npm - @authup/server-core - Versions diffs - 1.0.0-beta.50 → 1.0.0-beta.52 - Mend

@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.52

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (656) hide show

package/dist/app/modules/oauth2/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["CacheInjectionKey","ModuleName","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2KeyRepository","OAuth2ScopeRepository","OAuth2TokenRepository","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","KeyRepository","DataSource","TokenSigner","keyRepository","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\n\nimport {\n OAuth2AuthorizationCodeRepository,\n OAuth2AuthorizationStateRepository,\n OAuth2ClientRepository,\n OAuth2KeyRepository,\n OAuth2ScopeRepository,\n OAuth2TokenRepository,\n} from './repositories/index.ts';\nimport {\n OAuth2AccessTokenIssuer,\n OAuth2AuthorizationCodeIssuer,\n OAuth2AuthorizationCodeRequestVerifier,\n OAuth2AuthorizationCodeVerifier,\n OAuth2AuthorizationStateManager,\n OAuth2OpenIDTokenIssuer,\n OAuth2RefreshTokenIssuer,\n OAuth2TokenRevoker,\n OAuth2TokenSigner,\n OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n constructor() {\n this.name = ModuleName.OAUTH2;\n this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n }\n\n async setup(container: IContainer) : Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n\n container.register(OAuth2InjectionToken.ClientRepository, {\n useFactory: (c) => {\n const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n return new OAuth2ClientRepository(repository);\n },\n });\n\n container.register(OAuth2InjectionToken.ScopeRepository, {\n useFactory: (c) => {\n const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n return new OAuth2ScopeRepository(repository);\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2AuthorizationCodeRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2AuthorizationStateRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.TokenRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2TokenRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.KeyRepository, {\n // todo: cache use here\n useFactory: (c) => new OAuth2KeyRepository(c.resolve(DatabaseInjectionKey.DataSource)),\n });\n\n container.register(OAuth2InjectionToken.TokenSigner, {\n useFactory: (c) => {\n const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n return new OAuth2TokenSigner(keyRepository);\n },\n });\n\n // authorization code issuer\n container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n useFactory: (c) => {\n const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n return new OAuth2AuthorizationCodeIssuer(\n codeRepository,\n {\n // todo: own constant here\n maxAge: config.tokenAccessMaxAge,\n },\n );\n },\n });\n container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n useFactory: (c) => {\n const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n return new OAuth2AuthorizationCodeVerifier(codeRepository);\n },\n });\n\n // authorization code request verifier\n container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n useFactory: (c) => {\n const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n return new OAuth2AuthorizationCodeRequestVerifier({\n clientRepository,\n scopeRepository: clientScopeRepository,\n });\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n useFactory: (c) => {\n const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n return new OAuth2AuthorizationStateManager(stateRepository);\n },\n });\n\n // token revoker\n container.register(OAuth2InjectionToken.TokenRevoker, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n return new OAuth2TokenRevoker(tokenRepository);\n },\n });\n\n // token verifier\n container.register(OAuth2InjectionToken.TokenVerifier, {\n useFactory: (c) => {\n const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n return new OAuth2TokenVerifier(keyRepository, tokenRepository);\n },\n });\n\n // access token issuer\n container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n return new OAuth2AccessTokenIssuer(\n tokenRepository,\n tokenSigner,\n {\n maxAge: config.tokenAccessMaxAge,\n issuer: config.publicUrl,\n },\n identityRoleProvider,\n );\n },\n });\n\n // refresh token issuer\n container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n return new OAuth2RefreshTokenIssuer(\n tokenRepository,\n tokenSigner,\n {\n maxAge: config.tokenRefreshMaxAge,\n issuer: config.publicUrl,\n },\n );\n },\n });\n\n // open-id token issuer\n container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n useFactory: (c) => {\n const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n return new OAuth2OpenIDTokenIssuer({\n repository,\n signer,\n\n identityResolver,\n\n options: {\n // todo: own constant here\n maxAge: config.tokenAccessMaxAge,\n issuer: config.publicUrl,\n },\n });\n },\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,IAAawB,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOxB,WAAW0B;EACvB,KAAKD,eAAe;GAACzB,WAAW2B;GAAU3B,WAAW4B;GAAO5B,WAAW6B;GAAQ7B,WAAW8B;;CAC9F;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GAET,OAAO,IAAInC,uBADQmC,EAAEJ,QAAkCf,YACrBoB,CAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GAET,OAAO,IAAIjC,sBADQiC,EAAEJ,QAAuCd,iBAC3BmB,CAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GAET,OAAO,IAAIrC,kCADGqC,EAAEJ,QAAQnC,iBACqB2C,CAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GAET,OAAO,IAAIpC,mCADGoC,EAAEJ,QAAQnC,iBACsB2C,CAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GAET,OAAO,IAAIhC,sBADGgC,EAAEJ,QAAQnC,iBACS2C,CAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,eAAe,EAEnDR,aAAaC,MAAM,IAAIlC,oBAAoBkC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EACxF,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,aAAa,EACjDV,aAAaC,MAAAA;GAET,OAAO,IAAIvB,kBADWuB,EAAEJ,QAAQjB,qBAAqB4B,aACxBG,CAAAA;EACjC,EACJ,CAAA;EAGAhB,UAAUG,SAASlB,qBAAqBgC,yBAAyB,EAC7DZ,aAAaC,MAAAA;GAGT,OAAO,IAAI9B,8BAFY8B,EAAEJ,QAAQjB,qBAAqBwB,2BAGlDS,GACA,EAEIC,QAAQlB,OAAOmB,kBACnB,CAAA;EAER,EACJ,CAAA;EACApB,UAAUG,SAASlB,qBAAqBoC,2BAA2B,EAC/DhB,aAAaC,MAAAA;GAGT,OAAO,IAAI5B,gCAFY4B,EAAEJ,QAAQjB,qBAAqBwB,2BAEXS,CAAAA;EAC/C,EACJ,CAAA;EAGAlB,UAAUG,SAASlB,qBAAqBqC,kCAAkC,EACtEjB,aAAaC,MAAAA;GAIT,OAAO,IAAI7B,uCAAuC;IAC9C8C,kBAJqBjB,EAAEJ,QAAQjB,qBAAqBmB,gBAIpDmB;IACAE,iBAJ0BnB,EAAEJ,QAAQjB,qBAAqBuB,eAIxCgB;GACrB,CAAA;EACJ,EACJ,CAAA;EAEAxB,UAAUG,SAASlB,qBAAqByC,2BAA2B,EAC/DrB,aAAaC,MAAAA;GAGT,OAAO,IAAI3B,gCAFa2B,EAAEJ,QAAQjB,qBAAqB0B,4BAEZgB,CAAAA;EAC/C,EACJ,CAAA;EAGA3B,UAAUG,SAASlB,qBAAqB2C,cAAc,EAClDvB,aAAaC,MAAAA;GAET,OAAO,IAAIxB,mBADawB,EAAEJ,QAAQjB,qBAAqB2B,eACzBiB,CAAAA;EAClC,EACJ,CAAA;EAGA7B,UAAUG,SAASlB,qBAAqB6C,eAAe,EACnDzB,aAAaC,MAAAA;GAIT,OAAO,IAAItB,oBAHWsB,EAAEJ,QAAQjB,qBAAqB4B,aAGtBG,GAFPV,EAAEJ,QAAQjB,qBAAqB2B,eAETiB,CAAAA;EAClD,EACJ,CAAA;EAGA7B,UAAUG,SAASlB,qBAAqB8C,mBAAmB,EACvD1B,aAAaC,MAAAA;GACT,MAAMuB,kBAAkBvB,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAMoB,cAAc1B,EAAEJ,QAAQjB,qBAAqB8B,WAAW;GAC9D,MAAMkB,uBAAuB3B,EAAEJ,QAAQhB,qBAAqBgD,YAAY;GACxE,OAAO,IAAI3D,wBACPsD,iBACAG,aACA;IACIb,QAAQlB,OAAOmB;IACfe,QAAQlC,OAAOmC;GACnB,GACAH,oBAAAA;EAER,EACJ,CAAA;EAGAjC,UAAUG,SAASlB,qBAAqBoD,oBAAoB,EACxDhC,aAAaC,MAAAA;GAIT,OAAO,IAAIzB,yBAHayB,EAAEJ,QAAQjB,qBAAqB2B,eAInDiB,GAHgBvB,EAAEJ,QAAQjB,qBAAqB8B,WAI/CiB,GACA;IACIb,QAAQlB,OAAOqC;IACfH,QAAQlC,OAAOmC;GACnB,CAAA;EAER,EACJ,CAAA;EAGApC,UAAUG,SAASlB,qBAAqBsD,mBAAmB,EACvDlC,aAAaC,MAAAA;GAKT,OAAO,IAAI1B,wBAAwB;IAC/B2B,YALeD,EAAEJ,QAAQjB,qBAAqB2B,eAK9CL;IACAiC,QALWlC,EAAEJ,QAAQjB,qBAAqB8B,WAK1CyB;IAEAC,kBANqBnC,EAAEJ,QAAQhB,qBAAqBwD,QAMpDD;IAEAE,SAAS;KAELxB,QAAQlB,OAAOmB;KACfe,QAAQlC,OAAOmC;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["CacheInjectionKey","ModuleName","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2KeyRepository","OAuth2ScopeRepository","OAuth2TokenRepository","SessionTokenRepositoryAdapter","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","SessionTokenRepository","DataSource","KeyRepository","TokenSigner","keyRepository","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","sessionTokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\n\nimport {\n OAuth2AuthorizationCodeRepository,\n OAuth2AuthorizationStateRepository,\n OAuth2ClientRepository,\n OAuth2KeyRepository,\n OAuth2ScopeRepository,\n OAuth2TokenRepository,\n SessionTokenRepositoryAdapter,\n} from './repositories/index.ts';\nimport {\n OAuth2AccessTokenIssuer,\n OAuth2AuthorizationCodeIssuer,\n OAuth2AuthorizationCodeRequestVerifier,\n OAuth2AuthorizationCodeVerifier,\n OAuth2AuthorizationStateManager,\n OAuth2OpenIDTokenIssuer,\n OAuth2RefreshTokenIssuer,\n OAuth2TokenRevoker,\n OAuth2TokenSigner,\n OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n constructor() {\n this.name = ModuleName.OAUTH2;\n this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n }\n\n async setup(container: IContainer) : Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n\n container.register(OAuth2InjectionToken.ClientRepository, {\n useFactory: (c) => {\n const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n return new OAuth2ClientRepository(repository);\n },\n });\n\n container.register(OAuth2InjectionToken.ScopeRepository, {\n useFactory: (c) => {\n const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n return new OAuth2ScopeRepository(repository);\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2AuthorizationCodeRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2AuthorizationStateRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.TokenRepository, {\n useFactory: (c) => {\n const cache = c.resolve(CacheInjectionKey);\n return new OAuth2TokenRepository(cache);\n },\n });\n\n container.register(OAuth2InjectionToken.SessionTokenRepository, {\n useFactory: (c) => new SessionTokenRepositoryAdapter(\n c.resolve(DatabaseInjectionKey.DataSource),\n ),\n });\n\n container.register(OAuth2InjectionToken.KeyRepository, {\n // todo: cache use here\n useFactory: (c) => new OAuth2KeyRepository(c.resolve(DatabaseInjectionKey.DataSource)),\n });\n\n container.register(OAuth2InjectionToken.TokenSigner, {\n useFactory: (c) => {\n const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n return new OAuth2TokenSigner(keyRepository);\n },\n });\n\n // authorization code issuer\n container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n useFactory: (c) => {\n const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n return new OAuth2AuthorizationCodeIssuer(\n codeRepository,\n {\n // todo: own constant here\n maxAge: config.tokenAccessMaxAge,\n },\n );\n },\n });\n container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n useFactory: (c) => {\n const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n return new OAuth2AuthorizationCodeVerifier(codeRepository);\n },\n });\n\n // authorization code request verifier\n container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n useFactory: (c) => {\n const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n return new OAuth2AuthorizationCodeRequestVerifier({\n clientRepository,\n scopeRepository: clientScopeRepository,\n });\n },\n });\n\n container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n useFactory: (c) => {\n const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n return new OAuth2AuthorizationStateManager(stateRepository);\n },\n });\n\n // token revoker\n container.register(OAuth2InjectionToken.TokenRevoker, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n return new OAuth2TokenRevoker(tokenRepository, sessionTokenRepository);\n },\n });\n\n // token verifier\n container.register(OAuth2InjectionToken.TokenVerifier, {\n useFactory: (c) => {\n const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n return new OAuth2TokenVerifier(keyRepository, tokenRepository);\n },\n });\n\n // access token issuer\n container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n return new OAuth2AccessTokenIssuer(\n tokenRepository,\n tokenSigner,\n {\n maxAge: config.tokenAccessMaxAge,\n issuer: config.publicUrl,\n },\n identityRoleProvider,\n sessionTokenRepository,\n );\n },\n });\n\n // refresh token issuer\n container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n useFactory: (c) => {\n const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n\n return new OAuth2RefreshTokenIssuer(\n tokenRepository,\n tokenSigner,\n {\n maxAge: config.tokenRefreshMaxAge,\n issuer: config.publicUrl,\n },\n sessionTokenRepository,\n );\n },\n });\n\n // open-id token issuer\n container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n useFactory: (c) => {\n const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n return new OAuth2OpenIDTokenIssuer({\n repository,\n signer,\n\n identityResolver,\n\n options: {\n // todo: own constant here\n maxAge: config.tokenAccessMaxAge,\n issuer: config.publicUrl,\n },\n });\n },\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAayB,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOzB,WAAW2B;EACvB,KAAKD,eAAe;GAAC1B,WAAW4B;GAAU5B,WAAW6B;GAAO7B,WAAW8B;GAAQ9B,WAAW+B;;CAC9F;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GAET,OAAO,IAAIpC,uBADQoC,EAAEJ,QAAkCf,YACrBoB,CAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GAET,OAAO,IAAIlC,sBADQkC,EAAEJ,QAAuCd,iBAC3BmB,CAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GAET,OAAO,IAAItC,kCADGsC,EAAEJ,QAAQpC,iBACqB4C,CAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GAET,OAAO,IAAIrC,mCADGqC,EAAEJ,QAAQpC,iBACsB4C,CAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GAET,OAAO,IAAIjC,sBADGiC,EAAEJ,QAAQpC,iBACS4C,CAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,wBAAwB,EAC5DR,aAAaC,MAAM,IAAIhC,8BACnBgC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,eAAe,EAEnDV,aAAaC,MAAM,IAAInC,oBAAoBmC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EACxF,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB+B,aAAa,EACjDX,aAAaC,MAAAA;GAET,OAAO,IAAIvB,kBADWuB,EAAEJ,QAAQjB,qBAAqB8B,aACxBE,CAAAA;EACjC,EACJ,CAAA;EAGAjB,UAAUG,SAASlB,qBAAqBiC,yBAAyB,EAC7Db,aAAaC,MAAAA;GAGT,OAAO,IAAI9B,8BAFY8B,EAAEJ,QAAQjB,qBAAqBwB,2BAGlDU,GACA,EAEIC,QAAQnB,OAAOoB,kBACnB,CAAA;EAER,EACJ,CAAA;EACArB,UAAUG,SAASlB,qBAAqBqC,2BAA2B,EAC/DjB,aAAaC,MAAAA;GAGT,OAAO,IAAI5B,gCAFY4B,EAAEJ,QAAQjB,qBAAqBwB,2BAEXU,CAAAA;EAC/C,EACJ,CAAA;EAGAnB,UAAUG,SAASlB,qBAAqBsC,kCAAkC,EACtElB,aAAaC,MAAAA;GAIT,OAAO,IAAI7B,uCAAuC;IAC9C+C,kBAJqBlB,EAAEJ,QAAQjB,qBAAqBmB,gBAIpDoB;IACAE,iBAJ0BpB,EAAEJ,QAAQjB,qBAAqBuB,eAIxCiB;GACrB,CAAA;EACJ,EACJ,CAAA;EAEAzB,UAAUG,SAASlB,qBAAqB0C,2BAA2B,EAC/DtB,aAAaC,MAAAA;GAGT,OAAO,IAAI3B,gCAFa2B,EAAEJ,QAAQjB,qBAAqB0B,4BAEZiB,CAAAA;EAC/C,EACJ,CAAA;EAGA5B,UAAUG,SAASlB,qBAAqB4C,cAAc,EAClDxB,aAAaC,MAAAA;GAGT,OAAO,IAAIxB,mBAFawB,EAAEJ,QAAQjB,qBAAqB2B,eAEzBkB,GADCxB,EAAEJ,QAAQjB,qBAAqB4B,sBACfkB,CAAAA;EACnD,EACJ,CAAA;EAGA/B,UAAUG,SAASlB,qBAAqB+C,eAAe,EACnD3B,aAAaC,MAAAA;GAIT,OAAO,IAAItB,oBAHWsB,EAAEJ,QAAQjB,qBAAqB8B,aAGtBE,GAFPX,EAAEJ,QAAQjB,qBAAqB2B,eAETkB,CAAAA;EAClD,EACJ,CAAA;EAGA9B,UAAUG,SAASlB,qBAAqBgD,mBAAmB,EACvD5B,aAAaC,MAAAA;GACT,MAAMwB,kBAAkBxB,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAMsB,cAAc5B,EAAEJ,QAAQjB,qBAAqB+B,WAAW;GAC9D,MAAMmB,uBAAuB7B,EAAEJ,QAAQhB,qBAAqBkD,YAAY;GACxE,MAAML,yBAAyBzB,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAItC,wBACPuD,iBACAI,aACA;IACId,QAAQnB,OAAOoB;IACfgB,QAAQpC,OAAOqC;GACnB,GACAH,sBACAJ,sBAAAA;EAER,EACJ,CAAA;EAGA/B,UAAUG,SAASlB,qBAAqBsD,oBAAoB,EACxDlC,aAAaC,MAAAA;GACT,MAAMwB,kBAAkBxB,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAMsB,cAAc5B,EAAEJ,QAAQjB,qBAAqB+B,WAAW;GAC9D,MAAMe,yBAAyBzB,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GAEpF,OAAO,IAAIhC,yBACPiD,iBACAI,aACA;IACId,QAAQnB,OAAOuC;IACfH,QAAQpC,OAAOqC;GACnB,GACAP,sBAAAA;EAER,EACJ,CAAA;EAGA/B,UAAUG,SAASlB,qBAAqBwD,mBAAmB,EACvDpC,aAAaC,MAAAA;GAKT,OAAO,IAAI1B,wBAAwB;IAC/B2B,YALeD,EAAEJ,QAAQjB,qBAAqB2B,eAK9CL;IACAmC,QALWpC,EAAEJ,QAAQjB,qBAAqB+B,WAK1C0B;IAEAC,kBANqBrC,EAAEJ,QAAQhB,qBAAqB0D,QAMpDD;IAEAE,SAAS;KAELzB,QAAQnB,OAAOoB;KACfgB,QAAQpC,OAAOqC;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}

package/dist/app/modules/oauth2/repositories/client/repository.mjs CHANGED Viewed

@@ -12,9 +12,9 @@ var OAuth2ClientRepository = class {
 		const query = this.repository.createQueryBuilder("client").leftJoinAndSelect("client.realm", "realm");
 		if (isUUID(key)) query.where("client.id = :id", { id: key });
 		else {
-			query.where("client.name = :name", { name: key });
+			query.where("client.name = :name", { name: key.trim().toLowerCase() });
 			if (realmKey) if (isUUID(realmKey)) query.andWhere("client.realm_id = :realmId", { realmId: realmKey });
-			else query.andWhere("realm.name = :realmName", { realmName: realmKey });
+			else query.andWhere("realm.name = :realmName", { realmName: realmKey.trim().toLowerCase() });
 		}
 		return query.getOne();
 	}

package/dist/app/modules/oauth2/repositories/client/repository.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"repository.mjs","names":["isUUID","OAuth2ClientRepository","repository","findOneByIdOrName","key","realmKey","query","createQueryBuilder","leftJoinAndSelect","where","id","name","andWhere","realmId","realmName","getOne"],"sources":["../../../../../../src/app/modules/oauth2/repositories/client/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport type { IOAuth2ClientRepository } from '../../../../../core/index.ts';\n\nexport class OAuth2ClientRepository implements IOAuth2ClientRepository {\n private readonly repository: Repository<Client>;\n\n constructor(\n repository: Repository<Client>,\n ) {\n this.repository = repository;\n }\n\n async findOneByIdOrName(key: string, realmKey?: string): Promise<Client \| null> {\n const query = this.repository.createQueryBuilder('client')\n .leftJoinAndSelect('client.realm', 'realm');\n\n if (isUUID(key)) {\n query.where('client.id = :id', { id: key });\n } else {\n query.where('client.name = :name', { name: key });\n\n if (realmKey) {\n if (isUUID(realmKey)) {\n query.andWhere('client.realm_id = :realmId', { realmId: realmKey });\n } else {\n query.andWhere('realm.name = :realmName', { realmName: realmKey });\n }\n }\n }\n\n return query.getOne();\n }\n}\n"],"mappings":";;;;;AAYA,IAAaC,yBAAb,MAAaA;CACQC;CAEjB,YACIA,YACF;EACE,KAAKA,aAAaA;CACtB;CAEA,MAAMC,kBAAkBC,KAAaC,UAA2C;EAC5E,MAAMC,QAAQ,KAAKJ,WAAWK,mBAAmB,QAAA,CAAA,CAC5CC,kBAAkB,gBAAgB,OAAA;EAEvC,IAAIR,OAAOI,GAAAA,GACPE,MAAMG,MAAM,mBAAmB,EAAEC,IAAIN,IAAI,CAAA;OACtC;GACHE,MAAMG,MAAM,uBAAuB,EAAEE,MAAMP,~~IAAI~~,CAAA;~~GAE/C~~,~~IAAIC~~,UACA,IAAIL,OAAOK,QAAAA,GACPC,~~MAAMM~~,SAAS,8BAA8B,EAAEC,~~SAASR~~,SAAS,CAAA;QAEjEC,~~MAAMM~~,SAAS,2BAA2B,EAAEE,~~WAAWT~~,~~SAAS~~,CAAA;~~EAG5E~~;EAEA,~~OAAOC~~,~~MAAMS~~,OAAM;CACvB;AACJ"}
1	+ {"version":3,"file":"repository.mjs","names":["isUUID","OAuth2ClientRepository","repository","findOneByIdOrName","key","realmKey","query","createQueryBuilder","leftJoinAndSelect","where","id","name","trim","toLowerCase","andWhere","realmId","realmName","getOne"],"sources":["../../../../../../src/app/modules/oauth2/repositories/client/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport type { IOAuth2ClientRepository } from '../../../../../core/index.ts';\n\nexport class OAuth2ClientRepository implements IOAuth2ClientRepository {\n private readonly repository: Repository<Client>;\n\n constructor(\n repository: Repository<Client>,\n ) {\n this.repository = repository;\n }\n\n async findOneByIdOrName(key: string, realmKey?: string): Promise<Client \| null> {\n const query = this.repository.createQueryBuilder('client')\n .leftJoinAndSelect('client.realm', 'realm');\n\n if (isUUID(key)) {\n query.where('client.id = :id', { id: key });\n } else {\n query.where('client.name = :name', { name: key.trim().toLowerCase() });\n\n if (realmKey) {\n if (isUUID(realmKey)) {\n query.andWhere('client.realm_id = :realmId', { realmId: realmKey });\n } else {\n query.andWhere('realm.name = :realmName', { realmName: realmKey.trim().toLowerCase() });\n }\n }\n }\n\n return query.getOne();\n }\n}\n"],"mappings":";;;;;AAYA,IAAaC,yBAAb,MAAaA;CACQC;CAEjB,YACIA,YACF;EACE,KAAKA,aAAaA;CACtB;CAEA,MAAMC,kBAAkBC,KAAaC,UAA2C;EAC5E,MAAMC,QAAQ,KAAKJ,WAAWK,mBAAmB,QAAA,CAAA,CAC5CC,kBAAkB,gBAAgB,OAAA;EAEvC,IAAIR,OAAOI,GAAAA,GACPE,MAAMG,MAAM,mBAAmB,EAAEC,IAAIN,IAAI,CAAA;OACtC;GACHE,MAAMG,MAAM,uBAAuB,EAAEE,MAAMP,IAAIQ,KAAI,CAAA,CAAGC,YAAW,EAAG,CAAA;GAEpE,IAAIR,UACA,IAAIL,OAAOK,QAAAA,GACPC,MAAMQ,SAAS,8BAA8B,EAAEC,SAASV,SAAS,CAAA;QAEjEC,MAAMQ,SAAS,2BAA2B,EAAEE,WAAWX,SAASO,KAAI,CAAA,CAAGC,YAAW,EAAG,CAAA;EAGjG;EAEA,OAAOP,MAAMW,OAAM;CACvB;AACJ"}

package/dist/app/modules/oauth2/repositories/index.d.ts CHANGED Viewed

@@ -2,5 +2,6 @@ export * from './authorize/index.ts';
 export * from './client/index.ts';
 export * from './scope/index.ts';
 export * from './key/index.ts';
+export * from './session-token/index.ts';
 export * from './token/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/app/modules/oauth2/repositories/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}

package/dist/app/modules/oauth2/repositories/index.mjs CHANGED Viewed

@@ -9,6 +9,8 @@ import "./client/index.mjs";
 import { OAuth2ScopeRepository } from "./scope/repository.mjs";
 import { OAuth2KeyRepository } from "./key/repository.mjs";
 import "./key/index.mjs";
+import { SessionTokenRepositoryAdapter } from "./session-token/repository.mjs";
+import "./session-token/index.mjs";
 import { OAuth2TokenRepository } from "./token/repository.mjs";
 import "./token/index.mjs";
-export { OAuth2AuthorizationCodeRepository, OAuth2AuthorizationStateRepository, OAuth2ClientRepository, OAuth2KeyRepository, OAuth2ScopeRepository, OAuth2TokenRepository };
+export { OAuth2AuthorizationCodeRepository, OAuth2AuthorizationStateRepository, OAuth2ClientRepository, OAuth2KeyRepository, OAuth2ScopeRepository, OAuth2TokenRepository, SessionTokenRepositoryAdapter };

package/dist/app/modules/oauth2/repositories/session-token/index.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export * from './repository.ts';
2	+ //# sourceMappingURL=index.d.ts.map

package/dist/app/modules/oauth2/repositories/session-token/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,iBAAiB,CAAC"}

package/dist/app/modules/oauth2/repositories/session-token/index.mjs ADDED Viewed

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SessionTokenRepositoryAdapter } from "./repository.mjs";
+export { SessionTokenRepositoryAdapter };

package/dist/app/modules/oauth2/repositories/session-token/repository.d.ts ADDED Viewed

@@ -0,0 +1,17 @@
+import type { SessionToken } from '@authup/core-kit';
+import type { DataSource, Repository } from 'typeorm';
+import { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';
+import type { ISessionTokenRepository, SessionTokenCreateInput, SessionTokenRef } from '../../../../../core/index.ts';
+export declare class SessionTokenRepositoryAdapter implements ISessionTokenRepository {
+    protected repository: Repository<SessionTokenEntity>;
+    constructor(dataSource: DataSource);
+    create(input: SessionTokenCreateInput): Promise<SessionToken>;
+    findOneById(id: string): Promise<SessionToken | null>;
+    findBySessionId(sessionId: string): Promise<SessionToken[]>;
+    markRefreshConsumed(id: string, at: string): Promise<boolean>;
+    hasConsumedChild(parentId: string): Promise<boolean>;
+    revokeById(id: string, at: string): Promise<void>;
+    revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]>;
+    deleteExpired(before: string): Promise<number>;
+}
+//# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/oauth2/repositories/session-token/repository.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AACvF,OAAO,KAAK,EACR,uBAAuB,EACvB,uBAAuB,EACvB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAEtC,qBAAa,6BAA8B,YAAW,uBAAuB;IACzE,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;gBAEzC,UAAU,EAAE,UAAU;IAI5B,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC;IAyB7D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIrD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI3D,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASpD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAsB5E,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAKvD"}

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs ADDED Viewed

@@ -0,0 +1,63 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SessionTokenEntity } from "../../../../../adapters/database/domains/session-token/entity.mjs";
+import "../../../../../adapters/database/domains/index.mjs";
+import { In, LessThan } from "typeorm";
+//#region src/app/modules/oauth2/repositories/session-token/repository.ts
+var SessionTokenRepositoryAdapter = class {
+	repository;
+	constructor(dataSource) {
+		this.repository = dataSource.getRepository(SessionTokenEntity);
+	}
+	async create(input) {
+		const entity = this.repository.create({
+			id: input.id,
+			session_id: input.session_id,
+			kind: input.kind,
+			parent_id: input.parent_id ?? null,
+			refresh_token_id: input.refresh_token_id ?? null,
+			ip_address: input.ip_address,
+			user_agent: input.user_agent,
+			consumed_at: null,
+			revoked_at: null,
+			expires_at: input.expires_at
+		});
+		await this.repository.insert(entity);
+		entity.created_at = entity.created_at ?? (/* @__PURE__ */ new Date()).toISOString();
+		return entity;
+	}
+	async findOneById(id) {
+		return this.repository.findOne({ where: { id } });
+	}
+	async findBySessionId(sessionId) {
+		return this.repository.find({ where: { session_id: sessionId } });
+	}
+	async markRefreshConsumed(id, at) {
+		return ((await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ consumed_at: at }).where("id = :id", { id }).andWhere("kind = :kind", { kind: "refresh" }).andWhere("consumed_at IS NULL").andWhere("revoked_at IS NULL").execute()).affected ?? 0) > 0;
+	}
+	async hasConsumedChild(parentId) {
+		return await this.repository.createQueryBuilder().where("parent_id = :parentId", { parentId }).andWhere("consumed_at IS NOT NULL").getCount() > 0;
+	}
+	async revokeById(id, at) {
+		await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revoked_at: at }).where("id = :id", { id }).andWhere("revoked_at IS NULL").execute();
+	}
+	async revokeBySessionId(sessionId, at) {
+		const refs = (await this.repository.find({
+			where: { session_id: sessionId },
+			select: ["id", "expires_at"]
+		})).map((row) => ({
+			id: row.id,
+			expires_at: row.expires_at
+		}));
+		if (refs.length > 0) await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revoked_at: at }).where({ id: In(refs.map((ref) => ref.id)) }).andWhere("revoked_at IS NULL").execute();
+		return refs;
+	}
+	async deleteExpired(before) {
+		return (await this.repository.delete({ expires_at: LessThan(before) })).affected ?? 0;
+	}
+};
+//#endregion
+export { SessionTokenRepositoryAdapter };
+//# sourceMappingURL=repository.mjs.map

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"repository.mjs","names":["In","LessThan","SessionTokenEntity","SessionTokenRepositoryAdapter","repository","dataSource","getRepository","create","input","entity","id","session_id","kind","parent_id","refresh_token_id","ip_address","user_agent","consumed_at","revoked_at","expires_at","insert","created_at","Date","toISOString","findOneById","findOne","where","findBySessionId","sessionId","find","markRefreshConsumed","at","result","createQueryBuilder","update","set","andWhere","execute","affected","hasConsumedChild","parentId","count","getCount","revokeById","revokeBySessionId","rows","select","refs","map","row","length","ref","deleteExpired","before","delete"],"sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { SessionToken } from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { In, LessThan } from 'typeorm';\nimport { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';\nimport type {\n ISessionTokenRepository,\n SessionTokenCreateInput,\n SessionTokenRef,\n} from '../../../../../core/index.ts';\n\nexport class SessionTokenRepositoryAdapter implements ISessionTokenRepository {\n protected repository: Repository<SessionTokenEntity>;\n\n constructor(dataSource: DataSource) {\n this.repository = dataSource.getRepository(SessionTokenEntity);\n }\n\n async create(input: SessionTokenCreateInput): Promise<SessionToken> {\n const entity = this.repository.create({\n id: input.id,\n session_id: input.session_id,\n kind: input.kind,\n parent_id: input.parent_id ?? null,\n refresh_token_id: input.refresh_token_id ?? null,\n ip_address: input.ip_address,\n user_agent: input.user_agent,\n consumed_at: null,\n revoked_at: null,\n expires_at: input.expires_at,\n });\n\n await this.repository.insert(entity);\n\n // insert() does not hydrate @CreateDateColumn back onto the in-memory\n // entity (the DB fills created_at via its DEFAULT). Stamp it so the\n // returned object satisfies the SessionToken contract instead of\n // carrying an undefined created_at.\n entity.created_at = entity.created_at ?? new Date().toISOString();\n\n return entity;\n }\n\n async findOneById(id: string): Promise<SessionToken | null> {\n return this.repository.findOne({ where: { id } });\n }\n\n async findBySessionId(sessionId: string): Promise<SessionToken[]> {\n return this.repository.find({ where: { session_id: sessionId } });\n }\n\n async markRefreshConsumed(id: string, at: string): Promise<boolean> {\n const result = await this.repository.createQueryBuilder()\n .update(SessionTokenEntity)\n .set({ consumed_at: at })\n .where('id = :id', { id })\n .andWhere('kind = :kind', { kind: 'refresh' })\n .andWhere('consumed_at IS NULL')\n .andWhere('revoked_at IS NULL')\n .execute();\n\n return (result.affected ?? 0) > 0;\n }\n\n async hasConsumedChild(parentId: string): Promise<boolean> {\n const count = await this.repository.createQueryBuilder()\n .where('parent_id = :parentId', { parentId })\n .andWhere('consumed_at IS NOT NULL')\n .getCount();\n\n return count > 0;\n }\n\n async revokeById(id: string, at: string): Promise<void> {\n await this.repository.createQueryBuilder()\n .update(SessionTokenEntity)\n .set({ revoked_at: at })\n .where('id = :id', { id })\n .andWhere('revoked_at IS NULL')\n .execute();\n }\n\n async revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]> {\n const rows = await this.repository.find({\n where: { session_id: sessionId },\n select: ['id', 'expires_at'],\n });\n\n const refs: SessionTokenRef[] = rows.map((row) => ({\n id: row.id,\n expires_at: row.expires_at,\n }));\n if (refs.length > 0) {\n await this.repository.createQueryBuilder()\n .update(SessionTokenEntity)\n .set({ revoked_at: at })\n .where({ id: In(refs.map((ref) => ref.id)) })\n .andWhere('revoked_at IS NULL')\n .execute();\n }\n\n return refs;\n }\n\n async deleteExpired(before: string): Promise<number> {\n const result = await this.repository.delete({ expires_at: LessThan(before) });\n\n return result.affected ?? 0;\n }\n}\n"],"mappings":";;;;;;;AAiBA,IAAaG,gCAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcJ,kBAAAA;CAC/C;CAEA,MAAMK,OAAOC,OAAuD;EAChE,MAAMC,SAAS,KAAKL,WAAWG,OAAO;GAClCG,IAAIF,MAAME;GACVC,YAAYH,MAAMG;GAClBC,MAAMJ,MAAMI;GACZC,WAAWL,MAAMK,aAAa;GAC9BC,kBAAkBN,MAAMM,oBAAoB;GAC5CC,YAAYP,MAAMO;GAClBC,YAAYR,MAAMQ;GAClBC,aAAa;GACbC,YAAY;GACZC,YAAYX,MAAMW;EACtB,CAAA;EAEA,MAAM,KAAKf,WAAWgB,OAAOX,MAAAA;EAM7BA,OAAOY,aAAaZ,OAAOY,+BAAc,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAE/D,OAAOd;CACX;CAEA,MAAMe,YAAYd,IAA0C;EACxD,OAAO,KAAKN,WAAWqB,QAAQ,EAAEC,OAAO,EAAEhB,GAAG,EAAE,CAAA;CACnD;CAEA,MAAMiB,gBAAgBC,WAA4C;EAC9D,OAAO,KAAKxB,WAAWyB,KAAK,EAAEH,OAAO,EAAEf,YAAYiB,UAAU,EAAE,CAAA;CACnE;CAEA,MAAME,oBAAoBpB,IAAYqB,IAA8B;EAUhE,SAAQC,MATa,KAAK5B,WAAW6B,mBAAkB,CAAA,CAClDC,OAAOhC,kBAAAA,CAAAA,CACPiC,IAAI,EAAElB,aAAac,GAAG,CAAA,CAAA,CACtBL,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvB0B,SAAS,gBAAgB,EAAExB,MAAM,UAAU,CAAA,CAAA,CAC3CwB,SAAS,qBAAA,CAAA,CACTA,SAAS,oBAAA,CAAA,CACTC,QAAO,EAAA,CAEGC,YAAY,KAAK;CACpC;CAEA,MAAMC,iBAAiBC,UAAoC;EAMvD,OAAOC,MALa,KAAKrC,WAAW6B,mBAAkB,CAAA,CACjDP,MAAM,yBAAyB,EAAEc,SAAS,CAAA,CAAA,CAC1CJ,SAAS,yBAAA,CAAA,CACTM,SAAQ,IAEE;CACnB;CAEA,MAAMC,WAAWjC,IAAYqB,IAA2B;EACpD,MAAM,KAAK3B,WAAW6B,mBAAkB,CAAA,CACnCC,OAAOhC,kBAAAA,CAAAA,CACPiC,IAAI,EAAEjB,YAAYa,GAAG,CAAA,CAAA,CACrBL,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvB0B,SAAS,oBAAA,CAAA,CACTC,QAAO;CAChB;CAEA,MAAMO,kBAAkBhB,WAAmBG,IAAwC;EAM/E,MAAMgB,QAA0BF,MALb,KAAKzC,WAAWyB,KAAK;GACpCH,OAAO,EAAEf,YAAYiB,UAAU;GAC/BkB,QAAQ,CAAC,MAAM,YAAA;EACnB,CAAA,EAAA,CAEqCE,KAAKC,SAAS;GAC/CvC,IAAIuC,IAAIvC;GACRS,YAAY8B,IAAI9B;EACpB,EAAA;EACA,IAAI4B,KAAKG,SAAS,GACd,MAAM,KAAK9C,WAAW6B,mBAAkB,CAAA,CACnCC,OAAOhC,kBAAAA,CAAAA,CACPiC,IAAI,EAAEjB,YAAYa,GAAG,CAAA,CAAA,CACrBL,MAAM,EAAEhB,IAAIV,GAAG+C,KAAKC,KAAKG,QAAQA,IAAIzC,EAAE,CAAA,EAAG,CAAA,CAAA,CAC1C0B,SAAS,oBAAA,CAAA,CACTC,QAAO;EAGhB,OAAOU;CACX;CAEA,MAAMK,cAAcC,QAAiC;EAGjD,QAAOrB,MAFc,KAAK5B,WAAWkD,OAAO,EAAEnC,YAAYlB,SAASoD,MAAAA,EAAQ,CAAA,EAAA,CAE7Df,YAAY;CAC9B;AACJ"}

package/dist/app/modules/provisioning/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAsBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAYxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAMH,uBAAuB,EAW1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AASrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;~~cAgKjC~~,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAsBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAYxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAMH,uBAAuB,EAW1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AASrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cA+JjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}

package/dist/app/modules/provisioning/module.mjs CHANGED Viewed

@@ -109,7 +109,6 @@ var ProvisionerModule = class {
 		const roleSynchronizer = new RoleProvisioningSynchronizer({
 			repository: roleRepository,
 			permissionRepository,
-			policyRepository,
 			rolePermissionRepository: new RolePermissionRepositoryAdapter(container.resolve(RolePermissionEntity))
 		});
 		const clientSynchronizer = new ClientProvisioningSynchronizer({

package/dist/app/modules/provisioning/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RobotEntity","RobotPermissionEntity","RobotRoleEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RobotProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RobotPermissionRepositoryAdapter","RobotRepositoryAdapter","RobotRoleRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","LoggerInjectionKey","WebClientProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","robotSynchronizer","robotRepository","robotRoleRepository","robotPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","logger","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permission_id","id","save","create","permission_realm_id","realm_id","policy_id","policy_realm_id"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n Client,\n ClientPermission,\n ClientRole,\n PermissionPolicy,\n Realm,\n Robot,\n RobotPermission,\n RobotRole,\n Role,\n RolePermission,\n Scope,\n UserPermission,\n UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n ClientEntity,\n ClientPermissionEntity,\n ClientRoleEntity,\n PermissionEntity,\n RealmEntity,\n RobotEntity,\n RobotPermissionEntity,\n RobotRoleEntity,\n RoleEntity,\n RolePermissionEntity,\n ScopeEntity,\n UserPermissionEntity,\n UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n PermissionPolicyEntity,\n PolicyRepository,\n UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n ClientProvisioningSynchronizer,\n GraphProvisioningSynchronizer,\n PermissionProvisioningSynchronizer,\n PolicyProvisioningSynchronizer,\n RealmProvisioningSynchronizer,\n RobotProvisioningSynchronizer,\n RoleProvisioningSynchronizer,\n ScopeProvisioningSynchronizer,\n UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n ClientPermissionRepositoryAdapter,\n ClientRepositoryAdapter,\n ClientRoleRepositoryAdapter,\n PermissionPolicyRepositoryAdapter,\n PermissionRepositoryAdapter,\n PolicyRepositoryAdapter,\n RealmRepositoryAdapter,\n RobotPermissionRepositoryAdapter,\n RobotRepositoryAdapter,\n RobotRoleRepositoryAdapter,\n RolePermissionRepositoryAdapter,\n RoleRepositoryAdapter,\n ScopeRepositoryAdapter,\n UserPermissionRepositoryAdapter,\n UserRepositoryAdapter,\n UserRoleRepositoryAdapter,\n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n protected sources: IProvisioningSource[];\n\n constructor(sources: IProvisioningSource[] = []) {\n this.name = ModuleName.PROVISIONING;\n this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n this.sources = sources;\n }\n\n async setup(container: IContainer): Promise<void> {\n const sources = [...this.sources];\n\n const config = container.resolve(ConfigInjectionKey);\n const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n if (fs.existsSync(provisioningDir)) {\n sources.push(new FileProvisioningSource({ cwd: provisioningDir }));\n }\n\n const composite = new CompositeProvisioningSource(sources);\n const data = await composite.load(container);\n\n const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n const permissionRepository = new PermissionRepositoryAdapter({\n repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n realmRepository,\n });\n\n const policyRepository = new PolicyRepositoryAdapter({\n repository: new PolicyRepository(dataSource),\n realmRepository,\n });\n\n // ---------------------------------------------------------------\n // Synchronize all entities (policies → permissions → roles → ...)\n // ---------------------------------------------------------------\n\n const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n );\n\n const policySynchronizer = new PolicyProvisioningSynchronizer({\n repository: policyRepository,\n permissionPolicyRepository,\n });\n\n const roleRepository = new RoleRepositoryAdapter({\n repository: container.resolve<Repository<Role>>(RoleEntity),\n realmRepository,\n });\n const clientRepository = new ClientRepositoryAdapter({\n repository: container.resolve<Repository<Client>>(ClientEntity),\n realmRepository,\n });\n\n const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n repository: permissionRepository,\n policyRepository,\n permissionPolicyRepository,\n });\n\n const roleSynchronizer = new RoleProvisioningSynchronizer({\n repository: roleRepository,\n permissionRepository,\n policyRepository,\n rolePermissionRepository: new RolePermissionRepositoryAdapter(\n container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n ),\n });\n\n const clientSynchronizer = new ClientProvisioningSynchronizer({\n clientRepository,\n clientRoleRepository: new ClientRoleRepositoryAdapter(\n container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n ),\n clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n ),\n\n roleRepository,\n permissionRepository,\n\n roleSynchronizer,\n permissionSynchronizer,\n });\n\n const userSynchronizer = new UserProvisioningSynchronizer({\n userRepository: new UserRepositoryAdapter({\n repository: new UserRepository(dataSource),\n realmRepository,\n }),\n userRoleRepository: new UserRoleRepositoryAdapter(\n container.resolve<Repository<UserRole>>(UserRoleEntity),\n ),\n userPermissionRepository: new UserPermissionRepositoryAdapter(\n container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n ),\n\n clientRepository,\n roleRepository,\n permissionRepository,\n });\n\n const robotSynchronizer = new RobotProvisioningSynchronizer({\n robotRepository: new RobotRepositoryAdapter({\n repository: container.resolve<Repository<Robot>>(RobotEntity),\n realmRepository,\n }),\n robotRoleRepository: new RobotRoleRepositoryAdapter(\n container.resolve<Repository<RobotRole>>(RobotRoleEntity),\n ),\n robotPermissionRepository: new RobotPermissionRepositoryAdapter(\n container.resolve<Repository<RobotPermission>>(RobotPermissionEntity),\n ),\n\n roleRepository,\n permissionRepository,\n });\n\n const scopeRepository = new ScopeRepositoryAdapter({\n repository: container.resolve<Repository<Scope>>(ScopeEntity),\n realmRepository,\n });\n\n const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n const realmSynchronizer = new RealmProvisioningSynchronizer({\n repository: new RealmRepositoryAdapter(realmRepository),\n\n clientSynchronizer,\n roleSynchronizer,\n permissionSynchronizer,\n userSynchronizer,\n robotSynchronizer,\n scopeSynchronizer,\n });\n\n const rootSynchronizer = new GraphProvisioningSynchronizer({\n policySynchronizer,\n permissionSynchronizer,\n roleSynchronizer,\n realmSynchronizer,\n scopeSynchronizer,\n });\n\n await rootSynchronizer.synchronize(data);\n\n // ---------------------------------------------------------------\n // Per-realm public `web` client. Single provisioning mechanism:\n // list every realm (incl. pre-existing) and upsert its web client.\n // Idempotent; guarded on built_in inside the provisioner.\n // ---------------------------------------------------------------\n const webClientProvisioner = new WebClientProvisioner({\n clientRepository,\n appOrigins: getAppOrigins(config),\n logger: container.resolve(LoggerInjectionKey),\n });\n\n const realms = await realmRepository.find();\n for (const realm of realms) {\n await webClientProvisioner.ensureForRealm(realm);\n }\n\n if (config.permissionsDefaultPolicyAssignment) {\n await this.assignDefaultPolicy(dataSource, policyRepository);\n }\n }\n\n protected async assignDefaultPolicy(\n dataSource: DataSource,\n policyRepository: PolicyRepositoryAdapter,\n ): Promise<void> {\n const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n if (!defaultPolicy) {\n return;\n }\n\n const permissionRepo = dataSource.getRepository(PermissionEntity);\n const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n const permissions = await permissionRepo.find();\n for (const permission of permissions) {\n const hasAnyPolicy = await junctionRepo.findOneBy({ permission_id: permission.id });\n\n if (!hasAnyPolicy) {\n await junctionRepo.save(junctionRepo.create({\n permission_id: permission.id,\n permission_realm_id: permission.realm_id,\n policy_id: defaultPolicy.id,\n policy_realm_id: defaultPolicy.realm_id,\n }));\n }\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoFA,IAAaoD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOV,WAAWa;EACvB,KAAKF,eAAe,CAACX,WAAWc,QAAQd,WAAWe,QAAAA;EACnD,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAA,GAAI,KAAKA,OAAAA;EAEzB,MAAMM,SAASD,UAAUE,QAAQhB,kBAAAA;EACjC,MAAMiB,kBAAkBlB,KAAKmB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIrB,GAAGsB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB,EAAEiB,KAAKL,gBAAgB,CAAA,CAAA;EAInE,MAAMO,OAAO,MAAMD,IADGnB,4BAA4BK,OAC/Bc,CAAAA,CAAUE,KAAKX,SAAAA;EAElC,MAAMY,aAAaZ,UAAUE,QAAQpB,qBAAqB+B,UAAU;EACpE,MAAMC,kBAAkBd,UAAUE,QAA2B1D,WAAAA;EAE7D,MAAMuE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYhB,UAAUE,QAAsC3D,gBAAAA;GAC5DuE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI7D,iBAAiByD,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC+B,UAAUE,QAAsChD,sBAAAA,CAAAA;EAGpD,MAAMiE,qBAAqB,IAAI3D,+BAA+B;GAC1DwD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI3C,sBAAsB;GAC7CuC,YAAYhB,UAAUE,QAA0BtD,UAAAA;GAChDkE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAItD,wBAAwB;GACjDiD,YAAYhB,UAAUE,QAA4B9D,YAAAA;GAClD0E;EACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI/D,mCAAmC;GAClEyD,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAI5D,6BAA6B;GACtDqD,YAAYI;GACZL;GACAE;GACAO,0BAA0B,IAAIhD,gCAC1BwB,UAAUE,QAAoCrD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM4E,qBAAqB,IAAIpE,+BAA+B;GAC1DgE;GACAK,sBAAsB,IAAI1D,4BACtBgC,UAAUE,QAAgC5D,gBAAAA,CAAAA;GAE9CqF,4BAA4B,IAAI7D,kCAC5BkC,UAAUE,QAAsC7D,sBAAAA,CAAAA;GAGpD+E;GACAL;GAEAQ;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAI/D,6BAA6B;GACtDgE,gBAAgB,IAAIjD,sBAAsB;IACtCoC,YAAY,IAAI5D,eAAewD,UAAAA;IAC/BE;GACJ,CAAA;GACAgB,oBAAoB,IAAIjD,0BACpBmB,UAAUE,QAA8BlD,cAAAA,CAAAA;GAE5C+E,0BAA0B,IAAIpD,gCAC1BqB,UAAUE,QAAoCnD,oBAAAA,CAAAA;GAGlDsE;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMiB,oBAAoB,IAAItE,8BAA8B;GACxDuE,iBAAiB,IAAI3D,uBAAuB;IACxC0C,YAAYhB,UAAUE,QAA2BzD,WAAAA;IACjDqE;GACJ,CAAA;GACAoB,qBAAqB,IAAI3D,2BACrByB,UAAUE,QAA+BvD,eAAAA,CAAAA;GAE7CwF,2BAA2B,IAAI9D,iCAC3B2B,UAAUE,QAAqCxD,qBAAAA,CAAAA;GAGnD0E;GACAL;EACJ,CAAA;EAOA,MAAMsB,oBAAoB,IAAIzE,8BAA8B,EAAEoD,YAAYoB,IAL9C1D,uBAAuB;GAC/CsC,YAAYhB,UAAUE,QAA2BpD,WAAAA;GACjDgE;EACJ,CAE0EsB,EAAgB,CAAA;EAqB1F,MAAMG,IARuBjF,8BAA8B;GACvD6D;GACAG;GACAC;GACAe,mBAAAA,IAf0B7E,8BAA8B;IACxDuD,YAAY,IAAI5C,uBAAuB0C,eAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAI;IACAK;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY9B,IAAAA;EAOnC,MAAM+B,uBAAuB,IAAIpD,qBAAqB;GAClDgC;GACAqB,YAAYvD,cAAcc,MAAAA;GAC1B0C,QAAQ3C,UAAUE,QAAQd,kBAAAA;EAC9B,CAAA;EAEA,MAAMwD,SAAS,MAAM9B,gBAAgB+B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAChB,MAAMH,qBAAqBM,eAAeD,KAAAA;EAG9C,IAAI7C,OAAO+C,oCACP,MAAM,KAAKC,oBAAoBrC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgBgC,oBACZrC,YACAK,kBACa;EACb,MAAMiC,gBAAgB,MAAMjC,iBAAiBkC,cAAclG,iBAAiBmG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBzC,WAAW0C,cAAc/G,gBAAAA;EAChD,MAAMgH,eAAe3C,WAAW0C,cAAcpG,sBAAAA;EAE9C,MAAMsG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,eAAeH,WAAWI,GAAG,CAAA,GAG7E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,eAAeH,WAAWI;GAC1BG,qBAAqBP,WAAWQ;GAChCC,WAAWhB,cAAcW;GACzBM,iBAAiBjB,cAAce;EACnC,CAAA,CAAA;CAGZ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RobotEntity","RobotPermissionEntity","RobotRoleEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RobotProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RobotPermissionRepositoryAdapter","RobotRepositoryAdapter","RobotRoleRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","LoggerInjectionKey","WebClientProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","robotSynchronizer","robotRepository","robotRoleRepository","robotPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","logger","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permission_id","id","save","create","permission_realm_id","realm_id","policy_id","policy_realm_id"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n Client,\n ClientPermission,\n ClientRole,\n PermissionPolicy,\n Realm,\n Robot,\n RobotPermission,\n RobotRole,\n Role,\n RolePermission,\n Scope,\n UserPermission,\n UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n ClientEntity,\n ClientPermissionEntity,\n ClientRoleEntity,\n PermissionEntity,\n RealmEntity,\n RobotEntity,\n RobotPermissionEntity,\n RobotRoleEntity,\n RoleEntity,\n RolePermissionEntity,\n ScopeEntity,\n UserPermissionEntity,\n UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n PermissionPolicyEntity,\n PolicyRepository,\n UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n ClientProvisioningSynchronizer,\n GraphProvisioningSynchronizer,\n PermissionProvisioningSynchronizer,\n PolicyProvisioningSynchronizer,\n RealmProvisioningSynchronizer,\n RobotProvisioningSynchronizer,\n RoleProvisioningSynchronizer,\n ScopeProvisioningSynchronizer,\n UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n ClientPermissionRepositoryAdapter,\n ClientRepositoryAdapter,\n ClientRoleRepositoryAdapter,\n PermissionPolicyRepositoryAdapter,\n PermissionRepositoryAdapter,\n PolicyRepositoryAdapter,\n RealmRepositoryAdapter,\n RobotPermissionRepositoryAdapter,\n RobotRepositoryAdapter,\n RobotRoleRepositoryAdapter,\n RolePermissionRepositoryAdapter,\n RoleRepositoryAdapter,\n ScopeRepositoryAdapter,\n UserPermissionRepositoryAdapter,\n UserRepositoryAdapter,\n UserRoleRepositoryAdapter,\n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n protected sources: IProvisioningSource[];\n\n constructor(sources: IProvisioningSource[] = []) {\n this.name = ModuleName.PROVISIONING;\n this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n this.sources = sources;\n }\n\n async setup(container: IContainer): Promise<void> {\n const sources = [...this.sources];\n\n const config = container.resolve(ConfigInjectionKey);\n const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n if (fs.existsSync(provisioningDir)) {\n sources.push(new FileProvisioningSource({ cwd: provisioningDir }));\n }\n\n const composite = new CompositeProvisioningSource(sources);\n const data = await composite.load(container);\n\n const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n const permissionRepository = new PermissionRepositoryAdapter({\n repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n realmRepository,\n });\n\n const policyRepository = new PolicyRepositoryAdapter({\n repository: new PolicyRepository(dataSource),\n realmRepository,\n });\n\n // ---------------------------------------------------------------\n // Synchronize all entities (policies → permissions → roles → ...)\n // ---------------------------------------------------------------\n\n const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n );\n\n const policySynchronizer = new PolicyProvisioningSynchronizer({\n repository: policyRepository,\n permissionPolicyRepository,\n });\n\n const roleRepository = new RoleRepositoryAdapter({\n repository: container.resolve<Repository<Role>>(RoleEntity),\n realmRepository,\n });\n const clientRepository = new ClientRepositoryAdapter({\n repository: container.resolve<Repository<Client>>(ClientEntity),\n realmRepository,\n });\n\n const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n repository: permissionRepository,\n policyRepository,\n permissionPolicyRepository,\n });\n\n const roleSynchronizer = new RoleProvisioningSynchronizer({\n repository: roleRepository,\n permissionRepository,\n rolePermissionRepository: new RolePermissionRepositoryAdapter(\n container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n ),\n });\n\n const clientSynchronizer = new ClientProvisioningSynchronizer({\n clientRepository,\n clientRoleRepository: new ClientRoleRepositoryAdapter(\n container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n ),\n clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n ),\n\n roleRepository,\n permissionRepository,\n\n roleSynchronizer,\n permissionSynchronizer,\n });\n\n const userSynchronizer = new UserProvisioningSynchronizer({\n userRepository: new UserRepositoryAdapter({\n repository: new UserRepository(dataSource),\n realmRepository,\n }),\n userRoleRepository: new UserRoleRepositoryAdapter(\n container.resolve<Repository<UserRole>>(UserRoleEntity),\n ),\n userPermissionRepository: new UserPermissionRepositoryAdapter(\n container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n ),\n\n clientRepository,\n roleRepository,\n permissionRepository,\n });\n\n const robotSynchronizer = new RobotProvisioningSynchronizer({\n robotRepository: new RobotRepositoryAdapter({\n repository: container.resolve<Repository<Robot>>(RobotEntity),\n realmRepository,\n }),\n robotRoleRepository: new RobotRoleRepositoryAdapter(\n container.resolve<Repository<RobotRole>>(RobotRoleEntity),\n ),\n robotPermissionRepository: new RobotPermissionRepositoryAdapter(\n container.resolve<Repository<RobotPermission>>(RobotPermissionEntity),\n ),\n\n roleRepository,\n permissionRepository,\n });\n\n const scopeRepository = new ScopeRepositoryAdapter({\n repository: container.resolve<Repository<Scope>>(ScopeEntity),\n realmRepository,\n });\n\n const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n const realmSynchronizer = new RealmProvisioningSynchronizer({\n repository: new RealmRepositoryAdapter(realmRepository),\n\n clientSynchronizer,\n roleSynchronizer,\n permissionSynchronizer,\n userSynchronizer,\n robotSynchronizer,\n scopeSynchronizer,\n });\n\n const rootSynchronizer = new GraphProvisioningSynchronizer({\n policySynchronizer,\n permissionSynchronizer,\n roleSynchronizer,\n realmSynchronizer,\n scopeSynchronizer,\n });\n\n await rootSynchronizer.synchronize(data);\n\n // ---------------------------------------------------------------\n // Per-realm public `web` client. Single provisioning mechanism:\n // list every realm (incl. pre-existing) and upsert its web client.\n // Idempotent; guarded on built_in inside the provisioner.\n // ---------------------------------------------------------------\n const webClientProvisioner = new WebClientProvisioner({\n clientRepository,\n appOrigins: getAppOrigins(config),\n logger: container.resolve(LoggerInjectionKey),\n });\n\n const realms = await realmRepository.find();\n for (const realm of realms) {\n await webClientProvisioner.ensureForRealm(realm);\n }\n\n if (config.permissionsDefaultPolicyAssignment) {\n await this.assignDefaultPolicy(dataSource, policyRepository);\n }\n }\n\n protected async assignDefaultPolicy(\n dataSource: DataSource,\n policyRepository: PolicyRepositoryAdapter,\n ): Promise<void> {\n const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n if (!defaultPolicy) {\n return;\n }\n\n const permissionRepo = dataSource.getRepository(PermissionEntity);\n const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n const permissions = await permissionRepo.find();\n for (const permission of permissions) {\n const hasAnyPolicy = await junctionRepo.findOneBy({ permission_id: permission.id });\n\n if (!hasAnyPolicy) {\n await junctionRepo.save(junctionRepo.create({\n permission_id: permission.id,\n permission_realm_id: permission.realm_id,\n policy_id: defaultPolicy.id,\n policy_realm_id: defaultPolicy.realm_id,\n }));\n }\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoFA,IAAaoD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOV,WAAWa;EACvB,KAAKF,eAAe,CAACX,WAAWc,QAAQd,WAAWe,QAAAA;EACnD,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAA,GAAI,KAAKA,OAAAA;EAEzB,MAAMM,SAASD,UAAUE,QAAQhB,kBAAAA;EACjC,MAAMiB,kBAAkBlB,KAAKmB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIrB,GAAGsB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB,EAAEiB,KAAKL,gBAAgB,CAAA,CAAA;EAInE,MAAMO,OAAO,MAAMD,IADGnB,4BAA4BK,OAC/Bc,CAAAA,CAAUE,KAAKX,SAAAA;EAElC,MAAMY,aAAaZ,UAAUE,QAAQpB,qBAAqB+B,UAAU;EACpE,MAAMC,kBAAkBd,UAAUE,QAA2B1D,WAAAA;EAE7D,MAAMuE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYhB,UAAUE,QAAsC3D,gBAAAA;GAC5DuE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI7D,iBAAiByD,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC+B,UAAUE,QAAsChD,sBAAAA,CAAAA;EAGpD,MAAMiE,qBAAqB,IAAI3D,+BAA+B;GAC1DwD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI3C,sBAAsB;GAC7CuC,YAAYhB,UAAUE,QAA0BtD,UAAAA;GAChDkE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAItD,wBAAwB;GACjDiD,YAAYhB,UAAUE,QAA4B9D,YAAAA;GAClD0E;EACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI/D,mCAAmC;GAClEyD,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAI5D,6BAA6B;GACtDqD,YAAYI;GACZL;GACAS,0BAA0B,IAAIhD,gCAC1BwB,UAAUE,QAAoCrD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM4E,qBAAqB,IAAIpE,+BAA+B;GAC1DgE;GACAK,sBAAsB,IAAI1D,4BACtBgC,UAAUE,QAAgC5D,gBAAAA,CAAAA;GAE9CqF,4BAA4B,IAAI7D,kCAC5BkC,UAAUE,QAAsC7D,sBAAAA,CAAAA;GAGpD+E;GACAL;GAEAQ;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAI/D,6BAA6B;GACtDgE,gBAAgB,IAAIjD,sBAAsB;IACtCoC,YAAY,IAAI5D,eAAewD,UAAAA;IAC/BE;GACJ,CAAA;GACAgB,oBAAoB,IAAIjD,0BACpBmB,UAAUE,QAA8BlD,cAAAA,CAAAA;GAE5C+E,0BAA0B,IAAIpD,gCAC1BqB,UAAUE,QAAoCnD,oBAAAA,CAAAA;GAGlDsE;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMiB,oBAAoB,IAAItE,8BAA8B;GACxDuE,iBAAiB,IAAI3D,uBAAuB;IACxC0C,YAAYhB,UAAUE,QAA2BzD,WAAAA;IACjDqE;GACJ,CAAA;GACAoB,qBAAqB,IAAI3D,2BACrByB,UAAUE,QAA+BvD,eAAAA,CAAAA;GAE7CwF,2BAA2B,IAAI9D,iCAC3B2B,UAAUE,QAAqCxD,qBAAAA,CAAAA;GAGnD0E;GACAL;EACJ,CAAA;EAOA,MAAMsB,oBAAoB,IAAIzE,8BAA8B,EAAEoD,YAAYoB,IAL9C1D,uBAAuB;GAC/CsC,YAAYhB,UAAUE,QAA2BpD,WAAAA;GACjDgE;EACJ,CAE0EsB,EAAgB,CAAA;EAqB1F,MAAMG,IARuBjF,8BAA8B;GACvD6D;GACAG;GACAC;GACAe,mBAAAA,IAf0B7E,8BAA8B;IACxDuD,YAAY,IAAI5C,uBAAuB0C,eAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAI;IACAK;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY9B,IAAAA;EAOnC,MAAM+B,uBAAuB,IAAIpD,qBAAqB;GAClDgC;GACAqB,YAAYvD,cAAcc,MAAAA;GAC1B0C,QAAQ3C,UAAUE,QAAQd,kBAAAA;EAC9B,CAAA;EAEA,MAAMwD,SAAS,MAAM9B,gBAAgB+B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAChB,MAAMH,qBAAqBM,eAAeD,KAAAA;EAG9C,IAAI7C,OAAO+C,oCACP,MAAM,KAAKC,oBAAoBrC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgBgC,oBACZrC,YACAK,kBACa;EACb,MAAMiC,gBAAgB,MAAMjC,iBAAiBkC,cAAclG,iBAAiBmG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBzC,WAAW0C,cAAc/G,gBAAAA;EAChD,MAAMgH,eAAe3C,WAAW0C,cAAcpG,sBAAAA;EAE9C,MAAMsG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,eAAeH,WAAWI,GAAG,CAAA,GAG7E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,eAAeH,WAAWI;GAC1BG,qBAAqBP,WAAWQ;GAChCC,WAAWhB,cAAcW;GACzBM,iBAAiBjB,cAAce;EACnC,CAAA,CAAA;CAGZ;AACJ"}

package/dist/app/modules/provisioning/sources/default/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAMxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;~~IAuI3C~~,gBAAgB,IAAI,4BAA4B,EAAE;IA6BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;~~IA4DhC~~,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IA8F/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAMxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IA6F3C,gBAAgB,IAAI,4BAA4B,EAAE;IA6BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IAoEhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IA8F/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}

package/dist/app/modules/provisioning/sources/default/module.mjs CHANGED Viewed

@@ -11,7 +11,7 @@ import { ConfigInjectionKey } from "../../../config/constants.mjs";
 import "../../../config/index.mjs";
 import { DecisionStrategy } from "@authup/kit";
 import { PermissionName, REALM_MASTER_NAME, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME, ScopeName, buildUserFakeEmail } from "@authup/core-kit";
-import { BuiltInPolicyType, SystemPolicyName } from "@authup/access";
+import { BuiltInPolicyType, RealmScope, SystemPolicyName } from "@authup/access";
 //#region src/app/modules/provisioning/sources/default/module.ts
 var DefaultProvisioningSource = class {
 	buildPolicies() {
@@ -24,62 +24,17 @@ var DefaultProvisioningSource = class {
 					realm_id: null
 				},
 				extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },
-				children: [
-					{ attributes: {
-						name: SystemPolicyName.IDENTITY,
-						type: BuiltInPolicyType.IDENTITY,
-						built_in: true,
-						realm_id: null
-					} },
-					{ attributes: {
-						name: SystemPolicyName.PERMISSION_BINDING,
-						type: BuiltInPolicyType.PERMISSION_BINDING,
-						built_in: true,
-						realm_id: null
-					} },
-					{
-						attributes: {
-							name: SystemPolicyName.REALM_MATCH,
-							type: BuiltInPolicyType.REALM_MATCH,
-							built_in: true,
-							realm_id: null
-						},
-						extraAttributes: {
-							attribute_name: ["realm_id"],
-							attribute_name_strict: false,
-							identity_master_match_all: false,
-							attribute_null_match_all: true
-						}
-					}
-				]
-			},
-			{
-				attributes: {
-					name: SystemPolicyName.REALM_BOUND,
-					type: BuiltInPolicyType.REALM_MATCH,
+				children: [{ attributes: {
+					name: SystemPolicyName.IDENTITY,
+					type: BuiltInPolicyType.IDENTITY,
 					built_in: true,
 					realm_id: null
-				},
-				extraAttributes: {
-					attribute_name: ["realm_id"],
-					attribute_name_strict: false,
-					attribute_null_match_all: false,
-					identity_master_match_all: false
-				}
-			},
-			{
-				attributes: {
-					name: SystemPolicyName.REALM_OR_GLOBAL,
-					type: BuiltInPolicyType.REALM_MATCH,
+				} }, { attributes: {
+					name: SystemPolicyName.PERMISSION_BINDING,
+					type: BuiltInPolicyType.PERMISSION_BINDING,
 					built_in: true,
 					realm_id: null
-				},
-				extraAttributes: {
-					attribute_name: ["realm_id"],
-					attribute_name_strict: false,
-					attribute_null_match_all: true,
-					identity_master_match_all: false
-				}
+				} }]
 			},
 			{
 				attributes: {
@@ -173,7 +128,10 @@ var DefaultProvisioningSource = class {
 				name: ROLE_ADMIN_NAME,
 				built_in: true
 			},
-			relations: { globalPermissions: ["*"] }
+			relations: {
+				globalPermissions: ["*"],
+				globalPermissionsRealmScope: RealmScope.ANY
+			}
 		}, {
 			strategy: {
 				type: ProvisioningEntityStrategyType.MERGE,
@@ -190,8 +148,8 @@ var DefaultProvisioningSource = class {
 					PermissionName.REALM_UPDATE,
 					PermissionName.REALM_DELETE
 				],
-				globalPermissionsPolicyName: SystemPolicyName.REALM_OR_GLOBAL,
-				globalPermissionsPolicyOverrides: { [SystemPolicyName.REALM_BOUND]: [
+				globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,
+				globalPermissionsRealmScopeOverrides: { [RealmScope.OWN]: [
 					PermissionName.CLIENT_CREATE,
 					PermissionName.CLIENT_UPDATE,
 					PermissionName.CLIENT_DELETE,
@@ -210,6 +168,7 @@ var DefaultProvisioningSource = class {
 					PermissionName.SCOPE_CREATE,
 					PermissionName.SCOPE_UPDATE,
 					PermissionName.SCOPE_DELETE,
+					PermissionName.SESSION_DELETE,
 					PermissionName.USER_CREATE,
 					PermissionName.USER_UPDATE,
 					PermissionName.USER_DELETE

package/dist/app/modules/provisioning/sources/default/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","SystemPolicyName","DecisionStrategy","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","RobotCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","built_in","realm_id","extraAttributes","decision_strategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","REALM_MATCH","attribute_name","attribute_name_strict","identity_master_match_all","attribute_null_match_all","REALM_BOUND","REALM_OR_GLOBAL","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","ROBOT_NAMES_SELF_MANAGE","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","ROBOT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","globalPermissionsPolicyName","globalPermissionsPolicyOverrides","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","is_confidential","secret","clientSystemSecret","secret_hashed","clientSystemEnabled","robotCredentialsService","robotStrategy","robotAdminSecretReset","robots","robotAdminSecret","robotAdminEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n Client, \n Permission, \n Robot, \n Role, \n Scope, \n User,\n} from '@authup/core-kit';\nimport {\n PermissionName, \n REALM_MASTER_NAME, \n ROLE_ADMIN_NAME, \n ROLE_REALM_ADMIN_NAME, \n ScopeName, \n buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n ClientCredentialsService,\n RobotCredentialsService,\n UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n buildPolicies(): PolicyProvisioningEntity[] {\n return [\n {\n attributes: {\n name: SystemPolicyName.DEFAULT,\n type: BuiltInPolicyType.COMPOSITE,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },\n children: [\n {\n attributes: {\n name: SystemPolicyName.IDENTITY,\n type: BuiltInPolicyType.IDENTITY,\n built_in: true,\n realm_id: null,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.PERMISSION_BINDING,\n type: BuiltInPolicyType.PERMISSION_BINDING,\n built_in: true,\n realm_id: null,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.REALM_MATCH,\n type: BuiltInPolicyType.REALM_MATCH,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n attribute_name: ['realm_id'],\n attribute_name_strict: false,\n identity_master_match_all: false,\n attribute_null_match_all: true,\n },\n },\n ],\n },\n {\n attributes: {\n name: SystemPolicyName.REALM_BOUND,\n type: BuiltInPolicyType.REALM_MATCH,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n attribute_name: ['realm_id'],\n attribute_name_strict: false,\n attribute_null_match_all: false,\n identity_master_match_all: false,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.REALM_OR_GLOBAL,\n type: BuiltInPolicyType.REALM_MATCH,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n attribute_name: ['realm_id'],\n attribute_name_strict: false,\n attribute_null_match_all: true,\n identity_master_match_all: false,\n },\n },\n // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n // Each `names` entry is what self-edit must REJECT; everything else\n // is permitted. New columns added to the entity are self-editable\n // by default — extend the denylist when adding admin-only state.\n {\n attributes: {\n name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n // FK + lifecycle\n 'active',\n 'realm_id',\n // Security-critical: a self-edit must not change the\n // client's confidentiality (toggling this clears the\n // secret) or downgrade the secret-storage format\n // (which would persist the secret in plaintext).\n 'is_confidential',\n 'secret_hashed',\n 'secret_encrypted',\n ],\n },\n },\n {\n attributes: {\n name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n 'active',\n 'realm_id',\n 'user_id',\n ],\n },\n },\n {\n attributes: {\n name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n 'active',\n 'name_locked',\n 'status',\n 'status_message',\n 'realm_id',\n ],\n },\n },\n ];\n }\n\n buildPermissions(): PermissionProvisioningEntity[] {\n const policiesByPermission: Partial<Record<string, string[]>> = {\n [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n [PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],\n [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n };\n\n return Object.values(PermissionName)\n .map((name) => {\n const entity: PermissionProvisioningEntity = {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Permission)[],\n },\n attributes: {\n name,\n built_in: true,\n },\n };\n\n const policies = policiesByPermission[name];\n if (policies) {\n entity.relations = { policies };\n }\n\n return entity;\n });\n }\n\n buildScopes(): ScopeProvisioningEntity[] {\n return Object.values(ScopeName)\n .map((name) => ({\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Scope)[],\n },\n attributes: {\n name,\n built_in: true,\n },\n }));\n }\n\n buildRoles(): RoleProvisioningEntity[] {\n return [\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_ADMIN_NAME,\n built_in: true,\n },\n relations: { globalPermissions: [''] },\n },\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_REALM_ADMIN_NAME,\n built_in: true,\n },\n relations: {\n globalPermissions: ['*'],\n globalPermissionsExclude: [\n PermissionName.REALM_CREATE,\n PermissionName.REALM_UPDATE,\n PermissionName.REALM_DELETE,\n ],\n globalPermissionsPolicyName: SystemPolicyName.REALM_OR_GLOBAL,\n globalPermissionsPolicyOverrides: {\n [SystemPolicyName.REALM_BOUND]: [\n PermissionName.CLIENT_CREATE,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n PermissionName.IDENTITY_PROVIDER_CREATE,\n PermissionName.IDENTITY_PROVIDER_UPDATE,\n PermissionName.IDENTITY_PROVIDER_DELETE,\n PermissionName.PERMISSION_CREATE,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n PermissionName.ROBOT_CREATE,\n PermissionName.ROBOT_UPDATE,\n PermissionName.ROBOT_DELETE,\n PermissionName.ROLE_CREATE,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n PermissionName.SCOPE_CREATE,\n PermissionName.SCOPE_UPDATE,\n PermissionName.SCOPE_DELETE,\n PermissionName.USER_CREATE,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ],\n },\n },\n },\n ];\n }\n\n async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n const masterRealm : RealmProvisioningEntity = {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'],\n },\n attributes: {\n name: REALM_MASTER_NAME,\n built_in: true,\n },\n relations: {},\n };\n\n const userCredentialsService = new UserCredentialsService();\n\n let userStrategy : ProvisioningEntityStrategy<User> \| undefined;\n if (config.userAdminPasswordReset) {\n userStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['password'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.users = [\n {\n strategy: userStrategy,\n attributes: {\n name: 'admin',\n password: await userCredentialsService.protect(config.userAdminPassword),\n email: buildUserFakeEmail('admin'),\n active: config.userAdminEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n const clientCredentialsService = new ClientCredentialsService();\n\n let clientStrategy : ProvisioningEntityStrategy<Client> \| undefined;\n if (config.clientSystemSecretReset) {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in', 'is_confidential', 'secret', 'secret_hashed', 'secret_encrypted'],\n };\n } else {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in', 'is_confidential'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.clients = [\n {\n strategy: clientStrategy,\n attributes: {\n built_in: true,\n is_confidential: true,\n name: 'system',\n secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),\n secret_hashed: false,\n active: config.clientSystemEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n const robotCredentialsService = new RobotCredentialsService();\n\n let robotStrategy : ProvisioningEntityStrategy<Robot> \| undefined;\n if (config.robotAdminSecretReset) {\n robotStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['secret'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.robots = [\n {\n strategy: robotStrategy,\n attributes: {\n name: 'system',\n secret: await robotCredentialsService.protect(config.robotAdminSecret),\n active: config.robotAdminEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n return [masterRealm];\n }\n\n async load(container: IContainer): Promise<RootProvisioningEntity> {\n const config = container.resolve(ConfigInjectionKey);\n\n return {\n policies: this.buildPolicies(),\n permissions: this.buildPermissions(),\n scopes: this.buildScopes(),\n roles: this.buildRoles(),\n realms: await this.buildRealms(config),\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2CA,IAAac,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMhB,iBAAiBiB;KACvBC,MAAMnB,kBAAkBoB;KACxBC,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EAAEC,mBAAmBtB,iBAAiBuB,UAAU;IACjEC,UAAU;KACN,EACIV,YAAY;MACRC,MAAMhB,iBAAiB0B;MACvBR,MAAMnB,kBAAkB2B;MACxBN,UAAU;MACVC,UAAU;KACd,EACJ;KACA,EACIN,YAAY;MACRC,MAAMhB,iBAAiB2B;MACvBT,MAAMnB,kBAAkB4B;MACxBP,UAAU;MACVC,UAAU;KACd,EACJ;KACA;MACIN,YAAY;OACRC,MAAMhB,iBAAiB4B;OACvBV,MAAMnB,kBAAkB6B;OACxBR,UAAU;OACVC,UAAU;MACd;MACAC,iBAAiB;OACbO,gBAAgB,CAAC,UAAA;OACjBC,uBAAuB;OACvBC,2BAA2B;OAC3BC,0BAA0B;MAC9B;KACJ;;GAER;GACA;IACIjB,YAAY;KACRC,MAAMhB,iBAAiBiC;KACvBf,MAAMnB,kBAAkB6B;KACxBR,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB;KACbO,gBAAgB,CAAC,UAAA;KACjBC,uBAAuB;KACvBE,0BAA0B;KAC1BD,2BAA2B;IAC/B;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMhB,iBAAiBkC;KACvBhB,MAAMnB,kBAAkB6B;KACxBR,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB;KACbO,gBAAgB,CAAC,UAAA;KACjBC,uBAAuB;KACvBE,0BAA0B;KAC1BD,2BAA2B;IAC/B;GACJ;GAKA;IACIhB,YAAY;KACRC,MAAMhB,iBAAiBmC;KACvBjB,MAAMnB,kBAAkBqC;KACxBC,QAAQ;KACRjB,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbgB,OAAO;KAEH;KACA;KAKA;KACA;KACA;MAER;GACJ;GACA;IACIvB,YAAY;KACRC,MAAMhB,iBAAiBuC;KACvBrB,MAAMnB,kBAAkBqC;KACxBC,QAAQ;KACRjB,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbgB,OAAO;KACH;KACA;KACA;MAER;GACJ;GACA;IACIvB,YAAY;KACRC,MAAMhB,iBAAiBwC;KACvBtB,MAAMnB,kBAAkBqC;KACxBC,QAAQ;KACRjB,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbgB,OAAO;KACH;KACA;KACA;KACA;KACA;MAER;GACJ;;CAER;CAEAG,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3DxC,eAAeyC,qBAAqB,CAAC3C,iBAAiBiB,SAASjB,iBAAiBmC,wBAAAA;IAChFjC,eAAe0C,oBAAoB,CAAC5C,iBAAiBiB,SAASjB,iBAAiBuC,uBAAAA;IAC/ErC,eAAe2C,mBAAmB,CAAC7C,iBAAiBiB,SAASjB,iBAAiBwC,sBAAAA;EACnF;EAEA,OAAOM,OAAOC,OAAO7C,cAAAA,CAAAA,CAChB8C,KAAKhC,SAAAA;GACF,MAAMiC,SAAuC;IACzCC,UAAU;KACNhC,MAAMN,+BAA+BuC;KACrCpC,YAAY,CAAC,UAAA;IACjB;IACAA,YAAY;KACRC;KACAI,UAAU;IACd;GACJ;GAEA,MAAMgC,WAAWV,qBAAqB1B;GACtC,IAAIoC,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAOzC,SAAAA,CAAAA,CAChB0C,KAAKhC,UAAU;GACZkC,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC;IACAI,UAAU;GACd;EACJ,EAAA;CACR;CAEAmC,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMZ;IACNgB,UAAU;GACd;GACAiC,WAAW,EAAEG,mBAAmB,CAAC,GAAA,EAAK;EAC1C,GACA;GACIN,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMX;IACNe,UAAU;GACd;GACAiC,WAAW;IACPG,mBAAmB,CAAC,GAAA;IACpBC,0BAA0B;KACtBvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;;IAEnBC,6BAA6B7D,iBAAiBkC;IAC9C4B,kCAAkC,GAC7B9D,iBAAiBiC,cAAc;KAC5B/B,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;KACf/E,eAAegF;KACfhF,eAAeiF;MAEvB;GACJ;EACJ,CAAA;CAER;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1CpC,UAAU;IACNhC,MAAMN,+BAA+BuC;IACrCpC,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMb;IACNiB,UAAU;GACd;GACAiC,WAAW,CAAC;EAChB;EAEA,MAAMkC,yBAAyB,IAAI7E,uBAAAA;EAEnC,IAAI8E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXtE,MAAMN,+BAA+BuC;GACrCpC,YAAY,CAAC,UAAA;EACjB;EAGJuE,YAAYjC,YAAYiC,YAAYjC,aAAa,CAAC;EAClDiC,YAAYjC,UAAUqC,QAAQ,CAC1B;GACIxC,UAAUsC;GACVzE,YAAY;IACRC,MAAM;IACN2E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOvF,mBAAmB,OAAA;IAC1BwF,QAAQV,OAAOW;GACnB;GACA3C,WAAW,EAAE4C,aAAa,CAAC7F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAM8F,2BAA2B,IAAI1F,yBAAAA;EAErC,IAAI2F;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACbjF,MAAMN,+BAA+BuC;GACrCpC,YAAY;IAAC;IAAY;IAAmB;IAAU;IAAiB;;EAC3E;OAEAoF,iBAAiB;GACbjF,MAAMN,+BAA+BuC;GACrCpC,YAAY,CAAC,YAAY,iBAAA;EAC7B;EAGJuE,YAAYjC,YAAYiC,YAAYjC,aAAa,CAAC;EAClDiC,YAAYjC,UAAUgD,UAAU,CAC5B;GACInD,UAAUiD;GACVpF,YAAY;IACRK,UAAU;IACVkF,iBAAiB;IACjBtF,MAAM;IACNuF,QAAQ,MAAML,yBAAyBN,QAAQP,OAAOmB,oBAAoB,EAAEC,eAAe,MAAM,CAAA;IACjGA,eAAe;IACfV,QAAQV,OAAOqB;GACnB;GACArD,WAAW,EAAE4C,aAAa,CAAC7F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAMuG,0BAA0B,IAAIlG,wBAAAA;EAEpC,IAAImG;EACJ,IAAIvB,OAAOwB,uBACPD,gBAAgB;GACZ1F,MAAMN,+BAA+BuC;GACrCpC,YAAY,CAAC,QAAA;EACjB;EAGJuE,YAAYjC,YAAYiC,YAAYjC,aAAa,CAAC;EAClDiC,YAAYjC,UAAUyD,SAAS,CAC3B;GACI5D,UAAU0D;GACV7F,YAAY;IACRC,MAAM;IACNuF,QAAQ,MAAMI,wBAAwBf,QAAQP,OAAO0B,gBAAgB;IACrEhB,QAAQV,OAAO2B;GACnB;GACA3D,WAAW,EAAE4C,aAAa,CAAC7F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,OAAO,CAACkF,WAAAA;CACZ;CAEA,MAAM2B,KAAKC,WAAwD;EAC/D,MAAM7B,SAAS6B,UAAUC,QAAQxG,kBAAAA;EAEjC,OAAO;GACHyC,UAAU,KAAKtC,cAAa;GAC5BsG,aAAa,KAAK3E,iBAAgB;GAClC4E,QAAQ,KAAK/D,YAAW;GACxBgE,OAAO,KAAK/D,WAAU;GACtBgE,QAAQ,MAAM,KAAKnC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","RobotCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","built_in","realm_id","extraAttributes","decision_strategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","ROBOT_NAMES_SELF_MANAGE","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","ROBOT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","SESSION_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","is_confidential","secret","clientSystemSecret","secret_hashed","clientSystemEnabled","robotCredentialsService","robotStrategy","robotAdminSecretReset","robots","robotAdminSecret","robotAdminEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n Client, \n Permission, \n Robot, \n Role, \n Scope, \n User,\n} from '@authup/core-kit';\nimport {\n PermissionName, \n REALM_MASTER_NAME, \n ROLE_ADMIN_NAME, \n ROLE_REALM_ADMIN_NAME, \n ScopeName, \n buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n ClientCredentialsService,\n RobotCredentialsService,\n UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n buildPolicies(): PolicyProvisioningEntity[] {\n return [\n {\n attributes: {\n name: SystemPolicyName.DEFAULT,\n type: BuiltInPolicyType.COMPOSITE,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },\n children: [\n {\n attributes: {\n name: SystemPolicyName.IDENTITY,\n type: BuiltInPolicyType.IDENTITY,\n built_in: true,\n realm_id: null,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.PERMISSION_BINDING,\n type: BuiltInPolicyType.PERMISSION_BINDING,\n built_in: true,\n realm_id: null,\n },\n },\n ],\n },\n // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n // Each `names` entry is what self-edit must REJECT; everything else\n // is permitted. New columns added to the entity are self-editable\n // by default — extend the denylist when adding admin-only state.\n {\n attributes: {\n name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n // FK + lifecycle\n 'active',\n 'realm_id',\n // Security-critical: a self-edit must not change the\n // client's confidentiality (toggling this clears the\n // secret) or downgrade the secret-storage format\n // (which would persist the secret in plaintext).\n 'is_confidential',\n 'secret_hashed',\n 'secret_encrypted',\n ],\n },\n },\n {\n attributes: {\n name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n 'active',\n 'realm_id',\n 'user_id',\n ],\n },\n },\n {\n attributes: {\n name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n 'active',\n 'name_locked',\n 'status',\n 'status_message',\n 'realm_id',\n ],\n },\n },\n ];\n }\n\n buildPermissions(): PermissionProvisioningEntity[] {\n const policiesByPermission: Partial<Record<string, string[]>> = {\n [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n [PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],\n [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n };\n\n return Object.values(PermissionName)\n .map((name) => {\n const entity: PermissionProvisioningEntity = {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Permission)[],\n },\n attributes: {\n name,\n built_in: true,\n },\n };\n\n const policies = policiesByPermission[name];\n if (policies) {\n entity.relations = { policies };\n }\n\n return entity;\n });\n }\n\n buildScopes(): ScopeProvisioningEntity[] {\n return Object.values(ScopeName)\n .map((name) => ({\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Scope)[],\n },\n attributes: {\n name,\n built_in: true,\n },\n }));\n }\n\n buildRoles(): RoleProvisioningEntity[] {\n return [\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_ADMIN_NAME,\n built_in: true,\n },\n relations: {\n globalPermissions: [''],\n // Global admin: unrestricted realm reach (any realm + null/global).\n globalPermissionsRealmScope: RealmScope.ANY,\n },\n },\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_REALM_ADMIN_NAME,\n built_in: true,\n },\n relations: {\n globalPermissions: ['*'],\n globalPermissionsExclude: [\n PermissionName.REALM_CREATE,\n PermissionName.REALM_UPDATE,\n PermissionName.REALM_DELETE,\n ],\n // realm_admin: own realm + null/global by default (so it can\n // read/assign global building blocks), but strictly own-realm for\n // direct entity CUD (cannot create/modify global entities).\n globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n globalPermissionsRealmScopeOverrides: {\n [RealmScope.OWN]: [\n PermissionName.CLIENT_CREATE,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n PermissionName.IDENTITY_PROVIDER_CREATE,\n PermissionName.IDENTITY_PROVIDER_UPDATE,\n PermissionName.IDENTITY_PROVIDER_DELETE,\n PermissionName.PERMISSION_CREATE,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n PermissionName.ROBOT_CREATE,\n PermissionName.ROBOT_UPDATE,\n PermissionName.ROBOT_DELETE,\n PermissionName.ROLE_CREATE,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n PermissionName.SCOPE_CREATE,\n PermissionName.SCOPE_UPDATE,\n PermissionName.SCOPE_DELETE,\n PermissionName.SESSION_DELETE,\n PermissionName.USER_CREATE,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ],\n },\n },\n },\n ];\n }\n\n async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n const masterRealm : RealmProvisioningEntity = {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'],\n },\n attributes: {\n name: REALM_MASTER_NAME,\n built_in: true,\n },\n relations: {},\n };\n\n const userCredentialsService = new UserCredentialsService();\n\n let userStrategy : ProvisioningEntityStrategy<User> \| undefined;\n if (config.userAdminPasswordReset) {\n userStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['password'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.users = [\n {\n strategy: userStrategy,\n attributes: {\n name: 'admin',\n password: await userCredentialsService.protect(config.userAdminPassword),\n email: buildUserFakeEmail('admin'),\n active: config.userAdminEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n const clientCredentialsService = new ClientCredentialsService();\n\n let clientStrategy : ProvisioningEntityStrategy<Client> \| undefined;\n if (config.clientSystemSecretReset) {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in', 'is_confidential', 'secret', 'secret_hashed', 'secret_encrypted'],\n };\n } else {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in', 'is_confidential'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.clients = [\n {\n strategy: clientStrategy,\n attributes: {\n built_in: true,\n is_confidential: true,\n name: 'system',\n secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),\n secret_hashed: false,\n active: config.clientSystemEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n const robotCredentialsService = new RobotCredentialsService();\n\n let robotStrategy : ProvisioningEntityStrategy<Robot> \| undefined;\n if (config.robotAdminSecretReset) {\n robotStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['secret'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.robots = [\n {\n strategy: robotStrategy,\n attributes: {\n name: 'system',\n secret: await robotCredentialsService.protect(config.robotAdminSecret),\n active: config.robotAdminEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n return [masterRealm];\n }\n\n async load(container: IContainer): Promise<RootProvisioningEntity> {\n const config = container.resolve(ConfigInjectionKey);\n\n return {\n policies: this.buildPolicies(),\n permissions: this.buildPermissions(),\n scopes: this.buildScopes(),\n roles: this.buildRoles(),\n realms: await this.buildRealms(config),\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2CA,IAAae,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMhB,iBAAiBiB;KACvBC,MAAMpB,kBAAkBqB;KACxBC,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EAAEC,mBAAmBtB,iBAAiBuB,UAAU;IACjEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMhB,iBAAiB0B;KACvBR,MAAMpB,kBAAkB4B;KACxBN,UAAU;KACVC,UAAU;IACd,EACJ,GACA,EACIN,YAAY;KACRC,MAAMhB,iBAAiB2B;KACvBT,MAAMpB,kBAAkB6B;KACxBP,UAAU;KACVC,UAAU;IACd,EACJ,CAAA;GAER;GAKA;IACIN,YAAY;KACRC,MAAMhB,iBAAiB4B;KACvBV,MAAMpB,kBAAkB+B;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAKA;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMhB,iBAAiBgC;KACvBd,MAAMpB,kBAAkB+B;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMhB,iBAAiBiC;KACvBf,MAAMpB,kBAAkB+B;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;MAER;GACJ;;CAER;CAEAG,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3DjC,eAAekC,qBAAqB,CAACpC,iBAAiBiB,SAASjB,iBAAiB4B,wBAAAA;IAChF1B,eAAemC,oBAAoB,CAACrC,iBAAiBiB,SAASjB,iBAAiBgC,uBAAAA;IAC/E9B,eAAeoC,mBAAmB,CAACtC,iBAAiBiB,SAASjB,iBAAiBiC,sBAAAA;EACnF;EAEA,OAAOM,OAAOC,OAAOtC,cAAAA,CAAAA,CAChBuC,KAAKzB,SAAAA;GACF,MAAM0B,SAAuC;IACzCC,UAAU;KACNzB,MAAMN,+BAA+BgC;KACrC7B,YAAY,CAAC,UAAA;IACjB;IACAA,YAAY;KACRC;KACAI,UAAU;IACd;GACJ;GAEA,MAAMyB,WAAWV,qBAAqBnB;GACtC,IAAI6B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAOlC,SAAAA,CAAAA,CAChBmC,KAAKzB,UAAU;GACZ2B,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC;IACAI,UAAU;GACd;EACJ,EAAA;CACR;CAEA4B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMZ;IACNgB,UAAU;GACd;GACA0B,WAAW;IACPG,mBAAmB,CAAC,GAAA;IAEpBC,6BAA6BnD,WAAWoD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMX;IACNe,UAAU;GACd;GACA0B,WAAW;IACPG,mBAAmB,CAAC,GAAA;IACpBG,0BAA0B;KACtBlD,eAAemD;KACfnD,eAAeoD;KACfpD,eAAeqD;;IAKnBL,6BAA6BnD,WAAWyD;IACxCC,sCAAsC,GACjC1D,WAAW2D,MAAM;KACdxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;MAEvB;GACJ;EACJ,CAAA;CAER;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1CxC,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMb;IACNiB,UAAU;GACd;GACA0B,WAAW,CAAC;EAChB;EAEA,MAAMsC,yBAAyB,IAAI1E,uBAAAA;EAEnC,IAAI2E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXnE,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,UAAA;EACjB;EAGJoE,YAAYrC,YAAYqC,YAAYrC,aAAa,CAAC;EAClDqC,YAAYrC,UAAUyC,QAAQ,CAC1B;GACI5C,UAAU0C;GACVtE,YAAY;IACRC,MAAM;IACNwE,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOpF,mBAAmB,OAAA;IAC1BqF,QAAQV,OAAOW;GACnB;GACA/C,WAAW,EAAEgD,aAAa,CAAC1F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAM2F,2BAA2B,IAAIvF,yBAAAA;EAErC,IAAIwF;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACb9E,MAAMN,+BAA+BgC;GACrC7B,YAAY;IAAC;IAAY;IAAmB;IAAU;IAAiB;;EAC3E;OAEAiF,iBAAiB;GACb9E,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,YAAY,iBAAA;EAC7B;EAGJoE,YAAYrC,YAAYqC,YAAYrC,aAAa,CAAC;EAClDqC,YAAYrC,UAAUoD,UAAU,CAC5B;GACIvD,UAAUqD;GACVjF,YAAY;IACRK,UAAU;IACV+E,iBAAiB;IACjBnF,MAAM;IACNoF,QAAQ,MAAML,yBAAyBN,QAAQP,OAAOmB,oBAAoB,EAAEC,eAAe,MAAM,CAAA;IACjGA,eAAe;IACfV,QAAQV,OAAOqB;GACnB;GACAzD,WAAW,EAAEgD,aAAa,CAAC1F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAMoG,0BAA0B,IAAI/F,wBAAAA;EAEpC,IAAIgG;EACJ,IAAIvB,OAAOwB,uBACPD,gBAAgB;GACZvF,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,QAAA;EACjB;EAGJoE,YAAYrC,YAAYqC,YAAYrC,aAAa,CAAC;EAClDqC,YAAYrC,UAAU6D,SAAS,CAC3B;GACIhE,UAAU8D;GACV1F,YAAY;IACRC,MAAM;IACNoF,QAAQ,MAAMI,wBAAwBf,QAAQP,OAAO0B,gBAAgB;IACrEhB,QAAQV,OAAO2B;GACnB;GACA/D,WAAW,EAAEgD,aAAa,CAAC1F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,OAAO,CAAC+E,WAAAA;CACZ;CAEA,MAAM2B,KAAKC,WAAwD;EAC/D,MAAM7B,SAAS6B,UAAUC,QAAQrG,kBAAAA;EAEjC,OAAO;GACHkC,UAAU,KAAK/B,cAAa;GAC5BmG,aAAa,KAAK/E,iBAAgB;GAClCgF,QAAQ,KAAKnE,YAAW;GACxBoE,OAAO,KAAKnE,WAAU;GACtBoE,QAAQ,MAAM,KAAKnC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}

package/dist/app/modules/provisioning/sources/file/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"names":[],"mappings":"~~AASA~~,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAElE,qBAAa,sBAAuB,YAAW,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,OAAO,EAAE,+BAA+B;IAM9C,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;CAmBhD"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAElE,qBAAa,sBAAuB,YAAW,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,OAAO,EAAE,+BAA+B;IAM9C,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;CAmBhD"}

package/dist/app/modules/provisioning/sources/file/module.mjs CHANGED Viewed

@@ -4,6 +4,7 @@ import.meta.url;
 import { RootProvisioningValidator } from "../../../../../core/provisioning/entities/root/validator.mjs";
 import "../../../../../core/provisioning/entities/index.mjs";
 import { CompositeProvisioningSource } from "../composite/module.mjs";
+import { ValidatorGroup } from "@authup/kit";
 import path from "node:path";
 import { load, locateMany } from "locter";
 //#region src/app/modules/provisioning/sources/file/module.ts
@@ -20,7 +21,7 @@ var FileProvisioningSource = class {
 		const output = {};
 		for (const location of locations) {
 			const raw = await load(location);
-			const data = await this.rootValidator.run(raw.default);
+			const data = await this.rootValidator.run(raw.default, { group: ValidatorGroup.PROVISIONING });
 			compositeSource.merge(output, data);
 		}
 		return output;