@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.52

package/dist/core/entities/session/service.mjs

@@ -0,0 +1,151 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SESSION_FILTER_KEYS } from "../../authentication/session/types.mjs";
+import "../../authentication/index.mjs";
+import { isObject } from "@authup/kit";
+import { PermissionName } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { EntityNotFoundError, UnauthorizedError } from "@authup/errors";
+//#region src/core/entities/session/service.ts
+var SessionService = class extends AbstractEntityService {
+	repository;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+	}
+	isOwnedBy(session, actor) {
+		return !!actor.identity && session.sub === actor.identity.data.id && session.sub_kind === actor.identity.type;
+	}
+	async getMany(query, actor) {
+		let canReadAll = true;
+		try {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });
+		} catch (e) {
+			if (!actor.identity) throw e;
+			canReadAll = false;
+		}
+		if (!canReadAll) return this.repository.findMany(query, { owner: {
+			sub: actor.identity.data.id,
+			subKind: actor.identity.type
+		} });
+		const { data: entities, meta } = await this.repository.findMany(query);
+		const data = [];
+		let { total } = meta;
+		for (const entity of entities) {
+			if (this.isOwnedBy(entity, actor)) {
+				data.push(entity);
+				continue;
+			}
+			try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.SESSION_READ,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: entity,
+						...this.resourceRealmMatch(entity)
+					})
+				});
+				data.push(entity);
+			} catch {
+				total -= 1;
+			}
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(id, actor) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.SESSION_READ,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		return entity;
+	}
+	async delete(id, actor) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.SESSION_DELETE,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+	async deleteMany(actor, options = {}) {
+		if (!actor.identity) throw new UnauthorizedError();
+		if (this.hasTargetFilter(options.query)) return this.deleteManyByQuery(actor, options.query);
+		return this.deleteManyForSelf(actor, options.currentSessionId);
+	}
+	/**
+	* True when the query carries at least one recognized target filter — the
+	* discriminator between the admin bulk-revoke path and self-service. An
+	* unrecognized / empty filter falls through to self-service (fail-safe: a
+	* typo can never trigger an unconstrained mass delete).
+	*/ hasTargetFilter(query) {
+		const filter = query?.filter;
+		if (!isObject(filter)) return false;
+		return SESSION_FILTER_KEYS.some((key) => {
+			const value = filter[key];
+			return typeof value !== "undefined" && value !== "";
+		});
+	}
+	async deleteManyForSelf(actor, currentSessionId) {
+		const sessions = await this.repository.findAllByOwner({
+			sub: actor.identity.data.id,
+			subKind: actor.identity.type
+		});
+		let count = 0;
+		for (const session of sessions) {
+			if (currentSessionId && session.id === currentSessionId) continue;
+			await this.repository.remove(session);
+			count += 1;
+		}
+		return { count };
+	}
+	async deleteManyByQuery(actor, query) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });
+		const sessions = await this.repository.findAllByQuery(query);
+		let count = 0;
+		for (const session of sessions) {
+			if (!this.isOwnedBy(session, actor)) try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.SESSION_DELETE,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: session,
+						...this.resourceRealmMatch(session)
+					})
+				});
+			} catch {
+				continue;
+			}
+			await this.repository.remove(session);
+			count += 1;
+		}
+		return { count };
+	}
+};
+//#endregion
+export { SessionService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/session/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityNotFoundError","UnauthorizedError","isObject","PermissionName","AbstractEntityService","SESSION_FILTER_KEYS","SessionService","repository","ctx","isOwnedBy","session","actor","identity","sub","data","id","sub_kind","type","getMany","query","canReadAll","permissionEvaluator","preEvaluate","name","SESSION_READ","e","findMany","owner","subKind","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","delete","SESSION_DELETE","entityId","remove","deleteMany","options","hasTargetFilter","deleteManyByQuery","deleteManyForSelf","currentSessionId","filter","some","key","value","sessions","findAllByOwner","count","findAllByQuery"],"sources":["../../../../src/core/entities/session/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError, UnauthorizedError } from '@authup/errors';\nimport { isObject } from '@authup/kit';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Session } from '@authup/core-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { ISessionRepository } from '../../authentication/index.ts';\nimport { SESSION_FILTER_KEYS } from '../../authentication/index.ts';\nimport type { ISessionService, SessionDeleteManyOptions, SessionDeleteManyResult } from './types.ts';\n\nexport type SessionServiceContext = {\n    repository: ISessionRepository,\n};\n\nexport class SessionService extends AbstractEntityService implements ISessionService {\n    protected repository: ISessionRepository;\n\n    constructor(ctx: SessionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n    }\n\n    protected isOwnedBy(session: Session, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            session.sub === actor.identity.data.id &&\n            session.sub_kind === actor.identity.type;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own sessions\n            return this.repository.findMany(query, {\n                owner: {\n                    sub: actor.identity!.data.id,\n                    subKind: actor.identity!.type,\n                },\n            });\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(query);\n\n        const data: Session[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.SESSION_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext): Promise<Session> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SESSION_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n\n    async delete(id: string, actor: ActorContext): Promise<Session> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SESSION_DELETE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    async deleteMany(\n        actor: ActorContext,\n        options: SessionDeleteManyOptions = {},\n    ): Promise<SessionDeleteManyResult> {\n        if (!actor.identity) {\n            throw new UnauthorizedError();\n        }\n\n        if (this.hasTargetFilter(options.query)) {\n            return this.deleteManyByQuery(actor, options.query!);\n        }\n\n        return this.deleteManyForSelf(actor, options.currentSessionId);\n    }\n\n    /**\n     * True when the query carries at least one recognized target filter — the\n     * discriminator between the admin bulk-revoke path and self-service. An\n     * unrecognized / empty filter falls through to self-service (fail-safe: a\n     * typo can never trigger an unconstrained mass delete).\n     */\n    protected hasTargetFilter(query?: Record<string, any>): boolean {\n        const filter = query?.filter;\n        if (!isObject(filter)) {\n            return false;\n        }\n\n        return SESSION_FILTER_KEYS.some((key) => {\n            const value = filter[key];\n            return typeof value !== 'undefined' && value !== '';\n        });\n    }\n\n    protected async deleteManyForSelf(\n        actor: ActorContext,\n        currentSessionId?: string,\n    ): Promise<SessionDeleteManyResult> {\n        const sessions = await this.repository.findAllByOwner({\n            sub: actor.identity!.data.id,\n            subKind: actor.identity!.type,\n        });\n\n        let count = 0;\n        for (const session of sessions) {\n            if (currentSessionId && session.id === currentSessionId) {\n                continue;\n            }\n            await this.repository.remove(session);\n            count += 1;\n        }\n\n        return { count };\n    }\n\n    protected async deleteManyByQuery(\n        actor: ActorContext,\n        query: Record<string, any>,\n    ): Promise<SessionDeleteManyResult> {\n        // Gate: an actor without SESSION_DELETE cannot force-logout anyone → 403.\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n\n        const sessions = await this.repository.findAllByQuery(query);\n\n        let count = 0;\n        for (const session of sessions) {\n            // Own sessions are always deletable by the actor (mirrors getMany).\n            // Otherwise per-session realm-match: a realm_admin only reaches\n            // sessions in its realm — cross-realm rows are skipped, not failed,\n            // so filter breadth cannot escalate beyond the actor's reach.\n            if (!this.isOwnedBy(session, actor)) {\n                try {\n                    await actor.permissionEvaluator.evaluate({\n                        name: PermissionName.SESSION_DELETE,\n                        data: definePolicyData({\n                            [BuiltInPolicyType.ATTRIBUTES]: session,\n                            ...this.resourceRealmMatch(session),\n                        }),\n                    });\n                } catch {\n                    continue;\n                }\n            }\n\n            await this.repository.remove(session);\n            count += 1;\n        }\n\n        return { count };\n    }\n}\n"],"mappings":";;;;;;;;;;;AAsBA,IAAaQ,iBAAb,cAAoCF,sBAAAA;CACtBG;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,aAAaL,MAAMC,SAASK;CAC5C;CAEA,MAAMC,QACFC,OACAR,OACgD;EAChD,IAAIS,aAAa;EACjB,IAAI;GACA,MAAMT,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqB,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAACd,MAAMC,UACP,MAAMa;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKb,WAAWmB,SAASP,OAAO,EACnCQ,OAAO;GACHd,KAAKF,MAAMC,SAAUE,KAAKC;GAC1Ba,SAASjB,MAAMC,SAAUK;EAC7B,EACJ,CAAA;EAGJ,MAAM,EAAEH,MAAMe,UAAUC,SAAS,MAAM,KAAKvB,WAAWmB,SAASP,KAAAA;EAEhE,MAAML,OAAkB,CAAA;EACxB,IAAI,EAAEiB,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAKpB,UAAUuB,QAAQrB,KAAAA,GAAQ;IAC/BG,KAAKmB,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMrB,MAAMU,oBAAoBa,SAAS;KACrCX,MAAMpB,eAAeqB;KACrBV,MAAMf,iBAAiB;OAClBD,kBAAkBqC,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAlB,KAAKmB,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHjB;GACAgB,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAOtB,IAAYJ,OAAuC;EAC5D,MAAMqB,SAAS,MAAM,KAAKzB,WAAW+B,YAAYvB,EAAAA;EACjD,IAAI,CAACiB,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAAC,KAAKS,UAAUuB,QAAQrB,KAAAA,GAAQ;GAChC,MAAMA,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqB,aAAa,CAAA;GAChF,MAAMb,MAAMU,oBAAoBa,SAAS;IACrCX,MAAMpB,eAAeqB;IACrBV,MAAMf,iBAAiB;MAClBD,kBAAkBqC,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMO,OAAOxB,IAAYJ,OAAuC;EAC5D,MAAMqB,SAAS,MAAM,KAAKzB,WAAW+B,YAAYvB,EAAAA;EACjD,IAAI,CAACiB,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAAC,KAAKS,UAAUuB,QAAQrB,KAAAA,GAAQ;GAChC,MAAMA,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqC,eAAe,CAAA;GAClF,MAAM7B,MAAMU,oBAAoBa,SAAS;IACrCX,MAAMpB,eAAeqC;IACrB1B,MAAMf,iBAAiB;MAClBD,kBAAkBqC,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAEjB,IAAI0B,aAAaT;EACzB,MAAM,KAAKzB,WAAWmC,OAAOV,MAAAA;EAC7BA,OAAOjB,KAAK0B;EAEZ,OAAOT;CACX;CAEA,MAAMW,WACFhC,OACAiC,UAAoC,CAAC,GACL;EAChC,IAAI,CAACjC,MAAMC,UACP,MAAM,IAAIX,kBAAAA;EAGd,IAAI,KAAK4C,gBAAgBD,QAAQzB,KAAK,GAClC,OAAO,KAAK2B,kBAAkBnC,OAAOiC,QAAQzB,KAAK;EAGtD,OAAO,KAAK4B,kBAAkBpC,OAAOiC,QAAQI,gBAAgB;CACjE;;;;;;IAQA,gBAA0B7B,OAAsC;EAC5D,MAAM8B,SAAS9B,OAAO8B;EACtB,IAAI,CAAC/C,SAAS+C,MAAAA,GACV,OAAO;EAGX,OAAO5C,oBAAoB6C,MAAMC,QAAAA;GAC7B,MAAMC,QAAQH,OAAOE;GACrB,OAAO,OAAOC,UAAU,eAAeA,UAAU;EACrD,CAAA;CACJ;CAEA,MAAgBL,kBACZpC,OACAqC,kBACgC;EAChC,MAAMK,WAAW,MAAM,KAAK9C,WAAW+C,eAAe;GAClDzC,KAAKF,MAAMC,SAAUE,KAAKC;GAC1Ba,SAASjB,MAAMC,SAAUK;EAC7B,CAAA;EAEA,IAAIsC,QAAQ;EACZ,KAAK,MAAM7C,WAAW2C,UAAU;GAC5B,IAAIL,oBAAoBtC,QAAQK,OAAOiC,kBACnC;GAEJ,MAAM,KAAKzC,WAAWmC,OAAOhC,OAAAA;GAC7B6C,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;CAEA,MAAgBT,kBACZnC,OACAQ,OACgC;EAEhC,MAAMR,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqC,eAAe,CAAA;EAElF,MAAMa,WAAW,MAAM,KAAK9C,WAAWiD,eAAerC,KAAAA;EAEtD,IAAIoC,QAAQ;EACZ,KAAK,MAAM7C,WAAW2C,UAAU;GAK5B,IAAI,CAAC,KAAK5C,UAAUC,SAASC,KAAAA,GACzB,IAAI;IACA,MAAMA,MAAMU,oBAAoBa,SAAS;KACrCX,MAAMpB,eAAeqC;KACrB1B,MAAMf,iBAAiB;OAClBD,kBAAkBqC,aAAazB;MAChC,GAAG,KAAK0B,mBAAmB1B,OAAAA;KAC/B,CAAA;IACJ,CAAA;GACJ,QAAQ;IACJ;GACJ;GAGJ,MAAM,KAAKH,WAAWmC,OAAOhC,OAAAA;GAC7B6C,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;AACJ"}

package/dist/core/entities/session/types.d.ts

@@ -0,0 +1,48 @@
+import type { Session } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+export type SessionDeleteManyResult = {
+    count: number;
+};
+export type SessionDeleteManyOptions = {
+    /**
+     * The parsed request query. When it carries a recognized target filter
+     * (`SESSION_FILTER_KEYS`, e.g. `filter[user_id]`) the call is an admin
+     * bulk revoke; otherwise it is the self-service path.
+     */
+    query?: Record<string, any>;
+    /**
+     * The caller's current session id (from the bearer). Preserved on the
+     * self-service path so "log out my other devices" keeps this device.
+     */
+    currentSessionId?: string;
+};
+export interface ISessionService {
+    /**
+     * List sessions. An actor without `SESSION_READ` is scoped to its own
+     * sessions (self-service); an actor with `SESSION_READ` sees every session
+     * its realm reach permits.
+     */
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<Session>>;
+    /**
+     * Read a single session by id. Own sessions need no permission.
+     */
+    getOne(id: string, actor: ActorContext): Promise<Session>;
+    /**
+     * Revoke (delete) a single session by id. Own sessions need no permission.
+     */
+    delete(id: string, actor: ActorContext): Promise<Session>;
+    /**
+     * Bulk revoke.
+     *
+     * - **No recognized target filter** → self-service: revoke every session of
+     *   the actor except the current one ("log out my other devices"). No
+     *   permission required.
+     * - **A recognized target filter** (`SESSION_FILTER_KEYS`, e.g.
+     *   `filter[user_id]`, `filter[realm_id]`) → admin "force-logout": revoke
+     *   every matching session. Requires `SESSION_DELETE`, and each session is
+     *   additionally realm-matched (drop-unauthorized), so a `realm_admin` only
+     *   revokes sessions in its reach and filter breadth cannot escalate.
+     */
+    deleteMany(actor: ActorContext, options?: SessionDeleteManyOptions): Promise<SessionDeleteManyResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/session/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,MAAM,uBAAuB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3G;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1D;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1D;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACzG"}

package/dist/core/entities/session/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/entities/user/service.d.ts

@@ -7,6 +7,7 @@ import type { IUserRepository, IUserService } from './types.ts';
 export type UserServiceContext = {
     repository: IUserRepository;
     realmRepository: IRealmRepository;
+    passwordMinLength?: number;
 };
 export declare class UserService extends AbstractEntityService implements IUserService {
     protected repository: IUserRepository;

package/dist/core/entities/user/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAEH,aAAa,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,WAAY,SAAQ,qBAAsB,YAAW,YAAY;IAC1E,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;gBAEvB,GAAG,EAAE,kBAAkB;IAO7B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAoD1C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IAsCV,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAqII,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;CA2BnB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAEH,aAAa,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,qBAAa,WAAY,SAAQ,qBAAsB,YAAW,YAAY;IAC1E,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;gBAEvB,GAAG,EAAE,kBAAkB;IAO7B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAoD1C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IAsCV,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAsII,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;CA2BnB"}

package/dist/core/entities/user/service.mjs

@@ -5,7 +5,7 @@ import { UserCredentialsService } from "../../authentication/credential/entities
 import { ValidatorGroup, isUUID } from "@authup/kit";
 import { PermissionName, UserValidator } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
-import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/user/service.ts
 var UserService = class extends AbstractEntityService {
@@ -16,7 +16,7 @@ var UserService = class extends AbstractEntityService {
 		super();
 		this.repository = ctx.repository;
 		this.realmRepository = ctx.realmRepository;
-		this.validator = new UserValidator();
+		this.validator = new UserValidator({ passwordMinLength: ctx.passwordMinLength });
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -39,7 +39,10 @@ var UserService = class extends AbstractEntityService {
 						PermissionName.USER_UPDATE,
 						PermissionName.USER_DELETE
 					],
-					input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: entity,
+						...this.resourceRealmMatch(entity)
+					})
 				});
 				data.push(entity);
 			} catch {
@@ -70,7 +73,10 @@ var UserService = class extends AbstractEntityService {
 		}
 		if (!isMe) await actor.permissionEvaluator.evaluateOneOf({
 			name: permissionNames,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
 		});
 		return entity;
 	}
@@ -116,7 +122,10 @@ var UserService = class extends AbstractEntityService {
 			const originalNameLocked = entity.name_locked;
 			if (isSelfEdit) await actor.permissionEvaluator.evaluate({
 				name: PermissionName.USER_SELF_MANAGE,
-				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: validated,
+					...this.resourceRealmMatch(validated)
+				})
 			});
 			entity = this.repository.merge(entity, validated);
 			if (validated.name && validated.name !== originalName) {
@@ -125,10 +134,13 @@ var UserService = class extends AbstractEntityService {
 			}
 			if (!isSelfEdit) await actor.permissionEvaluator.evaluate({
 				name: PermissionName.USER_UPDATE,
-				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: {
-					...entity,
-					...validated
-				} })
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: {
+						...entity,
+						...validated
+					},
+					[BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null
+				})
 			});
 			if (validated.password) entity.password = await credentialsService.protect(validated.password);
 			await this.repository.save(entity);
@@ -144,7 +156,10 @@ var UserService = class extends AbstractEntityService {
 		entity = this.repository.create(validated);
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
 		});
 		if (validated.password) entity.password = await credentialsService.protect(validated.password);
 		await this.repository.save(entity);
@@ -160,7 +175,10 @@ var UserService = class extends AbstractEntityService {
 		if (!entity) throw new EntityNotFoundError();
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_DELETE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
 		});
 		const { id: entityId } = entity;
 		await this.repository.remove(entity);

package/dist/core/entities/user/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","ValidatorGroup","isUUID","BadRequestError","EntityNotFoundError","PermissionName","UserValidator","AbstractEntityService","UserCredentialsService","UserService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_READ","USER_UPDATE","USER_DELETE","data","entities","meta","findMany","total","entity","identity","type","id","push","evaluateOneOf","input","ATTRIBUTES","getOne","idOrName","realmId","permissionNames","isMe","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneBy","isSelfEdit","preEvaluate","e","USER_SELF_MANAGE","UPDATE","USER_CREATE","CREATE","validated","run","validateJoinColumns","credentialsService","originalName","originalNameLocked","name_locked","evaluate","merge","password","protect","created","actorRealmId","getActorRealmId","delete","entityId","remove"],"sources":["../../../../src/core/entities/user/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    UserValidator,\n} from '@authup/core-kit';\nimport type { User } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type { IUserRepository, IUserService } from './types.ts';\n\nexport type UserServiceContext = {\n    repository: IUserRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class UserService extends AbstractEntityService implements IUserService {\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: UserValidator;\n\n    constructor(ctx: UserServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new UserValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<User>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_READ,\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_DELETE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n\n        const data: User[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (\n                actor.identity &&\n                actor.identity.type === 'user' &&\n                actor.identity.data.id === entity.id\n            ) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: [\n                        PermissionName.USER_READ,\n                        PermissionName.USER_UPDATE,\n                        PermissionName.USER_DELETE,\n                    ],\n                    input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n                });\n\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<User> {\n        const permissionNames = [\n            PermissionName.USER_READ,\n            PermissionName.USER_UPDATE,\n            PermissionName.USER_DELETE,\n        ];\n\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        const entity = await this.repository.findOne(idOrName, query, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        if (!isMe) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: permissionNames,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: User,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: User | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'user' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n            }\n\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_CREATE });\n\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const credentialsService = new UserCredentialsService();\n\n        if (entity) {\n            const originalName = entity.name;\n            const originalNameLocked = entity.name_locked;\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_SELF_MANAGE,\n                    input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (\n                validated.name &&\n                validated.name !== originalName\n            ) {\n                if (validated.name_locked) {\n                    entity.name_locked = validated.name_locked;\n                }\n\n                if (originalNameLocked && validated.name_locked !== false) {\n                    entity.name = originalName;\n                }\n            }\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_UPDATE,\n                    input: new PolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: {\n                            ...entity,\n                            ...validated,\n                        },\n                    }),\n                });\n            }\n\n            if (validated.password) {\n                entity.password = await credentialsService.protect(validated.password);\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realm_id) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realm_id = actorRealmId;\n            }\n        }\n\n        entity = this.repository.create(validated);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        if (validated.password) {\n            entity.password = await credentialsService.protect(validated.password);\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<User> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });\n\n        if (\n            actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === id\n        ) {\n            throw new BadRequestError('The own user can not be deleted.');\n        }\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;AA0BA,IAAaU,cAAb,cAAiCF,sBAAAA;CACnBG;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIN,cAAAA;CACzB;CAEA,MAAMQ,QACFC,OACAC,OAC6C;EAC7C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,KAAAA;EAEnC,MAAMQ,OAAe,CAAA;EACrB,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UAAU;GAC3B,IACIR,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,IACpC;IACER,KAAKS,KAAKJ,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMZ,MAAMC,oBAAoBgB,cAAc;KAC1Cd,MAAM;MACFd,eAAee;MACff,eAAegB;MACfhB,eAAeiB;;KAEnBY,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaP,OAAO,CAAA;IACnE,CAAA;IAEAL,KAAKS,KAAKJ,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACa;EACb,MAAMC,kBAAkB;GACpBlC,eAAee;GACff,eAAegB;GACfhB,eAAeiB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMa,YACfb,MAAMa,SAASC,SAAS,WAEpBd,MAAMa,SAASN,KAAKQ,OAAOM,YAC3BrB,MAAMa,SAASN,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKlB,WAAW+B,QAAQJ,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAIxB,oBAAAA;EAGd,IAAIoC,QAAQxB,MAAMa,SAAUN,KAAKQ,OAAOH,OAAOG,IAAI;GAC/CS,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IAAI,CAACC,MACD,MAAMxB,MAAMC,oBAAoBgB,cAAc;GAC1Cd,MAAMoB;GACNL,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaP,OAAO,CAAA;EACnE,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMc,OACFnB,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKC,KAAAA,GAAWrB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMiB,OACFR,UACAd,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKN,UAAUd,MAAMP,OAAO,EAAE8B,YAAY,KAAK,CAAA;EAC7E,OAAOlB;CACX;CAEA,MAAMe,KACFN,UACAd,MACAP,OACA+B,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO1B,KAAK2B,aAAa,WACnC,MAAM,KAAKvC,gBAAgBwC,QAAQ5B,KAAK2B,QAAQ,IAChDN,KAAAA;EAEJ,IAAIhB;EACJ,IAAIS,UAAU;GACV,MAAMe,QAA6B,CAAC;GACpC,IAAIlD,OAAOmC,QAAAA,GACPe,MAAMrB,KAAKM;QAEXe,MAAMjC,OAAOkB;GAGjB,IAAIY,OACAG,MAAMF,WAAWD,MAAMlB;GAG3BH,SAAS,MAAM,KAAKlB,WAAW2C,UAAUD,KAAAA;GACzC,IAAI,CAACxB,UAAUmB,QAAQD,YACnB,MAAM,IAAI1C,oBAAAA;EAElB,OAAO,IAAI2C,QAAQD,YACf,MAAM,IAAI1C,oBAAAA;EAGd,IAAIkD,aAAa;EACjB,IAAI1B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMd,eAAegB,YAAY,CAAA;GACnF,SAASmC,GAAG;IACR,IACI,CAACxC,MAAMa,YACPb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,IAElC,MAAMyB;IAEVF,aAAa;IACb,MAAMtC,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMd,eAAeoD,iBAAiB,CAAA;GACxF;GAEAT,QAAQ/C,eAAeyD;EAC3B,OAAO;GACH,MAAM1C,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMd,eAAesD,YAAY,CAAA;GAE/EX,QAAQ/C,eAAe2D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKjD,UAAUkD,IAAIvC,MAAM,EAAEyB,MAAM,CAAA;EAEzD,MAAM,KAAKtC,WAAWqD,oBAAoBF,SAAAA;EAE1C,MAAMG,qBAAqB,IAAIxD,uBAAAA;EAE/B,IAAIoB,QAAQ;GACR,MAAMqC,eAAerC,OAAOT;GAC5B,MAAM+C,qBAAqBtC,OAAOuC;GAElC,IAAIb,YACA,MAAMtC,MAAMC,oBAAoBmD,SAAS;IACrCjD,MAAMd,eAAeoD;IACrBvB,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAa0B,UAAU,CAAA;GACtE,CAAA;GAGJjC,SAAS,KAAKlB,WAAW2D,MAAMzC,QAAQiC,SAAAA;GAEvC,IACIA,UAAU1C,QACV0C,UAAU1C,SAAS8C,cACrB;IACE,IAAIJ,UAAUM,aACVvC,OAAOuC,cAAcN,UAAUM;IAGnC,IAAID,sBAAsBL,UAAUM,gBAAgB,OAChDvC,OAAOT,OAAO8C;GAEtB;GAEA,IAAI,CAACX,YACD,MAAMtC,MAAMC,oBAAoBmD,SAAS;IACrCjD,MAAMd,eAAegB;IACrBa,OAAO,IAAIlC,WAAW,GACjBD,kBAAkBoC,aAAa;KAC5B,GAAGP;KACH,GAAGiC;IACP,EACJ,CAAA;GACJ,CAAA;GAGJ,IAAIA,UAAUS,UACV1C,OAAO0C,WAAW,MAAMN,mBAAmBO,QAAQV,UAAUS,QAAQ;GAGzE,MAAM,KAAK5D,WAAWiC,KAAKf,MAAAA;GAE3B,OAAO;IACHA;IACA4C,SAAS;GACb;EACJ;EAEA,IAAI,CAACX,UAAUX,UAAU;GACrB,MAAMuB,eAAe,KAAKC,gBAAgB1D,KAAAA;GAC1C,IAAIyD,cACAZ,UAAUX,WAAWuB;EAE7B;EAEA7C,SAAS,KAAKlB,WAAWgC,OAAOmB,SAAAA;EAEhC,MAAM7C,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMd,eAAesD;GACrBzB,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaP,OAAO,CAAA;EACnE,CAAA;EAEA,IAAIiC,UAAUS,UACV1C,OAAO0C,WAAW,MAAMN,mBAAmBO,QAAQV,UAAUS,QAAQ;EAGzE,MAAM,KAAK5D,WAAWiC,KAAKf,MAAAA;EAE3B,OAAO;GACHA;GACA4C,SAAS;EACb;CACJ;CAEA,MAAMG,OACF5C,IACAf,OACa;EACb,MAAMA,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMd,eAAeiB,YAAY,CAAA;EAE/E,IACIN,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOA,IAE3B,MAAM,IAAI5B,gBAAgB,kCAAA;EAG9B,MAAMyB,SAAS,MAAM,KAAKlB,WAAW2C,UAAU,EAAEtB,GAAG,CAAA;EACpD,IAAI,CAACH,QACD,MAAM,IAAIxB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMd,eAAeiB;GACrBY,OAAO,IAAIlC,WAAW,GAAGD,kBAAkBoC,aAAaP,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEG,IAAI6C,aAAahD;EACzB,MAAM,KAAKlB,WAAWmE,OAAOjD,MAAAA;EAC7BA,OAAOG,KAAK6C;EAEZ,OAAOhD;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","BadRequestError","EntityNotFoundError","PermissionName","UserValidator","AbstractEntityService","UserCredentialsService","UserService","repository","realmRepository","validator","ctx","passwordMinLength","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_READ","USER_UPDATE","USER_DELETE","data","entities","meta","findMany","total","entity","identity","type","id","push","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","getOne","idOrName","realmId","permissionNames","isMe","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneBy","isSelfEdit","preEvaluate","e","USER_SELF_MANAGE","UPDATE","USER_CREATE","CREATE","validated","run","validateJoinColumns","credentialsService","originalName","originalNameLocked","name_locked","evaluate","merge","REALM_MATCH","password","protect","created","actorRealmId","getActorRealmId","delete","entityId","remove"],"sources":["../../../../src/core/entities/user/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    UserValidator,\n} from '@authup/core-kit';\nimport type { User } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type { IUserRepository, IUserService } from './types.ts';\n\nexport type UserServiceContext = {\n    repository: IUserRepository;\n    realmRepository: IRealmRepository;\n    passwordMinLength?: number;\n};\n\nexport class UserService extends AbstractEntityService implements IUserService {\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: UserValidator;\n\n    constructor(ctx: UserServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new UserValidator({ passwordMinLength: ctx.passwordMinLength });\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<User>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_READ,\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_DELETE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n\n        const data: User[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (\n                actor.identity &&\n                actor.identity.type === 'user' &&\n                actor.identity.data.id === entity.id\n            ) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: [\n                        PermissionName.USER_READ,\n                        PermissionName.USER_UPDATE,\n                        PermissionName.USER_DELETE,\n                    ],\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<User> {\n        const permissionNames = [\n            PermissionName.USER_READ,\n            PermissionName.USER_UPDATE,\n            PermissionName.USER_DELETE,\n        ];\n\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        const entity = await this.repository.findOne(idOrName, query, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        if (!isMe) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: permissionNames,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: User,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: User | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'user' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n            }\n\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_CREATE });\n\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const credentialsService = new UserCredentialsService();\n\n        if (entity) {\n            const originalName = entity.name;\n            const originalNameLocked = entity.name_locked;\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (\n                validated.name &&\n                validated.name !== originalName\n            ) {\n                if (validated.name_locked) {\n                    entity.name_locked = validated.name_locked;\n                }\n\n                if (originalNameLocked && validated.name_locked !== false) {\n                    entity.name = originalName;\n                }\n            }\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_UPDATE,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: {\n                            ...entity,\n                            ...validated,\n                        },\n                        [BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null,\n                    }),\n                });\n            }\n\n            if (validated.password) {\n                entity.password = await credentialsService.protect(validated.password);\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realm_id) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realm_id = actorRealmId;\n            }\n        }\n\n        entity = this.repository.create(validated);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        if (validated.password) {\n            entity.password = await credentialsService.protect(validated.password);\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<User> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });\n\n        if (\n            actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === id\n        ) {\n            throw new BadRequestError('The own user can not be deleted.');\n        }\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;AA2BA,IAAaU,cAAb,cAAiCF,sBAAAA;CACnBG;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIN,cAAc,EAAEQ,mBAAmBD,IAAIC,kBAAkB,CAAA;CAClF;CAEA,MAAMC,QACFC,OACAC,OAC6C;EAC7C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKhB,WAAWiB,SAASX,KAAAA;EAEnC,MAAMQ,OAAe,CAAA;EACrB,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UAAU;GAC3B,IACIR,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,IACpC;IACER,KAAKS,KAAKJ,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMZ,MAAMC,oBAAoBgB,cAAc;KAC1Cd,MAAM;MACFf,eAAegB;MACfhB,eAAeiB;MACfjB,eAAekB;;KAEnBC,MAAMxB,iBAAiB;OAAGD,kBAAkBoC,aAAaN;MAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;KAAQ,CAAA;IACxG,CAAA;IAEAL,KAAKS,KAAKJ,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACa;EACb,MAAMC,kBAAkB;GACpBnC,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMa,YACfb,MAAMa,SAASC,SAAS,WAEpBd,MAAMa,SAASN,KAAKQ,OAAOM,YAC3BrB,MAAMa,SAASN,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKnB,WAAWgC,QAAQJ,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAIzB,oBAAAA;EAGd,IAAIqC,QAAQxB,MAAMa,SAAUN,KAAKQ,OAAOH,OAAOG,IAAI;GAC/CS,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IAAI,CAACC,MACD,MAAMxB,MAAMC,oBAAoBgB,cAAc;GAC1Cd,MAAMoB;GACNhB,MAAMxB,iBAAiB;KAAGD,kBAAkBoC,aAAaN;IAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMc,OACFnB,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKC,KAAAA,GAAWrB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMiB,OACFR,UACAd,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKN,UAAUd,MAAMP,OAAO,EAAE8B,YAAY,KAAK,CAAA;EAC7E,OAAOlB;CACX;CAEA,MAAMe,KACFN,UACAd,MACAP,OACA+B,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO1B,KAAK2B,aAAa,WACnC,MAAM,KAAKxC,gBAAgByC,QAAQ5B,KAAK2B,QAAQ,IAChDN,KAAAA;EAEJ,IAAIhB;EACJ,IAAIS,UAAU;GACV,MAAMe,QAA6B,CAAC;GACpC,IAAInD,OAAOoC,QAAAA,GACPe,MAAMrB,KAAKM;QAEXe,MAAMjC,OAAOkB;GAGjB,IAAIY,OACAG,MAAMF,WAAWD,MAAMlB;GAG3BH,SAAS,MAAM,KAAKnB,WAAW4C,UAAUD,KAAAA;GACzC,IAAI,CAACxB,UAAUmB,QAAQD,YACnB,MAAM,IAAI3C,oBAAAA;EAElB,OAAO,IAAI4C,QAAQD,YACf,MAAM,IAAI3C,oBAAAA;EAGd,IAAImD,aAAa;EACjB,IAAI1B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeiB,YAAY,CAAA;GACnF,SAASmC,GAAG;IACR,IACI,CAACxC,MAAMa,YACPb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,IAElC,MAAMyB;IAEVF,aAAa;IACb,MAAMtC,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeqD,iBAAiB,CAAA;GACxF;GAEAT,QAAQhD,eAAe0D;EAC3B,OAAO;GACH,MAAM1C,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeuD,YAAY,CAAA;GAE/EX,QAAQhD,eAAe4D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKlD,UAAUmD,IAAIvC,MAAM,EAAEyB,MAAM,CAAA;EAEzD,MAAM,KAAKvC,WAAWsD,oBAAoBF,SAAAA;EAE1C,MAAMG,qBAAqB,IAAIzD,uBAAAA;EAE/B,IAAIqB,QAAQ;GACR,MAAMqC,eAAerC,OAAOT;GAC5B,MAAM+C,qBAAqBtC,OAAOuC;GAElC,IAAIb,YACA,MAAMtC,MAAMC,oBAAoBmD,SAAS;IACrCjD,MAAMf,eAAeqD;IACrBlC,MAAMxB,iBAAiB;MAAGD,kBAAkBoC,aAAa2B;KAAW,GAAG,KAAK1B,mBAAmB0B,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJjC,SAAS,KAAKnB,WAAW4D,MAAMzC,QAAQiC,SAAAA;GAEvC,IACIA,UAAU1C,QACV0C,UAAU1C,SAAS8C,cACrB;IACE,IAAIJ,UAAUM,aACVvC,OAAOuC,cAAcN,UAAUM;IAGnC,IAAID,sBAAsBL,UAAUM,gBAAgB,OAChDvC,OAAOT,OAAO8C;GAEtB;GAEA,IAAI,CAACX,YACD,MAAMtC,MAAMC,oBAAoBmD,SAAS;IACrCjD,MAAMf,eAAeiB;IACrBE,MAAMxB,iBAAiB;MAClBD,kBAAkBoC,aAAa;MAC5B,GAAGN;MACH,GAAGiC;KACP;MACC/D,kBAAkBwE,cAAcT,UAAUX,YAAYtB,OAAOsB,YAAY;IAC9E,CAAA;GACJ,CAAA;GAGJ,IAAIW,UAAUU,UACV3C,OAAO2C,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;GAGzE,MAAM,KAAK9D,WAAWkC,KAAKf,MAAAA;GAE3B,OAAO;IACHA;IACA6C,SAAS;GACb;EACJ;EAEA,IAAI,CAACZ,UAAUX,UAAU;GACrB,MAAMwB,eAAe,KAAKC,gBAAgB3D,KAAAA;GAC1C,IAAI0D,cACAb,UAAUX,WAAWwB;EAE7B;EAEA9C,SAAS,KAAKnB,WAAWiC,OAAOmB,SAAAA;EAEhC,MAAM7C,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMf,eAAeuD;GACrBpC,MAAMxB,iBAAiB;KAAGD,kBAAkBoC,aAAaN;IAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,IAAIiC,UAAUU,UACV3C,OAAO2C,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;EAGzE,MAAM,KAAK9D,WAAWkC,KAAKf,MAAAA;EAE3B,OAAO;GACHA;GACA6C,SAAS;EACb;CACJ;CAEA,MAAMG,OACF7C,IACAf,OACa;EACb,MAAMA,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAekB,YAAY,CAAA;EAE/E,IACIN,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOA,IAE3B,MAAM,IAAI7B,gBAAgB,kCAAA;EAG9B,MAAM0B,SAAS,MAAM,KAAKnB,WAAW4C,UAAU,EAAEtB,GAAG,CAAA;EACpD,IAAI,CAACH,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAMa,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMf,eAAekB;GACrBC,MAAMxB,iBAAiB;KAAGD,kBAAkBoC,aAAaN;IAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEG,IAAI8C,aAAajD;EACzB,MAAM,KAAKnB,WAAWqE,OAAOlD,MAAAA;EAC7BA,OAAOG,KAAK8C;EAEZ,OAAOjD;CACX;AACJ"}

package/dist/core/entities/user-attribute/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-attribute/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAElF,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE,wBAAwB,CAAC;IACrC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,qBAAsB,YAAW,qBAAqB;IAC5F,SAAS,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAE/C,SAAS,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAEjC,GAAG,EAAE,2BAA2B;IAMtC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,aAAa,CAAC,CAAC;IAkCnD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAqBnB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAwDnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IA8CnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;YAyBX,oBAAoB;CAuBrC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-attribute/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAElF,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE,wBAAwB,CAAC;IACrC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,qBAAsB,YAAW,qBAAqB;IAC5F,SAAS,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAE/C,SAAS,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAEjC,GAAG,EAAE,2BAA2B;IAMtC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,aAAa,CAAC,CAAC;IAkCnD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAqBnB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAwDnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAuDnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;YAyBX,oBAAoB;CAuBrC"}

package/dist/core/entities/user-attribute/service.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
-import { BuiltInPolicyType, PermissionError, PolicyData } from "@authup/access";
+import { BuiltInPolicyType, PermissionError, definePolicyData } from "@authup/access";
 import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 import { buildErrorMessageForAttribute } from "validup";
 //#region src/core/entities/user-attribute/service.ts
@@ -58,11 +58,14 @@ var UserAttributeService = class extends AbstractEntityService {
 		const entity = this.repository.create(data);
 		if (isSelfFallback) await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_SELF_MANAGE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } })
+			data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } })
 		});
 		else await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_UPDATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
 		});
 		await this.repository.save(entity);
 		return entity;
@@ -81,14 +84,20 @@ var UserAttributeService = class extends AbstractEntityService {
 			isSelfFallback = true;
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });
 		}
+		delete data.user_id;
+		delete data.user;
+		delete data.realm_id;
 		entity = this.repository.merge(entity, data);
 		if (isSelfFallback) await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_SELF_MANAGE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } })
+			data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } })
 		});
 		else await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_UPDATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
 		});
 		await this.repository.save(entity);
 		return entity;
@@ -108,7 +117,10 @@ var UserAttributeService = class extends AbstractEntityService {
 		try {
 			await actor.permissionEvaluator.evaluate({
 				name: PermissionName.USER_UPDATE,
-				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
 			});
 			return true;
 		} catch {

package/dist/core/entities/user-attribute/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","PolicyData","BadRequestError","EntityNotFoundError","PermissionName","buildErrorMessageForAttribute","AbstractEntityService","UserAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_UPDATE","USER_SELF_MANAGE","data","entities","meta","findMany","total","entity","canRead","canReadUserAttribute","push","getOne","id","findOneBy","create","targetUserId","user_id","user","isSelfTarget","identity","type","isSelfFallback","preEvaluate","e","validateJoinColumns","has","realm_id","evaluate","input","ATTRIBUTES","value","save","update","merge","delete","entityId","remove","isMe"],"sources":["../../../../src/core/entities/user-attribute/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, PolicyData } from '@authup/access';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PermissionName } from '@authup/core-kit';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { buildErrorMessageForAttribute } from 'validup';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IUserAttributeRepository, IUserAttributeService } from './types.ts';\n\nexport type UserAttributeServiceContext = {\n    repository: IUserAttributeRepository;\n    reservedNames?: ReadonlySet<string>;\n};\n\nexport class UserAttributeService extends AbstractEntityService implements IUserAttributeService {\n    protected repository: IUserAttributeRepository;\n\n    protected reservedNames: ReadonlySet<string>;\n\n    constructor(ctx: UserAttributeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.reservedNames = ctx.reservedNames ?? new Set();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserAttribute>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const {\n            data: entities,\n            meta,\n        } = await this.repository.findMany(query);\n\n        const data: UserAttribute[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            const canRead = await this.canReadUserAttribute(actor, entity);\n            if (canRead) {\n                data.push(entity);\n            } else {\n                total--;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const canRead = await this.canReadUserAttribute(actor, entity);\n        if (!canRead) {\n            throw new PermissionError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        const targetUserId: string | undefined = data.user_id ||\n            (data.user && data.user.id);\n\n        const isSelfTarget = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            (!targetUserId || targetUserId === actor.identity.data.id);\n\n        let isSelfFallback = false;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n        } catch (e) {\n            if (!isSelfTarget) {\n                throw e;\n            }\n            isSelfFallback = true;\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n        }\n\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n        }\n\n        if (data.user) {\n            data.realm_id = data.user.realm_id;\n        } else if (\n            actor.identity &&\n            actor.identity.type === 'user'\n        ) {\n            data.user_id = actor.identity.data.id;\n            data.realm_id = actor.identity.data.realm_id;\n        } else {\n            throw new BadRequestError(buildErrorMessageForAttribute('user_id'));\n        }\n\n        const entity = this.repository.create(data);\n\n        if (isSelfFallback) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_SELF_MANAGE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } }),\n            });\n        } else {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n        }\n\n        let entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const isSelfTarget = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.user_id;\n\n        let isSelfFallback = false;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n        } catch (e) {\n            if (!isSelfTarget) {\n                throw e;\n            }\n            isSelfFallback = true;\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n        }\n\n        entity = this.repository.merge(entity, data);\n\n        if (isSelfFallback) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_SELF_MANAGE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } }),\n            });\n        } else {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const canRead = await this.canReadUserAttribute(actor, entity);\n        if (!canRead) {\n            throw new PermissionError();\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    private async canReadUserAttribute(\n        actor: ActorContext,\n        entity: UserAttribute,\n    ): Promise<boolean> {\n        const isMe = actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.user_id;\n\n        if (isMe) {\n            return true;\n        }\n\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n\n            return true;\n        } catch {\n            return false;\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAqBA,IAAaQ,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKd,WAAWe,SAASV,KAAAA;EAEnC,MAAMO,OAAwB,CAAA;EAC9B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UAEjB,IAAIK,MADkB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnDL,KAAKQ,KAAKH,MAAAA;OAEVD;EAIR,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMK,OACFC,IACAhB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAId,IAAI,CAACuB,MADiB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnD,MAAM,IAAIzB,gBAAAA;EAGd,OAAOyB;CACX;CAEA,MAAMO,OACFZ,MACAN,OACsB;EACtB,MAAMmB,eAAmCb,KAAKc,WACzCd,KAAKe,QAAQf,KAAKe,KAAKL;EAE5B,MAAMM,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,WACvB,CAACL,gBAAgBA,iBAAiBnB,MAAMuB,SAASjB,KAAKU;EAE3D,IAAIS,iBAAiB;EACrB,IAAI;GACA,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,YAAY,CAAA;EACnF,SAASuB,GAAG;GACR,IAAI,CAACL,cACD,MAAMK;GAEVF,iBAAiB;GACjB,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,iBAAiB,CAAA;EACxF;EAEA,MAAM,KAAKX,WAAWkC,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,IAAI,GACjE,MAAM,IAAIf,gBAAgB,4BAA4BkB,KAAKH,KAAK,sCAAsC;EAG1G,IAAIG,KAAKe,MACLf,KAAKwB,WAAWxB,KAAKe,KAAKS;OACvB,IACH9B,MAAMuB,YACNvB,MAAMuB,SAASC,SAAS,QAC1B;GACElB,KAAKc,UAAUpB,MAAMuB,SAASjB,KAAKU;GACnCV,KAAKwB,WAAW9B,MAAMuB,SAASjB,KAAKwB;EACxC,OACI,MAAM,IAAI1C,gBAAgBG,8BAA8B,SAAA,CAAA;EAG5D,MAAMoB,SAAS,KAAKjB,WAAWwB,OAAOZ,IAAAA;EAEtC,IAAImB,gBACA,MAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrB2B,OAAO,IAAI7C,WAAW,GAAGF,kBAAkBgD,aAAa,GAAG3B,KAAKH,OAAOG,KAAK4B,MAAM,EAAE,CAAA;EACxF,CAAA;OAEA,MAAMlC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrB4B,OAAO,IAAI7C,WAAW,GAAGF,kBAAkBgD,aAAatB,OAAO,CAAA;EACnE,CAAA;EAGJ,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMyB,OACFpB,IACAV,MACAN,OACsB;EACtB,MAAM,KAAKN,WAAWkC,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,IAAI,GACjE,MAAM,IAAIf,gBAAgB,4BAA4BkB,KAAKH,KAAK,sCAAsC;EAG1G,IAAIQ,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EAClD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMiC,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS;EAEtC,IAAIK,iBAAiB;EACrB,IAAI;GACA,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,YAAY,CAAA;EACnF,SAASuB,GAAG;GACR,IAAI,CAACL,cACD,MAAMK;GAEVF,iBAAiB;GACjB,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,iBAAiB,CAAA;EACxF;EAEAM,SAAS,KAAKjB,WAAW2C,MAAM1B,QAAQL,IAAAA;EAEvC,IAAImB,gBACA,MAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrB2B,OAAO,IAAI7C,WAAW,GAAGF,kBAAkBgD,aAAa,GAAGtB,OAAOR,OAAOQ,OAAOuB,MAAM,EAAE,CAAA;EAC5F,CAAA;OAEA,MAAMlC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrB4B,OAAO,IAAI7C,WAAW,GAAGF,kBAAkBgD,aAAatB,OAAO,CAAA;EACnE,CAAA;EAGJ,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAM2B,OACFtB,IACAhB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAId,IAAI,CAACuB,MADiB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnD,MAAM,IAAIzB,gBAAAA;EAGd,MAAM,EAAE8B,IAAIuB,aAAa5B;EACzB,MAAM,KAAKjB,WAAW8C,OAAO7B,MAAAA;EAC7BA,OAAOK,KAAKuB;EAEZ,OAAO5B;CACX;CAEA,MAAcE,qBACVb,OACAW,QACgB;EAKhB,IAJaX,MAAMuB,YACfvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS,SAGlC,OAAO;EAGX,IAAI;GACA,MAAMpB,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAMb,eAAec;IACrB4B,OAAO,IAAI7C,WAAW,GAAGF,kBAAkBgD,aAAatB,OAAO,CAAA;GACnE,CAAA;GAEA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","BadRequestError","EntityNotFoundError","PermissionName","buildErrorMessageForAttribute","AbstractEntityService","UserAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_UPDATE","USER_SELF_MANAGE","data","entities","meta","findMany","total","entity","canRead","canReadUserAttribute","push","getOne","id","findOneBy","create","targetUserId","user_id","user","isSelfTarget","identity","type","isSelfFallback","preEvaluate","e","validateJoinColumns","has","realm_id","evaluate","ATTRIBUTES","value","resourceRealmMatch","save","update","merge","delete","entityId","remove","isMe"],"sources":["../../../../src/core/entities/user-attribute/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PermissionName } from '@authup/core-kit';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { buildErrorMessageForAttribute } from 'validup';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IUserAttributeRepository, IUserAttributeService } from './types.ts';\n\nexport type UserAttributeServiceContext = {\n    repository: IUserAttributeRepository;\n    reservedNames?: ReadonlySet<string>;\n};\n\nexport class UserAttributeService extends AbstractEntityService implements IUserAttributeService {\n    protected repository: IUserAttributeRepository;\n\n    protected reservedNames: ReadonlySet<string>;\n\n    constructor(ctx: UserAttributeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.reservedNames = ctx.reservedNames ?? new Set();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserAttribute>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const {\n            data: entities,\n            meta,\n        } = await this.repository.findMany(query);\n\n        const data: UserAttribute[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            const canRead = await this.canReadUserAttribute(actor, entity);\n            if (canRead) {\n                data.push(entity);\n            } else {\n                total--;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const canRead = await this.canReadUserAttribute(actor, entity);\n        if (!canRead) {\n            throw new PermissionError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        const targetUserId: string | undefined = data.user_id ||\n            (data.user && data.user.id);\n\n        const isSelfTarget = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            (!targetUserId || targetUserId === actor.identity.data.id);\n\n        let isSelfFallback = false;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n        } catch (e) {\n            if (!isSelfTarget) {\n                throw e;\n            }\n            isSelfFallback = true;\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n        }\n\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n        }\n\n        if (data.user) {\n            data.realm_id = data.user.realm_id;\n        } else if (\n            actor.identity &&\n            actor.identity.type === 'user'\n        ) {\n            data.user_id = actor.identity.data.id;\n            data.realm_id = actor.identity.data.realm_id;\n        } else {\n            throw new BadRequestError(buildErrorMessageForAttribute('user_id'));\n        }\n\n        const entity = this.repository.create(data);\n\n        if (isSelfFallback) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_SELF_MANAGE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } }),\n            });\n        } else {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n        }\n\n        let entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const isSelfTarget = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.user_id;\n\n        let isSelfFallback = false;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n        } catch (e) {\n            if (!isSelfTarget) {\n                throw e;\n            }\n            isSelfFallback = true;\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n        }\n\n        // An attribute belongs to a fixed user; its owner (and the user-derived realm_id) is\n        // IMMUTABLE on update — strip both from the body. This blocks a self-manage or admin\n        // caller from reassigning the attribute to another user (isSelfTarget was decided from\n        // the ORIGINAL owner), and blocks a caller-supplied realm_id that would gate USER_UPDATE\n        // against a realm of their choosing. To move an attribute, delete + recreate.\n        delete data.user_id;\n        delete data.user;\n        delete data.realm_id;\n\n        entity = this.repository.merge(entity, data);\n\n        if (isSelfFallback) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_SELF_MANAGE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } }),\n            });\n        } else {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const canRead = await this.canReadUserAttribute(actor, entity);\n        if (!canRead) {\n            throw new PermissionError();\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    private async canReadUserAttribute(\n        actor: ActorContext,\n        entity: UserAttribute,\n    ): Promise<boolean> {\n        const isMe = actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.user_id;\n\n        if (isMe) {\n            return true;\n        }\n\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n\n            return true;\n        } catch {\n            return false;\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAqBA,IAAaQ,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKd,WAAWe,SAASV,KAAAA;EAEnC,MAAMO,OAAwB,CAAA;EAC9B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UAEjB,IAAIK,MADkB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnDL,KAAKQ,KAAKH,MAAAA;OAEVD;EAIR,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMK,OACFC,IACAhB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAId,IAAI,CAACuB,MADiB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnD,MAAM,IAAIzB,gBAAAA;EAGd,OAAOyB;CACX;CAEA,MAAMO,OACFZ,MACAN,OACsB;EACtB,MAAMmB,eAAmCb,KAAKc,WACzCd,KAAKe,QAAQf,KAAKe,KAAKL;EAE5B,MAAMM,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,WACvB,CAACL,gBAAgBA,iBAAiBnB,MAAMuB,SAASjB,KAAKU;EAE3D,IAAIS,iBAAiB;EACrB,IAAI;GACA,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,YAAY,CAAA;EACnF,SAASuB,GAAG;GACR,IAAI,CAACL,cACD,MAAMK;GAEVF,iBAAiB;GACjB,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,iBAAiB,CAAA;EACxF;EAEA,MAAM,KAAKX,WAAWkC,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,IAAI,GACjE,MAAM,IAAIf,gBAAgB,4BAA4BkB,KAAKH,KAAK,sCAAsC;EAG1G,IAAIG,KAAKe,MACLf,KAAKwB,WAAWxB,KAAKe,KAAKS;OACvB,IACH9B,MAAMuB,YACNvB,MAAMuB,SAASC,SAAS,QAC1B;GACElB,KAAKc,UAAUpB,MAAMuB,SAASjB,KAAKU;GACnCV,KAAKwB,WAAW9B,MAAMuB,SAASjB,KAAKwB;EACxC,OACI,MAAM,IAAI1C,gBAAgBG,8BAA8B,SAAA,CAAA;EAG5D,MAAMoB,SAAS,KAAKjB,WAAWwB,OAAOZ,IAAAA;EAEtC,IAAImB,gBACA,MAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrBC,MAAMnB,iBAAiB,GAAGF,kBAAkB+C,aAAa,GAAG1B,KAAKH,OAAOG,KAAK2B,MAAM,EAAE,CAAA;EACzF,CAAA;OAEA,MAAMjC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrBE,MAAMnB,iBAAiB;KAAGF,kBAAkB+C,aAAarB;IAAQ,GAAG,KAAKuB,mBAAmBvB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMyB,OACFpB,IACAV,MACAN,OACsB;EACtB,MAAM,KAAKN,WAAWkC,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,IAAI,GACjE,MAAM,IAAIf,gBAAgB,4BAA4BkB,KAAKH,KAAK,sCAAsC;EAG1G,IAAIQ,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EAClD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMiC,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS;EAEtC,IAAIK,iBAAiB;EACrB,IAAI;GACA,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,YAAY,CAAA;EACnF,SAASuB,GAAG;GACR,IAAI,CAACL,cACD,MAAMK;GAEVF,iBAAiB;GACjB,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,iBAAiB,CAAA;EACxF;EAOA,OAAOC,KAAKc;EACZ,OAAOd,KAAKe;EACZ,OAAOf,KAAKwB;EAEZnB,SAAS,KAAKjB,WAAW2C,MAAM1B,QAAQL,IAAAA;EAEvC,IAAImB,gBACA,MAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrBC,MAAMnB,iBAAiB,GAAGF,kBAAkB+C,aAAa,GAAGrB,OAAOR,OAAOQ,OAAOsB,MAAM,EAAE,CAAA;EAC7F,CAAA;OAEA,MAAMjC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrBE,MAAMnB,iBAAiB;KAAGF,kBAAkB+C,aAAarB;IAAQ,GAAG,KAAKuB,mBAAmBvB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAM2B,OACFtB,IACAhB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAId,IAAI,CAACuB,MADiB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnD,MAAM,IAAIzB,gBAAAA;EAGd,MAAM,EAAE8B,IAAIuB,aAAa5B;EACzB,MAAM,KAAKjB,WAAW8C,OAAO7B,MAAAA;EAC7BA,OAAOK,KAAKuB;EAEZ,OAAO5B;CACX;CAEA,MAAcE,qBACVb,OACAW,QACgB;EAKhB,IAJaX,MAAMuB,YACfvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS,SAGlC,OAAO;EAGX,IAAI;GACA,MAAMpB,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAMb,eAAec;IACrBE,MAAMnB,iBAAiB;MAAGF,kBAAkB+C,aAAarB;KAAQ,GAAG,KAAKuB,mBAAmBvB,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAEA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ"}

package/dist/core/entities/user-permission/service.d.ts

@@ -1,15 +1,18 @@
 import { UserPermissionValidator } from '@authup/core-kit';
-import type { UserPermission } from '@authup/core-kit';
+import type { Permission, UserPermission } from '@authup/core-kit';
 import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
-import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
-import { AbstractEntityService } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
+import { JunctionEntityService } from '@authup/server-kit';
 import type { IUserPermissionRepository, IUserPermissionService } from './types.ts';
 export type UserPermissionServiceContext = {
     repository: IUserPermissionRepository;
+    permissionRepository: IEntityRepository<Permission>;
     identityPermissionProvider: IIdentityPermissionProvider;
 };
-export declare class UserPermissionService extends AbstractEntityService implements IUserPermissionService {
+export declare class UserPermissionService extends JunctionEntityService implements IUserPermissionService {
+    protected readonly ownerRealmKey = "user_realm_id";
     protected repository: IUserPermissionRepository;
+    protected permissionRepository: IEntityRepository<Permission>;
     protected identityPermissionProvider: IIdentityPermissionProvider;
     protected validator: UserPermissionValidator;
     constructor(ctx: UserPermissionServiceContext);

package/dist/core/entities/user-permission/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-permission/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpF,MAAM,MAAM,4BAA4B,GAAG;IACvC,UAAU,EAAE,yBAAyB,CAAC;IACtC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,qBAAsB,SAAQ,qBAAsB,YAAW,sBAAsB;IAC9F,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAEhD,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,uBAAuB,CAAC;gBAEjC,GAAG,EAAE,4BAA4B;IAOvC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,cAAc,CAAC,CAAC;IAYpD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAiBpB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IA6DpB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAyBpB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;CAmB7B"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-permission/service.ts"],"names":[],"mappings":"AAcA,OAAO,EAAkB,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpF,MAAM,MAAM,4BAA4B,GAAG;IACvC,UAAU,EAAE,yBAAyB,CAAC;IACtC,oBAAoB,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACpD,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,qBAAsB,SAAQ,qBAAsB,YAAW,sBAAsB;IAC9F,SAAS,CAAC,QAAQ,CAAC,aAAa,mBAAmB;IAEnD,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAEhD,SAAS,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE9D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,uBAAuB,CAAC;gBAEjC,GAAG,EAAE,4BAA4B;IAQvC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,cAAc,CAAC,CAAC;IAYpD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAiBpB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IA4DpB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAgEpB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;CAsB7B"}