@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.52

package/dist/app/modules/provisioning/sources/file/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["load","locateMany","path","RootProvisioningValidator","CompositeProvisioningSource","FileProvisioningSource","options","rootValidator","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","data","run","default","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { load, locateMany } from 'locter';\nimport path from 'node:path';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\nexport class FileProvisioningSource implements IProvisioningSource {\n    protected options: FileEntitySchemaImporterOptions;\n\n    protected rootValidator: RootProvisioningValidator;\n\n    constructor(options: FileEntitySchemaImporterOptions) {\n        this.options = options;\n\n        this.rootValidator = new RootProvisioningValidator();\n    }\n\n    async load(): Promise<RootProvisioningEntity> {\n        const cwd = path.isAbsolute(this.options.cwd) ?\n            this.options.cwd :\n            path.join(process.cwd(), this.options.cwd);\n\n        const locations = await locateMany('*.{json,yaml,yml,ts,mts,mjs,js}', { path: cwd });\n\n        const compositeSource = new CompositeProvisioningSource([]);\n\n        const output : RootProvisioningEntity = {};\n        for (const location of locations) {\n            const raw = await load(location);\n            const data = await this.rootValidator.run(raw.default);\n\n            compositeSource.merge(output, data);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;AAeA,IAAaK,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIJ,0BAAAA;CAC7B;CAEA,MAAMH,OAAwC;EAK1C,MAAMY,YAAY,MAAMX,WAAW,mCAAmC,EAAEC,MAJ5DA,KAAKO,WAAW,KAAKH,QAAQE,GAAG,IACxC,KAAKF,QAAQE,MACbN,KAAKQ,KAAKC,QAAQH,IAAG,GAAI,KAAKF,QAAQE,GAAG,EAEqC,CAAA;EAElF,MAAMK,kBAAkB,IAAIT,4BAA4B,CAAA,CAAE;EAE1D,MAAMU,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,MAAMhB,KAAKe,QAAAA;GACvB,MAAME,OAAO,MAAM,KAAKV,cAAcW,IAAIF,IAAIG,OAAO;GAErDN,gBAAgBO,MAAMN,QAAQG,IAAAA;EAClC;EAEA,OAAOH;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["ValidatorGroup","load","locateMany","path","RootProvisioningValidator","CompositeProvisioningSource","FileProvisioningSource","options","rootValidator","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","data","run","default","group","PROVISIONING","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { ValidatorGroup } from '@authup/kit';\nimport { load, locateMany } from 'locter';\nimport path from 'node:path';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\nexport class FileProvisioningSource implements IProvisioningSource {\n    protected options: FileEntitySchemaImporterOptions;\n\n    protected rootValidator: RootProvisioningValidator;\n\n    constructor(options: FileEntitySchemaImporterOptions) {\n        this.options = options;\n\n        this.rootValidator = new RootProvisioningValidator();\n    }\n\n    async load(): Promise<RootProvisioningEntity> {\n        const cwd = path.isAbsolute(this.options.cwd) ?\n            this.options.cwd :\n            path.join(process.cwd(), this.options.cwd);\n\n        const locations = await locateMany('*.{json,yaml,yml,ts,mts,mjs,js}', { path: cwd });\n\n        const compositeSource = new CompositeProvisioningSource([]);\n\n        const output : RootProvisioningEntity = {};\n        for (const location of locations) {\n            const raw = await load(location);\n            const data = await this.rootValidator.run(raw.default, { group: ValidatorGroup.PROVISIONING });\n\n            compositeSource.merge(output, data);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;;AAgBA,IAAaM,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIJ,0BAAAA;CAC7B;CAEA,MAAMH,OAAwC;EAK1C,MAAMY,YAAY,MAAMX,WAAW,mCAAmC,EAAEC,MAJ5DA,KAAKO,WAAW,KAAKH,QAAQE,GAAG,IACxC,KAAKF,QAAQE,MACbN,KAAKQ,KAAKC,QAAQH,IAAG,GAAI,KAAKF,QAAQE,GAAG,EAEqC,CAAA;EAElF,MAAMK,kBAAkB,IAAIT,4BAA4B,CAAA,CAAE;EAE1D,MAAMU,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,MAAMhB,KAAKe,QAAAA;GACvB,MAAME,OAAO,MAAM,KAAKV,cAAcW,IAAIF,IAAIG,SAAS,EAAEC,OAAOrB,eAAesB,aAAa,CAAA;GAE5FR,gBAAgBS,MAAMR,QAAQG,IAAAA;EAClC;EAEA,OAAOH;CACX;AACJ"}

package/dist/cli/commands/migration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/migration.ts"],"names":[],"mappings":"AA4BA,aAAK,kBAAkB;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,GAAG,QAAQ;CACd;AAuHD,wBAAgB,yBAAyB;;;;;;;GAyCxC"}
+{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/migration.ts"],"names":[],"mappings":"AA4BA,aAAK,kBAAkB;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,GAAG,QAAQ;CACd;AAsID,wBAAgB,yBAAyB;;;;;;;GAyCxC"}

package/dist/cli/commands/migration.mjs

@@ -47,13 +47,17 @@ async function runMigrationOperation(container, operation) {
 			"migration"
 		]
 	});
-	await dataSource.initialize();
 	try {
+		await dataSource.initialize();
 		if (operation === "revert") await dataSource.undoLastMigration();
 		else if (operation === "status") await dataSource.showMigrations();
 		else await dataSource.runMigrations();
 	} finally {
-		await dataSource.destroy();
+		if (dataSource.isInitialized) try {
+			await dataSource.destroy();
+		} catch (e) {
+			logger.error(`Failed to destroy data source after migration operation: ${e}`);
+		}
 	}
 }
 async function generateMigrations() {
@@ -84,8 +88,8 @@ async function generateMigrations() {
 			synchronize: false
 		});
 		const dataSource = new DataSource(dataSourceOptions);
-		await dataSource.initialize();
 		try {
+			await dataSource.initialize();
 			await dataSource.runMigrations();
 			await generateMigration({
 				dataSource,
@@ -95,7 +99,11 @@ async function generateMigrations() {
 				prettify: true
 			});
 		} finally {
-			await dataSource.destroy();
+			if (dataSource.isInitialized) try {
+				await dataSource.destroy();
+			} catch (e) {
+				console.error(e);
+			}
 		}
 	}
 }

package/dist/cli/commands/migration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"migration.mjs","names":["defineCommand","path","process","checkDatabase","createDatabase","dropDatabase","generateMigration","transformFilePath","DataSource","DataSourceOptionsBuilder","ApplicationBuilder","ConfigInjectionKey","LoggerInjectionKey","ModuleName","CODE_PATH","MigrationOperation","runMigrationOperation","container","operation","config","resolve","logger","optionsBuilder","options","db","buildWith","buildWithEnv","debug","type","database","Array","isArray","migrations","i","length","check","exists","synchronize","ifNotExist","dataSource","logging","initialize","undoLastMigration","showMigrations","runMigrations","destroy","generateMigrations","connections","host","port","username","password","baseDirectory","join","timestamp","Date","now","connection","dataSourceOptions","directoryPath","name","prettify","defineCLIMigrationCommand","meta","args","required","Object","values","valueHint","setup","context","app","withConfig","withLogger","build","addModule","DATABASE","dependencies","CONFIG","LOGGER","exit","e","console","error"],"sources":["../../../src/cli/commands/migration.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport path from 'node:path';\nimport process from 'node:process';\nimport {\n    checkDatabase,\n    createDatabase, \n    dropDatabase, \n    generateMigration, \n    transformFilePath,\n} from 'typeorm-extension';\nimport { DataSource, type DataSourceOptions } from 'typeorm';\nimport { DataSourceOptionsBuilder } from '../../adapters/database/index.ts';\nimport {\n    ApplicationBuilder, \n    ConfigInjectionKey, \n    LoggerInjectionKey, \n    ModuleName,\n} from '../../app/index.ts';\nimport type { IContainer } from 'eldin';\nimport { CODE_PATH } from '../../path.ts';\n\nenum MigrationOperation {\n    GENERATE = 'generate',\n    REVERT = 'revert',\n    STATUS = 'status',\n    RUN = 'run',\n}\n\nasync function runMigrationOperation(\n    container: IContainer,\n    operation: string,\n): Promise<void> {\n    const config = container.resolve(ConfigInjectionKey);\n    const logger = container.resolve(LoggerInjectionKey);\n\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    let options: DataSourceOptions;\n    if (config.db) {\n        options = optionsBuilder.buildWith(config.db);\n    } else {\n        options = optionsBuilder.buildWithEnv();\n    }\n\n    logger.debug(`Type: ${options.type}`);\n    logger.debug(`Database: ${options.database}`);\n\n    if (Array.isArray(options.migrations)) {\n        for (let i = 0; i < options.migrations.length; i++) {\n            if (typeof options.migrations[i] === 'string') {\n                logger.debug(`Migration-Directory: ${options.migrations[i]}`);\n            }\n        }\n    } else if (typeof options.migrations === 'string') {\n        logger.debug(`Migration-Directory: ${options.migrations}`);\n    }\n\n    const check = await checkDatabase({ options });\n\n    if (!check.exists) {\n        await createDatabase({\n            options,\n            synchronize: false,\n            ifNotExist: true, \n        });\n    }\n\n    const dataSource = new DataSource({\n        ...options,\n        logging: ['error', 'schema', 'migration'],\n    });\n    await dataSource.initialize();\n\n    try {\n        if (operation === MigrationOperation.REVERT) {\n            await dataSource.undoLastMigration();\n        } else if (operation === MigrationOperation.STATUS) {\n            await dataSource.showMigrations();\n        } else {\n            await dataSource.runMigrations();\n        }\n    } finally {\n        await dataSource.destroy();\n    }\n}\n\nasync function generateMigrations(): Promise<void> {\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    const connections: DataSourceOptions[] = [\n        {\n            type: 'postgres',\n            database: 'migrations',\n            host: 'localhost',\n            port: 5432,\n            username: 'postgres',\n            password: 'start123',\n        },\n        {\n            type: 'mysql',\n            database: 'migrations',\n            host: 'localhost',\n            port: 3306,\n            username: 'root',\n            password: 'start123',\n        },\n    ];\n\n    const baseDirectory = transformFilePath(\n        path.join(CODE_PATH, 'adapters', 'database', 'migrations'),\n        './src',\n        './dist',\n    );\n\n    const timestamp = Date.now();\n\n    for (const connection of connections) {\n        const dataSourceOptions = optionsBuilder.buildWith(connection);\n        const directoryPath = path.join(baseDirectory, dataSourceOptions.type);\n\n        await dropDatabase({ options: dataSourceOptions });\n        await createDatabase({\n            options: dataSourceOptions,\n            synchronize: false, \n        });\n\n        const dataSource = new DataSource(dataSourceOptions);\n        await dataSource.initialize();\n\n        try {\n            await dataSource.runMigrations();\n\n            await generateMigration({\n                dataSource,\n                name: 'Default',\n                directoryPath,\n                timestamp,\n                prettify: true,\n            });\n        } finally {\n            await dataSource.destroy();\n        }\n    }\n}\n\nexport function defineCLIMigrationCommand() {\n    return defineCommand({\n        meta: { name: 'migration' },\n        args: {\n            operation: {\n                required: true,\n                type: 'positional',\n                options: Object.values(MigrationOperation),\n                valueHint: Object.values(MigrationOperation).join('|'),\n            },\n        },\n        async setup(context) {\n            try {\n                if (context.args.operation === MigrationOperation.GENERATE) {\n                    await generateMigrations();\n                } else {\n                    const app = new ApplicationBuilder()\n                        .withConfig()\n                        .withLogger()\n                        .build();\n\n                    app.addModule({\n                        name: ModuleName.DATABASE,\n                        dependencies: [ModuleName.CONFIG, ModuleName.LOGGER],\n                        async setup(container: IContainer): Promise<void> {\n                            await runMigrationOperation(container, context.args.operation);\n                        },\n                    });\n\n                    await app.setup();\n                }\n\n                process.exit(0);\n            } catch (e) {\n                // eslint-disable-next-line no-console\n                console.error(e);\n\n                process.exit(1);\n            }\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA4BA,IAAA,qBAAKe,uBAAAA,oBAAAA;;;;;QAAAA;EAAAA,sBAAAA,CAAAA,CAAAA;AAOL,eAAeC,sBACXC,WACAC,WAAiB;CAEjB,MAAMC,SAASF,UAAUG,QAAQT,kBAAAA;CACjC,MAAMU,SAASJ,UAAUG,QAAQR,kBAAAA;CAEjC,MAAMU,iBAAiB,IAAIb,yBAAAA;CAE3B,IAAIc;CACJ,IAAIJ,OAAOK,IACPD,UAAUD,eAAeG,UAAUN,OAAOK,EAAE;MAE5CD,UAAUD,eAAeI,aAAY;CAGzCL,OAAOM,MAAM,SAASJ,QAAQK,MAAM;CACpCP,OAAOM,MAAM,aAAaJ,QAAQM,UAAU;CAE5C,IAAIC,MAAMC,QAAQR,QAAQS,UAAU;OAC3B,IAAIC,IAAI,GAAGA,IAAIV,QAAQS,WAAWE,QAAQD,KAC3C,IAAI,OAAOV,QAAQS,WAAWC,OAAO,UACjCZ,OAAOM,MAAM,wBAAwBJ,QAAQS,WAAWC,IAAI;CAAA,OAGjE,IAAI,OAAOV,QAAQS,eAAe,UACrCX,OAAOM,MAAM,wBAAwBJ,QAAQS,YAAY;CAK7D,IAAI,EAACG,MAFehC,cAAc,EAAEoB,QAAQ,CAAA,EAAA,CAEjCa,QACP,MAAMhC,eAAe;EACjBmB;EACAc,aAAa;EACbC,YAAY;CAChB,CAAA;CAGJ,MAAMC,aAAa,IAAI/B,WAAW;EAC9B,GAAGe;EACHiB,SAAS;GAAC;GAAS;GAAU;;CACjC,CAAA;CACA,MAAMD,WAAWE,WAAU;CAE3B,IAAI;EACA,IAAIvB,cAAAA,UACA,MAAMqB,WAAWG,kBAAiB;OAC/B,IAAIxB,cAAAA,UACP,MAAMqB,WAAWI,eAAc;OAE/B,MAAMJ,WAAWK,cAAa;CAEtC,UAAU;EACN,MAAML,WAAWM,QAAO;CAC5B;AACJ;AAEA,eAAeC,qBAAAA;CACX,MAAMxB,iBAAiB,IAAIb,yBAAAA;CAE3B,MAAMsC,cAAmC,CACrC;EACInB,MAAM;EACNC,UAAU;EACVmB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,GACA;EACIvB,MAAM;EACNC,UAAU;EACVmB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,CAAA;CAGJ,MAAMC,gBAAgB7C,kBAClBN,KAAKoD,KAAKvC,WAAW,YAAY,YAAY,YAAA,GAC7C,SACA,QAAA;CAGJ,MAAMwC,YAAYC,KAAKC,IAAG;CAE1B,KAAK,MAAMC,cAAcV,aAAa;EAClC,MAAMW,oBAAoBpC,eAAeG,UAAUgC,UAAAA;EACnD,MAAME,gBAAgB1D,KAAKoD,KAAKD,eAAeM,kBAAkB9B,IAAI;EAErE,MAAMvB,aAAa,EAAEkB,SAASmC,kBAAkB,CAAA;EAChD,MAAMtD,eAAe;GACjBmB,SAASmC;GACTrB,aAAa;EACjB,CAAA;EAEA,MAAME,aAAa,IAAI/B,WAAWkD,iBAAAA;EAClC,MAAMnB,WAAWE,WAAU;EAE3B,IAAI;GACA,MAAMF,WAAWK,cAAa;GAE9B,MAAMtC,kBAAkB;IACpBiC;IACAqB,MAAM;IACND;IACAL;IACAO,UAAU;GACd,CAAA;EACJ,UAAU;GACN,MAAMtB,WAAWM,QAAO;EAC5B;CACJ;AACJ;AAEA,SAAgBiB,4BAAAA;CACZ,OAAO9D,cAAc;EACjB+D,MAAM,EAAEH,MAAM,YAAY;EAC1BI,MAAM,EACF9C,WAAW;GACP+C,UAAU;GACVrC,MAAM;GACNL,SAAS2C,OAAOC,OAAOpD,kBAAAA;GACvBqD,WAAWF,OAAOC,OAAOpD,kBAAAA,CAAAA,CAAoBsC,KAAK,GAAA;EACtD,EACJ;EACA,MAAMgB,MAAMC,SAAO;GACf,IAAI;IACA,IAAIA,QAAQN,KAAK9C,cAAS,YACtB,MAAM4B,mBAAAA;SACH;KACH,MAAMyB,MAAM,IAAI7D,mBAAAA,CAAAA,CACX8D,WAAU,CAAA,CACVC,WAAU,CAAA,CACVC,MAAK;KAEVH,IAAII,UAAU;MACVf,MAAM/C,WAAW+D;MACjBC,cAAc,CAAChE,WAAWiE,QAAQjE,WAAWkE,MAAAA;MAC7C,MAAMV,MAAMpD,WAAqB;OAC7B,MAAMD,sBAAsBC,WAAWqD,QAAQN,KAAK9C,SAAS;MACjE;KACJ,CAAA;KAEA,MAAMqD,IAAIF,MAAK;IACnB;IAEAnE,QAAQ8E,KAAK,CAAA;GACjB,SAASC,GAAG;IAERC,QAAQC,MAAMF,CAAAA;IAEd/E,QAAQ8E,KAAK,CAAA;GACjB;EACJ;CACJ,CAAA;AACJ"}
+{"version":3,"file":"migration.mjs","names":["defineCommand","path","process","checkDatabase","createDatabase","dropDatabase","generateMigration","transformFilePath","DataSource","DataSourceOptionsBuilder","ApplicationBuilder","ConfigInjectionKey","LoggerInjectionKey","ModuleName","CODE_PATH","MigrationOperation","runMigrationOperation","container","operation","config","resolve","logger","optionsBuilder","options","db","buildWith","buildWithEnv","debug","type","database","Array","isArray","migrations","i","length","check","exists","synchronize","ifNotExist","dataSource","logging","initialize","undoLastMigration","showMigrations","runMigrations","isInitialized","destroy","e","error","generateMigrations","connections","host","port","username","password","baseDirectory","join","timestamp","Date","now","connection","dataSourceOptions","directoryPath","name","prettify","console","defineCLIMigrationCommand","meta","args","required","Object","values","valueHint","setup","context","app","withConfig","withLogger","build","addModule","DATABASE","dependencies","CONFIG","LOGGER","exit"],"sources":["../../../src/cli/commands/migration.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport path from 'node:path';\nimport process from 'node:process';\nimport {\n    checkDatabase,\n    createDatabase, \n    dropDatabase, \n    generateMigration, \n    transformFilePath,\n} from 'typeorm-extension';\nimport { DataSource, type DataSourceOptions } from 'typeorm';\nimport { DataSourceOptionsBuilder } from '../../adapters/database/index.ts';\nimport {\n    ApplicationBuilder, \n    ConfigInjectionKey, \n    LoggerInjectionKey, \n    ModuleName,\n} from '../../app/index.ts';\nimport type { IContainer } from 'eldin';\nimport { CODE_PATH } from '../../path.ts';\n\nenum MigrationOperation {\n    GENERATE = 'generate',\n    REVERT = 'revert',\n    STATUS = 'status',\n    RUN = 'run',\n}\n\nasync function runMigrationOperation(\n    container: IContainer,\n    operation: string,\n): Promise<void> {\n    const config = container.resolve(ConfigInjectionKey);\n    const logger = container.resolve(LoggerInjectionKey);\n\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    let options: DataSourceOptions;\n    if (config.db) {\n        options = optionsBuilder.buildWith(config.db);\n    } else {\n        options = optionsBuilder.buildWithEnv();\n    }\n\n    logger.debug(`Type: ${options.type}`);\n    logger.debug(`Database: ${options.database}`);\n\n    if (Array.isArray(options.migrations)) {\n        for (let i = 0; i < options.migrations.length; i++) {\n            if (typeof options.migrations[i] === 'string') {\n                logger.debug(`Migration-Directory: ${options.migrations[i]}`);\n            }\n        }\n    } else if (typeof options.migrations === 'string') {\n        logger.debug(`Migration-Directory: ${options.migrations}`);\n    }\n\n    const check = await checkDatabase({ options });\n\n    if (!check.exists) {\n        await createDatabase({\n            options,\n            synchronize: false,\n            ifNotExist: true, \n        });\n    }\n\n    const dataSource = new DataSource({\n        ...options,\n        logging: ['error', 'schema', 'migration'],\n    });\n\n    try {\n        await dataSource.initialize();\n\n        if (operation === MigrationOperation.REVERT) {\n            await dataSource.undoLastMigration();\n        } else if (operation === MigrationOperation.STATUS) {\n            await dataSource.showMigrations();\n        } else {\n            await dataSource.runMigrations();\n        }\n    } finally {\n        if (dataSource.isInitialized) {\n            try {\n                await dataSource.destroy();\n            } catch (e) {\n                logger.error(`Failed to destroy data source after migration operation: ${e}`);\n            }\n        }\n    }\n}\n\nasync function generateMigrations(): Promise<void> {\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    const connections: DataSourceOptions[] = [\n        {\n            type: 'postgres',\n            database: 'migrations',\n            host: 'localhost',\n            port: 5432,\n            username: 'postgres',\n            password: 'start123',\n        },\n        {\n            type: 'mysql',\n            database: 'migrations',\n            host: 'localhost',\n            port: 3306,\n            username: 'root',\n            password: 'start123',\n        },\n    ];\n\n    const baseDirectory = transformFilePath(\n        path.join(CODE_PATH, 'adapters', 'database', 'migrations'),\n        './src',\n        './dist',\n    );\n\n    const timestamp = Date.now();\n\n    for (const connection of connections) {\n        const dataSourceOptions = optionsBuilder.buildWith(connection);\n        const directoryPath = path.join(baseDirectory, dataSourceOptions.type);\n\n        await dropDatabase({ options: dataSourceOptions });\n        await createDatabase({\n            options: dataSourceOptions,\n            synchronize: false, \n        });\n\n        const dataSource = new DataSource(dataSourceOptions);\n\n        try {\n            await dataSource.initialize();\n\n            await dataSource.runMigrations();\n\n            await generateMigration({\n                dataSource,\n                name: 'Default',\n                directoryPath,\n                timestamp,\n                prettify: true,\n            });\n        } finally {\n            if (dataSource.isInitialized) {\n                try {\n                    await dataSource.destroy();\n                } catch (e) {\n                    // eslint-disable-next-line no-console\n                    console.error(e);\n                }\n            }\n        }\n    }\n}\n\nexport function defineCLIMigrationCommand() {\n    return defineCommand({\n        meta: { name: 'migration' },\n        args: {\n            operation: {\n                required: true,\n                type: 'positional',\n                options: Object.values(MigrationOperation),\n                valueHint: Object.values(MigrationOperation).join('|'),\n            },\n        },\n        async setup(context) {\n            try {\n                if (context.args.operation === MigrationOperation.GENERATE) {\n                    await generateMigrations();\n                } else {\n                    const app = new ApplicationBuilder()\n                        .withConfig()\n                        .withLogger()\n                        .build();\n\n                    app.addModule({\n                        name: ModuleName.DATABASE,\n                        dependencies: [ModuleName.CONFIG, ModuleName.LOGGER],\n                        async setup(container: IContainer): Promise<void> {\n                            await runMigrationOperation(container, context.args.operation);\n                        },\n                    });\n\n                    await app.setup();\n                }\n\n                process.exit(0);\n            } catch (e) {\n                // eslint-disable-next-line no-console\n                console.error(e);\n\n                process.exit(1);\n            }\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA4BA,IAAA,qBAAKe,uBAAAA,oBAAAA;;;;;QAAAA;EAAAA,sBAAAA,CAAAA,CAAAA;AAOL,eAAeC,sBACXC,WACAC,WAAiB;CAEjB,MAAMC,SAASF,UAAUG,QAAQT,kBAAAA;CACjC,MAAMU,SAASJ,UAAUG,QAAQR,kBAAAA;CAEjC,MAAMU,iBAAiB,IAAIb,yBAAAA;CAE3B,IAAIc;CACJ,IAAIJ,OAAOK,IACPD,UAAUD,eAAeG,UAAUN,OAAOK,EAAE;MAE5CD,UAAUD,eAAeI,aAAY;CAGzCL,OAAOM,MAAM,SAASJ,QAAQK,MAAM;CACpCP,OAAOM,MAAM,aAAaJ,QAAQM,UAAU;CAE5C,IAAIC,MAAMC,QAAQR,QAAQS,UAAU;OAC3B,IAAIC,IAAI,GAAGA,IAAIV,QAAQS,WAAWE,QAAQD,KAC3C,IAAI,OAAOV,QAAQS,WAAWC,OAAO,UACjCZ,OAAOM,MAAM,wBAAwBJ,QAAQS,WAAWC,IAAI;CAAA,OAGjE,IAAI,OAAOV,QAAQS,eAAe,UACrCX,OAAOM,MAAM,wBAAwBJ,QAAQS,YAAY;CAK7D,IAAI,EAACG,MAFehC,cAAc,EAAEoB,QAAQ,CAAA,EAAA,CAEjCa,QACP,MAAMhC,eAAe;EACjBmB;EACAc,aAAa;EACbC,YAAY;CAChB,CAAA;CAGJ,MAAMC,aAAa,IAAI/B,WAAW;EAC9B,GAAGe;EACHiB,SAAS;GAAC;GAAS;GAAU;;CACjC,CAAA;CAEA,IAAI;EACA,MAAMD,WAAWE,WAAU;EAE3B,IAAIvB,cAAAA,UACA,MAAMqB,WAAWG,kBAAiB;OAC/B,IAAIxB,cAAAA,UACP,MAAMqB,WAAWI,eAAc;OAE/B,MAAMJ,WAAWK,cAAa;CAEtC,UAAU;EACN,IAAIL,WAAWM,eACX,IAAI;GACA,MAAMN,WAAWO,QAAO;EAC5B,SAASC,GAAG;GACR1B,OAAO2B,MAAM,4DAA4DD,GAAG;EAChF;CAER;AACJ;AAEA,eAAeE,qBAAAA;CACX,MAAM3B,iBAAiB,IAAIb,yBAAAA;CAE3B,MAAMyC,cAAmC,CACrC;EACItB,MAAM;EACNC,UAAU;EACVsB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,GACA;EACI1B,MAAM;EACNC,UAAU;EACVsB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,CAAA;CAGJ,MAAMC,gBAAgBhD,kBAClBN,KAAKuD,KAAK1C,WAAW,YAAY,YAAY,YAAA,GAC7C,SACA,QAAA;CAGJ,MAAM2C,YAAYC,KAAKC,IAAG;CAE1B,KAAK,MAAMC,cAAcV,aAAa;EAClC,MAAMW,oBAAoBvC,eAAeG,UAAUmC,UAAAA;EACnD,MAAME,gBAAgB7D,KAAKuD,KAAKD,eAAeM,kBAAkBjC,IAAI;EAErE,MAAMvB,aAAa,EAAEkB,SAASsC,kBAAkB,CAAA;EAChD,MAAMzD,eAAe;GACjBmB,SAASsC;GACTxB,aAAa;EACjB,CAAA;EAEA,MAAME,aAAa,IAAI/B,WAAWqD,iBAAAA;EAElC,IAAI;GACA,MAAMtB,WAAWE,WAAU;GAE3B,MAAMF,WAAWK,cAAa;GAE9B,MAAMtC,kBAAkB;IACpBiC;IACAwB,MAAM;IACND;IACAL;IACAO,UAAU;GACd,CAAA;EACJ,UAAU;GACN,IAAIzB,WAAWM,eACX,IAAI;IACA,MAAMN,WAAWO,QAAO;GAC5B,SAASC,GAAG;IAERkB,QAAQjB,MAAMD,CAAAA;GAClB;EAER;CACJ;AACJ;AAEA,SAAgBmB,4BAAAA;CACZ,OAAOlE,cAAc;EACjBmE,MAAM,EAAEJ,MAAM,YAAY;EAC1BK,MAAM,EACFlD,WAAW;GACPmD,UAAU;GACVzC,MAAM;GACNL,SAAS+C,OAAOC,OAAOxD,kBAAAA;GACvByD,WAAWF,OAAOC,OAAOxD,kBAAAA,CAAAA,CAAoByC,KAAK,GAAA;EACtD,EACJ;EACA,MAAMiB,MAAMC,SAAO;GACf,IAAI;IACA,IAAIA,QAAQN,KAAKlD,cAAS,YACtB,MAAM+B,mBAAAA;SACH;KACH,MAAM0B,MAAM,IAAIjE,mBAAAA,CAAAA,CACXkE,WAAU,CAAA,CACVC,WAAU,CAAA,CACVC,MAAK;KAEVH,IAAII,UAAU;MACVhB,MAAMlD,WAAWmE;MACjBC,cAAc,CAACpE,WAAWqE,QAAQrE,WAAWsE,MAAAA;MAC7C,MAAMV,MAAMxD,WAAqB;OAC7B,MAAMD,sBAAsBC,WAAWyD,QAAQN,KAAKlD,SAAS;MACjE;KACJ,CAAA;KAEA,MAAMyD,IAAIF,MAAK;IACnB;IAEAvE,QAAQkF,KAAK,CAAA;GACjB,SAASrC,GAAG;IAERkB,QAAQjB,MAAMD,CAAAA;IAEd7C,QAAQkF,KAAK,CAAA;GACjB;EACJ;CACJ,CAAA;AACJ"}

package/dist/components/oauth2-cleaner/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/components/oauth2-cleaner/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,UAAU,GAAI,SAAS,CAmB/E"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/components/oauth2-cleaner/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,UAAU,GAAI,SAAS,CA0B/E"}

package/dist/components/oauth2-cleaner/module.mjs

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { SessionEntity } from "../../adapters/database/domains/session/entity.mjs";
+import { SessionTokenEntity } from "../../adapters/database/domains/session-token/entity.mjs";
 import "../../adapters/database/domains/index.mjs";
 import { LessThan } from "typeorm";
 import cron from "node-cron";
@@ -9,8 +10,10 @@ import cron from "node-cron";
 function createOAuth2CleanerComponent(dataSource) {
 	return { async start() {
 		const sessionRepository = dataSource.getRepository(SessionEntity);
+		const sessionTokenRepository = dataSource.getRepository(SessionTokenEntity);
 		const execute = async () => {
 			const isoDate = (/* @__PURE__ */ new Date()).toISOString();
+			await sessionTokenRepository.delete({ expires_at: LessThan(isoDate) });
 			await sessionRepository.delete({ expires_at: LessThan(isoDate) });
 		};
 		await execute();

package/dist/components/oauth2-cleaner/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["cron","LessThan","SessionEntity","createOAuth2CleanerComponent","dataSource","start","sessionRepository","getRepository","execute","isoDate","Date","toISOString","delete","expires_at","schedule"],"sources":["../../../src/components/oauth2-cleaner/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport cron from 'node-cron';\nimport type { DataSource } from 'typeorm';\nimport { LessThan } from 'typeorm';\nimport { SessionEntity } from '../../adapters/database/domains/index.ts';\nimport type { Component } from '../types.ts';\n\nexport function createOAuth2CleanerComponent(dataSource: DataSource) : Component {\n    return {\n        async start() {\n            const sessionRepository = dataSource.getRepository(SessionEntity);\n\n            const execute = async () => {\n                const isoDate = new Date().toISOString();\n\n                await sessionRepository\n                    .delete({ expires_at: LessThan(isoDate) });\n            };\n\n            await execute();\n\n            cron.schedule('* * * * *', async () => {\n                await execute();\n            });\n        },\n    };\n}\n"],"mappings":";;;;;;;;AAaA,SAAgBG,6BAA6BC,YAAsB;CAC/D,OAAO,EACH,MAAMC,QAAAA;EACF,MAAMC,oBAAoBF,WAAWG,cAAcL,aAAAA;EAEnD,MAAMM,UAAU,YAAA;GACZ,MAAMC,2BAAU,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;GAEtC,MAAML,kBACDM,OAAO,EAAEC,YAAYZ,SAASQ,OAAAA,EAAS,CAAA;EAChD;EAEA,MAAMD,QAAAA;EAENR,KAAKc,SAAS,aAAa,YAAA;GACvB,MAAMN,QAAAA;EACV,CAAA;CACJ,EACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["cron","LessThan","SessionEntity","SessionTokenEntity","createOAuth2CleanerComponent","dataSource","start","sessionRepository","getRepository","sessionTokenRepository","execute","isoDate","Date","toISOString","delete","expires_at","schedule"],"sources":["../../../src/components/oauth2-cleaner/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport cron from 'node-cron';\nimport type { DataSource } from 'typeorm';\nimport { LessThan } from 'typeorm';\nimport { SessionEntity, SessionTokenEntity } from '../../adapters/database/domains/index.ts';\nimport type { Component } from '../types.ts';\n\nexport function createOAuth2CleanerComponent(dataSource: DataSource) : Component {\n    return {\n        async start() {\n            const sessionRepository = dataSource.getRepository(SessionEntity);\n            const sessionTokenRepository = dataSource.getRepository(SessionTokenEntity);\n\n            const execute = async () => {\n                const isoDate = new Date().toISOString();\n\n                // Sweep expired session-token rows first: the auth_session_tokens\n                // volume dominates (one row per access token, ~15min TTL) and a\n                // deleted session cascade-drops its remaining rows anyway.\n                await sessionTokenRepository\n                    .delete({ expires_at: LessThan(isoDate) });\n\n                await sessionRepository\n                    .delete({ expires_at: LessThan(isoDate) });\n            };\n\n            await execute();\n\n            cron.schedule('* * * * *', async () => {\n                await execute();\n            });\n        },\n    };\n}\n"],"mappings":";;;;;;;;;AAaA,SAAgBI,6BAA6BC,YAAsB;CAC/D,OAAO,EACH,MAAMC,QAAAA;EACF,MAAMC,oBAAoBF,WAAWG,cAAcN,aAAAA;EACnD,MAAMO,yBAAyBJ,WAAWG,cAAcL,kBAAAA;EAExD,MAAMO,UAAU,YAAA;GACZ,MAAMC,2BAAU,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;GAKtC,MAAMJ,uBACDK,OAAO,EAAEC,YAAYd,SAASU,OAAAA,EAAS,CAAA;GAE5C,MAAMJ,kBACDO,OAAO,EAAEC,YAAYd,SAASU,OAAAA,EAAS,CAAA;EAChD;EAEA,MAAMD,QAAAA;EAENV,KAAKgB,SAAS,aAAa,YAAA;GACvB,MAAMN,QAAAA;EACV,CAAA;CACJ,EACJ;AACJ"}

package/dist/core/authentication/index.mjs

@@ -12,5 +12,6 @@ import { UserAuthenticator } from "./entities/user/module.mjs";
 import "./entities/index.mjs";
 import { CredentialsAuthenticator } from "./module.mjs";
 import { SessionManager } from "./session/module.mjs";
+import { SESSION_FILTER_KEYS } from "./session/types.mjs";
 import "./session/index.mjs";
-export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsService, CredentialsAuthenticator, RobotAuthenticator, RobotCredentialsService, SessionManager, UserAuthenticator, UserCredentialsService };
+export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsService, CredentialsAuthenticator, RobotAuthenticator, RobotCredentialsService, SESSION_FILTER_KEYS, SessionManager, UserAuthenticator, UserCredentialsService };

package/dist/core/authentication/session/index.mjs

@@ -2,4 +2,5 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { SessionManager } from "./module.mjs";
-export { SessionManager };
+import { SESSION_FILTER_KEYS } from "./types.mjs";
+export { SESSION_FILTER_KEYS, SessionManager };

package/dist/core/authentication/session/module.d.ts

@@ -19,6 +19,7 @@ export declare class SessionManager implements ISessionManager {
      * @throws JWTError
      */
     findOneById(id: string): Promise<Session | null>;
+    revoke(id: string): Promise<void>;
     verify(session: Session): Promise<void>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/authentication/session/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EACR,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAEpB,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAI7B,GAAG,EAAE,qBAAqB;IAOtC;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BjD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAcjD;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMhD,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAShD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EACR,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAEpB,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAI7B,GAAG,EAAE,qBAAqB;IAOtC;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BjD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAcjD;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMhD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAShD"}

package/dist/core/authentication/session/module.mjs

@@ -54,6 +54,9 @@ var SessionManager = class {
 	*/ async findOneById(id) {
 		return this.repository.findOneById(id);
 	}
+	async revoke(id) {
+		await this.repository.removeById(id);
+	}
 	async verify(session) {
 		const ms = new Date(session.expires_at).getTime();
 		if (Date.now() > ms) {

package/dist/core/authentication/session/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ip_address","user_agent","expires_at","Date","now","maxAge","toISOString","sub_kind","CLIENT","client_id","sub","ROBOT","robot_id","USER","user_id","save","ping","session","seen_at","seenAt","getTime","threshold","refresh","refreshed_at","findOneById","id","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n    ISessionManager, \n    ISessionRepository, \n    SessionManagerContext, \n    SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n    protected options: SessionManagerOptions;\n\n    protected repository: ISessionRepository;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionManagerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Create/Update session\n     *\n     * @param input\n     */\n    async create(input: Partial<Session>): Promise<Session> {\n        input.ip_address = input.ip_address || '127.0.0.1';\n        input.user_agent = input.user_agent || 'system';\n        input.expires_at = input.expires_at || new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        switch (input.sub_kind) {\n            case IdentityType.CLIENT: {\n                input.client_id = input.sub;\n                break;\n            }\n            case IdentityType.ROBOT: {\n                input.robot_id = input.sub;\n                break;\n            }\n            case IdentityType.USER: {\n                input.user_id = input.sub;\n                break;\n            }\n        }\n\n        return this.repository.save(input);\n    }\n\n    // -----------------------------------------------------\n\n    async ping(session: Session): Promise<Session> {\n        if (session.seen_at) {\n            const seenAt = new Date(session.seen_at).getTime();\n            const threshold = seenAt + (5 * 1_000);\n\n            if (threshold > Date.now()) {\n                return session;\n            }\n        }\n\n        session.seen_at = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async refresh(session: Session): Promise<Session> {\n        const now = new Date().toISOString();\n        session.refreshed_at = now;\n        session.seen_at = now;\n\n        session.expires_at = new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Verify session on token inspection/verification.\n     *\n     * @param id\n     * @throws JWTError\n     */\n    async findOneById(id: string): Promise<Session | null> {\n        return this.repository.findOneById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async verify(session: Session): Promise<void> {\n        const ms = new Date(session.expires_at).getTime();\n        if (Date.now() > ms) {\n            await this.repository.remove(session);\n\n            // todo: better error\n            throw JWTError.expired();\n        }\n    }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,aAAaD,MAAMC,cAAc;EACvCD,MAAME,aAAaF,MAAME,cAAc;EACvCF,MAAMG,aAAaH,MAAMG,cAAc,IAAIC,KACvCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,UAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,YAAYV,MAAMW;IACxB;GAEJ,KAAKlB,aAAamB;IACdZ,MAAMa,WAAWb,MAAMW;IACvB;GAEJ,KAAKlB,aAAaqB;IACdd,MAAMe,UAAUf,MAAMW;IACtB;EAER;EAEA,OAAO,KAAKd,WAAWmB,KAAKhB,KAAAA;CAChC;CAIA,MAAMiB,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC;OACO,IAAIf,KAAKc,QAAQC,OAAO,CAAA,CAAEE,QACvBD,IAAU,IAAI,MAEhBhB,KAAKC,IAAG,GACpB,OAAOa;EAAAA;EAIfA,QAAQC,2BAAU,IAAIf,KAAAA,EAAAA,CAAOG,YAAW;EAExC,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;CAIA,MAAMK,QAAQL,SAAoC;EAC9C,MAAMb,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCW,QAAQM,eAAenB;EACvBa,QAAQC,UAAUd;EAElBa,QAAQf,aAAa,IAAIC,KACrBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMO,YAAYC,IAAqC;EACnD,OAAO,KAAK7B,WAAW4B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOT,SAAiC;EAC1C,MAAMU,KAAK,IAAIxB,KAAKc,QAAQf,UAAU,CAAA,CAAEkB,QAAO;EAC/C,IAAIjB,KAAKC,IAAG,IAAKuB,IAAI;GACjB,MAAM,KAAK/B,WAAWgC,OAAOX,OAAAA;GAG7B,MAAMxB,SAASoC,QAAO;EAC1B;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ip_address","user_agent","expires_at","Date","now","maxAge","toISOString","sub_kind","CLIENT","client_id","sub","ROBOT","robot_id","USER","user_id","save","ping","session","seen_at","seenAt","getTime","threshold","refresh","refreshed_at","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n    ISessionManager, \n    ISessionRepository, \n    SessionManagerContext, \n    SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n    protected options: SessionManagerOptions;\n\n    protected repository: ISessionRepository;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionManagerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Create/Update session\n     *\n     * @param input\n     */\n    async create(input: Partial<Session>): Promise<Session> {\n        input.ip_address = input.ip_address || '127.0.0.1';\n        input.user_agent = input.user_agent || 'system';\n        input.expires_at = input.expires_at || new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        switch (input.sub_kind) {\n            case IdentityType.CLIENT: {\n                input.client_id = input.sub;\n                break;\n            }\n            case IdentityType.ROBOT: {\n                input.robot_id = input.sub;\n                break;\n            }\n            case IdentityType.USER: {\n                input.user_id = input.sub;\n                break;\n            }\n        }\n\n        return this.repository.save(input);\n    }\n\n    // -----------------------------------------------------\n\n    async ping(session: Session): Promise<Session> {\n        if (session.seen_at) {\n            const seenAt = new Date(session.seen_at).getTime();\n            const threshold = seenAt + (5 * 1_000);\n\n            if (threshold > Date.now()) {\n                return session;\n            }\n        }\n\n        session.seen_at = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async refresh(session: Session): Promise<Session> {\n        const now = new Date().toISOString();\n        session.refreshed_at = now;\n        session.seen_at = now;\n\n        session.expires_at = new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Verify session on token inspection/verification.\n     *\n     * @param id\n     * @throws JWTError\n     */\n    async findOneById(id: string): Promise<Session | null> {\n        return this.repository.findOneById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async revoke(id: string): Promise<void> {\n        await this.repository.removeById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async verify(session: Session): Promise<void> {\n        const ms = new Date(session.expires_at).getTime();\n        if (Date.now() > ms) {\n            await this.repository.remove(session);\n\n            // todo: better error\n            throw JWTError.expired();\n        }\n    }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,aAAaD,MAAMC,cAAc;EACvCD,MAAME,aAAaF,MAAME,cAAc;EACvCF,MAAMG,aAAaH,MAAMG,cAAc,IAAIC,KACvCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,UAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,YAAYV,MAAMW;IACxB;GAEJ,KAAKlB,aAAamB;IACdZ,MAAMa,WAAWb,MAAMW;IACvB;GAEJ,KAAKlB,aAAaqB;IACdd,MAAMe,UAAUf,MAAMW;IACtB;EAER;EAEA,OAAO,KAAKd,WAAWmB,KAAKhB,KAAAA;CAChC;CAIA,MAAMiB,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC;OACO,IAAIf,KAAKc,QAAQC,OAAO,CAAA,CAAEE,QACvBD,IAAU,IAAI,MAEhBhB,KAAKC,IAAG,GACpB,OAAOa;EAAAA;EAIfA,QAAQC,2BAAU,IAAIf,KAAAA,EAAAA,CAAOG,YAAW;EAExC,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;CAIA,MAAMK,QAAQL,SAAoC;EAC9C,MAAMb,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCW,QAAQM,eAAenB;EACvBa,QAAQC,UAAUd;EAElBa,QAAQf,aAAa,IAAIC,KACrBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMO,YAAYC,IAAqC;EACnD,OAAO,KAAK7B,WAAW4B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,KAAK7B,WAAW+B,WAAWF,EAAAA;CACrC;CAIA,MAAMG,OAAOX,SAAiC;EAC1C,MAAMY,KAAK,IAAI1B,KAAKc,QAAQf,UAAU,CAAA,CAAEkB,QAAO;EAC/C,IAAIjB,KAAKC,IAAG,IAAKyB,IAAI;GACjB,MAAM,KAAKjC,WAAWkC,OAAOb,OAAAA;GAG7B,MAAMxB,SAASsC,QAAO;EAC1B;CACJ;AACJ"}

package/dist/core/authentication/session/types.d.ts

@@ -1,6 +1,33 @@
 import type { Session } from '@authup/core-kit';
+import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
+export type SessionOwner = {
+    sub: string;
+    subKind: string;
+};
+/**
+ * Filter keys a session query (list + bulk revoke) may target. Shared by the
+ * repository's rapiq `filters.allowed` and the service's "is this a targeted
+ * bulk revoke?" discriminator, so the two can never drift.
+ */
+export declare const SESSION_FILTER_KEYS: readonly ["id", "sub", "sub_kind", "user_id", "client_id", "robot_id", "realm_id"];
+export type SessionFindManyOptions = {
+    /**
+     * Force the result to a single subject (self-service). Applied as a
+     * mandatory WHERE that a rapiq query filter cannot override.
+     */
+    owner?: SessionOwner;
+};
 export interface ISessionRepository {
     findOneById(id: string): Promise<Session | null> | null;
+    findMany(query: Record<string, any>, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;
+    findAllByOwner(owner: SessionOwner): Promise<Session[]>;
+    /**
+     * Load EVERY session matching a rapiq query filter — **unbounded** (no
+     * pagination cap), because a bulk revoke must reach every match. Used by
+     * the admin "force-logout" path; per-session authorization is enforced by
+     * the caller (`SessionService`).
+     */
+    findAllByQuery(query: Record<string, any>): Promise<Session[]>;
     save(session: Partial<Session>): Promise<Session>;
     removeById(id: string): Promise<void>;
     remove(session: Session): Promise<void>;
@@ -47,5 +74,12 @@ export interface ISessionManager {
      * @param id
      */
     findOneById(id: string): Promise<Session | null>;
+    /**
+     * Revoke (delete) a session by id, forcing re-authentication. Idempotent —
+     * a no-op when the session does not exist.
+     *
+     * @param id
+     */
+    revoke(id: string): Promise<void>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/core/authentication/session/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAExD,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAChC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpD;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;CACpD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,YAAY,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,oFAQtB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAExD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzH,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAExD;;;;;OAKG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAE/D,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAChC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpD;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}

package/dist/core/authentication/session/types.mjs

@@ -1,4 +1,21 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-export {};
+//#region src/core/authentication/session/types.ts
+/**
+* Filter keys a session query (list + bulk revoke) may target. Shared by the
+* repository's rapiq `filters.allowed` and the service's "is this a targeted
+* bulk revoke?" discriminator, so the two can never drift.
+*/ const SESSION_FILTER_KEYS = [
+	"id",
+	"sub",
+	"sub_kind",
+	"user_id",
+	"client_id",
+	"robot_id",
+	"realm_id"
+];
+//#endregion
+export { SESSION_FILTER_KEYS };
+
+//# sourceMappingURL=types.mjs.map

package/dist/core/authentication/session/types.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.mjs","names":["SESSION_FILTER_KEYS"],"sources":["../../../../src/core/authentication/session/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type SessionOwner = {\n    sub: string,\n    subKind: string,\n};\n\n/**\n * Filter keys a session query (list + bulk revoke) may target. Shared by the\n * repository's rapiq `filters.allowed` and the service's \"is this a targeted\n * bulk revoke?\" discriminator, so the two can never drift.\n */\nexport const SESSION_FILTER_KEYS = [\n    'id',\n    'sub',\n    'sub_kind',\n    'user_id',\n    'client_id',\n    'robot_id',\n    'realm_id',\n] as const;\n\nexport type SessionFindManyOptions = {\n    /**\n     * Force the result to a single subject (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    owner?: SessionOwner,\n};\n\nexport interface ISessionRepository {\n    findOneById(id: string): Promise<Session | null> | null;\n\n    findMany(query: Record<string, any>, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;\n\n    findAllByOwner(owner: SessionOwner): Promise<Session[]>;\n\n    /**\n     * Load EVERY session matching a rapiq query filter — **unbounded** (no\n     * pagination cap), because a bulk revoke must reach every match. Used by\n     * the admin \"force-logout\" path; per-session authorization is enforced by\n     * the caller (`SessionService`).\n     */\n    findAllByQuery(query: Record<string, any>): Promise<Session[]>;\n\n    save(session: Partial<Session>): Promise<Session>;\n\n    removeById(id: string): Promise<void>;\n\n    remove(session: Session) : Promise<void>;\n}\n\nexport type SessionManagerOptions = {\n    /**\n     * Max age in seconds (sec).\n     */\n    maxAge: number\n};\n\nexport type SessionManagerContext = {\n    options: SessionManagerOptions,\n    repository: ISessionRepository,\n};\n\nexport interface ISessionManager {\n    /**\n     * Create new session.\n     *\n     * @param session\n     */\n    create(session: Partial<Session>): Promise<Session>;\n\n    /**\n     * Updates seen_at with current time.\n     *\n     * @param session\n     */\n    ping(session: Session) : Promise<Session>;\n\n    /**\n     * Updates refreshed_at, seen_at with current time.\n     *\n     * @param session\n     */\n    refresh(session: Session) : Promise<Session>;\n\n    /**\n     * Check if session exists and is valid.\n     *\n     * @throws JWTError\n     * @param session\n     */\n    verify(session: Session): Promise<void>;\n\n    /**\n     * Find session by id.\n     *\n     * @param id\n     */\n    findOneById(id: string): Promise<Session | null>;\n\n    /**\n     * Revoke (delete) a session by id, forcing re-authentication. Idempotent —\n     * a no-op when the session does not exist.\n     *\n     * @param id\n     */\n    revoke(id: string): Promise<void>;\n}\n"],"mappings":";;;;;;;;GAoBA,MAAaA,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA"}

package/dist/core/entities/client/service.mjs

@@ -5,7 +5,7 @@ import { ClientCredentialsService } from "../../authentication/credential/entiti
 import { ValidatorGroup, isUUID } from "@authup/kit";
 import { CLIENT_RESERVED_NAMES, ClientValidator, PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
-import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/client/service.ts
 var ClientService = class extends AbstractEntityService {
@@ -36,7 +36,10 @@ var ClientService = class extends AbstractEntityService {
 							PermissionName.CLIENT_UPDATE,
 							PermissionName.CLIENT_DELETE
 						],
-						input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+						data: definePolicyData({
+							[BuiltInPolicyType.ATTRIBUTES]: entity,
+							...this.resourceRealmMatch(entity)
+						})
 					});
 					data.push(entity);
 				} catch {
@@ -70,7 +73,10 @@ var ClientService = class extends AbstractEntityService {
 		}
 		if (!isMe && entity.secret && !entity.secret_encrypted && !entity.secret_hashed) await actor.permissionEvaluator.evaluateOneOf({
 			name: permissionNames,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
 		});
 		return entity;
 	}
@@ -120,12 +126,18 @@ var ClientService = class extends AbstractEntityService {
 			}
 			if (isSelfEdit) await actor.permissionEvaluator.evaluate({
 				name: PermissionName.CLIENT_SELF_MANAGE,
-				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: validated,
+					...this.resourceRealmMatch(validated)
+				})
 			});
 			entity = this.repository.merge(entity, validated);
 			if (!isSelfEdit) await actor.permissionEvaluator.evaluate({
 				name: PermissionName.CLIENT_UPDATE,
-				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
 			});
 			if (entity.is_confidential) {
 				if (!validated.secret && !entity.secret) validated.secret = credentialsService.generateSecret();
@@ -143,7 +155,10 @@ var ClientService = class extends AbstractEntityService {
 		}
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.CLIENT_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: validated,
+				...this.resourceRealmMatch(validated)
+			})
 		});
 		entity = this.repository.create(validated);
 		if (entity.is_confidential) {
@@ -162,7 +177,10 @@ var ClientService = class extends AbstractEntityService {
 		if (!entity) throw new EntityNotFoundError();
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.CLIENT_DELETE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
 		});
 		const { id: entityId } = entity;
 		await this.repository.remove(entity);

package/dist/core/entities/client/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ValidatorGroup","isUUID","BadRequestError","EntityNotFoundError","CLIENT_RESERVED_NAMES","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","data","entities","meta","findMany","total","entity","secret","secret_encrypted","secret_hashed","evaluateOneOf","input","ATTRIBUTES","push","getOne","idOrName","realmId","permissionNames","isMe","identity","type","id","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","built_in","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","is_confidential","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    CLIENT_RESERVED_NAMES,\n    ClientValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\n\nexport type ClientServiceContext = {\n    repository: IClientRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n    protected repository: IClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ClientValidator;\n\n    constructor(ctx: ClientServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ClientValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Client>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n        let { total } = meta;\n\n        const data: Client[] = [];\n        for (const entity of entities) {\n            if (\n                entity.secret &&\n                !entity.secret_encrypted &&\n                !entity.secret_hashed\n            ) {\n                try {\n                    await actor.permissionEvaluator.evaluateOneOf({\n                        name: [\n                            PermissionName.CLIENT_READ,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                        ],\n                        input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n                    });\n                    data.push(entity);\n                } catch {\n                    total -= 1;\n                }\n\n                continue;\n            }\n\n            data.push(entity);\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<Client> {\n        const permissionNames = [\n            PermissionName.CLIENT_READ,\n            PermissionName.CLIENT_UPDATE,\n            PermissionName.CLIENT_DELETE,\n        ];\n\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'client' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        const entity = await this.repository.findOne(idOrName, query, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        if (\n            !isMe &&\n            entity.secret &&\n            !entity.secret_encrypted &&\n            !entity.secret_hashed\n        ) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: permissionNames,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Client,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Client | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneWithSecret(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'client' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n            }\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        // Reserve the system-provisioned client names (`system`, `web`) so an\n        // API caller can't create or rename a client onto them — that would\n        // collide on unique(name, realm_id) or shadow the built_in client.\n        // Provisioning and runtime hooks bypass this service, so they remain\n        // free to manage the reserved clients. built_in clients are exempt\n        // (they ARE the provisioned ones) but API callers can never produce a\n        // built_in client since the validator strips the flag.\n        if (\n            typeof validated.name === 'string' &&\n            CLIENT_RESERVED_NAMES.includes(validated.name) &&\n            !(entity && entity.built_in && entity.name === validated.name)\n        ) {\n            throw new BadRequestError(`The client name '${validated.name}' is reserved.`);\n        }\n\n        await this.repository.validateJoinColumns(validated);\n        await this.repository.checkUniqueness(validated, entity || undefined);\n\n        const credentialsService = new ClientCredentialsService();\n\n        if (entity) {\n            if (\n                !isSelfEdit &&\n                !validated.realm_id &&\n                !entity.realm_id\n            ) {\n                const actorRealmId = this.getActorRealmId(actor);\n                if (actorRealmId) {\n                    validated.realm_id = actorRealmId;\n                }\n            }\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_SELF_MANAGE,\n                    input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_UPDATE,\n                    input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n                });\n            }\n\n            if (entity.is_confidential) {\n                if (!validated.secret && !entity.secret) {\n                    validated.secret = credentialsService.generateSecret();\n                }\n\n                if (validated.secret) {\n                    entity.secret = await credentialsService.protect(validated.secret, entity);\n                }\n            } else {\n                entity.secret = null;\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realm_id) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realm_id = actorRealmId;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        entity = this.repository.create(validated);\n\n        if (entity.is_confidential) {\n            if (!validated.secret) {\n                validated.secret = credentialsService.generateSecret();\n            }\n\n            entity.secret = await credentialsService.protect(validated.secret, validated);\n        } else {\n            entity.secret = null;\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;AA2BA,IAAaW,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,gBAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,KAAAA;EACnC,IAAI,EAAEY,UAAUF;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMK,UAAUJ,UAAU;GAC3B,IACII,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eACV;IACE,IAAI;KACA,MAAMf,MAAMC,oBAAoBe,cAAc;MAC1Cb,MAAM;OACFb,eAAec;OACfd,eAAee;OACff,eAAegB;;MAEnBW,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaN,OAAO,CAAA;KACnE,CAAA;KACAL,KAAKY,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAJ,KAAKY,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHL;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACe;EACf,MAAMC,kBAAkB;GACpBjC,eAAec;GACfd,eAAee;GACff,eAAegB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMyB,YACfzB,MAAMyB,SAASC,SAAS,aAEpB1B,MAAMyB,SAASlB,KAAKoB,OAAON,YAC3BrB,MAAMyB,SAASlB,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKlB,WAAWkC,QAAQP,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAIzB,oBAAAA;EAGd,IAAIqC,QAAQxB,MAAMyB,SAAUlB,KAAKoB,OAAOf,OAAOe,IAAI;GAC/CH,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACC,QACDZ,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eAER,MAAMf,MAAMC,oBAAoBe,cAAc;GAC1Cb,MAAMoB;GACNN,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaN,OAAO,CAAA;EACnE,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFtB,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWxB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMoB,OACFX,UACAd,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKT,UAAUd,MAAMP,OAAO,EAAEiC,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAd,MACAP,OACAkC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO7B,KAAK8B,aAAa,WACnC,MAAM,KAAK1C,gBAAgB2C,QAAQ/B,KAAK8B,QAAQ,IAChDN,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMkB,QAA6B,CAAC;GACpC,IAAItD,OAAOoC,QAAAA,GACPkB,MAAMZ,KAAKN;QAEXkB,MAAMpC,OAAOkB;GAGjB,IAAIe,OACAG,MAAMF,WAAWD,MAAMT;GAG3Bf,SAAS,MAAM,KAAKlB,WAAW8C,kBAAkBD,KAAAA;GACjD,IAAI,CAAC3B,UAAUsB,QAAQD,YACnB,MAAM,IAAI9C,oBAAAA;EAElB,OAAO,IAAI+C,QAAQD,YACf,MAAM,IAAI9C,oBAAAA;EAGd,IAAIsD,aAAa;EACjB,IAAI7B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAee,cAAc,CAAA;GACrF,SAASsC,GAAG;IACR,IACI,CAAC3C,MAAMyB,YACPzB,MAAMyB,SAASC,SAAS,YACxB1B,MAAMyB,SAASlB,KAAKoB,OAAOf,OAAOe,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMzC,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAesD,mBAAmB,CAAA;GAC1F;GACAT,QAAQnD,eAAe6D;EAC3B,OAAO;GACH,MAAM7C,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAewD,cAAc,CAAA;GACjFX,QAAQnD,eAAe+D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKpD,UAAUqD,IAAI1C,MAAM,EAAE4B,MAAM,CAAA;EASzD,IACI,OAAOa,UAAU7C,SAAS,YAC1Bf,sBAAsB8D,SAASF,UAAU7C,IAAI,KAC7C,EAAES,UAAUA,OAAOuC,YAAYvC,OAAOT,SAAS6C,UAAU7C,OAEzD,MAAM,IAAIjB,gBAAgB,oBAAoB8D,UAAU7C,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAW0D,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKtD,WAAW2D,gBAAgBL,WAAWpC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI9D,yBAAAA;EAE/B,IAAIoB,QAAQ;GACR,IACI,CAAC6B,cACD,CAACO,UAAUX,YACX,CAACzB,OAAOyB,UACV;IACE,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;IAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;GAE7B;GAEA,IAAId,YACA,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAesD;IACrB3B,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAa8B,UAAU,CAAA;GACtE,CAAA;GAGJpC,SAAS,KAAKlB,WAAWgE,MAAM9C,QAAQoC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAee;IACrBY,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaN,OAAO,CAAA;GACnE,CAAA;GAGJ,IAAIA,OAAO+C,iBAAiB;IACxB,IAAI,CAACX,UAAUnC,UAAU,CAACD,OAAOC,QAC7BmC,UAAUnC,SAASyC,mBAAmBM,eAAc;IAGxD,IAAIZ,UAAUnC,QACVD,OAAOC,SAAS,MAAMyC,mBAAmBO,QAAQb,UAAUnC,QAAQD,MAAAA;GAE3E,OACIA,OAAOC,SAAS;GAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAkD,SAAS;GACb;EACJ;EAEA,IAAI,CAACd,UAAUX,UAAU;GACrB,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;GAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;EAE7B;EAEA,MAAMvD,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAewD;GACrB7B,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAa8B,UAAU,CAAA;EACtE,CAAA;EAEApC,SAAS,KAAKlB,WAAWmC,OAAOmB,SAAAA;EAEhC,IAAIpC,OAAO+C,iBAAiB;GACxB,IAAI,CAACX,UAAUnC,QACXmC,UAAUnC,SAASyC,mBAAmBM,eAAc;GAGxDhD,OAAOC,SAAS,MAAMyC,mBAAmBO,QAAQb,UAAUnC,QAAQmC,SAAAA;EACvE,OACIpC,OAAOC,SAAS;EAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAkD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFpC,IACA3B,OACe;EACf,MAAMA,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAegB,cAAc,CAAA;EAEjF,MAAMM,SAAS,MAAM,KAAKlB,WAAWsE,UAAU,EAAErC,GAAG,CAAA;EACpD,IAAI,CAACf,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAMa,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAegB;GACrBW,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaN,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEe,IAAIsC,aAAarD;EACzB,MAAM,KAAKlB,WAAWwE,OAAOtD,MAAAA;EAC7BA,OAAOe,KAAKsC;EAEZ,OAAOrD;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","BadRequestError","EntityNotFoundError","CLIENT_RESERVED_NAMES","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","data","entities","meta","findMany","total","entity","secret","secret_encrypted","secret_hashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","realmId","permissionNames","isMe","identity","type","id","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","built_in","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","is_confidential","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    CLIENT_RESERVED_NAMES,\n    ClientValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\n\nexport type ClientServiceContext = {\n    repository: IClientRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n    protected repository: IClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ClientValidator;\n\n    constructor(ctx: ClientServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ClientValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Client>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n        let { total } = meta;\n\n        const data: Client[] = [];\n        for (const entity of entities) {\n            if (\n                entity.secret &&\n                !entity.secret_encrypted &&\n                !entity.secret_hashed\n            ) {\n                try {\n                    await actor.permissionEvaluator.evaluateOneOf({\n                        name: [\n                            PermissionName.CLIENT_READ,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                        ],\n                        data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                    });\n                    data.push(entity);\n                } catch {\n                    total -= 1;\n                }\n\n                continue;\n            }\n\n            data.push(entity);\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<Client> {\n        const permissionNames = [\n            PermissionName.CLIENT_READ,\n            PermissionName.CLIENT_UPDATE,\n            PermissionName.CLIENT_DELETE,\n        ];\n\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'client' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        const entity = await this.repository.findOne(idOrName, query, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        if (\n            !isMe &&\n            entity.secret &&\n            !entity.secret_encrypted &&\n            !entity.secret_hashed\n        ) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: permissionNames,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Client,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Client | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneWithSecret(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'client' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n            }\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        // Reserve the system-provisioned client names (`system`, `web`) so an\n        // API caller can't create or rename a client onto them — that would\n        // collide on unique(name, realm_id) or shadow the built_in client.\n        // Provisioning and runtime hooks bypass this service, so they remain\n        // free to manage the reserved clients. built_in clients are exempt\n        // (they ARE the provisioned ones) but API callers can never produce a\n        // built_in client since the validator strips the flag.\n        if (\n            typeof validated.name === 'string' &&\n            CLIENT_RESERVED_NAMES.includes(validated.name) &&\n            !(entity && entity.built_in && entity.name === validated.name)\n        ) {\n            throw new BadRequestError(`The client name '${validated.name}' is reserved.`);\n        }\n\n        await this.repository.validateJoinColumns(validated);\n        await this.repository.checkUniqueness(validated, entity || undefined);\n\n        const credentialsService = new ClientCredentialsService();\n\n        if (entity) {\n            if (\n                !isSelfEdit &&\n                !validated.realm_id &&\n                !entity.realm_id\n            ) {\n                const actorRealmId = this.getActorRealmId(actor);\n                if (actorRealmId) {\n                    validated.realm_id = actorRealmId;\n                }\n            }\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_UPDATE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n            }\n\n            if (entity.is_confidential) {\n                if (!validated.secret && !entity.secret) {\n                    validated.secret = credentialsService.generateSecret();\n                }\n\n                if (validated.secret) {\n                    entity.secret = await credentialsService.protect(validated.secret, entity);\n                }\n            } else {\n                entity.secret = null;\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realm_id) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realm_id = actorRealmId;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        entity = this.repository.create(validated);\n\n        if (entity.is_confidential) {\n            if (!validated.secret) {\n                validated.secret = credentialsService.generateSecret();\n            }\n\n            entity.secret = await credentialsService.protect(validated.secret, validated);\n        } else {\n            entity.secret = null;\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;AA2BA,IAAaW,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,gBAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,KAAAA;EACnC,IAAI,EAAEY,UAAUF;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMK,UAAUJ,UAAU;GAC3B,IACII,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eACV;IACE,IAAI;KACA,MAAMf,MAAMC,oBAAoBe,cAAc;MAC1Cb,MAAM;OACFb,eAAec;OACfd,eAAee;OACff,eAAegB;;MAEnBC,MAAMxB,iBAAiB;QAAGD,kBAAkBmC,aAAaL;OAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;MAAQ,CAAA;KACxG,CAAA;KACAL,KAAKY,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAJ,KAAKY,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHL;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACe;EACf,MAAMC,kBAAkB;GACpBjC,eAAec;GACfd,eAAee;GACff,eAAegB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMyB,YACfzB,MAAMyB,SAASC,SAAS,aAEpB1B,MAAMyB,SAASlB,KAAKoB,OAAON,YAC3BrB,MAAMyB,SAASlB,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKlB,WAAWkC,QAAQP,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAIzB,oBAAAA;EAGd,IAAIqC,QAAQxB,MAAMyB,SAAUlB,KAAKoB,OAAOf,OAAOe,IAAI;GAC/CH,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACC,QACDZ,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eAER,MAAMf,MAAMC,oBAAoBe,cAAc;GAC1Cb,MAAMoB;GACNhB,MAAMxB,iBAAiB;KAAGD,kBAAkBmC,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFtB,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWxB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMoB,OACFX,UACAd,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKT,UAAUd,MAAMP,OAAO,EAAEiC,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAd,MACAP,OACAkC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO7B,KAAK8B,aAAa,WACnC,MAAM,KAAK1C,gBAAgB2C,QAAQ/B,KAAK8B,QAAQ,IAChDN,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMkB,QAA6B,CAAC;GACpC,IAAItD,OAAOoC,QAAAA,GACPkB,MAAMZ,KAAKN;QAEXkB,MAAMpC,OAAOkB;GAGjB,IAAIe,OACAG,MAAMF,WAAWD,MAAMT;GAG3Bf,SAAS,MAAM,KAAKlB,WAAW8C,kBAAkBD,KAAAA;GACjD,IAAI,CAAC3B,UAAUsB,QAAQD,YACnB,MAAM,IAAI9C,oBAAAA;EAElB,OAAO,IAAI+C,QAAQD,YACf,MAAM,IAAI9C,oBAAAA;EAGd,IAAIsD,aAAa;EACjB,IAAI7B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAee,cAAc,CAAA;GACrF,SAASsC,GAAG;IACR,IACI,CAAC3C,MAAMyB,YACPzB,MAAMyB,SAASC,SAAS,YACxB1B,MAAMyB,SAASlB,KAAKoB,OAAOf,OAAOe,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMzC,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAesD,mBAAmB,CAAA;GAC1F;GACAT,QAAQnD,eAAe6D;EAC3B,OAAO;GACH,MAAM7C,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAewD,cAAc,CAAA;GACjFX,QAAQnD,eAAe+D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKpD,UAAUqD,IAAI1C,MAAM,EAAE4B,MAAM,CAAA;EASzD,IACI,OAAOa,UAAU7C,SAAS,YAC1Bf,sBAAsB8D,SAASF,UAAU7C,IAAI,KAC7C,EAAES,UAAUA,OAAOuC,YAAYvC,OAAOT,SAAS6C,UAAU7C,OAEzD,MAAM,IAAIjB,gBAAgB,oBAAoB8D,UAAU7C,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAW0D,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKtD,WAAW2D,gBAAgBL,WAAWpC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI9D,yBAAAA;EAE/B,IAAIoB,QAAQ;GACR,IACI,CAAC6B,cACD,CAACO,UAAUX,YACX,CAACzB,OAAOyB,UACV;IACE,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;IAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;GAE7B;GAEA,IAAId,YACA,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAesD;IACrBrC,MAAMxB,iBAAiB;MAAGD,kBAAkBmC,aAAa+B;KAAW,GAAG,KAAK9B,mBAAmB8B,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJpC,SAAS,KAAKlB,WAAWgE,MAAM9C,QAAQoC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAee;IACrBE,MAAMxB,iBAAiB;MAAGD,kBAAkBmC,aAAaL;KAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAO+C,iBAAiB;IACxB,IAAI,CAACX,UAAUnC,UAAU,CAACD,OAAOC,QAC7BmC,UAAUnC,SAASyC,mBAAmBM,eAAc;IAGxD,IAAIZ,UAAUnC,QACVD,OAAOC,SAAS,MAAMyC,mBAAmBO,QAAQb,UAAUnC,QAAQD,MAAAA;GAE3E,OACIA,OAAOC,SAAS;GAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAkD,SAAS;GACb;EACJ;EAEA,IAAI,CAACd,UAAUX,UAAU;GACrB,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;GAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;EAE7B;EAEA,MAAMvD,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAewD;GACrBvC,MAAMxB,iBAAiB;KAAGD,kBAAkBmC,aAAa+B;IAAW,GAAG,KAAK9B,mBAAmB8B,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEApC,SAAS,KAAKlB,WAAWmC,OAAOmB,SAAAA;EAEhC,IAAIpC,OAAO+C,iBAAiB;GACxB,IAAI,CAACX,UAAUnC,QACXmC,UAAUnC,SAASyC,mBAAmBM,eAAc;GAGxDhD,OAAOC,SAAS,MAAMyC,mBAAmBO,QAAQb,UAAUnC,QAAQmC,SAAAA;EACvE,OACIpC,OAAOC,SAAS;EAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAkD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFpC,IACA3B,OACe;EACf,MAAMA,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAegB,cAAc,CAAA;EAEjF,MAAMM,SAAS,MAAM,KAAKlB,WAAWsE,UAAU,EAAErC,GAAG,CAAA;EACpD,IAAI,CAACf,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAMa,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAegB;GACrBC,MAAMxB,iBAAiB;KAAGD,kBAAkBmC,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEe,IAAIsC,aAAarD;EACzB,MAAM,KAAKlB,WAAWwE,OAAOtD,MAAAA;EAC7BA,OAAOe,KAAKsC;EAEZ,OAAOrD;CACX;AACJ"}

package/dist/core/entities/client/web-client.d.ts

@@ -15,9 +15,11 @@ export type WebClientProvisionerContext = {
  * `global` scope lets the issued token drive the management API (parity
  * with the legacy password-grant admin login); `openid` for the id-token.
  *
- * `grant_types` is metadata only — the auth-code grant issues a refresh
- * token regardless — but it documents the intended flow. `redirect_uri` is
- * one `<origin>/**` wildcard per trusted origin (matched by isSimpleMatch).
+ * `grant_types` is an enforced allowlist (`assertClientGrantAllowed` at the
+ * /token grants and the /authorize code-request verifier; null = allow-all),
+ * so it must list every flow the client uses. `redirect_uri` and
+ * `post_logout_redirect_uri` are each one `<origin>/**` wildcard per trusted
+ * origin (matched by isSimpleMatch).
  */
 export declare function buildWebClientAttributes(realm: Realm | {
     id: string;

package/dist/core/entities/client/web-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAMtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAsCrE"}
+{"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAMtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAsCrE"}

package/dist/core/entities/client/web-client.mjs

@@ -12,10 +12,13 @@ import { CLIENT_WEB_NAME, ScopeName } from "@authup/core-kit";
 * `global` scope lets the issued token drive the management API (parity
 * with the legacy password-grant admin login); `openid` for the id-token.
 *
-* `grant_types` is metadata only — the auth-code grant issues a refresh
-* token regardless — but it documents the intended flow. `redirect_uri` is
-* one `<origin>/**` wildcard per trusted origin (matched by isSimpleMatch).
+* `grant_types` is an enforced allowlist (`assertClientGrantAllowed` at the
+* /token grants and the /authorize code-request verifier; null = allow-all),
+* so it must list every flow the client uses. `redirect_uri` and
+* `post_logout_redirect_uri` are each one `<origin>/**` wildcard per trusted
+* origin (matched by isSimpleMatch).
 */ function buildWebClientAttributes(realm, appOrigins) {
+	const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(",");
 	return {
 		name: CLIENT_WEB_NAME,
 		realm_id: realm.id,
@@ -24,7 +27,8 @@ import { CLIENT_WEB_NAME, ScopeName } from "@authup/core-kit";
 		active: true,
 		grant_types: "authorization_code refresh_token",
 		scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,
-		redirect_uri: appOrigins.map((origin) => `${origin}/**`).join(",")
+		redirect_uri: originPatterns,
+		post_logout_redirect_uri: originPatterns
 	};
 }
 var WebClientProvisioner = class {

package/dist/core/entities/client/web-client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"web-client.mjs","names":["CLIENT_WEB_NAME","ScopeName","buildWebClientAttributes","realm","appOrigins","name","realm_id","id","is_confidential","built_in","active","grant_types","scope","GLOBAL","OPEN_ID","redirect_uri","map","origin","join","WebClientProvisioner","clientRepository","logger","ctx","ensureForRealm","attributes","existing","findOneBy","warn","isDirty","Object","keys","some","key","merged","merge","save","entity","create"],"sources":["../../../../src/core/entities/client/web-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { CLIENT_WEB_NAME, ScopeName  } from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientRepository, IWebClientProvisioner } from './types.ts';\n\nexport type WebClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * Build the attribute set for a realm's public `web` client.\n *\n * Public (PKCE) client used by authup's own client-web and any downstream\n * UI embedding client-web-kit. `built_in` makes it auto-consent in the\n * /authorize flow and protects it from the API reserved-name guard. The\n * `global` scope lets the issued token drive the management API (parity\n * with the legacy password-grant admin login); `openid` for the id-token.\n *\n * `grant_types` is metadata only — the auth-code grant issues a refresh\n * token regardless — but it documents the intended flow. `redirect_uri` is\n * one `<origin>/**` wildcard per trusted origin (matched by isSimpleMatch).\n */\nexport function buildWebClientAttributes(\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    return {\n        name: CLIENT_WEB_NAME,\n        realm_id: realm.id,\n        is_confidential: false,\n        built_in: true,\n        active: true,\n        grant_types: 'authorization_code refresh_token',\n        scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,\n        redirect_uri: appOrigins.map((origin) => `${origin}/**`).join(','),\n    };\n}\n\nexport class WebClientProvisioner implements IWebClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: WebClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const attributes = buildWebClientAttributes(realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: CLIENT_WEB_NAME,\n            realm_id: realm.id,\n        });\n\n        if (existing) {\n            // Never overwrite a non-built_in client that happens to be named\n            // `web` — that would be a user-owned client. Skip and warn.\n            if (!existing.built_in) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping web client provisioning for realm ${realm.id}: a non-built-in client named '${CLIENT_WEB_NAME}' already exists.`,\n                    );\n                }\n                return;\n            }\n\n            // MERGE: refresh attributes (e.g. redirect_uri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updated_at) per realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return;\n            }\n\n            const merged = this.clientRepository.merge(existing, attributes);\n            await this.clientRepository.save(merged);\n            return;\n        }\n\n        const entity = this.clientRepository.create(attributes);\n        await this.clientRepository.save(entity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;GA+BA,SAAgBE,yBACZC,OACAC,YAAoB;CAEpB,OAAO;EACHC,MAAML;EACNM,UAAUH,MAAMI;EAChBC,iBAAiB;EACjBC,UAAU;EACVC,QAAQ;EACRC,aAAa;EACbC,OAAO,GAAGX,UAAUY,OAAO,GAAGZ,UAAUa;EACxCC,cAAcX,WAAWY,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAClE;AACJ;AAEA,IAAaC,uBAAb,MAAaA;CACCC;CAEAhB;CAEAiB;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKhB,aAAakB,IAAIlB;EACtB,KAAKiB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAepB,OAA8C;EAC/D,MAAMqB,aAAatB,yBAAyBC,OAAO,KAAKC,UAAU;EAElE,MAAMqB,WAAW,MAAM,KAAKL,iBAAiBM,UAAU;GACnDrB,MAAML;GACNM,UAAUH,MAAMI;EACpB,CAAA;EAEA,IAAIkB,UAAU;GAGV,IAAI,CAACA,SAAShB,UAAU;IACpB,IAAI,KAAKY,QACL,KAAKA,OAAOM,KACR,8CAA8CxB,MAAMI,GAAG,iCAAiCP,gBAAgB,kBAAkB;IAGlI;GACJ;GAQA,IAAI,CAFY,OAAQ8B,KAAKN,UAAAA,CAAAA,CACxBO,MAAMC,QAAQP,SAASO,SAASR,WAAWQ,IAC3CJ,GACD;GAGJ,MAAMK,SAAS,KAAKb,iBAAiBc,MAAMT,UAAUD,UAAAA;GACrD,MAAM,KAAKJ,iBAAiBe,KAAKF,MAAAA;GACjC;EACJ;EAEA,MAAMG,SAAS,KAAKhB,iBAAiBiB,OAAOb,UAAAA;EAC5C,MAAM,KAAKJ,iBAAiBe,KAAKC,MAAAA;CACrC;AACJ"}
+{"version":3,"file":"web-client.mjs","names":["CLIENT_WEB_NAME","ScopeName","buildWebClientAttributes","realm","appOrigins","originPatterns","map","origin","join","name","realm_id","id","is_confidential","built_in","active","grant_types","scope","GLOBAL","OPEN_ID","redirect_uri","post_logout_redirect_uri","WebClientProvisioner","clientRepository","logger","ctx","ensureForRealm","attributes","existing","findOneBy","warn","isDirty","Object","keys","some","key","merged","merge","save","entity","create"],"sources":["../../../../src/core/entities/client/web-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { CLIENT_WEB_NAME, ScopeName  } from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientRepository, IWebClientProvisioner } from './types.ts';\n\nexport type WebClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * Build the attribute set for a realm's public `web` client.\n *\n * Public (PKCE) client used by authup's own client-web and any downstream\n * UI embedding client-web-kit. `built_in` makes it auto-consent in the\n * /authorize flow and protects it from the API reserved-name guard. The\n * `global` scope lets the issued token drive the management API (parity\n * with the legacy password-grant admin login); `openid` for the id-token.\n *\n * `grant_types` is an enforced allowlist (`assertClientGrantAllowed` at the\n * /token grants and the /authorize code-request verifier; null = allow-all),\n * so it must list every flow the client uses. `redirect_uri` and\n * `post_logout_redirect_uri` are each one `<origin>/**` wildcard per trusted\n * origin (matched by isSimpleMatch).\n */\nexport function buildWebClientAttributes(\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(',');\n\n    return {\n        name: CLIENT_WEB_NAME,\n        realm_id: realm.id,\n        is_confidential: false,\n        built_in: true,\n        active: true,\n        grant_types: 'authorization_code refresh_token',\n        scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,\n        redirect_uri: originPatterns,\n        post_logout_redirect_uri: originPatterns,\n    };\n}\n\nexport class WebClientProvisioner implements IWebClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: WebClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const attributes = buildWebClientAttributes(realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: CLIENT_WEB_NAME,\n            realm_id: realm.id,\n        });\n\n        if (existing) {\n            // Never overwrite a non-built_in client that happens to be named\n            // `web` — that would be a user-owned client. Skip and warn.\n            if (!existing.built_in) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping web client provisioning for realm ${realm.id}: a non-built-in client named '${CLIENT_WEB_NAME}' already exists.`,\n                    );\n                }\n                return;\n            }\n\n            // MERGE: refresh attributes (e.g. redirect_uri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updated_at) per realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return;\n            }\n\n            const merged = this.clientRepository.merge(existing, attributes);\n            await this.clientRepository.save(merged);\n            return;\n        }\n\n        const entity = this.clientRepository.create(attributes);\n        await this.clientRepository.save(entity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;GAiCA,SAAgBE,yBACZC,OACAC,YAAoB;CAEpB,MAAMC,iBAAiBD,WAAWE,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAEvE,OAAO;EACHC,MAAMT;EACNU,UAAUP,MAAMQ;EAChBC,iBAAiB;EACjBC,UAAU;EACVC,QAAQ;EACRC,aAAa;EACbC,OAAO,GAAGf,UAAUgB,OAAO,GAAGhB,UAAUiB;EACxCC,cAAcd;EACde,0BAA0Bf;CAC9B;AACJ;AAEA,IAAagB,uBAAb,MAAaA;CACCC;CAEAlB;CAEAmB;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKlB,aAAaoB,IAAIpB;EACtB,KAAKmB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAetB,OAA8C;EAC/D,MAAMuB,aAAaxB,yBAAyBC,OAAO,KAAKC,UAAU;EAElE,MAAMuB,WAAW,MAAM,KAAKL,iBAAiBM,UAAU;GACnDnB,MAAMT;GACNU,UAAUP,MAAMQ;EACpB,CAAA;EAEA,IAAIgB,UAAU;GAGV,IAAI,CAACA,SAASd,UAAU;IACpB,IAAI,KAAKU,QACL,KAAKA,OAAOM,KACR,8CAA8C1B,MAAMQ,GAAG,iCAAiCX,gBAAgB,kBAAkB;IAGlI;GACJ;GAQA,IAAI,CAFY,OAAQgC,KAAKN,UAAAA,CAAAA,CACxBO,MAAMC,QAAQP,SAASO,SAASR,WAAWQ,IAC3CJ,GACD;GAGJ,MAAMK,SAAS,KAAKb,iBAAiBc,MAAMT,UAAUD,UAAAA;GACrD,MAAM,KAAKJ,iBAAiBe,KAAKF,MAAAA;GACjC;EACJ;EAEA,MAAMG,SAAS,KAAKhB,iBAAiBiB,OAAOb,UAAAA;EAC5C,MAAM,KAAKJ,iBAAiBe,KAAKC,MAAAA;CACrC;AACJ"}

package/dist/core/entities/client-permission/service.d.ts

@@ -1,15 +1,18 @@
 import { ClientPermissionValidator } from '@authup/core-kit';
-import type { ClientPermission } from '@authup/core-kit';
+import type { ClientPermission, Permission } from '@authup/core-kit';
 import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
-import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
-import { AbstractEntityService } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
+import { JunctionEntityService } from '@authup/server-kit';
 import type { IClientPermissionRepository, IClientPermissionService } from './types.ts';
 export type ClientPermissionServiceContext = {
     repository: IClientPermissionRepository;
+    permissionRepository: IEntityRepository<Permission>;
     identityPermissionProvider: IIdentityPermissionProvider;
 };
-export declare class ClientPermissionService extends AbstractEntityService implements IClientPermissionService {
+export declare class ClientPermissionService extends JunctionEntityService implements IClientPermissionService {
+    protected readonly ownerRealmKey = "client_realm_id";
     protected repository: IClientPermissionRepository;
+    protected permissionRepository: IEntityRepository<Permission>;
     protected identityPermissionProvider: IIdentityPermissionProvider;
     protected validator: ClientPermissionValidator;
     constructor(ctx: ClientPermissionServiceContext);