@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.52

package/dist/core/entities/index.mjs

@@ -32,6 +32,8 @@ import { RolePermissionService } from "./role-permission/service.mjs";
 import "./role-permission/index.mjs";
 import { ScopeService } from "./scope/service.mjs";
 import "./scope/index.mjs";
+import { SessionService } from "./session/service.mjs";
+import "./session/index.mjs";
 import { UserService } from "./user/service.mjs";
 import "./user/index.mjs";
 import { UserAttributeService } from "./user-attribute/service.mjs";
@@ -42,4 +44,4 @@ import { UserRoleService } from "./user-role/service.mjs";
 import "./user-role/index.mjs";
 import { IdentityProviderRoleMappingService } from "./identity-provider-role-mapping/service.mjs";
 import "./identity-provider-role-mapping/index.mjs";
-export { ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, IdentityProviderRoleMappingService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RobotPermissionService, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleService, ScopeService, UserAttributeService, UserPermissionService, UserRoleService, UserService, WebClientProvisioner, buildWebClientAttributes };
+export { ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, IdentityProviderRoleMappingService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RobotPermissionService, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleService, ScopeService, SessionService, UserAttributeService, UserPermissionService, UserRoleService, UserService, WebClientProvisioner, buildWebClientAttributes };

package/dist/core/entities/permission/service.d.ts

@@ -50,9 +50,9 @@ export declare class PermissionService extends AbstractEntityService implements
     /**
      * Assign a newly created permission to all matching realm_admin roles.
      *
-     * Uses differentiated junction policies:
-     * - CUD on global-capable entity types → system.realm-bound
-     * - Everything else → system.realm-or-global
+     * Uses differentiated realm_scope on the junction:
+     * - CUD on global-capable entity types → own (strictly own realm)
+     * - Everything else → ownOrNull (own realm + null/global resources)
      *
      * Eligible permissions:
      * - Built-in authup permissions (global) — assigned to all realm_admin roles
@@ -61,8 +61,6 @@ export declare class PermissionService extends AbstractEntityService implements
      * Excluded:
      * - Realm CRUD permissions (realm_create, realm_update, realm_delete)
      * - Custom global permissions (non-built-in with realm_id: null)
-     *
-     * Fails closed: skips assignment entirely if required policies are not found.
      */
     private assignToRealmAdminRoles;
 }

package/dist/core/entities/permission/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAEH,mBAAmB,EAGtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA0C5E,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,qBAAqB,CAAC;IAClC,eAAe,EAAE,gBAAgB,CAAC;IAClC,cAAc,EAAE,eAAe,CAAC;IAChC,wBAAwB,EAAE,yBAAyB,CAAC;IACpD,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,qBAAsB,YAAW,kBAAkB;IACtF,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAE5C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,wBAAwB,EAAE,yBAAyB,CAAC;IAE9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC;gBAE7B,GAAG,EAAE,wBAAwB;IAWnC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAYhD,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAiBhB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAKhB,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAKhB,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IA+FI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAwBtB;;;;OAIG;YACW,mBAAmB;IAuBjC;;;OAGG;YACW,iBAAiB;IAuB/B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;CA4CxC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission/service.ts"],"names":[],"mappings":"AAeA,OAAO,EAEH,mBAAmB,EAGtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA0C5E,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,qBAAqB,CAAC;IAClC,eAAe,EAAE,gBAAgB,CAAC;IAClC,cAAc,EAAE,eAAe,CAAC;IAChC,wBAAwB,EAAE,yBAAyB,CAAC;IACpD,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,qBAAsB,YAAW,kBAAkB;IACtF,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAE5C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,wBAAwB,EAAE,yBAAyB,CAAC;IAE9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC;gBAE7B,GAAG,EAAE,wBAAwB;IAWnC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAYhD,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAiBhB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAKhB,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAKhB,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAgGI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAwBtB;;;;OAIG;YACW,mBAAmB;IAuBjC;;;OAGG;YACW,iBAAiB;IAyB/B;;;;;;;;;;;;;;OAcG;YACW,uBAAuB;CAuCxC"}

package/dist/core/entities/permission/service.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { ValidatorGroup, isPropertySet, isUUID } from "@authup/kit";
 import { PermissionName, PermissionValidator, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
-import { BuiltInPolicyType, PolicyData, SystemPolicyName } from "@authup/access";
+import { BuiltInPolicyType, RealmScope, SystemPolicyName, definePolicyData } from "@authup/access";
 import { AuthupError, BadRequestError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/permission/service.ts
 const REALM_ADMIN_EXCLUDED_PERMISSIONS = [
@@ -13,14 +13,14 @@ const REALM_ADMIN_EXCLUDED_PERMISSIONS = [
 	PermissionName.REALM_DELETE
 ];
 /**
-* CUD permissions that get system.realm-bound on realm_admin.
-* Covers direct entity types (both global-capable and realm-only).
+* Direct-entity CUD permissions that realm_admin grants at `realm_scope: own`
+* (strictly the actor's own realm — see line 372). Every other realm_admin
+* permission defaults to `ownOrNull` (own realm OR global/null resources) so it
+* can act on global building blocks.
 *
-* Junction entity CUD (e.g. user_role, role_permission) intentionally
-* use realm-or-global instead, because their attributes include
-* multiple realm_id fields (e.g. user_realm_id + role_realm_id).
-* With attribute_name_strict: false, realm-bound would reject
-* junctions where one side is global (realm_id: null).
+* Junction CUD (e.g. user_role, role_permission) is intentionally NOT listed here:
+* it stays `ownOrNull` because a junction can legitimately reference a global
+* side (realm_id: null) — a strict `own` would reject those.
 */ const REALM_ADMIN_BOUND_PERMISSIONS = [
 	PermissionName.CLIENT_CREATE,
 	PermissionName.CLIENT_UPDATE,
@@ -113,10 +113,13 @@ var PermissionService = class extends AbstractEntityService {
 			if (entity.built_in && isPropertySet(validated, "name") && entity.name !== validated.name) throw new BadRequestError("The name of a built-in permission can not be changed.");
 			await actor.permissionEvaluator.evaluate({
 				name: PermissionName.PERMISSION_UPDATE,
-				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: {
-					...entity,
-					...validated
-				} })
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: {
+						...entity,
+						...validated
+					},
+					[BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null
+				})
 			});
 			await this.repository.checkUniqueness(validated, entity);
 			entity = this.repository.merge(entity, validated);
@@ -129,7 +132,10 @@ var PermissionService = class extends AbstractEntityService {
 		if (!isPropertySet(validated, "realm_id") && actor.identity) validated.realm_id = this.getActorRealmId(actor) || null;
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.PERMISSION_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: validated,
+				...this.resourceRealmMatch(validated)
+			})
 		});
 		await this.repository.checkUniqueness(validated);
 		entity = this.repository.create(validated);
@@ -149,7 +155,10 @@ var PermissionService = class extends AbstractEntityService {
 		if (entity.built_in) throw new BadRequestError("A built-in permission can not be deleted.");
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.PERMISSION_DELETE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
 		});
 		const { id: entityId } = entity;
 		await this.repository.remove(entity);
@@ -189,16 +198,17 @@ var PermissionService = class extends AbstractEntityService {
 			role_id: adminRole.id,
 			role_realm_id: adminRole.realm_id,
 			permission_id: permission.id,
-			permission_realm_id: permission.realm_id
+			permission_realm_id: permission.realm_id,
+			realm_scope: RealmScope.ANY
 		});
 		await this.rolePermissionRepository.save(entry);
 	}
 	/**
 	* Assign a newly created permission to all matching realm_admin roles.
 	*
-	* Uses differentiated junction policies:
-	* - CUD on global-capable entity types → system.realm-bound
-	* - Everything else → system.realm-or-global
+	* Uses differentiated realm_scope on the junction:
+	* - CUD on global-capable entity types → own (strictly own realm)
+	* - Everything else → ownOrNull (own realm + null/global resources)
 	*
 	* Eligible permissions:
 	* - Built-in authup permissions (global) — assigned to all realm_admin roles
@@ -207,15 +217,11 @@ var PermissionService = class extends AbstractEntityService {
 	* Excluded:
 	* - Realm CRUD permissions (realm_create, realm_update, realm_delete)
 	* - Custom global permissions (non-built-in with realm_id: null)
-	*
-	* Fails closed: skips assignment entirely if required policies are not found.
 	*/ async assignToRealmAdminRoles(permission) {
 		if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name)) return;
 		const isBuiltIn = Object.values(PermissionName).includes(permission.name);
 		if (!permission.realm_id && !isBuiltIn) return;
-		const policyName = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name) ? SystemPolicyName.REALM_BOUND : SystemPolicyName.REALM_OR_GLOBAL;
-		const policy = await this.policyRepository.findOneByName(policyName);
-		if (!policy) return;
+		const realmScope = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name) ? RealmScope.OWN : RealmScope.OWN_OR_NULL;
 		const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });
 		for (const role of realmAdminRoles) {
 			if (permission.realm_id && permission.realm_id !== role.realm_id) continue;
@@ -228,7 +234,7 @@ var PermissionService = class extends AbstractEntityService {
 				role_realm_id: role.realm_id,
 				permission_id: permission.id,
 				permission_realm_id: permission.realm_id,
-				policy_id: policy.id
+				realm_scope: realmScope
 			});
 			await this.rolePermissionRepository.save(entry);
 		}

package/dist/core/entities/permission/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","SystemPolicyName","ValidatorGroup","isPropertySet","isUUID","AuthupError","BadRequestError","EntityNotFoundError","PermissionName","PermissionValidator","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","AbstractEntityService","REALM_ADMIN_EXCLUDED_PERMISSIONS","REALM_CREATE","REALM_UPDATE","REALM_DELETE","REALM_ADMIN_BOUND_PERMISSIONS","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","PermissionService","repository","realmRepository","roleRepository","rolePermissionRepository","policyRepository","permissionPolicyRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","findMany","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","CREATE","validated","run","validateJoinColumns","built_in","evaluate","input","ATTRIBUTES","checkUniqueness","merge","created","identity","getActorRealmId","assignDefaultPolicy","assignToAdminRole","assignToRealmAdminRoles","delete","entityId","remove","permission","defaultPolicy","findOneByName","DEFAULT","existing","permission_id","policy_id","entry","permission_realm_id","policy_realm_id","adminRole","role_id","role_realm_id","includes","isBuiltIn","Object","values","policyName","REALM_BOUND","REALM_OR_GLOBAL","policy","realmAdminRoles","findManyBy","role"],"sources":["../../../../src/core/entities/permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData, SystemPolicyName } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { AuthupError, BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    PermissionValidator,\n    ROLE_ADMIN_NAME,\n    ROLE_REALM_ADMIN_NAME,\n} from '@authup/core-kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository } from '../permission-policy/types.ts';\nimport type { IPolicyRepository } from '../policy/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport type { IRoleRepository } from '../role/types.ts';\nimport type { IRolePermissionRepository } from '../role-permission/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IPermissionRepository, IPermissionService } from './types.ts';\n\nconst REALM_ADMIN_EXCLUDED_PERMISSIONS = [\n    PermissionName.REALM_CREATE,\n    PermissionName.REALM_UPDATE,\n    PermissionName.REALM_DELETE,\n];\n\n/**\n * CUD permissions that get system.realm-bound on realm_admin.\n * Covers direct entity types (both global-capable and realm-only).\n *\n * Junction entity CUD (e.g. user_role, role_permission) intentionally\n * use realm-or-global instead, because their attributes include\n * multiple realm_id fields (e.g. user_realm_id + role_realm_id).\n * With attribute_name_strict: false, realm-bound would reject\n * junctions where one side is global (realm_id: null).\n */\nconst REALM_ADMIN_BOUND_PERMISSIONS = [\n    PermissionName.CLIENT_CREATE,\n    PermissionName.CLIENT_UPDATE,\n    PermissionName.CLIENT_DELETE,\n    PermissionName.IDENTITY_PROVIDER_CREATE,\n    PermissionName.IDENTITY_PROVIDER_UPDATE,\n    PermissionName.IDENTITY_PROVIDER_DELETE,\n    PermissionName.PERMISSION_CREATE,\n    PermissionName.PERMISSION_UPDATE,\n    PermissionName.PERMISSION_DELETE,\n    PermissionName.ROBOT_CREATE,\n    PermissionName.ROBOT_UPDATE,\n    PermissionName.ROBOT_DELETE,\n    PermissionName.ROLE_CREATE,\n    PermissionName.ROLE_UPDATE,\n    PermissionName.ROLE_DELETE,\n    PermissionName.SCOPE_CREATE,\n    PermissionName.SCOPE_UPDATE,\n    PermissionName.SCOPE_DELETE,\n    PermissionName.USER_CREATE,\n    PermissionName.USER_UPDATE,\n    PermissionName.USER_DELETE,\n];\n\nexport type PermissionServiceContext = {\n    repository: IPermissionRepository;\n    realmRepository: IRealmRepository;\n    roleRepository: IRoleRepository;\n    rolePermissionRepository: IRolePermissionRepository;\n    policyRepository: IPolicyRepository;\n    permissionPolicyRepository: IPermissionPolicyRepository;\n};\n\nexport class PermissionService extends AbstractEntityService implements IPermissionService {\n    protected repository: IPermissionRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected roleRepository: IRoleRepository;\n\n    protected rolePermissionRepository: IRolePermissionRepository;\n\n    protected policyRepository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    protected validator: PermissionValidator;\n\n    constructor(ctx: PermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.rolePermissionRepository = ctx.rolePermissionRepository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n        this.validator = new PermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Permission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Permission,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Permission | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            if (\n                entity.built_in &&\n                isPropertySet(validated, 'name') &&\n                entity.name !== validated.name\n            ) {\n                throw new BadRequestError('The name of a built-in permission can not be changed.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                input: new PolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            entity = this.repository.merge(entity, validated);\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        await this.assignDefaultPolicy(entity);\n        await this.assignToAdminRole(entity);\n        await this.assignToRealmAdminRoles(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in permission can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    /**\n     * Assign the system.default policy to a newly created permission.\n     * This ensures all permissions are evaluated with the baseline security\n     * policy (identity, permission-binding, realm-match) by default.\n     */\n    private async assignDefaultPolicy(permission: Permission): Promise<void> {\n        const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);\n        }\n\n        const existing = await this.permissionPolicyRepository.findOneBy({\n            permission_id: permission.id,\n            policy_id: defaultPolicy.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.permissionPolicyRepository.create({\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n            policy_id: defaultPolicy.id,\n            policy_realm_id: defaultPolicy.realm_id,\n        });\n        await this.permissionPolicyRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to the global admin role.\n     * The admin role receives every permission without policy restrictions.\n     */\n    private async assignToAdminRole(permission: Permission): Promise<void> {\n        const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);\n        if (!adminRole) {\n            return;\n        }\n\n        const existing = await this.rolePermissionRepository.findOneBy({\n            role_id: adminRole.id,\n            permission_id: permission.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.rolePermissionRepository.create({\n            role_id: adminRole.id,\n            role_realm_id: adminRole.realm_id,\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n        });\n        await this.rolePermissionRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to all matching realm_admin roles.\n     *\n     * Uses differentiated junction policies:\n     * - CUD on global-capable entity types → system.realm-bound\n     * - Everything else → system.realm-or-global\n     *\n     * Eligible permissions:\n     * - Built-in authup permissions (global) — assigned to all realm_admin roles\n     * - Realm-scoped permissions — assigned to the realm_admin in the matching realm\n     *\n     * Excluded:\n     * - Realm CRUD permissions (realm_create, realm_update, realm_delete)\n     * - Custom global permissions (non-built-in with realm_id: null)\n     *\n     * Fails closed: skips assignment entirely if required policies are not found.\n     */\n    private async assignToRealmAdminRoles(permission: Permission): Promise<void> {\n        if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name as PermissionName)) {\n            return;\n        }\n\n        const isBuiltIn = (Object.values(PermissionName) as string[]).includes(permission.name);\n        if (!permission.realm_id && !isBuiltIn) {\n            return;\n        }\n\n        const policyName = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name as PermissionName) ?\n            SystemPolicyName.REALM_BOUND :\n            SystemPolicyName.REALM_OR_GLOBAL;\n\n        const policy = await this.policyRepository.findOneByName(policyName);\n        if (!policy) {\n            return;\n        }\n\n        const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });\n\n        for (const role of realmAdminRoles) {\n            if (permission.realm_id && permission.realm_id !== role.realm_id) {\n                continue;\n            }\n\n            const existing = await this.rolePermissionRepository.findOneBy({\n                role_id: role.id,\n                permission_id: permission.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.rolePermissionRepository.create({\n                role_id: role.id,\n                role_realm_id: role.realm_id,\n                permission_id: permission.id,\n                permission_realm_id: permission.realm_id,\n                policy_id: policy.id,\n            });\n            await this.rolePermissionRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AA0BA,MAAMc,mCAAmC;CACrCL,eAAeM;CACfN,eAAeO;CACfP,eAAeQ;;;;;;;;;;;GAanB,MAAMC,gCAAgC;CAClCT,eAAeU;CACfV,eAAeW;CACfX,eAAeY;CACfZ,eAAea;CACfb,eAAec;CACfd,eAAee;CACff,eAAegB;CACfhB,eAAeiB;CACfjB,eAAekB;CACflB,eAAemB;CACfnB,eAAeoB;CACfpB,eAAeqB;CACfrB,eAAesB;CACftB,eAAeuB;CACfvB,eAAewB;CACfxB,eAAeyB;CACfzB,eAAe0B;CACf1B,eAAe2B;CACf3B,eAAe4B;CACf5B,eAAe6B;CACf7B,eAAe8B;;AAYnB,IAAaC,oBAAb,cAAuC3B,sBAAAA;CACzB4B;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKP,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIrC,oBAAAA;CACzB;CAEA,MAAMuC,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKc,WAAWe,SAASN,KAAAA;CACpC;CAEA,MAAMO,OACFC,UACAP,OACAQ,OACmB;EACnB,MAAMR,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMiC,SAAS,MAAM,KAAKnB,WAAWoB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAIpD,oBAAAA;EAGd,OAAOoD;CACX;CAEA,MAAME,OACFC,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMZ,KAAAA;EACpD,OAAOS;CACX;CAEA,MAAMM,OACFR,UACAK,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMZ,OAAO,EAAEgB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAZ,OACAiB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,aAAa,WACnC,MAAM,KAAK5B,gBAAgB6B,QAAQR,KAAKO,QAAQ,IAChDL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAInE,OAAOqD,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMlB,OAAOI;GAGjB,IAAIC,OACAa,MAAMF,WAAWX,MAAMc;GAG3Bb,SAAS,MAAM,KAAKnB,WAAWiC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAI3D,oBAAAA;EAElB,OAAO,IAAI4D,QAAQD,YACf,MAAM,IAAI3D,oBAAAA;EAGd,IAAIoD,QAAQ;GACR,MAAMT,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAeiB,kBAAkB,CAAA;GACrF2C,QAAQlE,eAAeyE;EAC3B,OAAO;GACH,MAAMzB,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAegB,kBAAkB,CAAA;GACrF4C,QAAQlE,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK/B,UAAUgC,IAAIhB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK5B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIlB,QAAQ;GACR,IACIA,OAAOqB,YACP7E,cAAc0E,WAAW,MAAA,KACzBlB,OAAON,SAASwB,UAAUxB,MAE1B,MAAM,IAAI/C,gBAAgB,uDAAA;GAG9B,MAAM4C,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAM7C,eAAeiB;IACrByD,OAAO,IAAIlF,WAAW,GACjBD,kBAAkBoF,aAAa;KAC5B,GAAGxB;KACH,GAAGkB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,WAAWlB,MAAAA;GAEjDA,SAAS,KAAKnB,WAAW6C,MAAM1B,QAAQkB,SAAAA;GAEvC,MAAM,KAAKrC,WAAWuB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,IAAI,CAACnF,cAAc0E,WAAW,UAAA,KAAe3B,MAAMqC,UAC/CV,UAAUR,WAAW,KAAKmB,gBAAgBtC,KAAAA,KAAU;EAGxD,MAAMA,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAegB;GACrB0D,OAAO,IAAIlF,WAAW,GAAGD,kBAAkBoF,aAAaN,UAAU,CAAA;EACtE,CAAA;EAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,SAAAA;EAEtClB,SAAS,KAAKnB,WAAWqB,OAAOgB,SAAAA;EAChClB,SAAS,MAAM,KAAKnB,WAAWuB,KAAKJ,MAAAA;EAEpC,MAAM,KAAK8B,oBAAoB9B,MAAAA;EAC/B,MAAM,KAAK+B,kBAAkB/B,MAAAA;EAC7B,MAAM,KAAKgC,wBAAwBhC,MAAAA;EAEnC,OAAO;GACHA;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMM,OACFpB,IACAtB,OACmB;EACnB,MAAMA,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAekB,kBAAkB,CAAA;EAErF,MAAMiC,SAAS,MAAM,KAAKnB,WAAWiC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAIpD,oBAAAA;EAGd,IAAIoD,OAAOqB,UACP,MAAM,IAAI1E,gBAAgB,2CAAA;EAG9B,MAAM4C,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAekB;GACrBwD,OAAO,IAAIlF,WAAW,GAAGD,kBAAkBoF,aAAaxB,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEa,IAAIqB,aAAalC;EACzB,MAAM,KAAKnB,WAAWsD,OAAOnC,MAAAA;EAC7BA,OAAOa,KAAKqB;EAEZ,OAAOlC;CACX;;;;;IAOA,MAAc8B,oBAAoBM,YAAuC;EACrE,MAAMC,gBAAgB,MAAM,KAAKpD,iBAAiBqD,cAAchG,iBAAiBiG,OAAO;EACxF,IAAI,CAACF,eACD,MAAM,IAAI3F,YAAY,OAAOJ,iBAAiBiG,QAAQ,2FAA2F;EAOrJ,IAAIC,MAJmB,KAAKtD,2BAA2B4B,UAAU;GAC7D2B,eAAeL,WAAWvB;GAC1B6B,WAAWL,cAAcxB;EAC7B,CAAA,GAEI;EAGJ,MAAM8B,QAAQ,KAAKzD,2BAA2BgB,OAAO;GACjDuC,eAAeL,WAAWvB;GAC1B+B,qBAAqBR,WAAW1B;GAChCgC,WAAWL,cAAcxB;GACzBgC,iBAAiBR,cAAc3B;EACnC,CAAA;EACA,MAAM,KAAKxB,2BAA2BkB,KAAKuC,KAAAA;CAC/C;;;;IAMA,MAAcZ,kBAAkBK,YAAuC;EACnE,MAAMU,YAAY,MAAM,KAAK/D,eAAeuD,cAAcvF,eAAAA;EAC1D,IAAI,CAAC+F,WACD;EAOJ,IAAIN,MAJmB,KAAKxD,yBAAyB8B,UAAU;GAC3DiC,SAASD,UAAUjC;GACnB4B,eAAeL,WAAWvB;EAC9B,CAAA,GAEI;EAGJ,MAAM8B,QAAQ,KAAK3D,yBAAyBkB,OAAO;GAC/C6C,SAASD,UAAUjC;GACnBmC,eAAeF,UAAUpC;GACzB+B,eAAeL,WAAWvB;GAC1B+B,qBAAqBR,WAAW1B;EACpC,CAAA;EACA,MAAM,KAAK1B,yBAAyBoB,KAAKuC,KAAAA;CAC7C;;;;;;;;;;;;;;;;;IAmBA,MAAcX,wBAAwBI,YAAuC;EACzE,IAAIlF,iCAAiC+F,SAASb,WAAW1C,IAAI,GACzD;EAGJ,MAAMwD,YAAY,OAAQE,OAAOvG,cAAAA,CAAAA,CAA6BoG,SAASb,WAAW1C,IAAI;EACtF,IAAI,CAAC0C,WAAW1B,YAAY,CAACwC,WACzB;EAGJ,MAAMG,aAAa/F,8BAA8B2F,SAASb,WAAW1C,IAAI,IACrEpD,iBAAiBgH,cACjBhH,iBAAiBiH;EAErB,MAAMC,SAAS,MAAM,KAAKvE,iBAAiBqD,cAAce,UAAAA;EACzD,IAAI,CAACG,QACD;EAGJ,MAAMC,kBAAkB,MAAM,KAAK1E,eAAe2E,WAAW,EAAEhE,MAAM1C,sBAAsB,CAAA;EAE3F,KAAK,MAAM2G,QAAQF,iBAAiB;GAChC,IAAIrB,WAAW1B,YAAY0B,WAAW1B,aAAaiD,KAAKjD,UACpD;GAOJ,IAAI8B,MAJmB,KAAKxD,yBAAyB8B,UAAU;IAC3DiC,SAASY,KAAK9C;IACd4B,eAAeL,WAAWvB;GAC9B,CAAA,GAEI;GAGJ,MAAM8B,QAAQ,KAAK3D,yBAAyBkB,OAAO;IAC/C6C,SAASY,KAAK9C;IACdmC,eAAeW,KAAKjD;IACpB+B,eAAeL,WAAWvB;IAC1B+B,qBAAqBR,WAAW1B;IAChCgC,WAAWc,OAAO3C;GACtB,CAAA;GACA,MAAM,KAAK7B,yBAAyBoB,KAAKuC,KAAAA;EAC7C;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","definePolicyData","ValidatorGroup","isPropertySet","isUUID","AuthupError","BadRequestError","EntityNotFoundError","PermissionName","PermissionValidator","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","AbstractEntityService","REALM_ADMIN_EXCLUDED_PERMISSIONS","REALM_CREATE","REALM_UPDATE","REALM_DELETE","REALM_ADMIN_BOUND_PERMISSIONS","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","PermissionService","repository","realmRepository","roleRepository","rolePermissionRepository","policyRepository","permissionPolicyRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","findMany","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","CREATE","validated","run","validateJoinColumns","built_in","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","merge","created","identity","getActorRealmId","resourceRealmMatch","assignDefaultPolicy","assignToAdminRole","assignToRealmAdminRoles","delete","entityId","remove","permission","defaultPolicy","findOneByName","DEFAULT","existing","permission_id","policy_id","entry","permission_realm_id","policy_realm_id","adminRole","role_id","role_realm_id","realm_scope","ANY","includes","isBuiltIn","Object","values","realmScope","OWN","OWN_OR_NULL","realmAdminRoles","findManyBy","role"],"sources":["../../../../src/core/entities/permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { \n    BuiltInPolicyType, \n    RealmScope, \n    SystemPolicyName, \n    definePolicyData, \n} from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { AuthupError, BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    PermissionValidator,\n    ROLE_ADMIN_NAME,\n    ROLE_REALM_ADMIN_NAME,\n} from '@authup/core-kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository } from '../permission-policy/types.ts';\nimport type { IPolicyRepository } from '../policy/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport type { IRoleRepository } from '../role/types.ts';\nimport type { IRolePermissionRepository } from '../role-permission/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IPermissionRepository, IPermissionService } from './types.ts';\n\nconst REALM_ADMIN_EXCLUDED_PERMISSIONS = [\n    PermissionName.REALM_CREATE,\n    PermissionName.REALM_UPDATE,\n    PermissionName.REALM_DELETE,\n];\n\n/**\n * Direct-entity CUD permissions that realm_admin grants at `realm_scope: own`\n * (strictly the actor's own realm — see line 372). Every other realm_admin\n * permission defaults to `ownOrNull` (own realm OR global/null resources) so it\n * can act on global building blocks.\n *\n * Junction CUD (e.g. user_role, role_permission) is intentionally NOT listed here:\n * it stays `ownOrNull` because a junction can legitimately reference a global\n * side (realm_id: null) — a strict `own` would reject those.\n */\nconst REALM_ADMIN_BOUND_PERMISSIONS = [\n    PermissionName.CLIENT_CREATE,\n    PermissionName.CLIENT_UPDATE,\n    PermissionName.CLIENT_DELETE,\n    PermissionName.IDENTITY_PROVIDER_CREATE,\n    PermissionName.IDENTITY_PROVIDER_UPDATE,\n    PermissionName.IDENTITY_PROVIDER_DELETE,\n    PermissionName.PERMISSION_CREATE,\n    PermissionName.PERMISSION_UPDATE,\n    PermissionName.PERMISSION_DELETE,\n    PermissionName.ROBOT_CREATE,\n    PermissionName.ROBOT_UPDATE,\n    PermissionName.ROBOT_DELETE,\n    PermissionName.ROLE_CREATE,\n    PermissionName.ROLE_UPDATE,\n    PermissionName.ROLE_DELETE,\n    PermissionName.SCOPE_CREATE,\n    PermissionName.SCOPE_UPDATE,\n    PermissionName.SCOPE_DELETE,\n    PermissionName.USER_CREATE,\n    PermissionName.USER_UPDATE,\n    PermissionName.USER_DELETE,\n];\n\nexport type PermissionServiceContext = {\n    repository: IPermissionRepository;\n    realmRepository: IRealmRepository;\n    roleRepository: IRoleRepository;\n    rolePermissionRepository: IRolePermissionRepository;\n    policyRepository: IPolicyRepository;\n    permissionPolicyRepository: IPermissionPolicyRepository;\n};\n\nexport class PermissionService extends AbstractEntityService implements IPermissionService {\n    protected repository: IPermissionRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected roleRepository: IRoleRepository;\n\n    protected rolePermissionRepository: IRolePermissionRepository;\n\n    protected policyRepository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    protected validator: PermissionValidator;\n\n    constructor(ctx: PermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.rolePermissionRepository = ctx.rolePermissionRepository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n        this.validator = new PermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Permission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Permission,\n        created: boolean\n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Permission | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            if (\n                entity.built_in &&\n                isPropertySet(validated, 'name') &&\n                entity.name !== validated.name\n            ) {\n                throw new BadRequestError('The name of a built-in permission can not be changed.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            entity = this.repository.merge(entity, validated);\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false,\n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        await this.assignDefaultPolicy(entity);\n        await this.assignToAdminRole(entity);\n        await this.assignToRealmAdminRoles(entity);\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in permission can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    /**\n     * Assign the system.default policy to a newly created permission.\n     * This ensures all permissions are evaluated with the baseline security\n     * policy (identity, permission-binding, realm-match) by default.\n     */\n    private async assignDefaultPolicy(permission: Permission): Promise<void> {\n        const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);\n        }\n\n        const existing = await this.permissionPolicyRepository.findOneBy({\n            permission_id: permission.id,\n            policy_id: defaultPolicy.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.permissionPolicyRepository.create({\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n            policy_id: defaultPolicy.id,\n            policy_realm_id: defaultPolicy.realm_id,\n        });\n        await this.permissionPolicyRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to the global admin role.\n     * The admin role receives every permission without policy restrictions.\n     */\n    private async assignToAdminRole(permission: Permission): Promise<void> {\n        const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);\n        if (!adminRole) {\n            return;\n        }\n\n        const existing = await this.rolePermissionRepository.findOneBy({\n            role_id: adminRole.id,\n            permission_id: permission.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.rolePermissionRepository.create({\n            role_id: adminRole.id,\n            role_realm_id: adminRole.realm_id,\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n            // Global admin: unrestricted realm reach.\n            realm_scope: RealmScope.ANY,\n        });\n        await this.rolePermissionRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to all matching realm_admin roles.\n     *\n     * Uses differentiated realm_scope on the junction:\n     * - CUD on global-capable entity types → own (strictly own realm)\n     * - Everything else → ownOrNull (own realm + null/global resources)\n     *\n     * Eligible permissions:\n     * - Built-in authup permissions (global) — assigned to all realm_admin roles\n     * - Realm-scoped permissions — assigned to the realm_admin in the matching realm\n     *\n     * Excluded:\n     * - Realm CRUD permissions (realm_create, realm_update, realm_delete)\n     * - Custom global permissions (non-built-in with realm_id: null)\n     */\n    private async assignToRealmAdminRoles(permission: Permission): Promise<void> {\n        if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name as PermissionName)) {\n            return;\n        }\n\n        const isBuiltIn = (Object.values(PermissionName) as string[]).includes(permission.name);\n        if (!permission.realm_id && !isBuiltIn) {\n            return;\n        }\n\n        const realmScope = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name as PermissionName) ?\n            RealmScope.OWN :\n            RealmScope.OWN_OR_NULL;\n\n        const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });\n\n        for (const role of realmAdminRoles) {\n            if (permission.realm_id && permission.realm_id !== role.realm_id) {\n                continue;\n            }\n\n            const existing = await this.rolePermissionRepository.findOneBy({\n                role_id: role.id,\n                permission_id: permission.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.rolePermissionRepository.create({\n                role_id: role.id,\n                role_realm_id: role.realm_id,\n                permission_id: permission.id,\n                permission_realm_id: permission.realm_id,\n                realm_scope: realmScope,\n            });\n            await this.rolePermissionRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AA+BA,MAAMe,mCAAmC;CACrCL,eAAeM;CACfN,eAAeO;CACfP,eAAeQ;;;;;;;;;;;GAanB,MAAMC,gCAAgC;CAClCT,eAAeU;CACfV,eAAeW;CACfX,eAAeY;CACfZ,eAAea;CACfb,eAAec;CACfd,eAAee;CACff,eAAegB;CACfhB,eAAeiB;CACfjB,eAAekB;CACflB,eAAemB;CACfnB,eAAeoB;CACfpB,eAAeqB;CACfrB,eAAesB;CACftB,eAAeuB;CACfvB,eAAewB;CACfxB,eAAeyB;CACfzB,eAAe0B;CACf1B,eAAe2B;CACf3B,eAAe4B;CACf5B,eAAe6B;CACf7B,eAAe8B;;AAYnB,IAAaC,oBAAb,cAAuC3B,sBAAAA;CACzB4B;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKP,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIrC,oBAAAA;CACzB;CAEA,MAAMuC,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKc,WAAWe,SAASN,KAAAA;CACpC;CAEA,MAAMO,OACFC,UACAP,OACAQ,OACmB;EACnB,MAAMR,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMiC,SAAS,MAAM,KAAKnB,WAAWoB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAIpD,oBAAAA;EAGd,OAAOoD;CACX;CAEA,MAAME,OACFC,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMZ,KAAAA;EACpD,OAAOS;CACX;CAEA,MAAMM,OACFR,UACAK,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMZ,OAAO,EAAEgB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAZ,OACAiB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,aAAa,WACnC,MAAM,KAAK5B,gBAAgB6B,QAAQR,KAAKO,QAAQ,IAChDL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAInE,OAAOqD,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMlB,OAAOI;GAGjB,IAAIC,OACAa,MAAMF,WAAWX,MAAMc;GAG3Bb,SAAS,MAAM,KAAKnB,WAAWiC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAI3D,oBAAAA;EAElB,OAAO,IAAI4D,QAAQD,YACf,MAAM,IAAI3D,oBAAAA;EAGd,IAAIoD,QAAQ;GACR,MAAMT,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAeiB,kBAAkB,CAAA;GACrF2C,QAAQlE,eAAeyE;EAC3B,OAAO;GACH,MAAMzB,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAegB,kBAAkB,CAAA;GACrF4C,QAAQlE,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK/B,UAAUgC,IAAIhB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK5B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIlB,QAAQ;GACR,IACIA,OAAOqB,YACP7E,cAAc0E,WAAW,MAAA,KACzBlB,OAAON,SAASwB,UAAUxB,MAE1B,MAAM,IAAI/C,gBAAgB,uDAAA;GAG9B,MAAM4C,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAM7C,eAAeiB;IACrBqC,MAAM7D,iBAAiB;MAClBH,kBAAkBoF,aAAa;MAC5B,GAAGvB;MACH,GAAGkB;KACP;MACC/E,kBAAkBqF,cAAcN,UAAUR,YAAYV,OAAOU,YAAY;IAC9E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK7B,WAAW4C,gBAAgBP,WAAWlB,MAAAA;GAEjDA,SAAS,KAAKnB,WAAW6C,MAAM1B,QAAQkB,SAAAA;GAEvC,MAAM,KAAKrC,WAAWuB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,IAAI,CAACnF,cAAc0E,WAAW,UAAA,KAAe3B,MAAMqC,UAC/CV,UAAUR,WAAW,KAAKmB,gBAAgBtC,KAAAA,KAAU;EAGxD,MAAMA,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAegB;GACrBsC,MAAM7D,iBAAiB;KAAGH,kBAAkBoF,aAAaL;IAAW,GAAG,KAAKY,mBAAmBZ,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,SAAAA;EAEtClB,SAAS,KAAKnB,WAAWqB,OAAOgB,SAAAA;EAChClB,SAAS,MAAM,KAAKnB,WAAWuB,KAAKJ,MAAAA;EAEpC,MAAM,KAAK+B,oBAAoB/B,MAAAA;EAC/B,MAAM,KAAKgC,kBAAkBhC,MAAAA;EAC7B,MAAM,KAAKiC,wBAAwBjC,MAAAA;EAEnC,OAAO;GACHA;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMO,OACFrB,IACAtB,OACmB;EACnB,MAAMA,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAekB,kBAAkB,CAAA;EAErF,MAAMiC,SAAS,MAAM,KAAKnB,WAAWiC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAIpD,oBAAAA;EAGd,IAAIoD,OAAOqB,UACP,MAAM,IAAI1E,gBAAgB,2CAAA;EAG9B,MAAM4C,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAekB;GACrBoC,MAAM7D,iBAAiB;KAAGH,kBAAkBoF,aAAavB;IAAQ,GAAG,KAAK8B,mBAAmB9B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEa,IAAIsB,aAAanC;EACzB,MAAM,KAAKnB,WAAWuD,OAAOpC,MAAAA;EAC7BA,OAAOa,KAAKsB;EAEZ,OAAOnC;CACX;;;;;IAOA,MAAc+B,oBAAoBM,YAAuC;EACrE,MAAMC,gBAAgB,MAAM,KAAKrD,iBAAiBsD,cAAclG,iBAAiBmG,OAAO;EACxF,IAAI,CAACF,eACD,MAAM,IAAI5F,YAAY,OAAOL,iBAAiBmG,QAAQ,2FAA2F;EAOrJ,IAAIC,MAJmB,KAAKvD,2BAA2B4B,UAAU;GAC7D4B,eAAeL,WAAWxB;GAC1B8B,WAAWL,cAAczB;EAC7B,CAAA,GAEI;EAGJ,MAAM+B,QAAQ,KAAK1D,2BAA2BgB,OAAO;GACjDwC,eAAeL,WAAWxB;GAC1BgC,qBAAqBR,WAAW3B;GAChCiC,WAAWL,cAAczB;GACzBiC,iBAAiBR,cAAc5B;EACnC,CAAA;EACA,MAAM,KAAKxB,2BAA2BkB,KAAKwC,KAAAA;CAC/C;;;;IAMA,MAAcZ,kBAAkBK,YAAuC;EACnE,MAAMU,YAAY,MAAM,KAAKhE,eAAewD,cAAcxF,eAAAA;EAC1D,IAAI,CAACgG,WACD;EAOJ,IAAIN,MAJmB,KAAKzD,yBAAyB8B,UAAU;GAC3DkC,SAASD,UAAUlC;GACnB6B,eAAeL,WAAWxB;EAC9B,CAAA,GAEI;EAGJ,MAAM+B,QAAQ,KAAK5D,yBAAyBkB,OAAO;GAC/C8C,SAASD,UAAUlC;GACnBoC,eAAeF,UAAUrC;GACzBgC,eAAeL,WAAWxB;GAC1BgC,qBAAqBR,WAAW3B;GAEhCwC,aAAa9G,WAAW+G;EAC5B,CAAA;EACA,MAAM,KAAKnE,yBAAyBoB,KAAKwC,KAAAA;CAC7C;;;;;;;;;;;;;;;IAiBA,MAAcX,wBAAwBI,YAAuC;EACzE,IAAInF,iCAAiCkG,SAASf,WAAW3C,IAAI,GACzD;EAGJ,MAAM2D,YAAY,OAAQE,OAAO1G,cAAAA,CAAAA,CAA6BuG,SAASf,WAAW3C,IAAI;EACtF,IAAI,CAAC2C,WAAW3B,YAAY,CAAC2C,WACzB;EAGJ,MAAMG,aAAalG,8BAA8B8F,SAASf,WAAW3C,IAAI,IACrEtD,WAAWqH,MACXrH,WAAWsH;EAEf,MAAMC,kBAAkB,MAAM,KAAK5E,eAAe6E,WAAW,EAAElE,MAAM1C,sBAAsB,CAAA;EAE3F,KAAK,MAAM6G,QAAQF,iBAAiB;GAChC,IAAItB,WAAW3B,YAAY2B,WAAW3B,aAAamD,KAAKnD,UACpD;GAOJ,IAAI+B,MAJmB,KAAKzD,yBAAyB8B,UAAU;IAC3DkC,SAASa,KAAKhD;IACd6B,eAAeL,WAAWxB;GAC9B,CAAA,GAEI;GAGJ,MAAM+B,QAAQ,KAAK5D,yBAAyBkB,OAAO;IAC/C8C,SAASa,KAAKhD;IACdoC,eAAeY,KAAKnD;IACpBgC,eAAeL,WAAWxB;IAC1BgC,qBAAqBR,WAAW3B;IAChCwC,aAAaM;GACjB,CAAA;GACA,MAAM,KAAKxE,yBAAyBoB,KAAKwC,KAAAA;EAC7C;CACJ;AACJ"}

package/dist/core/entities/permission-policy/service.d.ts

@@ -1,12 +1,13 @@
 import { PermissionPolicyValidator } from '@authup/core-kit';
 import type { PermissionPolicy } from '@authup/core-kit';
 import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
-import { AbstractEntityService } from '@authup/server-kit';
+import { JunctionEntityService } from '@authup/server-kit';
 import type { IPermissionPolicyRepository, IPermissionPolicyService } from './types.ts';
 export type PermissionPolicyServiceContext = {
     repository: IPermissionPolicyRepository;
 };
-export declare class PermissionPolicyService extends AbstractEntityService implements IPermissionPolicyService {
+export declare class PermissionPolicyService extends JunctionEntityService implements IPermissionPolicyService {
+    protected readonly ownerRealmKey = "permission_realm_id";
     protected repository: IPermissionPolicyRepository;
     protected validator: PermissionPolicyValidator;
     constructor(ctx: PermissionPolicyServiceContext);

package/dist/core/entities/permission-policy/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,MAAM,8BAA8B,GAAG;IACzC,UAAU,EAAE,2BAA2B,CAAC;CAC3C,CAAC;AAEF,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,SAAS,EAAE,yBAAyB,CAAC;gBAEnC,GAAG,EAAE,8BAA8B;IAMzC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IAWtD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAgBtB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAkCtB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;CAmB/B"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,MAAM,8BAA8B,GAAG;IACzC,UAAU,EAAE,2BAA2B,CAAC;CAC3C,CAAC;AAEF,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,QAAQ,CAAC,aAAa,yBAAyB;IAEzD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,SAAS,EAAE,yBAAyB,CAAC;gBAEnC,GAAG,EAAE,8BAA8B;IAMzC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IAWtD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAgBtB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAsCtB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;CAuB/B"}

package/dist/core/entities/permission-policy/service.mjs

@@ -3,11 +3,12 @@ import "node:url";
 import.meta.url;
 import { ValidatorGroup } from "@authup/kit";
 import { PermissionName, PermissionPolicyValidator } from "@authup/core-kit";
-import { AbstractEntityService } from "@authup/server-kit";
-import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { JunctionEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/permission-policy/service.ts
-var PermissionPolicyService = class extends AbstractEntityService {
+var PermissionPolicyService = class extends JunctionEntityService {
+	ownerRealmKey = "permission_realm_id";
 	repository;
 	validator;
 	constructor(ctx) {
@@ -37,7 +38,10 @@ var PermissionPolicyService = class extends AbstractEntityService {
 		if (validated.policy) validated.policy_realm_id = validated.policy.realm_id;
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.PERMISSION_UPDATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),
+				[BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated)
+			})
 		});
 		let entity = this.repository.create(validated);
 		entity = await this.repository.save(entity);
@@ -49,7 +53,10 @@ var PermissionPolicyService = class extends AbstractEntityService {
 		if (!entity) throw new EntityNotFoundError();
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.PERMISSION_UPDATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),
+				[BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity)
+			})
 		});
 		const { id: entityId } = entity;
 		await this.repository.remove(entity);

package/dist/core/entities/permission-policy/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","PermissionPolicyValidator","AbstractEntityService","PermissionPolicyService","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permission_id","policy_id","permission","permission_realm_id","realm_id","policy","policy_realm_id","evaluate","input","ATTRIBUTES","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/permission-policy/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, PermissionPolicyValidator } from '@authup/core-kit';\nimport type { PermissionPolicy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository, IPermissionPolicyService } from './types.ts';\n\nexport type PermissionPolicyServiceContext = {\n    repository: IPermissionPolicyRepository;\n};\n\nexport class PermissionPolicyService extends AbstractEntityService implements IPermissionPolicyService {\n    protected repository: IPermissionPolicyRepository;\n\n    protected validator: PermissionPolicyValidator;\n\n    constructor(ctx: PermissionPolicyServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new PermissionPolicyValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<PermissionPolicy>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<PermissionPolicy> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<PermissionPolicy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            permission_id: validated.permission_id,\n            policy_id: validated.policy_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'permission-policy' });\n        }\n\n        if (validated.permission) {\n            validated.permission_realm_id = validated.permission.realm_id;\n        }\n\n        if (validated.policy) {\n            validated.policy_realm_id = validated.policy.realm_id;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_UPDATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<PermissionPolicy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_UPDATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaQ,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIJ,0BAAAA;CACzB;CAEA,MAAMM,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFZ,eAAea,iBACfb,eAAec,iBAAAA,EAEvB,CAAA;EAEA,OAAO,KAAKV,WAAWW,SAASP,KAAAA;CACpC;CAEA,MAAMQ,OACFC,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFZ,eAAea,iBACfb,eAAec,iBAAAA,EAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKd,WAAWe,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIpB,oBAAAA;EAGd,OAAOoB;CACX;CAEA,MAAME,OACFC,MACAZ,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMZ,eAAec,kBAAkB,CAAA;EAErF,MAAMS,YAAY,MAAM,KAAKlB,UAAUmB,IAAIH,MAAM,EAAEI,OAAO1B,eAAe2B,OAAO,CAAA;EAEhF,MAAM,KAAKtB,WAAWuB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAKxB,WAAWe,UAAU;GAC7CU,eAAeN,UAAUM;GACzBC,WAAWP,UAAUO;EACzB,CAAA,GAEI,MAAM,IAAIjC,oBAAoB,EAAEqB,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YACVR,UAAUS,sBAAsBT,UAAUQ,WAAWE;EAGzD,IAAIV,UAAUW,QACVX,UAAUY,kBAAkBZ,UAAUW,OAAOD;EAGjD,MAAMxB,MAAMC,oBAAoB0B,SAAS;GACrCxB,MAAMZ,eAAec;GACrBuB,OAAO,IAAIzC,WAAW,GAAGD,kBAAkB2C,aAAaf,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIL,SAAS,KAAKd,WAAWgB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKd,WAAWmC,KAAKrB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMsB,OACFvB,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMZ,eAAec,kBAAkB,CAAA;EAErF,MAAMI,SAAS,MAAM,KAAKd,WAAWe,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIpB,oBAAAA;EAGd,MAAMW,MAAMC,oBAAoB0B,SAAS;GACrCxB,MAAMZ,eAAec;GACrBuB,OAAO,IAAIzC,WAAW,GAAGD,kBAAkB2C,aAAapB,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAIwB,aAAavB;EACzB,MAAM,KAAKd,WAAWsC,OAAOxB,MAAAA;EAC7BA,OAAOD,KAAKwB;EAEZ,OAAOvB;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","PermissionPolicyValidator","JunctionEntityService","PermissionPolicyService","ownerRealmKey","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permission_id","policy_id","permission","permission_realm_id","realm_id","policy","policy_realm_id","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/permission-policy/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, PermissionPolicyValidator } from '@authup/core-kit';\nimport type { PermissionPolicy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository, IPermissionPolicyService } from './types.ts';\n\nexport type PermissionPolicyServiceContext = {\n    repository: IPermissionPolicyRepository;\n};\n\nexport class PermissionPolicyService extends JunctionEntityService implements IPermissionPolicyService {\n    protected readonly ownerRealmKey = 'permission_realm_id';\n\n    protected repository: IPermissionPolicyRepository;\n\n    protected validator: PermissionPolicyValidator;\n\n    constructor(ctx: PermissionPolicyServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new PermissionPolicyValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<PermissionPolicy>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<PermissionPolicy> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<PermissionPolicy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            permission_id: validated.permission_id,\n            policy_id: validated.policy_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'permission-policy' });\n        }\n\n        if (validated.permission) {\n            validated.permission_realm_id = validated.permission.realm_id;\n        }\n\n        if (validated.policy) {\n            validated.policy_realm_id = validated.policy.realm_id;\n        }\n\n        // Stamp the owner (permission) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<PermissionPolicy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (permission) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaQ,0BAAb,cAA6CD,sBAAAA;CACtBE,gBAAgB;CAEzBC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIL,0BAAAA;CACzB;CAEA,MAAMO,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,iBACfd,eAAee,iBAAAA,EAEvB,CAAA;EAEA,OAAO,KAAKV,WAAWW,SAASP,KAAAA;CACpC;CAEA,MAAMQ,OACFC,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,iBACfd,eAAee,iBAAAA,EAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKd,WAAWe,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIrB,oBAAAA;EAGd,OAAOqB;CACX;CAEA,MAAME,OACFC,MACAZ,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMb,eAAee,kBAAkB,CAAA;EAErF,MAAMS,YAAY,MAAM,KAAKlB,UAAUmB,IAAIH,MAAM,EAAEI,OAAO3B,eAAe4B,OAAO,CAAA;EAEhF,MAAM,KAAKtB,WAAWuB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAKxB,WAAWe,UAAU;GAC7CU,eAAeN,UAAUM;GACzBC,WAAWP,UAAUO;EACzB,CAAA,GAEI,MAAM,IAAIlC,oBAAoB,EAAEsB,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YACVR,UAAUS,sBAAsBT,UAAUQ,WAAWE;EAGzD,IAAIV,UAAUW,QACVX,UAAUY,kBAAkBZ,UAAUW,OAAOD;EAIjD,MAAMxB,MAAMC,oBAAoB0B,SAAS;GACrCxB,MAAMb,eAAee;GACrBO,MAAM1B,iBAAiB;KAClBD,kBAAkB2C,aAAa,KAAKC,mBAAmBf,SAAAA;KACvD7B,kBAAkB6C,cAAc,KAAKC,sBAAsBjB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKd,WAAWgB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKd,WAAWqC,KAAKvB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMwB,OACFzB,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMb,eAAee,kBAAkB,CAAA;EAErF,MAAMI,SAAS,MAAM,KAAKd,WAAWe,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIrB,oBAAAA;EAId,MAAMY,MAAMC,oBAAoB0B,SAAS;GACrCxB,MAAMb,eAAee;GACrBO,MAAM1B,iBAAiB;KAClBD,kBAAkB2C,aAAa,KAAKC,mBAAmBpB,MAAAA;KACvDxB,kBAAkB6C,cAAc,KAAKC,sBAAsBtB,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI0B,aAAazB;EACzB,MAAM,KAAKd,WAAWwC,OAAO1B,MAAAA;EAC7BA,OAAOD,KAAK0B;EAEZ,OAAOzB;CACX;AACJ"}

package/dist/core/entities/policy/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/policy/service.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEH,eAAe,EAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;IAErC,SAAS,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;gBAE7C,GAAG,EAAE,oBAAoB;IAQ/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAY5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;IAiBZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;YA8FY,QAAQ;IAqBhB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CA4BrB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/policy/service.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEH,eAAe,EAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;IAErC,SAAS,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;gBAE7C,GAAG,EAAE,oBAAoB;IAQ/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAY5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;IAiBZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;YA+FY,QAAQ;IAqBhB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CA4BrB"}

package/dist/core/entities/policy/service.mjs

@@ -5,7 +5,7 @@ import { PolicyAttributesValidator } from "./attributes-validator.mjs";
 import { ValidatorGroup, extendObject, isPropertySet, isUUID, removeObjectProperty } from "@authup/kit";
 import { PermissionName, PolicyValidator } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
-import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/policy/service.ts
 var PolicyService = class extends AbstractEntityService {
@@ -72,10 +72,13 @@ var PolicyService = class extends AbstractEntityService {
 			if (entity.built_in) throw new BadRequestError("A built-in policy can not be updated.");
 			await actor.permissionEvaluator.evaluate({
 				name: PermissionName.PERMISSION_UPDATE,
-				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: {
-					...entity,
-					...validated
-				} })
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: {
+						...entity,
+						...validated
+					},
+					[BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null
+				})
 			});
 			await this.repository.checkUniqueness(validated, entity);
 			extendObject(entity, validated);
@@ -88,7 +91,10 @@ var PolicyService = class extends AbstractEntityService {
 		if (!isPropertySet(validated, "realm_id") && actor.identity) validated.realm_id = this.getActorRealmId(actor) || null;
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.PERMISSION_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: validated,
+				...this.resourceRealmMatch(validated)
+			})
 		});
 		await this.repository.checkUniqueness(validated);
 		entity = this.repository.create(validated);
@@ -116,7 +122,10 @@ var PolicyService = class extends AbstractEntityService {
 		if (entity.built_in) throw new BadRequestError("A built-in policy can not be deleted.");
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.PERMISSION_DELETE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
 		});
 		const { id: entityId } = entity;
 		await this.repository.deleteFromTree(entity);

package/dist/core/entities/policy/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ValidatorGroup","extendObject","isPropertySet","isUUID","removeObjectProperty","BadRequestError","EntityNotFoundError","PermissionName","PolicyValidator","AbstractEntityService","PolicyAttributesValidator","PolicyService","repository","realmRepository","validator","attributesValidator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","PERMISSION_DELETE","findMany","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","PERMISSION_CREATE","CREATE","validated","validate","validateJoinColumns","parent","type","COMPOSITE","built_in","evaluate","input","ATTRIBUTES","checkUniqueness","saveWithEA","created","identity","getActorRealmId","run","attributes","Array","isArray","children","promises","map","child","Promise","all","delete","entityId","deleteFromTree"],"sources":["../../../../src/core/entities/policy/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport {\n    ValidatorGroup,\n    extendObject,\n    isPropertySet,\n    isUUID,\n    removeObjectProperty,\n} from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    PolicyValidator,\n} from '@authup/core-kit';\nimport type { Policy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { PolicyAttributesValidator } from './attributes-validator.ts';\nimport type { IPolicyRepository, IPolicyService } from './types.ts';\n\nexport type PolicyServiceContext = {\n    repository: IPolicyRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class PolicyService extends AbstractEntityService implements IPolicyService {\n    protected repository: IPolicyRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: PolicyValidator;\n\n    protected attributesValidator: PolicyAttributesValidator;\n\n    constructor(ctx: PolicyServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new PolicyValidator();\n        this.attributesValidator = new PolicyAttributesValidator({});\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Policy>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Policy> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Policy,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Policy | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validate(data, group);\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (\n            validated.parent &&\n            validated.parent.type !== BuiltInPolicyType.COMPOSITE\n        ) {\n            throw new BadRequestError('The parent policy must be of type group.');\n        }\n\n        if (entity) {\n            if (entity.built_in) {\n                throw new BadRequestError('A built-in policy can not be updated.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                input: new PolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            extendObject(entity, validated);\n\n            await this.repository.saveWithEA(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        await this.repository.saveWithEA(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    private async validate(\n        data: Record<string, any>,\n        group: string,\n    ): Promise<Policy> {\n        const validated = await this.validator.run(data, { group });\n\n        const attributes = await this.attributesValidator.run(data);\n        extendObject(validated, attributes);\n\n        if (Array.isArray(data.children)) {\n            if (data.type === BuiltInPolicyType.COMPOSITE) {\n                const promises = data.children.map(\n                    (child) => this.validate(child, group),\n                );\n                validated.children = await Promise.all(promises);\n            }\n        }\n\n        return validated;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in policy can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n\n        await this.repository.deleteFromTree(entity);\n\n        entity.id = entityId;\n\n        // todo: remove after PolicyEntity - parent delete on cascade\n        removeObjectProperty(entity, 'children');\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;AAgCA,IAAaa,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,YAAY,IAAIN,gBAAAA;EACrB,KAAKO,sBAAsB,IAAIL,0BAA0B,CAAC,CAAA;CAC9D;CAEA,MAAMO,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,UACAT,OACAU,OACe;EACf,MAAMV,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKlB,WAAWmB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAIxB,oBAAAA;EAGd,OAAOwB;CACX;CAEA,MAAME,OACFC,MACAd,OACe;EACf,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMd,KAAAA;EACpD,OAAOW;CACX;CAEA,MAAMM,OACFR,UACAK,MACAd,OACe;EACf,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMd,OAAO,EAAEkB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAd,OACAmB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,aAAa,WACnC,MAAM,KAAK3B,gBAAgB4B,QAAQR,KAAKO,QAAQ,IAChDL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAIvC,OAAOyB,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMpB,OAAOM;GAGjB,IAAIC,OACAa,MAAMF,WAAWX,MAAMc;GAG3Bb,SAAS,MAAM,KAAKlB,WAAWgC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAI/B,oBAAAA;EAElB,OAAO,IAAIgC,QAAQD,YACf,MAAM,IAAI/B,oBAAAA;EAGd,IAAIwB,QAAQ;GACR,MAAMX,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMf,eAAeiB,kBAAkB,CAAA;GACrFe,QAAQvC,eAAe8C;EAC3B,OAAO;GACH,MAAM3B,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMf,eAAewC,kBAAkB,CAAA;GACrFR,QAAQvC,eAAegD;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKC,SAASjB,MAAMM,KAAAA;EAE5C,MAAM,KAAK3B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IACIA,UAAUG,UACVH,UAAUG,OAAOC,SAASvD,kBAAkBwD,WAE5C,MAAM,IAAIjD,gBAAgB,0CAAA;EAG9B,IAAIyB,QAAQ;GACR,IAAIA,OAAOyB,UACP,MAAM,IAAIlD,gBAAgB,uCAAA;GAG9B,MAAMc,MAAMC,oBAAoBoC,SAAS;IACrClC,MAAMf,eAAeiB;IACrBiC,OAAO,IAAI1D,WAAW,GACjBD,kBAAkB4D,aAAa;KAC5B,GAAG5B;KACH,GAAGmB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,MAAM,KAAKrC,WAAW+C,gBAAgBV,WAAWnB,MAAAA;GAEjD7B,aAAa6B,QAAQmB,SAAAA;GAErB,MAAM,KAAKrC,WAAWgD,WAAW9B,MAAAA;GAEjC,OAAO;IACHA;IACA+B,SAAS;GACb;EACJ;EAEA,IAAI,CAAC3D,cAAc+C,WAAW,UAAA,KAAe9B,MAAM2C,UAC/Cb,UAAUT,WAAW,KAAKuB,gBAAgB5C,KAAAA,KAAU;EAGxD,MAAMA,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMf,eAAewC;GACrBU,OAAO,IAAI1D,WAAW,GAAGD,kBAAkB4D,aAAaT,UAAU,CAAA;EACtE,CAAA;EAEA,MAAM,KAAKrC,WAAW+C,gBAAgBV,SAAAA;EAEtCnB,SAAS,KAAKlB,WAAWoB,OAAOiB,SAAAA;EAChC,MAAM,KAAKrC,WAAWgD,WAAW9B,MAAAA;EAEjC,OAAO;GACHA;GACA+B,SAAS;EACb;CACJ;CAEA,MAAcX,SACVjB,MACAM,OACe;EACf,MAAMU,YAAY,MAAM,KAAKnC,UAAUkD,IAAI/B,MAAM,EAAEM,MAAM,CAAA;EAGzDtC,aAAagD,WAAWgB,MADC,KAAKlD,oBAAoBiD,IAAI/B,IAAAA,CAC9BgC;EAExB,IAAIC,MAAMC,QAAQlC,KAAKmC,QAAQ;OACvBnC,KAAKoB,SAASvD,kBAAkBwD,WAAW;IAC3C,MAAMe,WAAWpC,KAAKmC,SAASE,KAC1BC,UAAU,KAAKrB,SAASqB,OAAOhC,KAAAA,CAAAA;IAEpCU,UAAUmB,WAAW,MAAMI,QAAQC,IAAIJ,QAAAA;GAC3C;;EAGJ,OAAOpB;CACX;CAEA,MAAMyB,OACF/B,IACAxB,OACe;EACf,MAAMA,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMf,eAAekB,kBAAkB,CAAA;EAErF,MAAMK,SAAS,MAAM,KAAKlB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAIxB,oBAAAA;EAGd,IAAIwB,OAAOyB,UACP,MAAM,IAAIlD,gBAAgB,uCAAA;EAG9B,MAAMc,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMf,eAAekB;GACrBgC,OAAO,IAAI1D,WAAW,GAAGD,kBAAkB4D,aAAa5B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEa,IAAIgC,aAAa7C;EAEzB,MAAM,KAAKlB,WAAWgE,eAAe9C,MAAAA;EAErCA,OAAOa,KAAKgC;EAGZvE,qBAAqB0B,QAAQ,UAAA;EAE7B,OAAOA;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","extendObject","isPropertySet","isUUID","removeObjectProperty","BadRequestError","EntityNotFoundError","PermissionName","PolicyValidator","AbstractEntityService","PolicyAttributesValidator","PolicyService","repository","realmRepository","validator","attributesValidator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","PERMISSION_DELETE","findMany","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","PERMISSION_CREATE","CREATE","validated","validate","validateJoinColumns","parent","type","COMPOSITE","built_in","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","saveWithEA","created","identity","getActorRealmId","resourceRealmMatch","run","attributes","Array","isArray","children","promises","map","child","Promise","all","delete","entityId","deleteFromTree"],"sources":["../../../../src/core/entities/policy/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    ValidatorGroup,\n    extendObject,\n    isPropertySet,\n    isUUID,\n    removeObjectProperty,\n} from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    PolicyValidator,\n} from '@authup/core-kit';\nimport type { Policy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { PolicyAttributesValidator } from './attributes-validator.ts';\nimport type { IPolicyRepository, IPolicyService } from './types.ts';\n\nexport type PolicyServiceContext = {\n    repository: IPolicyRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class PolicyService extends AbstractEntityService implements IPolicyService {\n    protected repository: IPolicyRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: PolicyValidator;\n\n    protected attributesValidator: PolicyAttributesValidator;\n\n    constructor(ctx: PolicyServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new PolicyValidator();\n        this.attributesValidator = new PolicyAttributesValidator({});\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Policy>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Policy> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Policy,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Policy | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validate(data, group);\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (\n            validated.parent &&\n            validated.parent.type !== BuiltInPolicyType.COMPOSITE\n        ) {\n            throw new BadRequestError('The parent policy must be of type group.');\n        }\n\n        if (entity) {\n            if (entity.built_in) {\n                throw new BadRequestError('A built-in policy can not be updated.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            extendObject(entity, validated);\n\n            await this.repository.saveWithEA(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        await this.repository.saveWithEA(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    private async validate(\n        data: Record<string, any>,\n        group: string,\n    ): Promise<Policy> {\n        const validated = await this.validator.run(data, { group });\n\n        const attributes = await this.attributesValidator.run(data);\n        extendObject(validated, attributes);\n\n        if (Array.isArray(data.children)) {\n            if (data.type === BuiltInPolicyType.COMPOSITE) {\n                const promises = data.children.map(\n                    (child) => this.validate(child, group),\n                );\n                validated.children = await Promise.all(promises);\n            }\n        }\n\n        return validated;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in policy can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n\n        await this.repository.deleteFromTree(entity);\n\n        entity.id = entityId;\n\n        // todo: remove after PolicyEntity - parent delete on cascade\n        removeObjectProperty(entity, 'children');\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;AAgCA,IAAaa,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,YAAY,IAAIN,gBAAAA;EACrB,KAAKO,sBAAsB,IAAIL,0BAA0B,CAAC,CAAA;CAC9D;CAEA,MAAMO,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,UACAT,OACAU,OACe;EACf,MAAMV,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKlB,WAAWmB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAIxB,oBAAAA;EAGd,OAAOwB;CACX;CAEA,MAAME,OACFC,MACAd,OACe;EACf,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMd,KAAAA;EACpD,OAAOW;CACX;CAEA,MAAMM,OACFR,UACAK,MACAd,OACe;EACf,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMd,OAAO,EAAEkB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAd,OACAmB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,aAAa,WACnC,MAAM,KAAK3B,gBAAgB4B,QAAQR,KAAKO,QAAQ,IAChDL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAIvC,OAAOyB,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMpB,OAAOM;GAGjB,IAAIC,OACAa,MAAMF,WAAWX,MAAMc;GAG3Bb,SAAS,MAAM,KAAKlB,WAAWgC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAI/B,oBAAAA;EAElB,OAAO,IAAIgC,QAAQD,YACf,MAAM,IAAI/B,oBAAAA;EAGd,IAAIwB,QAAQ;GACR,MAAMX,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMf,eAAeiB,kBAAkB,CAAA;GACrFe,QAAQvC,eAAe8C;EAC3B,OAAO;GACH,MAAM3B,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMf,eAAewC,kBAAkB,CAAA;GACrFR,QAAQvC,eAAegD;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKC,SAASjB,MAAMM,KAAAA;EAE5C,MAAM,KAAK3B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IACIA,UAAUG,UACVH,UAAUG,OAAOC,SAASvD,kBAAkBwD,WAE5C,MAAM,IAAIjD,gBAAgB,0CAAA;EAG9B,IAAIyB,QAAQ;GACR,IAAIA,OAAOyB,UACP,MAAM,IAAIlD,gBAAgB,uCAAA;GAG9B,MAAMc,MAAMC,oBAAoBoC,SAAS;IACrClC,MAAMf,eAAeiB;IACrBS,MAAMlC,iBAAiB;MAClBD,kBAAkB2D,aAAa;MAC5B,GAAG3B;MACH,GAAGmB;KACP;MACCnD,kBAAkB4D,cAAcT,UAAUT,YAAYV,OAAOU,YAAY;IAC9E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK5B,WAAW+C,gBAAgBV,WAAWnB,MAAAA;GAEjD7B,aAAa6B,QAAQmB,SAAAA;GAErB,MAAM,KAAKrC,WAAWgD,WAAW9B,MAAAA;GAEjC,OAAO;IACHA;IACA+B,SAAS;GACb;EACJ;EAEA,IAAI,CAAC3D,cAAc+C,WAAW,UAAA,KAAe9B,MAAM2C,UAC/Cb,UAAUT,WAAW,KAAKuB,gBAAgB5C,KAAAA,KAAU;EAGxD,MAAMA,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMf,eAAewC;GACrBd,MAAMlC,iBAAiB;KAAGD,kBAAkB2D,aAAaR;IAAW,GAAG,KAAKe,mBAAmBf,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW+C,gBAAgBV,SAAAA;EAEtCnB,SAAS,KAAKlB,WAAWoB,OAAOiB,SAAAA;EAChC,MAAM,KAAKrC,WAAWgD,WAAW9B,MAAAA;EAEjC,OAAO;GACHA;GACA+B,SAAS;EACb;CACJ;CAEA,MAAcX,SACVjB,MACAM,OACe;EACf,MAAMU,YAAY,MAAM,KAAKnC,UAAUmD,IAAIhC,MAAM,EAAEM,MAAM,CAAA;EAGzDtC,aAAagD,WAAWiB,MADC,KAAKnD,oBAAoBkD,IAAIhC,IAAAA,CAC9BiC;EAExB,IAAIC,MAAMC,QAAQnC,KAAKoC,QAAQ;OACvBpC,KAAKoB,SAASvD,kBAAkBwD,WAAW;IAC3C,MAAMgB,WAAWrC,KAAKoC,SAASE,KAC1BC,UAAU,KAAKtB,SAASsB,OAAOjC,KAAAA,CAAAA;IAEpCU,UAAUoB,WAAW,MAAMI,QAAQC,IAAIJ,QAAAA;GAC3C;;EAGJ,OAAOrB;CACX;CAEA,MAAM0B,OACFhC,IACAxB,OACe;EACf,MAAMA,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMf,eAAekB,kBAAkB,CAAA;EAErF,MAAMK,SAAS,MAAM,KAAKlB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAIxB,oBAAAA;EAGd,IAAIwB,OAAOyB,UACP,MAAM,IAAIlD,gBAAgB,uCAAA;EAG9B,MAAMc,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMf,eAAekB;GACrBQ,MAAMlC,iBAAiB;KAAGD,kBAAkB2D,aAAa3B;IAAQ,GAAG,KAAKkC,mBAAmBlC,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEa,IAAIiC,aAAa9C;EAEzB,MAAM,KAAKlB,WAAWiE,eAAe/C,MAAAA;EAErCA,OAAOa,KAAKiC;EAGZxE,qBAAqB0B,QAAQ,UAAA;EAE7B,OAAOA;CACX;AACJ"}

package/dist/core/entities/realm/service.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { ValidatorGroup, isPropertySet, isUUID } from "@authup/kit";
 import { PermissionName, REALM_MASTER_NAME, RealmValidator } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
-import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/realm/service.ts
 var RealmService = class extends AbstractEntityService {
@@ -57,7 +57,7 @@ var RealmService = class extends AbstractEntityService {
 		if (entity) {
 			await actor.permissionEvaluator.evaluate({
 				name: PermissionName.REALM_UPDATE,
-				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: {
+				data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: {
 					...entity,
 					...validated
 				} })
@@ -72,7 +72,7 @@ var RealmService = class extends AbstractEntityService {
 		}
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.REALM_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+			data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
 		});
 		entity = this.repository.create(validated);
 		await this.repository.save(entity);
@@ -93,7 +93,7 @@ var RealmService = class extends AbstractEntityService {
 		if (entity.built_in) throw new BadRequestError("A built-in realm can not be deleted.");
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.REALM_DELETE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
 		});
 		const { id: entityId } = entity;
 		await this.repository.remove(entity);

package/dist/core/entities/realm/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ValidatorGroup","isPropertySet","isUUID","BadRequestError","EntityNotFoundError","PermissionName","REALM_MASTER_NAME","RealmValidator","AbstractEntityService","RealmService","repository","validator","webClientProvisioner","logger","ctx","getMany","query","findMany","getOne","idOrName","entity","findOneByIdOrName","create","data","actor","save","undefined","update","updateOnly","options","group","where","id","name","findOneBy","permissionEvaluator","preEvaluate","REALM_UPDATE","UPDATE","REALM_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","input","ATTRIBUTES","merge","created","ensureForRealm","e","warn","Error","message","String","delete","REALM_DELETE","built_in","entityId","remove"],"sources":["../../../../src/core/entities/realm/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    REALM_MASTER_NAME,\n    RealmValidator,\n} from '@authup/core-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IWebClientProvisioner } from '../client/types.ts';\nimport type { IRealmRepository, IRealmService } from './types.ts';\n\nexport type RealmServiceContext = {\n    repository: IRealmRepository;\n    webClientProvisioner?: IWebClientProvisioner;\n    logger?: Logger;\n};\n\nexport class RealmService extends AbstractEntityService implements IRealmService {\n    protected repository: IRealmRepository;\n\n    protected validator: RealmValidator;\n\n    protected webClientProvisioner?: IWebClientProvisioner;\n\n    protected logger?: Logger;\n\n    constructor(ctx: RealmServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.webClientProvisioner = ctx.webClientProvisioner;\n        this.logger = ctx.logger;\n        this.validator = new RealmValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n    ): Promise<EntityRepositoryFindManyResult<Realm>> {\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n    ): Promise<Realm> {\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Realm,\n        created: boolean \n    }> {\n        let group: string;\n\n        let entity: Realm | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.REALM_UPDATE,\n                input: new PolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            if (entity.name === REALM_MASTER_NAME && isPropertySet(validated, 'name') && entity.name !== validated.name) {\n                throw new BadRequestError(`The name of the ${REALM_MASTER_NAME} can not be changed.`);\n            }\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        // Provision the realm's public `web` client via the system-level\n        // provisioner (NOT clientService.create) — it must not be gated on\n        // the actor's CLIENT_CREATE, since a realm creator may lack it.\n        // Realm creation must stay atomic from the caller's perspective: the\n        // realm is already persisted, so a provisioning failure is logged and\n        // swallowed (startup provisioning reconciles every realm's web client).\n        if (this.webClientProvisioner) {\n            try {\n                await this.webClientProvisioner.ensureForRealm(entity);\n            } catch (e) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Failed to provision web client for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`,\n                    );\n                }\n            }\n        }\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in realm can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AA2BA,IAAaW,eAAb,cAAkCD,sBAAAA;CACpBE;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKE,uBAAuBE,IAAIF;EAChC,KAAKC,SAASC,IAAID;EAClB,KAAKF,YAAY,IAAIJ,eAAAA;CACzB;CAEA,MAAMQ,QACFC,OAC8C;EAC9C,OAAO,KAAKN,WAAWO,SAASD,KAAAA;CACpC;CAEA,MAAME,OACFC,UACc;EACd,MAAMC,SAAS,MAAM,KAAKV,WAAWW,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIhB,oBAAAA;EAGd,OAAOgB;CACX;CAEA,MAAME,OACFC,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKC,KAAAA,GAAWH,MAAMC,KAAAA;EACpD,OAAOJ;CACX;CAEA,MAAMO,OACFR,UACAI,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKN,UAAUI,MAAMC,OAAO,EAAEI,YAAY,KAAK,CAAA;EAC7E,OAAOR;CACX;CAEA,MAAMK,KACFN,UACAI,MACAC,OACAK,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,IAAIV;EACJ,IAAID,UAAU;GACV,MAAMY,QAA6B,CAAC;GACpC,IAAI7B,OAAOiB,QAAAA,GACPY,MAAMC,KAAKb;QAEXY,MAAME,OAAOd;GAGjBC,SAAS,MAAM,KAAKV,WAAWwB,UAAUH,KAAAA;GACzC,IAAI,CAACX,UAAUS,QAAQD,YACnB,MAAM,IAAIxB,oBAAAA;EAElB,OAAO,IAAIyB,QAAQD,YACf,MAAM,IAAIxB,oBAAAA;EAGd,IAAIgB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM5B,eAAegC,aAAa,CAAA;GAChFP,QAAQ9B,eAAesC;EAC3B,OAAO;GACH,MAAMd,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM5B,eAAekC,aAAa,CAAA;GAChFT,QAAQ9B,eAAewC;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK9B,UAAU+B,IAAInB,MAAM,EAAEO,MAAM,CAAA;EAEzD,MAAM,KAAKpB,WAAWiC,oBAAoBF,SAAAA;EAE1C,IAAIrB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBS,SAAS;IACrCX,MAAM5B,eAAegC;IACrBQ,OAAO,IAAI9C,WAAW,GACjBD,kBAAkBgD,aAAa;KAC5B,GAAG1B;KACH,GAAGqB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,IAAIrB,OAAOa,SAAS3B,qBAAqBL,cAAcwC,WAAW,MAAA,KAAWrB,OAAOa,SAASQ,UAAUR,MACnG,MAAM,IAAI9B,gBAAgB,mBAAmBG,kBAAkB,qBAAqB;GAGxFc,SAAS,KAAKV,WAAWqC,MAAM3B,QAAQqB,SAAAA;GACvC,MAAM,KAAK/B,WAAWe,KAAKL,MAAAA;GAE3B,OAAO;IACHA;IACA4B,SAAS;GACb;EACJ;EAEA,MAAMxB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM5B,eAAekC;GACrBM,OAAO,IAAI9C,WAAW,GAAGD,kBAAkBgD,aAAaL,UAAU,CAAA;EACtE,CAAA;EAEArB,SAAS,KAAKV,WAAWY,OAAOmB,SAAAA;EAChC,MAAM,KAAK/B,WAAWe,KAAKL,MAAAA;EAQ3B,IAAI,KAAKR,sBACL,IAAI;GACA,MAAM,KAAKA,qBAAqBqC,eAAe7B,MAAAA;EACnD,SAAS8B,GAAG;GACR,IAAI,KAAKrC,QACL,KAAKA,OAAOsC,KACR,4CAA4C/B,OAAOY,GAAG,IAAIkB,aAAaE,QAAQF,EAAEG,UAAUC,OAAOJ,CAAAA,GAAI;EAGlH;EAGJ,OAAO;GACH9B;GACA4B,SAAS;EACb;CACJ;CAEA,MAAMO,OACFvB,IACAR,OACc;EACd,MAAMA,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM5B,eAAemD,aAAa,CAAA;EAEhF,MAAMpC,SAAS,MAAM,KAAKV,WAAWwB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACZ,QACD,MAAM,IAAIhB,oBAAAA;EAGd,IAAIgB,OAAOqC,UACP,MAAM,IAAItD,gBAAgB,sCAAA;EAG9B,MAAMqB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM5B,eAAemD;GACrBX,OAAO,IAAI9C,WAAW,GAAGD,kBAAkBgD,aAAa1B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEY,IAAI0B,aAAatC;EACzB,MAAM,KAAKV,WAAWiD,OAAOvC,MAAAA;EAC7BA,OAAOY,KAAK0B;EAEZ,OAAOtC;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","BadRequestError","EntityNotFoundError","PermissionName","REALM_MASTER_NAME","RealmValidator","AbstractEntityService","RealmService","repository","validator","webClientProvisioner","logger","ctx","getMany","query","findMany","getOne","idOrName","entity","findOneByIdOrName","create","data","actor","save","undefined","update","updateOnly","options","group","where","id","name","findOneBy","permissionEvaluator","preEvaluate","REALM_UPDATE","UPDATE","REALM_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","merge","created","ensureForRealm","e","warn","Error","message","String","delete","REALM_DELETE","built_in","entityId","remove"],"sources":["../../../../src/core/entities/realm/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    REALM_MASTER_NAME,\n    RealmValidator,\n} from '@authup/core-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IWebClientProvisioner } from '../client/types.ts';\nimport type { IRealmRepository, IRealmService } from './types.ts';\n\nexport type RealmServiceContext = {\n    repository: IRealmRepository;\n    webClientProvisioner?: IWebClientProvisioner;\n    logger?: Logger;\n};\n\nexport class RealmService extends AbstractEntityService implements IRealmService {\n    protected repository: IRealmRepository;\n\n    protected validator: RealmValidator;\n\n    protected webClientProvisioner?: IWebClientProvisioner;\n\n    protected logger?: Logger;\n\n    constructor(ctx: RealmServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.webClientProvisioner = ctx.webClientProvisioner;\n        this.logger = ctx.logger;\n        this.validator = new RealmValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n    ): Promise<EntityRepositoryFindManyResult<Realm>> {\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n    ): Promise<Realm> {\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Realm,\n        created: boolean \n    }> {\n        let group: string;\n\n        let entity: Realm | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.REALM_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            if (entity.name === REALM_MASTER_NAME && isPropertySet(validated, 'name') && entity.name !== validated.name) {\n                throw new BadRequestError(`The name of the ${REALM_MASTER_NAME} can not be changed.`);\n            }\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        // Provision the realm's public `web` client via the system-level\n        // provisioner (NOT clientService.create) — it must not be gated on\n        // the actor's CLIENT_CREATE, since a realm creator may lack it.\n        // Realm creation must stay atomic from the caller's perspective: the\n        // realm is already persisted, so a provisioning failure is logged and\n        // swallowed (startup provisioning reconciles every realm's web client).\n        if (this.webClientProvisioner) {\n            try {\n                await this.webClientProvisioner.ensureForRealm(entity);\n            } catch (e) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Failed to provision web client for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`,\n                    );\n                }\n            }\n        }\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in realm can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AA2BA,IAAaW,eAAb,cAAkCD,sBAAAA;CACpBE;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKE,uBAAuBE,IAAIF;EAChC,KAAKC,SAASC,IAAID;EAClB,KAAKF,YAAY,IAAIJ,eAAAA;CACzB;CAEA,MAAMQ,QACFC,OAC8C;EAC9C,OAAO,KAAKN,WAAWO,SAASD,KAAAA;CACpC;CAEA,MAAME,OACFC,UACc;EACd,MAAMC,SAAS,MAAM,KAAKV,WAAWW,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIhB,oBAAAA;EAGd,OAAOgB;CACX;CAEA,MAAME,OACFC,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKC,KAAAA,GAAWH,MAAMC,KAAAA;EACpD,OAAOJ;CACX;CAEA,MAAMO,OACFR,UACAI,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKN,UAAUI,MAAMC,OAAO,EAAEI,YAAY,KAAK,CAAA;EAC7E,OAAOR;CACX;CAEA,MAAMK,KACFN,UACAI,MACAC,OACAK,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,IAAIV;EACJ,IAAID,UAAU;GACV,MAAMY,QAA6B,CAAC;GACpC,IAAI7B,OAAOiB,QAAAA,GACPY,MAAMC,KAAKb;QAEXY,MAAME,OAAOd;GAGjBC,SAAS,MAAM,KAAKV,WAAWwB,UAAUH,KAAAA;GACzC,IAAI,CAACX,UAAUS,QAAQD,YACnB,MAAM,IAAIxB,oBAAAA;EAElB,OAAO,IAAIyB,QAAQD,YACf,MAAM,IAAIxB,oBAAAA;EAGd,IAAIgB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM5B,eAAegC,aAAa,CAAA;GAChFP,QAAQ9B,eAAesC;EAC3B,OAAO;GACH,MAAMd,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM5B,eAAekC,aAAa,CAAA;GAChFT,QAAQ9B,eAAewC;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK9B,UAAU+B,IAAInB,MAAM,EAAEO,MAAM,CAAA;EAEzD,MAAM,KAAKpB,WAAWiC,oBAAoBF,SAAAA;EAE1C,IAAIrB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBS,SAAS;IACrCX,MAAM5B,eAAegC;IACrBd,MAAMxB,iBAAiB,GAClBD,kBAAkB+C,aAAa;KAC5B,GAAGzB;KACH,GAAGqB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,IAAIrB,OAAOa,SAAS3B,qBAAqBL,cAAcwC,WAAW,MAAA,KAAWrB,OAAOa,SAASQ,UAAUR,MACnG,MAAM,IAAI9B,gBAAgB,mBAAmBG,kBAAkB,qBAAqB;GAGxFc,SAAS,KAAKV,WAAWoC,MAAM1B,QAAQqB,SAAAA;GACvC,MAAM,KAAK/B,WAAWe,KAAKL,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,MAAMvB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM5B,eAAekC;GACrBhB,MAAMxB,iBAAiB,GAAGD,kBAAkB+C,aAAaJ,UAAU,CAAA;EACvE,CAAA;EAEArB,SAAS,KAAKV,WAAWY,OAAOmB,SAAAA;EAChC,MAAM,KAAK/B,WAAWe,KAAKL,MAAAA;EAQ3B,IAAI,KAAKR,sBACL,IAAI;GACA,MAAM,KAAKA,qBAAqBoC,eAAe5B,MAAAA;EACnD,SAAS6B,GAAG;GACR,IAAI,KAAKpC,QACL,KAAKA,OAAOqC,KACR,4CAA4C9B,OAAOY,GAAG,IAAIiB,aAAaE,QAAQF,EAAEG,UAAUC,OAAOJ,CAAAA,GAAI;EAGlH;EAGJ,OAAO;GACH7B;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMO,OACFtB,IACAR,OACc;EACd,MAAMA,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM5B,eAAekD,aAAa,CAAA;EAEhF,MAAMnC,SAAS,MAAM,KAAKV,WAAWwB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACZ,QACD,MAAM,IAAIhB,oBAAAA;EAGd,IAAIgB,OAAOoC,UACP,MAAM,IAAIrD,gBAAgB,sCAAA;EAG9B,MAAMqB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM5B,eAAekD;GACrBhC,MAAMxB,iBAAiB,GAAGD,kBAAkB+C,aAAazB,OAAO,CAAA;EACpE,CAAA;EAEA,MAAM,EAAEY,IAAIyB,aAAarC;EACzB,MAAM,KAAKV,WAAWgD,OAAOtC,MAAAA;EAC7BA,OAAOY,KAAKyB;EAEZ,OAAOrC;CACX;AACJ"}