;GAAK;EACvC,SAAS8B,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAOtC,eAAeqC,CAAAA;GAAG;EACtD;CACJ;AACJ"}

package/dist/core/identity/permission/index.d.ts CHANGED Viewed

@@ -1,4 +1,5 @@
 export * from './checker/index.ts';
+export * from './junction-grant.ts';
 export * from './module.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/identity/permission/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/permission/index.mjs CHANGED Viewed

@@ -1,7 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { applyJunctionCreateGrant, buildJunctionUpdateData } from "./junction-grant.mjs";
 import { PermissionCheckerService } from "./checker/service.mjs";
 import "./checker/index.mjs";
 import { IdentityPermissionProvider } from "./module.mjs";
-export { IdentityPermissionProvider, PermissionCheckerService };
+export { IdentityPermissionProvider, PermissionCheckerService, applyJunctionCreateGrant, buildJunctionUpdateData };