@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.51

package/dist/core/provisioning/synchronizer/user/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["buildUserFakeEmail","pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","UserProvisioningSynchronizer","userRepository","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","userPermissionRepository","ownerKey","ownerRealmKey","userRoleRepository","synchronize","input","strategy","attributes","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","includes","email","merge","save","REPLACE","undefined","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","clientPermissions","clientKeys","Object","keys","clientKey","client","entities","resolveClient","push","length","roles","globalRoles","realmRoles","clientRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Permission, \n    Role, \n    UserPermission, \n    UserRole,\n} from '@authup/core-kit';\nimport { buildUserFakeEmail } from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type {\n    IClientRepository,\n    IUserRepository,\n} from '../../../entities/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { UserProvisioningSynchronizerContext } from './types.ts';\n\nexport class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {\n    protected userRepository: IUserRepository;\n\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;\n\n    constructor(ctx: UserProvisioningSynchronizerContext) {\n        super();\n\n        this.userRepository = ctx.userRepository;\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userPermissionRepository,\n            ownerKey: 'user_id',\n            ownerRealmKey: 'user_realm_id',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userRoleRepository,\n            ownerKey: 'user_id',\n            ownerRealmKey: 'user_realm_id',\n        });\n    }\n\n    async synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.userRepository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.userRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    if (\n                        strategy.attributes &&\n                        strategy.attributes.includes('email')\n                    ) {\n                        input.attributes.email = input.attributes.email ||\n                            attributes.email ||\n                            buildUserFakeEmail(input.attributes.name || attributes.name);\n                    }\n\n                    attributes = this.userRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.userRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.email = input.attributes.email ||\n                        attributes.email ||\n                        (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);\n\n                    input.attributes.id = attributes.id;\n                    attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            if (!input.attributes.email && input.attributes.name) {\n                input.attributes.email = buildUserFakeEmail(input.attributes.name);\n            }\n\n            attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n        }\n\n        // Permissions (Global, Realm & Client)\n        const permissions : Permission[] = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realm_id ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientPermissions) {\n            const clientKeys = Object.keys(input.relations.clientPermissions);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realm_id: attributes.realm_id,\n                });\n\n                if (client) {\n                    const entities = await this.permissionResolver.resolveClient(\n                        input.relations.clientPermissions[clientKey],\n                        attributes.realm_id,\n                        client.id,\n                    );\n                    permissions.push(...entities);\n                }\n            }\n        }\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permission_id',\n                'permission_realm_id',\n            );\n        }\n\n        // Roles (Global, Realm & Client)\n        const roles : Role[] = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realm_id ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientRoles) {\n            const clientKeys = Object.keys(input.relations.clientRoles);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realm_id: attributes.realm_id,\n                });\n\n                if (client) {\n                    const entities = await this.roleResolver.resolveClient(\n                        input.relations.clientRoles[clientKey],\n                        attributes.realm_id,\n                        client.id,\n                    );\n                    roles.push(...entities);\n                }\n            }\n        }\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'role_id',\n                'role_realm_id',\n            );\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAaO,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKN,iBAAiBM,IAAIN;EAC1B,KAAKC,mBAAmBK,IAAIL;EAE5B,KAAKC,qBAAqB,IAAIL,2BAA2BS,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIN,2BAA2BS,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIN,iCAAiC;GAC3DW,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIP,iCAAiC;GACrDW,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAgE;EAC9E,MAAMC,WAAWrB,oCAAoCoB,MAAMC,QAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKjB,eAAekB,UAAU;GACjDC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;EAC3C,CAAA;EAEA,IAAIJ,SAASK,SAAS3B,+BAA+B4B,QAAQ;GACzD,IAAIL,YACA,MAAM,KAAKjB,eAAeuB,OAAON,UAAAA;GAErC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQD,SAASK,MAAjB;GACI,KAAK3B,+BAA+B8B;IAChC,IACIR,SAASC,cACTD,SAASC,WAAWQ,SAAS,OAAA,GAE7BV,MAAME,WAAWS,QAAQX,MAAME,WAAWS,SACtCT,WAAWS,SACXlC,mBAAmBuB,MAAME,WAAWE,QAAQF,WAAWE,IAAI;IAGnEF,aAAa,KAAKjB,eAAe2B,MAC7BV,YACAD,SAASC,aACLxB,WAAWsB,MAAME,YAAYD,SAASC,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKjB,eAAe4B,KAAKX,UAAAA;IAC5C;GACJ,KAAKvB,+BAA+BmC;IAChCd,MAAME,WAAWS,QAAQX,MAAME,WAAWS,SACtCT,WAAWS,UACVX,MAAME,WAAWE,OAAO3B,mBAAmBuB,MAAME,WAAWE,IAAI,IAAIW,KAAAA;IAEzEf,MAAME,WAAWc,KAAKd,WAAWc;IACjCd,aAAa,MAAM,KAAKjB,eAAe4B,KAAK,KAAK5B,eAAegC,OAAOjB,MAAME,UAAU,CAAA;IACvF;EACR;OACG;GACH,IAAI,CAACF,MAAME,WAAWS,SAASX,MAAME,WAAWE,MAC5CJ,MAAME,WAAWS,QAAQlC,mBAAmBuB,MAAME,WAAWE,IAAI;GAGrEF,aAAa,MAAM,KAAKjB,eAAe4B,KAAK,KAAK5B,eAAegC,OAAOjB,MAAME,UAAU,CAAA;EAC3F;EAGA,MAAMgB,cAA6B,CAAA,GAC5B,MAAM,KAAK/B,mBAAmBgC,cAC7BnB,MAAMoB,aAAapB,MAAMoB,UAAUC,iBAAiB,GAAA,GAEpDnB,WAAWG,WACX,MAAM,KAAKlB,mBAAmBmC,aAC1BtB,MAAMoB,aAAapB,MAAMoB,UAAUG,kBACnCrB,WAAWG,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIL,MAAMoB,aAAapB,MAAMoB,UAAUI,mBAAmB;GACtD,MAAMC,aAAaC,OAAOC,KAAK3B,MAAMoB,UAAUI,iBAAiB;GAChE,KAAK,MAAMI,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK3C,iBAAiBiB,UAAU;KACjDC,MAAMwB;KACNvB,UAAUH,WAAWG;IACzB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK3C,mBAAmB4C,cAC3C/B,MAAMoB,UAAUI,kBAAkBI,YAClC1B,WAAWG,UACXwB,OAAOb,EAAE;KAEbE,YAAYc,KAAI,GAAIF,QAAAA;IACxB;GACJ;EACJ;EAEA,IAAIZ,YAAYe,SAAS,GACrB,MAAM,KAAK5C,mBAAmBU,YAC1BG,YACAgB,aACA,iBACA,qBAAA;EAKR,MAAMgB,QAAiB,CAAA,GAChB,MAAM,KAAK9C,aAAa+B,cACvBnB,MAAMoB,aAAapB,MAAMoB,UAAUe,WAAW,GAAA,GAE9CjC,WAAWG,WACX,MAAM,KAAKjB,aAAakC,aACpBtB,MAAMoB,aAAapB,MAAMoB,UAAUgB,YACnClC,WAAWG,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIL,MAAMoB,aAAapB,MAAMoB,UAAUiB,aAAa;GAChD,MAAMZ,aAAaC,OAAOC,KAAK3B,MAAMoB,UAAUiB,WAAW;GAC1D,KAAK,MAAMT,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK3C,iBAAiBiB,UAAU;KACjDC,MAAMwB;KACNvB,UAAUH,WAAWG;IACzB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK1C,aAAa2C,cACrC/B,MAAMoB,UAAUiB,YAAYT,YAC5B1B,WAAWG,UACXwB,OAAOb,EAAE;KAEbkB,MAAMF,KAAI,GAAIF,QAAAA;IAClB;GACJ;EACJ;EAEA,IAAII,MAAMD,SAAS,GACf,MAAM,KAAK3C,aAAaS,YACpBG,YACAgC,OACA,WACA,eAAA;EAIR,OAAO;GACH,GAAGlC;GACHE;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["buildUserFakeEmail","pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","UserProvisioningSynchronizer","userRepository","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","userPermissionRepository","ownerKey","ownerRealmKey","userRoleRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","includes","email","merge","save","REPLACE","undefined","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","clientPermissions","clientKeys","Object","keys","clientKey","client","entities","resolveClient","push","length","roles","globalRoles","realmRoles","clientRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Permission, \n    Role, \n    UserPermission, \n    UserRole,\n} from '@authup/core-kit';\nimport { buildUserFakeEmail } from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type {\n    IClientRepository,\n    IUserRepository,\n} from '../../../entities/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { UserProvisioningSynchronizerContext } from './types.ts';\n\nexport class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {\n    protected userRepository: IUserRepository;\n\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;\n\n    constructor(ctx: UserProvisioningSynchronizerContext) {\n        super();\n\n        this.userRepository = ctx.userRepository;\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userPermissionRepository,\n            ownerKey: 'user_id',\n            ownerRealmKey: 'user_realm_id',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userRoleRepository,\n            ownerKey: 'user_id',\n            ownerRealmKey: 'user_realm_id',\n        });\n    }\n\n    async synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.userRepository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.userRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    if (\n                        strategy.attributes &&\n                        strategy.attributes.includes('email')\n                    ) {\n                        input.attributes.email = input.attributes.email ||\n                            attributes.email ||\n                            buildUserFakeEmail(input.attributes.name || attributes.name);\n                    }\n\n                    attributes = this.userRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.userRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.email = input.attributes.email ||\n                        attributes.email ||\n                        (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);\n\n                    input.attributes.id = attributes.id;\n                    attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            if (!input.attributes.email && input.attributes.name) {\n                input.attributes.email = buildUserFakeEmail(input.attributes.name);\n            }\n\n            attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n        }\n\n        // Permissions (Global, Realm & Client)\n        const permissions : Permission[] = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realm_id ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientPermissions) {\n            const clientKeys = Object.keys(input.relations.clientPermissions);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realm_id: attributes.realm_id,\n                });\n\n                if (client) {\n                    const entities = await this.permissionResolver.resolveClient(\n                        input.relations.clientPermissions[clientKey],\n                        attributes.realm_id,\n                        client.id,\n                    );\n                    permissions.push(...entities);\n                }\n            }\n        }\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permission_id',\n                'permission_realm_id',\n            );\n        }\n\n        // Roles (Global, Realm & Client)\n        const roles : Role[] = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realm_id ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientRoles) {\n            const clientKeys = Object.keys(input.relations.clientRoles);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realm_id: attributes.realm_id,\n                });\n\n                if (client) {\n                    const entities = await this.roleResolver.resolveClient(\n                        input.relations.clientRoles[clientKey],\n                        attributes.realm_id,\n                        client.id,\n                    );\n                    roles.push(...entities);\n                }\n            }\n        }\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'role_id',\n                'role_realm_id',\n            );\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAaO,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKN,iBAAiBM,IAAIN;EAC1B,KAAKC,mBAAmBK,IAAIL;EAE5B,KAAKC,qBAAqB,IAAIL,2BAA2BS,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIN,2BAA2BS,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIN,iCAAiC;GAC3DW,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIP,iCAAiC;GACrDW,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWvB,oCAAoCoB,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKjB,eAAemB,UAAU;GACjDC,MAAML,MAAME,WAAWG;GACvBC,UAAUN,MAAME,WAAWI,YAAY;EAC3C,CAAA;EAEA,IAAIH,SAASI,SAAS5B,+BAA+B6B,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKjB,eAAewB,OAAOP,UAAAA;GAErC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAK5B,+BAA+B+B;IAChC,IACIP,SAASD,cACTC,SAASD,WAAWS,SAAS,OAAA,GAE7BX,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,SACXnC,mBAAmBuB,MAAME,WAAWG,QAAQH,WAAWG,IAAI;IAGnEH,aAAa,KAAKjB,eAAe4B,MAC7BX,YACAC,SAASD,aACLxB,WAAWsB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKjB,eAAe6B,KAAKZ,UAAAA;IAC5C;GACJ,KAAKvB,+BAA+BoC;IAChCf,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,UACVZ,MAAME,WAAWG,OAAO5B,mBAAmBuB,MAAME,WAAWG,IAAI,IAAIW,KAAAA;IAEzEhB,MAAME,WAAWe,KAAKf,WAAWe;IACjCf,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;IACvF;EACR;OACG;GACH,IAAI,CAACF,MAAME,WAAWU,SAASZ,MAAME,WAAWG,MAC5CL,MAAME,WAAWU,QAAQnC,mBAAmBuB,MAAME,WAAWG,IAAI;GAGrEH,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;EAC3F;EAGA,MAAMiB,cAA6B,CAAA,GAC5B,MAAM,KAAKhC,mBAAmBiC,cAC7BpB,MAAMqB,aAAarB,MAAMqB,UAAUC,iBAAiB,GAAA,GAEpDpB,WAAWI,WACX,MAAM,KAAKnB,mBAAmBoC,aAC1BvB,MAAMqB,aAAarB,MAAMqB,UAAUG,kBACnCtB,WAAWI,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUI,mBAAmB;GACtD,MAAMC,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUI,iBAAiB;GAChE,KAAK,MAAMI,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,UAAUJ,WAAWI;IACzB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK5C,mBAAmB6C,cAC3ChC,MAAMqB,UAAUI,kBAAkBI,YAClC3B,WAAWI,UACXwB,OAAOb,EAAE;KAEbE,YAAYc,KAAI,GAAIF,QAAAA;IACxB;GACJ;EACJ;EAEA,IAAIZ,YAAYe,SAAS,GACrB,MAAM,KAAK7C,mBAAmBU,YAC1BG,YACAiB,aACA,iBACA,qBAAA;EAKR,MAAMgB,QAAiB,CAAA,GAChB,MAAM,KAAK/C,aAAagC,cACvBpB,MAAMqB,aAAarB,MAAMqB,UAAUe,WAAW,GAAA,GAE9ClC,WAAWI,WACX,MAAM,KAAKlB,aAAamC,aACpBvB,MAAMqB,aAAarB,MAAMqB,UAAUgB,YACnCnC,WAAWI,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUiB,aAAa;GAChD,MAAMZ,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUiB,WAAW;GAC1D,KAAK,MAAMT,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,UAAUJ,WAAWI;IACzB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK3C,aAAa4C,cACrChC,MAAMqB,UAAUiB,YAAYT,YAC5B3B,WAAWI,UACXwB,OAAOb,EAAE;KAEbkB,MAAMF,KAAI,GAAIF,QAAAA;IAClB;GACJ;EACJ;EAEA,IAAII,MAAMD,SAAS,GACf,MAAM,KAAK5C,aAAaS,YACpBG,YACAiC,OACA,WACA,eAAA;EAIR,OAAO;GACH,GAAGnC;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/security/policy/evaluator.d.ts

@@ -1,13 +1,13 @@
-import type { IPolicyEvaluator, PermissionPolicyBinding, PolicyEvaluationContext, PolicyEvaluationResult } from '@authup/access';
-import { AttributesPolicyEvaluator, IdentityPolicyEvaluator, PermissionBindingPolicyValidator } from '@authup/access';
+import type { IPolicyEvaluator, PermissionPolicyBindingAggregated, PolicyEvaluationContext, PolicyEvaluationResult } from '@authup/access';
+import { IdentityPolicyEvaluator, PermissionBindingPolicyValidator, RealmMatchPolicyEvaluator } from '@authup/access';
 import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
 export declare class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {
     protected validator: PermissionBindingPolicyValidator;
     protected identityEvaluator: IdentityPolicyEvaluator;
-    protected attributesEvaluator: AttributesPolicyEvaluator;
+    protected realmMatchEvaluator: RealmMatchPolicyEvaluator;
     protected identityPermissionProvider: IIdentityPermissionProvider;
     constructor(identityPermissionProvider: IIdentityPermissionProvider);
-    accessData(ctx: PolicyEvaluationContext): Promise<PermissionPolicyBinding | null>;
+    accessData(ctx: PolicyEvaluationContext): Promise<PermissionPolicyBindingAggregated | null>;
     evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }
 //# sourceMappingURL=evaluator.d.ts.map

package/dist/core/security/policy/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/core/security/policy/evaluator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAGR,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACH,yBAAyB,EAEzB,uBAAuB,EACvB,gCAAgC,EAMnC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,qBAAa,gCAAiC,YAAW,gBAAgB;IACrE,SAAS,CAAC,SAAS,EAAG,gCAAgC,CAAC;IAEvD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,0BAA0B,EAAE,2BAA2B;IAO7D,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAiBlF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA+E5G"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/core/security/policy/evaluator.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,gBAAgB,EAChB,iCAAiC,EACjC,uBAAuB,EACvB,sBAAsB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEH,uBAAuB,EACvB,gCAAgC,EAGhC,yBAAyB,EAI5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,qBAAa,gCAAiC,YAAW,gBAAgB;IACrE,SAAS,CAAC,SAAS,EAAG,gCAAgC,CAAC;IAEvD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,0BAA0B,EAAE,2BAA2B;IAO7D,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAiB5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA2G5G"}

package/dist/core/security/policy/evaluator.mjs

@@ -1,17 +1,17 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { AttributesPolicyEvaluator, BuiltInPolicyType, IdentityPolicyEvaluator, PermissionBindingPolicyValidator, PolicyEngine, PolicyIssueCode, definePolicyIssueItem, maybeInvertPolicyOutcome, mergePermissionPolicyBindings } from "@authup/access";
+import { BuiltInPolicyType, IdentityPolicyEvaluator, PermissionBindingPolicyValidator, PolicyEngine, PolicyIssueCode, RealmMatchPolicyEvaluator, aggregatePermissionPolicyBindings, definePolicyIssueItem, maybeInvertPolicyOutcome } from "@authup/access";
 //#region src/core/security/policy/evaluator.ts
 var PermissionBindingPolicyEvaluator = class {
 	validator;
 	identityEvaluator;
-	attributesEvaluator;
+	realmMatchEvaluator;
 	identityPermissionProvider;
 	constructor(identityPermissionProvider) {
 		this.validator = new PermissionBindingPolicyValidator();
 		this.identityEvaluator = new IdentityPolicyEvaluator();
-		this.attributesEvaluator = new AttributesPolicyEvaluator();
+		this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();
 		this.identityPermissionProvider = identityPermissionProvider;
 	}
 	async accessData(ctx) {
@@ -47,22 +47,23 @@ var PermissionBindingPolicyEvaluator = class {
 			return (binding.permission.realm_id ?? null) === (item.permission.realm_id ?? null) && (binding.permission.client_id ?? null) === (item.permission.client_id ?? null);
 		}));
 		if (identityBindings.length === 0) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
-		const bindingsMerged = mergePermissionPolicyBindings(identityBindings);
-		if (bindingsMerged.length === 0) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
-		const policies = bindingsMerged.flatMap((b) => b.policies || []);
-		if (policies.length === 0) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
-		if (!ctx.evaluators) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
-		const compositePolicy = {
-			children: policies,
-			type: BuiltInPolicyType.COMPOSITE
-		};
-		const outcome = await new PolicyEngine(ctx.evaluators).evaluate(compositePolicy, {
-			...ctx,
-			path: [...ctx.path || [], ...compositePolicy.type ? [compositePolicy.type] : []]
-		});
+		const [aggr] = aggregatePermissionPolicyBindings(identityBindings);
+		if (!aggr) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+		const issues = [];
+		for (const grant of aggr.grants) {
+			if (!(await this.realmMatchEvaluator.evaluate({ scope: grant.realm_scope }, ctx)).success) continue;
+			if (!grant.policy) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+			const outcome = await new PolicyEngine(ctx.evaluators).evaluate(grant.policy, {
+				...ctx,
+				path: [...ctx.path || []]
+			});
+			if (outcome.success) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+			if (outcome.issues) issues.push(...outcome.issues);
+		}
+		const success = maybeInvertPolicyOutcome(false, policy.invert);
 		return {
-			...outcome,
-			success: maybeInvertPolicyOutcome(outcome.success, policy.invert)
+			success,
+			issues: success ? [] : issues
 		};
 	}
 };

package/dist/core/security/policy/evaluator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.mjs","names":["AttributesPolicyEvaluator","BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","definePolicyIssueItem","maybeInvertPolicyOutcome","mergePermissionPolicyBindings","PermissionBindingPolicyEvaluator","validator","identityEvaluator","attributesEvaluator","identityPermissionProvider","accessData","ctx","data","has","PERMISSION_BINDING","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realm_id","client_id","length","invert","bindingsMerged","policies","flatMap","b","evaluators","compositePolicy","children","type","COMPOSITE","engine","outcome"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    BasePolicy,\n    CompositePolicy,\n    IPolicyEvaluator,\n    PermissionPolicyBinding,\n    PolicyEvaluationContext,\n    PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n    AttributesPolicyEvaluator,\n    BuiltInPolicyType,\n    IdentityPolicyEvaluator,\n    PermissionBindingPolicyValidator,\n    PolicyEngine,\n    PolicyIssueCode,\n    definePolicyIssueItem,\n    maybeInvertPolicyOutcome,\n    mergePermissionPolicyBindings,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n    protected validator : PermissionBindingPolicyValidator;\n\n    protected identityEvaluator: IdentityPolicyEvaluator;\n\n    protected attributesEvaluator : AttributesPolicyEvaluator;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        this.validator = new PermissionBindingPolicyValidator();\n        this.identityEvaluator = new IdentityPolicyEvaluator();\n        this.attributesEvaluator = new AttributesPolicyEvaluator();\n        this.identityPermissionProvider = identityPermissionProvider;\n    }\n\n    async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBinding | null> {\n        if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return null;\n        }\n\n        if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n        }\n\n        const data = ctx.data.get<PermissionPolicyBinding>(BuiltInPolicyType.PERMISSION_BINDING);\n\n        ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n        ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n        return data;\n    }\n\n    async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n        const policy = await this.validator.run(value);\n\n        const identity = await this.identityEvaluator.accessData(ctx);\n        if (!identity) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property identity is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n        const binding = await this.accessData(ctx);\n        if (!binding) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property permission is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n\n        const identityBindings = await this.identityPermissionProvider.getFor(identity)\n            .then((bindings) => bindings.filter((item) => {\n                if (item.permission.name !== binding.permission.name) {\n                    return false;\n                }\n\n                return (binding.permission.realm_id ?? null) === (item.permission.realm_id ?? null) &&\n                    (binding.permission.client_id ?? null) === (item.permission.client_id ?? null);\n            }));\n\n        if (identityBindings.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const bindingsMerged = mergePermissionPolicyBindings(identityBindings);\n        if (bindingsMerged.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const policies : BasePolicy[] = bindingsMerged\n            .flatMap((b) => b.policies || []);\n\n        if (policies.length === 0) {\n            return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n        }\n\n        if (!ctx.evaluators) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const compositePolicy : CompositePolicy = {\n            children: policies,\n            type: BuiltInPolicyType.COMPOSITE,\n        };\n\n        const engine = new PolicyEngine(ctx.evaluators);\n        const outcome = await engine.evaluate(compositePolicy, {\n            ...ctx,\n            path: [\n                ...(ctx.path || []),\n                ...(compositePolicy.type ? [compositePolicy.type] : []),\n            ],\n        });\n\n        return {\n            ...outcome,\n            success: maybeInvertPolicyOutcome(outcome.success, policy.invert),\n        };\n    }\n}\n"],"mappings":";;;;;AA4BA,IAAaS,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;EACjE,KAAKH,YAAY,IAAIP,iCAAAA;EACrB,KAAKQ,oBAAoB,IAAIT,wBAAAA;EAC7B,KAAKU,sBAAsB,IAAIZ,0BAAAA;EAC/B,KAAKa,6BAA6BA;CACtC;CAEA,MAAMC,WAAWC,KAAwE;EACrF,IAAI,CAACA,IAAIC,KAAKC,IAAIhB,kBAAkBiB,kBAAkB,GAClD,OAAO;EAGX,IAAIH,IAAIC,KAAKG,YAAYlB,kBAAkBiB,kBAAkB,GACzD,OAAOH,IAAIC,KAAKI,IAAInB,kBAAkBiB,kBAAkB;EAG5D,MAAMF,OAAOD,IAAIC,KAAKI,IAA6BnB,kBAAkBiB,kBAAkB;EAEvFH,IAAIC,KAAKK,IAAIpB,kBAAkBiB,oBAAoBF,IAAAA;EACnDD,IAAIC,KAAKM,aAAarB,kBAAkBiB,kBAAkB;EAE1D,OAAOF;CACX;CAEA,MAAMO,SAASC,OAA4BT,KAA+D;EACtG,MAAMU,SAAS,MAAM,KAAKf,UAAUgB,IAAIF,KAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKhB,kBAAkBG,WAAWC,GAAAA;EACzD,IAAI,CAACY,UACD,OAAO;GACHC,SAAS;GACTC,QAAQ,CACJvB,sBAAsB;IAClBwB,MAAMzB,gBAAgB0B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;GACd,CAAA,CAAA;EAER;EAEJ,MAAMC,UAAU,MAAM,KAAKpB,WAAWC,GAAAA;EACtC,IAAI,CAACmB,SACD,OAAO;GACHN,SAAS;GACTC,QAAQ,CACJvB,sBAAsB;IAClBwB,MAAMzB,gBAAgB0B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;GACd,CAAA,CAAA;EAER;EAGJ,MAAME,mBAAmB,MAAM,KAAKtB,2BAA2BuB,OAAOT,QAAAA,CAAAA,CACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;GACjC,IAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,MAC5C,OAAO;GAGX,QAAQR,QAAQO,WAAWE,YAAY,WAAWH,KAAKC,WAAWE,YAAY,UACzET,QAAQO,WAAWG,aAAa,WAAWJ,KAAKC,WAAWG,aAAa;EACjF,CAAA,CAAA;EAEJ,IAAIT,iBAAiBU,WAAW,GAC5B,OAAO,EAAEjB,SAASrB,yBAAyB,OAAOkB,OAAOqB,MAAM,EAAE;EAGrE,MAAMC,iBAAiBvC,8BAA8B2B,gBAAAA;EACrD,IAAIY,eAAeF,WAAW,GAC1B,OAAO,EAAEjB,SAASrB,yBAAyB,OAAOkB,OAAOqB,MAAM,EAAE;EAGrE,MAAME,WAA0BD,eAC3BE,SAASC,MAAMA,EAAEF,YAAY,CAAA,CAAE;EAEpC,IAAIA,SAASH,WAAW,GACpB,OAAO,EAAEjB,SAASrB,yBAAyB,MAAMkB,OAAOqB,MAAM,EAAE;EAGpE,IAAI,CAAC/B,IAAIoC,YACL,OAAO,EAAEvB,SAASrB,yBAAyB,OAAOkB,OAAOqB,MAAM,EAAE;EAGrE,MAAMM,kBAAoC;GACtCC,UAAUL;GACVM,MAAMrD,kBAAkBsD;EAC5B;EAGA,MAAME,UAAU,MAAMD,IADHpD,aAAaW,IAAIoC,UACdK,CAAAA,CAAOjC,SAAS6B,iBAAiB;GACnD,GAAGrC;GACHkB,MAAM,CAAA,GACElB,IAAIkB,QAAQ,CAAA,GAAA,GACZmB,gBAAgBE,OAAO,CAACF,gBAAgBE,IAAAA,IAAQ,CAAA,CAAA;EAE5D,CAAA;EAEA,OAAO;GACH,GAAGG;GACH7B,SAASrB,yBAAyBkD,QAAQ7B,SAASH,OAAOqB,MAAM;EACpE;CACJ;AACJ"}
+{"version":3,"file":"evaluator.mjs","names":["BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","RealmMatchPolicyEvaluator","aggregatePermissionPolicyBindings","definePolicyIssueItem","maybeInvertPolicyOutcome","PermissionBindingPolicyEvaluator","validator","identityEvaluator","realmMatchEvaluator","identityPermissionProvider","accessData","ctx","data","has","PERMISSION_BINDING","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realm_id","client_id","length","invert","aggr","grant","grants","realmOutcome","scope","realm_scope","engine","evaluators","outcome","push"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Issue } from 'validup';\nimport type {\n    IPolicyEvaluator,\n    PermissionPolicyBindingAggregated,\n    PolicyEvaluationContext,\n    PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n    BuiltInPolicyType,\n    IdentityPolicyEvaluator,\n    PermissionBindingPolicyValidator,\n    PolicyEngine,\n    PolicyIssueCode,\n    RealmMatchPolicyEvaluator,\n    aggregatePermissionPolicyBindings,\n    definePolicyIssueItem,\n    maybeInvertPolicyOutcome,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n    protected validator : PermissionBindingPolicyValidator;\n\n    protected identityEvaluator: IdentityPolicyEvaluator;\n\n    protected realmMatchEvaluator : RealmMatchPolicyEvaluator;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        this.validator = new PermissionBindingPolicyValidator();\n        this.identityEvaluator = new IdentityPolicyEvaluator();\n        this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();\n        this.identityPermissionProvider = identityPermissionProvider;\n    }\n\n    async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBindingAggregated | null> {\n        if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return null;\n        }\n\n        if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n        }\n\n        const data = ctx.data.get<PermissionPolicyBindingAggregated>(BuiltInPolicyType.PERMISSION_BINDING);\n\n        ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n        ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n        return data;\n    }\n\n    async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n        const policy = await this.validator.run(value);\n\n        const identity = await this.identityEvaluator.accessData(ctx);\n        if (!identity) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property identity is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n        const binding = await this.accessData(ctx);\n        if (!binding) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property permission is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n\n        const identityBindings = await this.identityPermissionProvider.getFor(identity)\n            .then((bindings) => bindings.filter((item) => {\n                if (item.permission.name !== binding.permission.name) {\n                    return false;\n                }\n\n                return (binding.permission.realm_id ?? null) === (item.permission.realm_id ?? null) &&\n                    (binding.permission.client_id ?? null) === (item.permission.client_id ?? null);\n            }));\n\n        if (identityBindings.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const [aggr] = aggregatePermissionPolicyBindings(identityBindings);\n        if (!aggr) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        // identityBindings is filtered to a single (name, realm_id, client_id) key, so the\n        // aggregate yields exactly one entry whose `grants` are the actor's per-grant\n        // (realm_scope, policy) disjunction terms; access is the DISJUNCTION over them:\n        //   ∃ grant . realmScopeMatches(grant.realm_scope, resource) ∧ (grant.policy passes)\n        // Pairing each grant's realm reach with its OWN policy is what fixes both the mixed\n        // policy-free + policy-bound UNDER-grant (a policy-free `own` grant must not mask a\n        // policy-bound `any` grant's wider reach) and the symmetric OVER-grant (an `own`\n        // grant's passing policy must not ride an `any` grant's wider reach).\n        const issues : Issue[] = [];\n        for (const grant of aggr.grants) {\n            // Realm reach (coarse, actor-relative) — a SEPARATE factor from the grant's\n            // policy, ANDed with it. The realm-match evaluator runs in SCOPE MODE: it reads the\n            // resource realm from ctx.data[REALM_MATCH] (fallback ATTRIBUTES.realm_id) and\n            // neutral-passes when absent (preEvaluate / gate checks / realm-less resources) —\n            // key-PRESENCE is the discriminator. Invoked DIRECTLY (not via PolicyEngine —\n            // REALM_MATCH is in policiesExcluded, so the engine would skip it).\n            const realmOutcome = await this.realmMatchEvaluator.evaluate(\n                { scope: grant.realm_scope },\n                ctx,\n            );\n            if (!realmOutcome.success) {\n                continue;\n            }\n\n            if (!grant.policy) {\n                // Reach matches and this grant carries no further restriction.\n                return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n            }\n\n            // Missing evaluators is a misconfiguration: let the engine fail CLOSED with a\n            // surfaced POLICY_EVALUATOR_NOT_FOUND issue (new PolicyEngine(undefined) defaults\n            // to an empty registry, so grant.policy resolves to no evaluator) rather than\n            // swallowing the grant with a silent issue-less deny.\n            const engine = new PolicyEngine(ctx.evaluators);\n            const outcome = await engine.evaluate(grant.policy, {\n                ...ctx,\n                path: [\n                    ...(ctx.path || []),\n                ],\n            });\n\n            if (outcome.success) {\n                return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n            }\n\n            if (outcome.issues) {\n                issues.push(...outcome.issues);\n            }\n        }\n\n        // No grant term satisfied (reach ∧ policies). Apply `invert` ONCE to the aggregated\n        // disjunction outcome — never per term, which would corrupt the quantifier.\n        const success = maybeInvertPolicyOutcome(false, policy.invert);\n        return {\n            success,\n            issues: success ? [] : issues,\n        };\n    }\n}\n"],"mappings":";;;;;AA2BA,IAAaS,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;EACjE,KAAKH,YAAY,IAAIR,iCAAAA;EACrB,KAAKS,oBAAoB,IAAIV,wBAAAA;EAC7B,KAAKW,sBAAsB,IAAIP,0BAAAA;EAC/B,KAAKQ,6BAA6BA;CACtC;CAEA,MAAMC,WAAWC,KAAkF;EAC/F,IAAI,CAACA,IAAIC,KAAKC,IAAIjB,kBAAkBkB,kBAAkB,GAClD,OAAO;EAGX,IAAIH,IAAIC,KAAKG,YAAYnB,kBAAkBkB,kBAAkB,GACzD,OAAOH,IAAIC,KAAKI,IAAIpB,kBAAkBkB,kBAAkB;EAG5D,MAAMF,OAAOD,IAAIC,KAAKI,IAAuCpB,kBAAkBkB,kBAAkB;EAEjGH,IAAIC,KAAKK,IAAIrB,kBAAkBkB,oBAAoBF,IAAAA;EACnDD,IAAIC,KAAKM,aAAatB,kBAAkBkB,kBAAkB;EAE1D,OAAOF;CACX;CAEA,MAAMO,SAASC,OAA4BT,KAA+D;EACtG,MAAMU,SAAS,MAAM,KAAKf,UAAUgB,IAAIF,KAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKhB,kBAAkBG,WAAWC,GAAAA;EACzD,IAAI,CAACY,UACD,OAAO;GACHC,SAAS;GACTC,QAAQ,CACJtB,sBAAsB;IAClBuB,MAAM1B,gBAAgB2B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;GACd,CAAA,CAAA;EAER;EAEJ,MAAMC,UAAU,MAAM,KAAKpB,WAAWC,GAAAA;EACtC,IAAI,CAACmB,SACD,OAAO;GACHN,SAAS;GACTC,QAAQ,CACJtB,sBAAsB;IAClBuB,MAAM1B,gBAAgB2B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;GACd,CAAA,CAAA;EAER;EAGJ,MAAME,mBAAmB,MAAM,KAAKtB,2BAA2BuB,OAAOT,QAAAA,CAAAA,CACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;GACjC,IAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,MAC5C,OAAO;GAGX,QAAQR,QAAQO,WAAWE,YAAY,WAAWH,KAAKC,WAAWE,YAAY,UACzET,QAAQO,WAAWG,aAAa,WAAWJ,KAAKC,WAAWG,aAAa;EACjF,CAAA,CAAA;EAEJ,IAAIT,iBAAiBU,WAAW,GAC5B,OAAO,EAAEjB,SAASpB,yBAAyB,OAAOiB,OAAOqB,MAAM,EAAE;EAGrE,MAAM,CAACC,QAAQzC,kCAAkC6B,gBAAAA;EACjD,IAAI,CAACY,MACD,OAAO,EAAEnB,SAASpB,yBAAyB,OAAOiB,OAAOqB,MAAM,EAAE;EAWrE,MAAMjB,SAAmB,CAAA;EACzB,KAAK,MAAMmB,SAASD,KAAKE,QAAQ;GAW7B,IAAI,EAACC,MAJsB,KAAKtC,oBAAoBW,SAChD,EAAE4B,OAAOH,MAAMI,YAAY,GAC3BrC,GAAAA,EAAAA,CAEca,SACd;GAGJ,IAAI,CAACoB,MAAMvB,QAEP,OAAO,EAAEG,SAASpB,yBAAyB,MAAMiB,OAAOqB,MAAM,EAAE;GAQpE,MAAMS,UAAU,MAAMF,IADHlD,aAAaY,IAAIuC,UACdD,CAAAA,CAAO9B,SAASyB,MAAMvB,QAAQ;IAChD,GAAGV;IACHkB,MAAM,CAAA,GACElB,IAAIkB,QAAQ,CAAA,CAAA;GAExB,CAAA;GAEA,IAAIsB,QAAQ3B,SACR,OAAO,EAAEA,SAASpB,yBAAyB,MAAMiB,OAAOqB,MAAM,EAAE;GAGpE,IAAIS,QAAQ1B,QACRA,OAAO2B,KAAI,GAAID,QAAQ1B,MAAM;EAErC;EAIA,MAAMD,UAAUpB,yBAAyB,OAAOiB,OAAOqB,MAAM;EAC7D,OAAO;GACHlB;GACAC,QAAQD,UAAU,CAAA,IAAKC;EAC3B;CACJ;AACJ"}

package/dist/index.mjs

@@ -104,7 +104,7 @@ import { ComponentsModule } from "./app/modules/components/module.mjs";
 import { HTTPInjectionKey } from "./app/modules/http/constants.mjs";
 import { RequestHandlerOperation } from "./adapters/http/request/constants.mjs";
 import { setRequestPermissionEvaluator, useRequestPermissionEvaluator } from "./adapters/http/request/permission/helper.mjs";
-import { RequestIdentity, isRequestIdentityMasterRealmMember, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./adapters/http/request/helpers/identity.mjs";
+import { RequestIdentity, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./adapters/http/request/helpers/identity.mjs";
 import { buildActorContext } from "./adapters/http/request/helpers/actor.mjs";
 import { getBodyRealmID } from "./adapters/http/request/helpers/body-realm-id.mjs";
 import { LOCALE_COOKIE, useRequestLocale } from "./adapters/http/request/helpers/locale.mjs";
@@ -116,7 +116,7 @@ import { setRequestScopes, useRequestScopes } from "./adapters/http/request/help
 import { setRequestToken, useRequestToken } from "./adapters/http/request/helpers/token.mjs";
 import { RequestPermissionEvaluator } from "./adapters/http/request/permission/module.mjs";
 import { HTTPOAuth2Authorizer } from "./adapters/http/adapters/oauth2/authorization/module.mjs";
-import { extractClientCredentialsFromRequest } from "./adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs";
+import { extractClientCredentialsFromRequest, readStringField } from "./adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./adapters/http/adapters/oauth2/grant-types/utils/guess.mjs";
 import { HTTPOAuth2AuthorizeGrant } from "./adapters/http/adapters/oauth2/grant-types/authorize.mjs";
 import { HTTPClientCredentialsGrant } from "./adapters/http/adapters/oauth2/grant-types/client-credentials.mjs";
@@ -213,4 +213,4 @@ import { defineCLIResetCommand } from "./cli/commands/reset.mjs";
 import { defineCLIStartCommand } from "./cli/commands/start.mjs";
 import "./cli/commands/index.mjs";
 import "reflect-metadata";
-export { ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthorizationMiddleware, AuthorizeController, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountEntity, IdentityProviderAccountRepository, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyEntity, LDAPInjectionKey, LOCALE_COOKIE, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, ProvisionerModule, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotEntity, RobotIdentityRepository, RobotPermissionController, RobotPermissionEntity, RobotPermissionRepositoryAdapter, RobotPermissionRequestValidator, RobotPermissionSubscriber, RobotRepositoryAdapter, RobotRoleController, RobotRoleEntity, RobotRoleRepositoryAdapter, RobotRoleRequestValidator, RobotRoleSubscriber, RobotSubscriber, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionEntity, SessionRepository, StatusController, TokenController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserController, UserEntity, UserIdentityRepository, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIResetCommand, defineCLIStartCommand, expandToOrigins, extractClientCredentialsFromRequest, getAppOrigins, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isRequestIdentityMasterRealmMember, readFromLocations, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestToken };
+export { ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthorizationMiddleware, AuthorizeController, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountEntity, IdentityProviderAccountRepository, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyEntity, LDAPInjectionKey, LOCALE_COOKIE, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, ProvisionerModule, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotEntity, RobotIdentityRepository, RobotPermissionController, RobotPermissionEntity, RobotPermissionRepositoryAdapter, RobotPermissionRequestValidator, RobotPermissionSubscriber, RobotRepositoryAdapter, RobotRoleController, RobotRoleEntity, RobotRoleRepositoryAdapter, RobotRoleRequestValidator, RobotRoleSubscriber, RobotSubscriber, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionEntity, SessionRepository, StatusController, TokenController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserController, UserEntity, UserIdentityRepository, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIResetCommand, defineCLIStartCommand, expandToOrigins, extractClientCredentialsFromRequest, getAppOrigins, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, readFromLocations, readStringField, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestToken };

package/dist/swagger.json

@@ -1070,6 +1070,16 @@
                     }
                 ]
             },
+            "RealmScopeValue": {
+                "type": "string",
+                "enum": [
+                    "none",
+                    "own",
+                    "ownOrNull",
+                    "any"
+                ],
+                "description": "Relative realm reach of a permission grant (the `realm_scope` column). Mirrors the\n`RealmScope` enum in `@authup/access` (the logic source of truth) — the values must\nagree. Kept here as a plain const (no enum) since core-kit cannot depend on access."
+            },
             "Permission": {
                 "properties": {
                     "id": {
@@ -1201,6 +1211,10 @@
                             }
                         ]
                     },
+                    "realm_scope": {
+                        "$ref": "#/components/schemas/RealmScopeValue",
+                        "description": "Relative realm reach of this grant (none/own/ownOrNull/any). Fail-closed\ndefault `own`. See {@link REALM_SCOPE }."
+                    },
                     "permission_id": {
                         "type": "string"
                     },
@@ -1266,6 +1280,7 @@
                 "required": [
                     "policy_id",
                     "policy",
+                    "realm_scope",
                     "permission_id",
                     "permission",
                     "permission_realm_id",
@@ -1334,6 +1349,9 @@
                     },
                     {
                         "properties": {
+                            "realm_scope": {
+                                "$ref": "#/components/schemas/RealmScopeValue"
+                            },
                             "policy_id": {
                                 "anyOf": [
                                     {
@@ -1351,6 +1369,9 @@
             },
             "ClientPermissionUpdatePayload": {
                 "properties": {
+                    "realm_scope": {
+                        "$ref": "#/components/schemas/RealmScopeValue"
+                    },
                     "policy_id": {
                         "anyOf": [
                             {
@@ -3715,6 +3736,10 @@
                             }
                         ]
                     },
+                    "realm_scope": {
+                        "$ref": "#/components/schemas/RealmScopeValue",
+                        "description": "Relative realm reach of this grant (none/own/ownOrNull/any). Fail-closed\ndefault `own`. See {@link REALM_SCOPE }."
+                    },
                     "permission_id": {
                         "type": "string"
                     },
@@ -3780,6 +3805,7 @@
                 "required": [
                     "policy_id",
                     "policy",
+                    "realm_scope",
                     "permission_id",
                     "permission",
                     "permission_realm_id",
@@ -3848,6 +3874,9 @@
                     },
                     {
                         "properties": {
+                            "realm_scope": {
+                                "$ref": "#/components/schemas/RealmScopeValue"
+                            },
                             "policy_id": {
                                 "anyOf": [
                                     {
@@ -3865,6 +3894,9 @@
             },
             "RobotPermissionUpdatePayload": {
                 "properties": {
+                    "realm_scope": {
+                        "$ref": "#/components/schemas/RealmScopeValue"
+                    },
                     "policy_id": {
                         "anyOf": [
                             {
@@ -4335,6 +4367,10 @@
                             }
                         ]
                     },
+                    "realm_scope": {
+                        "$ref": "#/components/schemas/RealmScopeValue",
+                        "description": "Relative realm reach of this grant (none/own/ownOrNull/any). Fail-closed\ndefault `own`. See {@link REALM_SCOPE }."
+                    },
                     "permission_id": {
                         "type": "string"
                     },
@@ -4400,6 +4436,7 @@
                 "required": [
                     "policy_id",
                     "policy",
+                    "realm_scope",
                     "permission_id",
                     "permission",
                     "permission_realm_id",
@@ -4468,6 +4505,9 @@
                     },
                     {
                         "properties": {
+                            "realm_scope": {
+                                "$ref": "#/components/schemas/RealmScopeValue"
+                            },
                             "policy_id": {
                                 "anyOf": [
                                     {
@@ -4485,6 +4525,9 @@
             },
             "RolePermissionUpdatePayload": {
                 "properties": {
+                    "realm_scope": {
+                        "$ref": "#/components/schemas/RealmScopeValue"
+                    },
                     "policy_id": {
                         "anyOf": [
                             {
@@ -5240,6 +5283,10 @@
                             }
                         ]
                     },
+                    "realm_scope": {
+                        "$ref": "#/components/schemas/RealmScopeValue",
+                        "description": "Relative realm reach of this grant (none/own/ownOrNull/any). Fail-closed\ndefault `own`. See {@link REALM_SCOPE }."
+                    },
                     "permission_id": {
                         "type": "string"
                     },
@@ -5305,6 +5352,7 @@
                 "required": [
                     "policy_id",
                     "policy",
+                    "realm_scope",
                     "permission_id",
                     "permission",
                     "permission_realm_id",
@@ -5373,6 +5421,9 @@
                     },
                     {
                         "properties": {
+                            "realm_scope": {
+                                "$ref": "#/components/schemas/RealmScopeValue"
+                            },
                             "policy_id": {
                                 "anyOf": [
                                     {
@@ -5390,6 +5441,9 @@
             },
             "UserPermissionUpdatePayload": {
                 "properties": {
+                    "realm_scope": {
+                        "$ref": "#/components/schemas/RealmScopeValue"
+                    },
                     "policy_id": {
                         "anyOf": [
                             {