@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.52

package/dist/core/entities/user-permission/service.mjs

@@ -1,19 +1,23 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { applyJunctionCreateGrant, buildJunctionUpdateData } from "../../identity/permission/junction-grant.mjs";
 import { ValidatorGroup } from "@authup/kit";
 import { PermissionName, UserPermissionValidator } from "@authup/core-kit";
-import { AbstractEntityService } from "@authup/server-kit";
-import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { JunctionEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, RealmScope, definePolicyData } from "@authup/access";
 import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/user-permission/service.ts
-var UserPermissionService = class extends AbstractEntityService {
+var UserPermissionService = class extends JunctionEntityService {
+	ownerRealmKey = "user_realm_id";
 	repository;
+	permissionRepository;
 	identityPermissionProvider;
 	validator;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
+		this.permissionRepository = ctx.permissionRepository;
 		this.identityPermissionProvider = ctx.identityPermissionProvider;
 		this.validator = new UserPermissionValidator();
 	}
@@ -52,20 +56,21 @@ var UserPermissionService = class extends AbstractEntityService {
 			});
 		}
 		if (validated.user) validated.user_realm_id = validated.user.realm_id;
-		if (validated.permission && actor.identity && typeof validated.policy_id === "undefined") {
-			const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy({
-				type: actor.identity.type,
-				id: actor.identity.data.id
-			}, {
-				name: validated.permission.name,
-				realmId: validated.permission.realm_id,
-				clientId: validated.permission.client_id
-			});
-			if (junctionPolicy) validated.policy_id = junctionPolicy.id;
-		}
+		if (validated.permission && actor.identity) applyJunctionCreateGrant(validated, await this.identityPermissionProvider.resolveJunctionGrant({
+			type: actor.identity.type,
+			id: actor.identity.data.id
+		}, {
+			name: validated.permission.name,
+			realmId: validated.permission.realm_id,
+			clientId: validated.permission.client_id,
+			realmScope: validated.realm_scope ?? RealmScope.OWN
+		}));
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_PERMISSION_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),
+				[BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated)
+			})
 		});
 		let entity = this.repository.create(validated);
 		entity = await this.repository.save(entity);
@@ -75,13 +80,45 @@ var UserPermissionService = class extends AbstractEntityService {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_UPDATE });
 		const entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
-		const updateData = {};
-		if (Object.prototype.hasOwnProperty.call(data, "policy_id")) updateData.policy_id = data.policy_id;
+		const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });
+		const permission = await this.permissionRepository.findOneById(entity.permission_id);
+		if (permission) await actor.permissionEvaluator.preEvaluate({
+			name: permission.name,
+			realmId: permission.realm_id,
+			clientId: permission.client_id
+		});
+		let actorScope = RealmScope.ANY;
+		let actorPolicyFree = true;
+		let actorPolicyId = null;
+		if (actor.identity && permission) {
+			const grant = await this.identityPermissionProvider.resolveJunctionGrant({
+				type: actor.identity.type,
+				id: actor.identity.data.id
+			}, {
+				name: permission.name,
+				realmId: permission.realm_id,
+				clientId: permission.client_id,
+				realmScope: validated.realm_scope ?? entity.realm_scope
+			});
+			actorScope = grant.realmScope;
+			actorPolicyFree = !grant.policy;
+			actorPolicyId = grant.policy ? grant.policy.id : null;
+		} else if (actor.identity) actorScope = RealmScope.OWN;
+		const updateData = buildJunctionUpdateData({
+			data: validated,
+			existingScope: entity.realm_scope,
+			actorScope,
+			actorPolicyFree,
+			actorPolicyId
+		});
 		await this.repository.validateJoinColumns(updateData);
 		const merged = this.repository.merge(entity, updateData);
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_PERMISSION_UPDATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),
+				[BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged)
+			})
 		});
 		return this.repository.save(merged);
 	}
@@ -91,7 +128,10 @@ var UserPermissionService = class extends AbstractEntityService {
 		if (!entity) throw new EntityNotFoundError();
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_PERMISSION_DELETE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),
+				[BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity)
+			})
 		});
 		const { id: entityId } = entity;
 		await this.repository.remove(entity);

package/dist/core/entities/user-permission/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","UserPermissionValidator","AbstractEntityService","UserPermissionService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_PERMISSION_CREATE","USER_PERMISSION_DELETE","USER_PERMISSION_READ","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permission_id","user_id","permission","permission_realm_id","realm_id","realmId","clientId","client_id","user","user_realm_id","identity","policy_id","junctionPolicy","resolveJunctionPolicy","type","evaluate","input","ATTRIBUTES","save","update","USER_PERMISSION_UPDATE","updateData","Object","prototype","hasOwnProperty","call","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/user-permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, UserPermissionValidator } from '@authup/core-kit';\nimport type { UserPermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IUserPermissionRepository, IUserPermissionService } from './types.ts';\n\nexport type UserPermissionServiceContext = {\n    repository: IUserPermissionRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserPermissionService extends AbstractEntityService implements IUserPermissionService {\n    protected repository: IUserPermissionRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: UserPermissionValidator;\n\n    constructor(ctx: UserPermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new UserPermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserPermission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_PERMISSION_CREATE,\n                PermissionName.USER_PERMISSION_DELETE,\n                PermissionName.USER_PERMISSION_READ,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_PERMISSION_CREATE,\n                PermissionName.USER_PERMISSION_DELETE,\n                PermissionName.USER_PERMISSION_READ,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            permission_id: validated.permission_id,\n            user_id: validated.user_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'user-permission' });\n        }\n\n        if (validated.permission) {\n            validated.permission_realm_id = validated.permission.realm_id;\n\n            await actor.permissionEvaluator.preEvaluate({\n                name: validated.permission.name,\n                realmId: validated.permission.realm_id,\n                clientId: validated.permission.client_id,\n            });\n        }\n\n        if (validated.user) {\n            validated.user_realm_id = validated.user.realm_id;\n        }\n\n        if (\n            validated.permission &&\n            actor.identity &&\n            typeof validated.policy_id === 'undefined'\n        ) {\n            const junctionPolicy = await this.identityPermissionProvider.resolveJunctionPolicy(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    name: validated.permission.name,\n                    realmId: validated.permission.realm_id,\n                    clientId: validated.permission.client_id,\n                },\n            );\n            if (junctionPolicy) {\n                validated.policy_id = junctionPolicy.id;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const updateData: Record<string, any> = {};\n        if (Object.prototype.hasOwnProperty.call(data, 'policy_id')) {\n            updateData.policy_id = data.policy_id;\n        }\n\n        await this.repository.validateJoinColumns(updateData);\n\n        const merged = this.repository.merge(entity, updateData);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_UPDATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: merged }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAsBA,IAAaQ,wBAAb,cAA2CD,sBAAAA;CAC7BE;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIL,wBAAAA;CACzB;CAEA,MAAMO,QACFC,OACAC,OACuD;EACvD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,OAAOsB;CACX;CAEA,MAAME,OACFC,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMb,eAAec,uBAAuB,CAAA;EAE1F,MAAMW,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAO5B,eAAe6B,OAAO,CAAA;EAEhF,MAAM,KAAKxB,WAAWyB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK1B,WAAWiB,UAAU;GAC7CU,eAAeN,UAAUM;GACzBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAInC,oBAAoB,EAAEuB,QAAQ,kBAAkB,CAAA;EAG9D,IAAIK,UAAUQ,YAAY;GACtBR,UAAUS,sBAAsBT,UAAUQ,WAAWE;GAErD,MAAMzB,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMY,UAAUQ,WAAWpB;IAC3BuB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWK;GACnC,CAAA;EACJ;EAEA,IAAIb,UAAUc,MACVd,UAAUe,gBAAgBf,UAAUc,KAAKJ;EAG7C,IACIV,UAAUQ,cACVvB,MAAM+B,YACN,OAAOhB,UAAUiB,cAAc,aACjC;GACE,MAAMC,iBAAiB,MAAM,KAAKtC,2BAA2BuC,sBACzD;IACIC,MAAMnC,MAAM+B,SAASI;IACrB1B,IAAIT,MAAM+B,SAASlB,KAAKJ;GAC5B,GACA;IACIN,MAAMY,UAAUQ,WAAWpB;IAC3BuB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWK;GACnC,CAAA;GAEJ,IAAIK,gBACAlB,UAAUiB,YAAYC,eAAexB;EAE7C;EAEA,MAAMT,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMb,eAAec;GACrBiC,OAAO,IAAInD,WAAW,GAAGD,kBAAkBqD,aAAavB,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIL,SAAS,KAAKhB,WAAWkB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKhB,WAAW6C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAI,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMb,eAAemD,uBAAuB,CAAA;EAE1F,MAAM/B,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMsD,aAAkC,CAAC;EACzC,IAAIC,OAAOC,UAAUC,eAAeC,KAAKjC,MAAM,WAAA,GAC3C6B,WAAWV,YAAYnB,KAAKmB;EAGhC,MAAM,KAAKtC,WAAWyB,oBAAoBuB,UAAAA;EAE1C,MAAMK,SAAS,KAAKrD,WAAWsD,MAAMtC,QAAQgC,UAAAA;EAE7C,MAAM1C,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMb,eAAemD;GACrBJ,OAAO,IAAInD,WAAW,GAAGD,kBAAkBqD,aAAaS,OAAO,CAAA;EACnE,CAAA;EAEA,OAAO,KAAKrD,WAAW6C,KAAKQ,MAAAA;CAChC;CAEA,MAAME,OACFxC,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMb,eAAee,uBAAuB,CAAA;EAE1F,MAAMK,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMb,eAAee;GACrBgC,OAAO,IAAInD,WAAW,GAAGD,kBAAkBqD,aAAa5B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAIyC,aAAaxC;EACzB,MAAM,KAAKhB,WAAWyD,OAAOzC,MAAAA;EAC7BA,OAAOD,KAAKyC;EAEZ,OAAOxC;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","UserPermissionValidator","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","UserPermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_PERMISSION_CREATE","USER_PERMISSION_DELETE","USER_PERMISSION_READ","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permission_id","user_id","permission","permission_realm_id","realm_id","realmId","clientId","client_id","user","user_realm_id","identity","grant","resolveJunctionGrant","type","realmScope","realm_scope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","USER_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/user-permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    BuiltInPolicyType,\n    RealmScope,\n    definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, UserPermissionValidator } from '@authup/core-kit';\nimport type { Permission, UserPermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IUserPermissionRepository, IUserPermissionService } from './types.ts';\n\nexport type UserPermissionServiceContext = {\n    repository: IUserPermissionRepository;\n    permissionRepository: IEntityRepository<Permission>;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserPermissionService extends JunctionEntityService implements IUserPermissionService {\n    protected readonly ownerRealmKey = 'user_realm_id';\n\n    protected repository: IUserPermissionRepository;\n\n    protected permissionRepository: IEntityRepository<Permission>;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: UserPermissionValidator;\n\n    constructor(ctx: UserPermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.permissionRepository = ctx.permissionRepository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new UserPermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserPermission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_PERMISSION_CREATE,\n                PermissionName.USER_PERMISSION_DELETE,\n                PermissionName.USER_PERMISSION_READ,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_PERMISSION_CREATE,\n                PermissionName.USER_PERMISSION_DELETE,\n                PermissionName.USER_PERMISSION_READ,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            permission_id: validated.permission_id,\n            user_id: validated.user_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'user-permission' });\n        }\n\n        if (validated.permission) {\n            validated.permission_realm_id = validated.permission.realm_id;\n\n            await actor.permissionEvaluator.preEvaluate({\n                name: validated.permission.name,\n                realmId: validated.permission.realm_id,\n                clientId: validated.permission.client_id,\n            });\n        }\n\n        if (validated.user) {\n            validated.user_realm_id = validated.user.realm_id;\n        }\n\n        if (validated.permission && actor.identity) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    name: validated.permission.name,\n                    realmId: validated.permission.realm_id,\n                    clientId: validated.permission.client_id,\n                    realmScope: validated.realm_scope ?? RealmScope.OWN,\n                },\n            );\n\n            applyJunctionCreateGrant(validated, grant);\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        const permission = await this.permissionRepository.findOneById(entity.permission_id);\n        if (permission) {\n            // Member-permission gate: an actor may only modify a binding for a permission it\n            // holds (mirrors create()).\n            await actor.permissionEvaluator.preEvaluate({\n                name: permission.name,\n                realmId: permission.realm_id,\n                clientId: permission.client_id,\n            });\n        }\n\n        let actorScope: `${RealmScope}` = RealmScope.ANY;\n        let actorPolicyFree = true;\n        let actorPolicyId: string | null = null;\n        if (actor.identity && permission) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                { type: actor.identity.type, id: actor.identity.data.id },\n                {\n                    name: permission.name,\n                    realmId: permission.realm_id,\n                    clientId: permission.client_id,\n                    realmScope: validated.realm_scope ?? entity.realm_scope,\n                },\n            );\n            actorScope = grant.realmScope;\n            actorPolicyFree = !grant.policy;\n            actorPolicyId = grant.policy ? grant.policy.id : null;\n        } else if (actor.identity) {\n            actorScope = RealmScope.OWN;\n        }\n\n        const updateData = buildJunctionUpdateData({\n            data: validated,\n            existingScope: entity.realm_scope,\n            actorScope,\n            actorPolicyFree,\n            actorPolicyId,\n        });\n\n        await this.repository.validateJoinColumns(updateData);\n\n        const merged = this.repository.merge(entity, updateData);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n            }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;AA4BA,IAAaW,wBAAb,cAA2CD,sBAAAA;CACpBE,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIT,wBAAAA;CACzB;CAEA,MAAMW,QACFC,OACAC,OACuD;EACvD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFjB,eAAekB;GACflB,eAAemB;GACfnB,eAAeoB;IAEvB,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFjB,eAAekB;GACflB,eAAemB;GACfnB,eAAeoB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMjB,eAAekB,uBAAuB,CAAA;EAE1F,MAAMW,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOhC,eAAeiC,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWkB,UAAU;GAC7CU,eAAeN,UAAUM;GACzBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIvC,oBAAoB,EAAE2B,QAAQ,kBAAkB,CAAA;EAG9D,IAAIK,UAAUQ,YAAY;GACtBR,UAAUS,sBAAsBT,UAAUQ,WAAWE;GAErD,MAAMzB,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMY,UAAUQ,WAAWpB;IAC3BuB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWK;GACnC,CAAA;EACJ;EAEA,IAAIb,UAAUc,MACVd,UAAUe,gBAAgBf,UAAUc,KAAKJ;EAG7C,IAAIV,UAAUQ,cAAcvB,MAAM+B,UAc9B3C,yBAAyB2B,WAAWiB,MAbhB,KAAKrC,2BAA2BsC,qBAChD;GACIC,MAAMlC,MAAM+B,SAASG;GACrBzB,IAAIT,MAAM+B,SAASlB,KAAKJ;EAC5B,GACA;GACIN,MAAMY,UAAUQ,WAAWpB;GAC3BuB,SAASX,UAAUQ,WAAWE;GAC9BE,UAAUZ,UAAUQ,WAAWK;GAC/BO,YAAYpB,UAAUqB,eAAevD,WAAWwD;EACpD,CAAA,CAGgCL;EAGxC,MAAMhC,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAekB;GACrBS,MAAM/B,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBzB,SAAAA;KACvDnC,kBAAkB6D,cAAc,KAAKC,sBAAsB3B,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKjB,WAAWmB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKjB,WAAWkD,KAAKjC,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMkC,OACFnC,IACAI,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMjB,eAAe2D,uBAAuB,CAAA;EAE1F,MAAMnC,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,MAAM+B,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOhC,eAAe6D,OAAO,CAAA;EAEhF,MAAMvB,aAAa,MAAM,KAAK7B,qBAAqBqD,YAAYrC,OAAOW,aAAa;EACnF,IAAIE,YAGA,MAAMvB,MAAMC,oBAAoBa,YAAY;GACxCX,MAAMoB,WAAWpB;GACjBuB,SAASH,WAAWE;GACpBE,UAAUJ,WAAWK;EACzB,CAAA;EAGJ,IAAIoB,aAA8BnE,WAAWoE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAInD,MAAM+B,YAAYR,YAAY;GAC9B,MAAMS,QAAQ,MAAM,KAAKrC,2BAA2BsC,qBAChD;IAAEC,MAAMlC,MAAM+B,SAASG;IAAMzB,IAAIT,MAAM+B,SAASlB,KAAKJ;GAAG,GACxD;IACIN,MAAMoB,WAAWpB;IACjBuB,SAASH,WAAWE;IACpBE,UAAUJ,WAAWK;IACrBO,YAAYpB,UAAUqB,eAAe1B,OAAO0B;GAChD,CAAA;GAEJY,aAAahB,MAAMG;GACnBe,kBAAkB,CAAClB,MAAMoB;GACzBD,gBAAgBnB,MAAMoB,SAASpB,MAAMoB,OAAO3C,KAAK;EACrD,OAAO,IAAIT,MAAM+B,UACbiB,aAAanE,WAAWwD;EAG5B,MAAMgB,aAAahE,wBAAwB;GACvCwB,MAAME;GACNuC,eAAe5C,OAAO0B;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAK1D,WAAW0B,oBAAoBkC,UAAAA;EAE1C,MAAME,SAAS,KAAK9D,WAAW+D,MAAM9C,QAAQ2C,UAAAA;EAE7C,MAAMrD,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAe2D;GACrBhC,MAAM/B,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBe,MAAAA;KACvD3E,kBAAkB6D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK9D,WAAWkD,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACFhD,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMjB,eAAemB,uBAAuB,CAAA;EAE1F,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,MAAMgB,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAemB;GACrBQ,MAAM/B,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmB9B,MAAAA;KACvD9B,kBAAkB6D,cAAc,KAAKC,sBAAsBhC,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIiD,aAAahD;EACzB,MAAM,KAAKjB,WAAWkE,OAAOjD,MAAAA;EAC7BA,OAAOD,KAAKiD;EAEZ,OAAOhD;CACX;AACJ"}

package/dist/core/entities/user-role/service.d.ts

@@ -1,14 +1,15 @@
 import { UserRoleValidator } from '@authup/core-kit';
 import type { UserRole } from '@authup/core-kit';
 import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
-import { AbstractEntityService } from '@authup/server-kit';
+import { JunctionEntityService } from '@authup/server-kit';
 import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
 import type { IUserRoleRepository, IUserRoleService } from './types.ts';
 export type UserRoleServiceContext = {
     repository: IUserRoleRepository;
     identityPermissionProvider: IIdentityPermissionProvider;
 };
-export declare class UserRoleService extends AbstractEntityService implements IUserRoleService {
+export declare class UserRoleService extends JunctionEntityService implements IUserRoleService {
+    protected readonly ownerRealmKey = "user_realm_id";
     protected repository: IUserRoleRepository;
     protected identityPermissionProvider: IIdentityPermissionProvider;
     protected validator: UserRoleValidator;

package/dist/core/entities/user-role/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,MAAM,sBAAsB,GAAG;IACjC,UAAU,EAAE,mBAAmB,CAAC;IAChC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,eAAgB,SAAQ,qBAAsB,YAAW,gBAAgB;IAClF,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAE1C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,iBAAiB,CAAC;gBAE3B,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IAY9C,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAiBd,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAmDd,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;CAmBvB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,MAAM,sBAAsB,GAAG;IACjC,UAAU,EAAE,mBAAmB,CAAC;IAChC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,eAAgB,SAAQ,qBAAsB,YAAW,gBAAgB;IAClF,SAAS,CAAC,QAAQ,CAAC,aAAa,mBAAmB;IAEnD,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAE1C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,iBAAiB,CAAC;gBAE3B,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IAY9C,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAiBd,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAuDd,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;CAuBvB"}

package/dist/core/entities/user-role/service.mjs

@@ -3,11 +3,12 @@ import "node:url";
 import.meta.url;
 import { ValidatorGroup } from "@authup/kit";
 import { PermissionName, UserRoleValidator } from "@authup/core-kit";
-import { AbstractEntityService } from "@authup/server-kit";
-import { BuiltInPolicyType, PermissionError, PolicyData } from "@authup/access";
+import { JunctionEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, PermissionError, definePolicyData } from "@authup/access";
 import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/user-role/service.ts
-var UserRoleService = class extends AbstractEntityService {
+var UserRoleService = class extends JunctionEntityService {
+	ownerRealmKey = "user_realm_id";
 	repository;
 	identityPermissionProvider;
 	validator;
@@ -57,7 +58,10 @@ var UserRoleService = class extends AbstractEntityService {
 		}
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_ROLE_CREATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),
+				[BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated)
+			})
 		});
 		let entity = this.repository.create(validated);
 		entity = await this.repository.save(entity);
@@ -69,7 +73,10 @@ var UserRoleService = class extends AbstractEntityService {
 		if (!entity) throw new EntityNotFoundError();
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_ROLE_DELETE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),
+				[BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity)
+			})
 		});
 		const { id: entityId } = entity;
 		await this.repository.remove(entity);

package/dist/core/entities/user-role/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","PolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","UserRoleValidator","AbstractEntityService","UserRoleService","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_ROLE_READ","USER_ROLE_CREATE","USER_ROLE_UPDATE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","role_id","user_id","role","role_realm_id","realm_id","user","user_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","message","evaluate","input","ATTRIBUTES","save","delete","USER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/user-role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, PolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, UserRoleValidator } from '@authup/core-kit';\nimport type { UserRole } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IUserRoleRepository, IUserRoleService } from './types.ts';\n\nexport type UserRoleServiceContext = {\n    repository: IUserRoleRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserRoleService extends AbstractEntityService implements IUserRoleService {\n    protected repository: IUserRoleRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: UserRoleValidator;\n\n    constructor(ctx: UserRoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new UserRoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserRole>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            role_id: validated.role_id,\n            user_id: validated.user_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'user-role' });\n        }\n\n        if (validated.role) {\n            validated.role_realm_id = validated.role.realm_id;\n        }\n\n        if (validated.user) {\n            validated.user_realm_id = validated.user.realm_id;\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.role_id,\n                    clientId: validated.role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_CREATE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAsBA,IAAaS,kBAAb,cAAqCD,sBAAAA;CACvBE;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;EACrC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIL,kBAAAA;CACzB;CAEA,MAAMO,QACFC,OACAC,OACiD;EACjD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,IACAT,OACiB;EACjB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,OAAOsB;CACX;CAEA,MAAME,OACFC,MACAb,OACiB;EACjB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMb,eAAee,iBAAiB,CAAA;EAEpF,MAAMU,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAO5B,eAAe6B,OAAO,CAAA;EAEhF,MAAM,KAAKxB,WAAWyB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK1B,WAAWiB,UAAU;GAC7CU,SAASN,UAAUM;GACnBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAInC,oBAAoB,EAAEuB,QAAQ,YAAY,CAAA;EAGxD,IAAIK,UAAUQ,MACVR,UAAUS,gBAAgBT,UAAUQ,KAAKE;EAG7C,IAAIV,UAAUW,MACVX,UAAUY,gBAAgBZ,UAAUW,KAAKD;EAG7C,IAAIV,UAAUQ,QAAQvB,MAAM4B;OAYpB,CAACC,MAXwB,KAAKlC,2BAA2BmC,WACzD;IACIC,MAAM/B,MAAM4B,SAASG;IACrBtB,IAAIT,MAAM4B,SAASf,KAAKJ;GAC5B,GACA;IACIsB,MAAM;IACNtB,IAAIM,UAAUM;IACdW,UAAUjB,UAAUQ,KAAKU;GAC7B,CAAA,GAGA,MAAM,IAAIhD,gBAAgB,EAAEiD,SAAS,0CAA2C,CAAA;EAAA;EAIxF,MAAMlC,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMb,eAAee;GACrB+B,OAAO,IAAIlD,WAAW,GAAGF,kBAAkBqD,aAAatB,UAAU,CAAA;EACtE,CAAA;EAEA,IAAIL,SAAS,KAAKhB,WAAWkB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKhB,WAAW4C,KAAK5B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM6B,OACF9B,IACAT,OACiB;EACjB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMb,eAAekD,iBAAiB,CAAA;EAEpF,MAAM9B,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMY,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMb,eAAekD;GACrBJ,OAAO,IAAIlD,WAAW,GAAGF,kBAAkBqD,aAAa3B,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAED,IAAIgC,aAAa/B;EACzB,MAAM,KAAKhB,WAAWgD,OAAOhC,MAAAA;EAC7BA,OAAOD,KAAKgC;EAEZ,OAAO/B;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","UserRoleValidator","JunctionEntityService","UserRoleService","ownerRealmKey","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_ROLE_READ","USER_ROLE_CREATE","USER_ROLE_UPDATE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","role_id","user_id","role","role_realm_id","realm_id","user","user_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","message","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","USER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/user-role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, UserRoleValidator } from '@authup/core-kit';\nimport type { UserRole } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IUserRoleRepository, IUserRoleService } from './types.ts';\n\nexport type UserRoleServiceContext = {\n    repository: IUserRoleRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserRoleService extends JunctionEntityService implements IUserRoleService {\n    protected readonly ownerRealmKey = 'user_realm_id';\n\n    protected repository: IUserRoleRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: UserRoleValidator;\n\n    constructor(ctx: UserRoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new UserRoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserRole>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            role_id: validated.role_id,\n            user_id: validated.user_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'user-role' });\n        }\n\n        if (validated.role) {\n            validated.role_realm_id = validated.role.realm_id;\n        }\n\n        if (validated.user) {\n            validated.user_realm_id = validated.user.realm_id;\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.role_id,\n                    clientId: validated.role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n            }\n        }\n\n        // Stamp the owner (user) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (user) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAsBA,IAAaS,kBAAb,cAAqCD,sBAAAA;CACdE,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;EACrC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIN,kBAAAA;CACzB;CAEA,MAAMQ,QACFC,OACAC,OACiD;EACjD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,IACAT,OACiB;EACjB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,OAAOuB;CACX;CAEA,MAAME,OACFC,MACAb,OACiB;EACjB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAegB,iBAAiB,CAAA;EAEpF,MAAMU,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAO7B,eAAe8B,OAAO,CAAA;EAEhF,MAAM,KAAKxB,WAAWyB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK1B,WAAWiB,UAAU;GAC7CU,SAASN,UAAUM;GACnBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIpC,oBAAoB,EAAEwB,QAAQ,YAAY,CAAA;EAGxD,IAAIK,UAAUQ,MACVR,UAAUS,gBAAgBT,UAAUQ,KAAKE;EAG7C,IAAIV,UAAUW,MACVX,UAAUY,gBAAgBZ,UAAUW,KAAKD;EAG7C,IAAIV,UAAUQ,QAAQvB,MAAM4B;OAYpB,CAACC,MAXwB,KAAKlC,2BAA2BmC,WACzD;IACIC,MAAM/B,MAAM4B,SAASG;IACrBtB,IAAIT,MAAM4B,SAASf,KAAKJ;GAC5B,GACA;IACIsB,MAAM;IACNtB,IAAIM,UAAUM;IACdW,UAAUjB,UAAUQ,KAAKU;GAC7B,CAAA,GAGA,MAAM,IAAIjD,gBAAgB,EAAEkD,SAAS,0CAA2C,CAAA;EAAA;EAKxF,MAAMlC,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMd,eAAegB;GACrBQ,MAAM5B,iBAAiB;KAClBF,kBAAkBqD,aAAa,KAAKC,mBAAmBtB,SAAAA;KACvDhC,kBAAkBuD,cAAc,KAAKC,sBAAsBxB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKhB,WAAWkB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKhB,WAAW8C,KAAK9B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM+B,OACFhC,IACAT,OACiB;EACjB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAeqD,iBAAiB,CAAA;EAEpF,MAAMhC,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAId,MAAMa,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMd,eAAeqD;GACrB7B,MAAM5B,iBAAiB;KAClBF,kBAAkBqD,aAAa,KAAKC,mBAAmB3B,MAAAA;KACvD3B,kBAAkBuD,cAAc,KAAKC,sBAAsB7B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIkC,aAAajC;EACzB,MAAM,KAAKhB,WAAWkD,OAAOlC,MAAAA;EAC7BA,OAAOD,KAAKkC;EAEZ,OAAOjC;CACX;AACJ"}

package/dist/core/identity/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { applyJunctionCreateGrant, buildJunctionUpdateData } from "./permission/junction-grant.mjs";
 import { PASSWORD_RESET_EXPIRES_IN_MINUTES } from "./password-recovery/constants.mjs";
 import { PasswordRecoveryService } from "./password-recovery/service.mjs";
 import "./password-recovery/index.mjs";
@@ -32,4 +33,4 @@ import "./registration/index.mjs";
 import { IdentityResolver } from "./resolver/module.mjs";
 import "./resolver/index.mjs";
 import { IdentityRoleProvider } from "./role/module.mjs";
-export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityResolver, IdentityRoleProvider, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordRecoveryService, PermissionCheckerService, PolicyCheckerService, RegistrationService, createIdentityProviderOAuth2Authenticator };
+export { IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityResolver, IdentityRoleProvider, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordRecoveryService, PermissionCheckerService, PolicyCheckerService, RegistrationService, applyJunctionCreateGrant, buildJunctionUpdateData, createIdentityProviderOAuth2Authenticator };

package/dist/core/identity/password-recovery/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/service.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,mBAAmB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAG3D,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,OAAO,EAAE,8BAA8B,CAAC;IAElD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;gBAE1C,GAAG,EAAE,8BAA8B;IAQzC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAwE3G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;YA0C9D,0BAA0B;YAgC1B,yBAAyB;CAuC1C"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/service.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,mBAAmB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAG3D,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,OAAO,EAAE,8BAA8B,CAAC;IAElD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;gBAE1C,GAAG,EAAE,8BAA8B;IAQzC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAwE3G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;YA0C9D,0BAA0B;YAgC1B,yBAAyB;CA2C1C"}

package/dist/core/identity/password-recovery/service.mjs

@@ -8,6 +8,7 @@ import "./constants.mjs";
 import { PasswordRecoveryDisabledError } from "./disabled.mjs";
 import { EmailVerificationRequiredError } from "./email-verification-required.mjs";
 import { ResetTokenExpiredError } from "./token-expired.mjs";
+import { USER_PASSWORD_MAX_LENGTH, USER_PASSWORD_MIN_LENGTH } from "@authup/core-kit";
 import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 import { Container } from "validup";
 import { createValidator } from "@validup/zod";
@@ -110,7 +111,7 @@ var PasswordRecoveryService = class {
 		validator.mount(oneOfContainer);
 		validator.mount("realm_id", { optional: true }, createValidator(z.uuid().nullable()));
 		validator.mount("token", createValidator(z.string().min(3).max(256)));
-		validator.mount("password", createValidator(z.string().min(5).max(512)));
+		validator.mount("password", createValidator(z.string().min(this.options.passwordMinLength ?? USER_PASSWORD_MIN_LENGTH).max(USER_PASSWORD_MAX_LENGTH)));
 		return validator.run(data);
 	}
 };

package/dist/core/identity/password-recovery/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BadRequestError","EntityNotFoundError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidator","randomBytes","Container","z","UserCredentialsService","MailTemplateName","PASSWORD_RESET_EXPIRES_IN_MINUTES","PasswordRecoveryService","options","repository","realmRepository","mailClient","mailTemplateRenderer","ctx","forgotPassword","data","context","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realm_id","where","name","email","id","entity","findOneByWithEmail","merged","merge","reset_expires","Date","now","toISOString","reset_hash","toString","save","resetUrl","publicUrl","replace","encodeURIComponent","undefined","mail","render","template","PASSWORD_RESET","params","code","url","expiresInMinutes","locale","send","to","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","reset_at","validator","oneOfContainer","oneOf","mount","string","trim","toLowerCase","regex","message","min","optional","uuid","nullable","run","max"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidator } from '@validup/zod';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IPasswordRecoveryService,\n    PasswordForgotResult,\n    PasswordRecoveryServiceContext,\n    PasswordRecoveryServiceOptions,\n    PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\nimport { PASSWORD_RESET_EXPIRES_IN_MINUTES } from './constants.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n    protected options: PasswordRecoveryServiceOptions;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    constructor(ctx: PasswordRecoveryServiceContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n    }\n\n    async forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        if (!this.options.emailVerificationEnabled) {\n            throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n        }\n\n        const validated = await this.runForgotPasswordValidator(data);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneByWithEmail(where);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            reset_expires: new Date(\n                Date.now() + (1000 * 60 * PASSWORD_RESET_EXPIRES_IN_MINUTES),\n            ).toISOString(),\n            reset_hash: randomBytes(32).toString('hex'),\n        });\n\n        await this.repository.save(merged);\n\n        try {\n            // realm_id MUST ride the link: resetPassword resolves the realm\n            // from the request and filters the lookup by it, so a realm-less\n            // link resolves to the master realm and never matches a\n            // non-master user.\n            const resetUrl = this.options.publicUrl ?\n                `${this.options.publicUrl.replace(/\\/+$/, '')}/password-reset` +\n                `?token=${encodeURIComponent(merged.reset_hash!)}` +\n                `&realm_id=${encodeURIComponent(entity.realm_id)}` :\n                undefined;\n\n            const mail = await this.mailTemplateRenderer.render({\n                template: MailTemplateName.PASSWORD_RESET,\n                params: {\n                    code: merged.reset_hash!,\n                    url: resetUrl,\n                    expiresInMinutes: PASSWORD_RESET_EXPIRES_IN_MINUTES,\n                },\n                locale: context?.locale,\n            });\n\n            await this.mailClient.send({\n                to: entity.email,\n                ...mail,\n            });\n        } catch {\n            this.repository.merge(merged, {\n                reset_hash: null,\n                reset_expires: null,\n            });\n            await this.repository.save(merged);\n\n            throw new BadRequestError('Password recovery failed. Could not send reset email.');\n        }\n\n        return { reset_expires: merged.reset_expires! };\n    }\n\n    async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        const validated = await this.runResetPasswordValidator(data);\n\n        await this.repository.validateJoinColumns(validated);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            reset_hash: validated.token,\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneBy(where);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!entity.reset_expires || new Date(entity.reset_expires) < new Date()) {\n            throw new ResetTokenExpiredError();\n        }\n\n        const credentialsService = new UserCredentialsService();\n        const hashedPassword = await credentialsService.protect(validated.password);\n\n        const merged = this.repository.merge(entity, {\n            reset_at: new Date().toISOString(),\n            reset_hash: null,\n            reset_expires: null,\n            password: hashedPassword,\n        });\n\n        await this.repository.save(merged);\n\n        return { reset_at: merged.reset_at! };\n    }\n\n    private async runForgotPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        return validator.run(data);\n    }\n\n    private async runResetPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        validator.mount(\n            'token',\n            createValidator(z.string().min(3).max(256)),\n        );\n\n        validator.mount(\n            'password',\n            createValidator(z.string().min(5).max(512)),\n        );\n\n        return validator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6BA,IAAaY,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKL,UAAUK,IAAIL;EACnB,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,uBAAuBC,IAAID;CACpC;CAEA,MAAME,eAAeC,MAA2BC,SAAkE;EAC9G,IAAI,CAAC,KAAKR,QAAQS,yBACd,MAAM,IAAIpB,8BAAAA;EAGd,IAAI,CAAC,KAAKW,QAAQU,0BACd,MAAM,IAAIpB,+BAA+B,sEAAA;EAG7C,MAAMqB,YAAY,MAAM,KAAKC,2BAA2BL,IAAAA;EAExD,MAAMM,QAAQ,MAAM,KAAKX,gBAAgBY,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKnB,WAAWoB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkC,SAAS,KAAKrB,WAAWsB,MAAMH,QAAQ;GACzCI,eAAe,IAAIC,KACfA,KAAKC,IAAG,IAAM,MAAO,KAAA,EAAK5B,CAAAA,CAC5B6B,YAAW;GACbC,YAAYnC,YAAY,EAAA,CAAA,CAAIoC,SAAS,KAAA;EACzC,CAAA;EAEA,MAAM,KAAK5B,WAAW6B,KAAKR,MAAAA;EAE3B,IAAI;GAKA,MAAMS,WAAW,KAAK/B,QAAQgC,YAC1B,GAAG,KAAKhC,QAAQgC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,wBACpCC,mBAAmBZ,OAAOM,UAAU,EAAA,YACjCM,mBAAmBd,OAAOL,QAAQ,MAC/CoB,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKhC,qBAAqBiC,OAAO;IAChDC,UAAUzC,iBAAiB0C;IAC3BC,QAAQ;KACJC,MAAMnB,OAAOM;KACbc,KAAKX;KACLY,kBAAAA;IACJ;IACAC,QAAQpC,SAASoC;GACrB,CAAA;GAEA,MAAM,KAAKzC,WAAW0C,KAAK;IACvBC,IAAI1B,OAAOF;IACX,GAAGkB;GACP,CAAA;EACJ,QAAQ;GACJ,KAAKnC,WAAWsB,MAAMD,QAAQ;IAC1BM,YAAY;IACZJ,eAAe;GACnB,CAAA;GACA,MAAM,KAAKvB,WAAW6B,KAAKR,MAAAA;GAE3B,MAAM,IAAInC,gBAAgB,uDAAA;EAC9B;EAEA,OAAO,EAAEqC,eAAeF,OAAOE,cAAe;CAClD;CAEA,MAAMuB,cAAcxC,MAAyD;EACzE,IAAI,CAAC,KAAKP,QAAQS,yBACd,MAAM,IAAIpB,8BAAAA;EAGd,MAAMsB,YAAY,MAAM,KAAKqC,0BAA0BzC,IAAAA;EAEvD,MAAM,KAAKN,WAAWgD,oBAAoBtC,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKX,gBAAgBY,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,YAAYjB,UAAUuC;GACtBnC,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKnB,WAAWkD,UAAUnC,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAACgC,OAAOI,iBAAiB,IAAIC,KAAKL,OAAOI,aAAa,oBAAI,IAAIC,KAAAA,GAC9D,MAAM,IAAIlC,uBAAAA;EAId,MAAM8D,iBAAiB,MAAMD,IADExD,uBACFwD,CAAAA,CAAmBE,QAAQ3C,UAAU4C,QAAQ;EAE1E,MAAMjC,SAAS,KAAKrB,WAAWsB,MAAMH,QAAQ;GACzCoC,2BAAU,IAAI/B,KAAAA,EAAAA,CAAOE,YAAW;GAChCC,YAAY;GACZJ,eAAe;GACf+B,UAAUF;EACd,CAAA;EAEA,MAAM,KAAKpD,WAAW6B,KAAKR,MAAAA;EAE3B,OAAO,EAAEkC,UAAUlC,OAAOkC,SAAU;CACxC;CAEA,MAAc5C,2BAA2BL,MAA2B;EAChE,MAAMkD,YAAY,IAAI/D,UAAe,CAAC,CAAA;EAEtC,MAAMgE,iBAAiB,IAAIhE,UAAU,EAAEiE,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MACX,SACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACX7C,MAAK,CAAA,CACL8C,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAItEP,eAAeE,MACX,QACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3E,gBAAgBG,EAAEyE,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrC,OAAOZ,UAAUa,IAAI/D,IAAAA;CACzB;CAEA,MAAcyC,0BAA0BzC,MAA2B;EAC/D,MAAMkD,YAAY,IAAI/D,UAAe,CAAC,CAAA;EAEtC,MAAMgE,iBAAiB,IAAIhE,UAAU,EAAEiE,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACX7C,MAAK,CAAA,CACL8C,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAGtEP,eAAeE,MACX,QACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3E,gBAAgBG,EAAEyE,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrCZ,UAAUG,MACN,SACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1Cd,UAAUG,MACN,YACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1C,OAAOd,UAAUa,IAAI/D,IAAAA;CACzB;AACJ"}
+{"version":3,"file":"service.mjs","names":["USER_PASSWORD_MAX_LENGTH","USER_PASSWORD_MIN_LENGTH","BadRequestError","EntityNotFoundError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidator","randomBytes","Container","z","UserCredentialsService","MailTemplateName","PASSWORD_RESET_EXPIRES_IN_MINUTES","PasswordRecoveryService","options","repository","realmRepository","mailClient","mailTemplateRenderer","ctx","forgotPassword","data","context","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realm_id","where","name","email","id","entity","findOneByWithEmail","merged","merge","reset_expires","Date","now","toISOString","reset_hash","toString","save","resetUrl","publicUrl","replace","encodeURIComponent","undefined","mail","render","template","PASSWORD_RESET","params","code","url","expiresInMinutes","locale","send","to","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","reset_at","validator","oneOfContainer","oneOf","mount","string","trim","toLowerCase","regex","message","min","optional","uuid","nullable","run","max","passwordMinLength"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { USER_PASSWORD_MAX_LENGTH, USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidator } from '@validup/zod';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IPasswordRecoveryService,\n    PasswordForgotResult,\n    PasswordRecoveryServiceContext,\n    PasswordRecoveryServiceOptions,\n    PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\nimport { PASSWORD_RESET_EXPIRES_IN_MINUTES } from './constants.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n    protected options: PasswordRecoveryServiceOptions;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    constructor(ctx: PasswordRecoveryServiceContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n    }\n\n    async forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        if (!this.options.emailVerificationEnabled) {\n            throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n        }\n\n        const validated = await this.runForgotPasswordValidator(data);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneByWithEmail(where);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            reset_expires: new Date(\n                Date.now() + (1000 * 60 * PASSWORD_RESET_EXPIRES_IN_MINUTES),\n            ).toISOString(),\n            reset_hash: randomBytes(32).toString('hex'),\n        });\n\n        await this.repository.save(merged);\n\n        try {\n            // realm_id MUST ride the link: resetPassword resolves the realm\n            // from the request and filters the lookup by it, so a realm-less\n            // link resolves to the master realm and never matches a\n            // non-master user.\n            const resetUrl = this.options.publicUrl ?\n                `${this.options.publicUrl.replace(/\\/+$/, '')}/password-reset` +\n                `?token=${encodeURIComponent(merged.reset_hash!)}` +\n                `&realm_id=${encodeURIComponent(entity.realm_id)}` :\n                undefined;\n\n            const mail = await this.mailTemplateRenderer.render({\n                template: MailTemplateName.PASSWORD_RESET,\n                params: {\n                    code: merged.reset_hash!,\n                    url: resetUrl,\n                    expiresInMinutes: PASSWORD_RESET_EXPIRES_IN_MINUTES,\n                },\n                locale: context?.locale,\n            });\n\n            await this.mailClient.send({\n                to: entity.email,\n                ...mail,\n            });\n        } catch {\n            this.repository.merge(merged, {\n                reset_hash: null,\n                reset_expires: null,\n            });\n            await this.repository.save(merged);\n\n            throw new BadRequestError('Password recovery failed. Could not send reset email.');\n        }\n\n        return { reset_expires: merged.reset_expires! };\n    }\n\n    async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        const validated = await this.runResetPasswordValidator(data);\n\n        await this.repository.validateJoinColumns(validated);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            reset_hash: validated.token,\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneBy(where);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!entity.reset_expires || new Date(entity.reset_expires) < new Date()) {\n            throw new ResetTokenExpiredError();\n        }\n\n        const credentialsService = new UserCredentialsService();\n        const hashedPassword = await credentialsService.protect(validated.password);\n\n        const merged = this.repository.merge(entity, {\n            reset_at: new Date().toISOString(),\n            reset_hash: null,\n            reset_expires: null,\n            password: hashedPassword,\n        });\n\n        await this.repository.save(merged);\n\n        return { reset_at: merged.reset_at! };\n    }\n\n    private async runForgotPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        return validator.run(data);\n    }\n\n    private async runResetPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        validator.mount(\n            'token',\n            createValidator(z.string().min(3).max(256)),\n        );\n\n        validator.mount(\n            'password',\n            createValidator(\n                z.string()\n                    .min(this.options.passwordMinLength ?? USER_PASSWORD_MIN_LENGTH)\n                    .max(USER_PASSWORD_MAX_LENGTH),\n            ),\n        );\n\n        return validator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA8BA,IAAac,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKL,UAAUK,IAAIL;EACnB,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,uBAAuBC,IAAID;CACpC;CAEA,MAAME,eAAeC,MAA2BC,SAAkE;EAC9G,IAAI,CAAC,KAAKR,QAAQS,yBACd,MAAM,IAAIpB,8BAAAA;EAGd,IAAI,CAAC,KAAKW,QAAQU,0BACd,MAAM,IAAIpB,+BAA+B,sEAAA;EAG7C,MAAMqB,YAAY,MAAM,KAAKC,2BAA2BL,IAAAA;EAExD,MAAMM,QAAQ,MAAM,KAAKX,gBAAgBY,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKnB,WAAWoB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkC,SAAS,KAAKrB,WAAWsB,MAAMH,QAAQ;GACzCI,eAAe,IAAIC,KACfA,KAAKC,IAAG,IAAM,MAAO,KAAA,EAAK5B,CAAAA,CAC5B6B,YAAW;GACbC,YAAYnC,YAAY,EAAA,CAAA,CAAIoC,SAAS,KAAA;EACzC,CAAA;EAEA,MAAM,KAAK5B,WAAW6B,KAAKR,MAAAA;EAE3B,IAAI;GAKA,MAAMS,WAAW,KAAK/B,QAAQgC,YAC1B,GAAG,KAAKhC,QAAQgC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,wBACpCC,mBAAmBZ,OAAOM,UAAU,EAAA,YACjCM,mBAAmBd,OAAOL,QAAQ,MAC/CoB,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKhC,qBAAqBiC,OAAO;IAChDC,UAAUzC,iBAAiB0C;IAC3BC,QAAQ;KACJC,MAAMnB,OAAOM;KACbc,KAAKX;KACLY,kBAAAA;IACJ;IACAC,QAAQpC,SAASoC;GACrB,CAAA;GAEA,MAAM,KAAKzC,WAAW0C,KAAK;IACvBC,IAAI1B,OAAOF;IACX,GAAGkB;GACP,CAAA;EACJ,QAAQ;GACJ,KAAKnC,WAAWsB,MAAMD,QAAQ;IAC1BM,YAAY;IACZJ,eAAe;GACnB,CAAA;GACA,MAAM,KAAKvB,WAAW6B,KAAKR,MAAAA;GAE3B,MAAM,IAAInC,gBAAgB,uDAAA;EAC9B;EAEA,OAAO,EAAEqC,eAAeF,OAAOE,cAAe;CAClD;CAEA,MAAMuB,cAAcxC,MAAyD;EACzE,IAAI,CAAC,KAAKP,QAAQS,yBACd,MAAM,IAAIpB,8BAAAA;EAGd,MAAMsB,YAAY,MAAM,KAAKqC,0BAA0BzC,IAAAA;EAEvD,MAAM,KAAKN,WAAWgD,oBAAoBtC,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKX,gBAAgBY,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,YAAYjB,UAAUuC;GACtBnC,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKnB,WAAWkD,UAAUnC,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAACgC,OAAOI,iBAAiB,IAAIC,KAAKL,OAAOI,aAAa,oBAAI,IAAIC,KAAAA,GAC9D,MAAM,IAAIlC,uBAAAA;EAId,MAAM8D,iBAAiB,MAAMD,IADExD,uBACFwD,CAAAA,CAAmBE,QAAQ3C,UAAU4C,QAAQ;EAE1E,MAAMjC,SAAS,KAAKrB,WAAWsB,MAAMH,QAAQ;GACzCoC,2BAAU,IAAI/B,KAAAA,EAAAA,CAAOE,YAAW;GAChCC,YAAY;GACZJ,eAAe;GACf+B,UAAUF;EACd,CAAA;EAEA,MAAM,KAAKpD,WAAW6B,KAAKR,MAAAA;EAE3B,OAAO,EAAEkC,UAAUlC,OAAOkC,SAAU;CACxC;CAEA,MAAc5C,2BAA2BL,MAA2B;EAChE,MAAMkD,YAAY,IAAI/D,UAAe,CAAC,CAAA;EAEtC,MAAMgE,iBAAiB,IAAIhE,UAAU,EAAEiE,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MACX,SACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACX7C,MAAK,CAAA,CACL8C,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAItEP,eAAeE,MACX,QACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3E,gBAAgBG,EAAEyE,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrC,OAAOZ,UAAUa,IAAI/D,IAAAA;CACzB;CAEA,MAAcyC,0BAA0BzC,MAA2B;EAC/D,MAAMkD,YAAY,IAAI/D,UAAe,CAAC,CAAA;EAEtC,MAAMgE,iBAAiB,IAAIhE,UAAU,EAAEiE,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACX7C,MAAK,CAAA,CACL8C,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAGtEP,eAAeE,MACX,QACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3E,gBAAgBG,EAAEyE,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrCZ,UAAUG,MACN,SACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1Cd,UAAUG,MACN,YACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHK,IAAI,KAAKlE,QAAQwE,qBAAqBtF,wBAAAA,CAAAA,CACtCqF,IAAItF,wBAAAA,CAAAA,CAAAA;EAIjB,OAAOwE,UAAUa,IAAI/D,IAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/types.d.ts

@@ -5,6 +5,7 @@ export type PasswordRecoveryServiceOptions = {
     passwordRecoveryEnabled?: boolean;
     emailVerificationEnabled?: boolean;
     publicUrl?: string;
+    passwordMinLength?: number;
 };
 export type PasswordRecoveryServiceContext = {
     options: PasswordRecoveryServiceOptions;

package/dist/core/identity/password-recovery/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,8BAA8B,GAAG;IACzC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,8BAA8B,GAAG;IACzC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1E"}

package/dist/core/identity/permission/checker/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/permission/checker/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EACR,yBAAyB,EACzB,+BAA+B,EAClC,MAAM,YAAY,CAAC;AAEpB,qBAAa,wBAAyB,YAAW,yBAAyB;IACtE,SAAS,CAAC,GAAG,EAAE,+BAA+B,CAAC;gBAEnC,GAAG,EAAE,+BAA+B;IAI1C,KAAK,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IA0CV,SAAS,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ3B"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/permission/checker/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EACR,yBAAyB,EACzB,+BAA+B,EAClC,MAAM,YAAY,CAAC;AAEpB,qBAAa,wBAAyB,YAAW,yBAAyB;IACtE,SAAS,CAAC,GAAG,EAAE,+BAA+B,CAAC;gBAEnC,GAAG,EAAE,+BAA+B;IAI1C,KAAK,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAqDV,SAAS,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ3B"}

package/dist/core/identity/permission/checker/service.mjs

@@ -3,8 +3,8 @@ import "node:url";
 import.meta.url;
 import { PolicyEngine as PolicyEngine$1 } from "../../../security/policy/engine.mjs";
 import { toIdentityPolicyData } from "../identity-policy-data.mjs";
-import { isUUID } from "@authup/kit";
-import { BuiltInPolicyType, PermissionEvaluator, PolicyData } from "@authup/access";
+import { hasOwnProperty, isUUID } from "@authup/kit";
+import { BuiltInPolicyType, PermissionEvaluator, definePolicyData } from "@authup/access";
 import { EntityNotFoundError, normalizeError } from "@authup/errors";
 //#region src/core/identity/permission/checker/service.ts
 var PermissionCheckerService = class {
@@ -16,25 +16,28 @@ var PermissionCheckerService = class {
 		let criteria;
 		if (isUUID(idOrName)) criteria = { id: idOrName };
 		else {
-			const realmEntity = await this.ctx.realmRepository.resolve(realm);
-			criteria = {
-				name: idOrName,
-				...realmEntity ? { realm_id: realmEntity.id } : {}
-			};
+			criteria = { name: idOrName };
+			if (realm) {
+				const realmId = await this.ctx.realmRepository.resolveId(realm);
+				if (!realmId) throw new EntityNotFoundError();
+				criteria.realm_id = realmId;
+			}
 		}
 		const entity = await this.ctx.repository.findOneBy(criteria);
 		if (!entity) throw new EntityNotFoundError();
 		const input = { ...data };
 		if (typeof input[BuiltInPolicyType.IDENTITY] === "undefined") input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);
+		const attributes = input[BuiltInPolicyType.ATTRIBUTES];
+		if (attributes && hasOwnProperty(attributes, "realm_id")) input[BuiltInPolicyType.REALM_MATCH] = attributes.realm_id ?? null;
 		const evaluationContext = {
 			name: entity.name,
-			input: new PolicyData(input)
+			data: definePolicyData(input)
 		};
 		const evaluator = new PermissionEvaluator({
 			provider: this.ctx.permissionProvider,
 			policyEngine: new PolicyEngine$1(this.ctx.identityPermissionProvider)
 		});
-		if (evaluationContext.input && evaluationContext.input.has(BuiltInPolicyType.ATTRIBUTES)) await evaluator.evaluate(evaluationContext);
+		if (evaluationContext.data && evaluationContext.data.has(BuiltInPolicyType.ATTRIBUTES)) await evaluator.evaluate(evaluationContext);
 		else await evaluator.preEvaluate(evaluationContext);
 	}
 	async safeCheck(idOrName, data, actor, realm) {

package/dist/core/identity/permission/checker/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionEvaluator","PolicyData","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PermissionCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","realmEntity","realmRepository","resolve","name","realm_id","entity","repository","findOneBy","input","IDENTITY","identity","evaluationContext","evaluator","provider","permissionProvider","policyEngine","identityPermissionProvider","has","ATTRIBUTES","evaluate","preEvaluate","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/permission/checker/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PermissionEvaluationContext } from '@authup/access';\nimport { BuiltInPolicyType, PermissionEvaluator, PolicyData } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../identity-policy-data.ts';\nimport type {\n    IPermissionCheckerService,\n    PermissionCheckerServiceContext,\n} from './types.ts';\n\nexport class PermissionCheckerService implements IPermissionCheckerService {\n    protected ctx: PermissionCheckerServiceContext;\n\n    constructor(ctx: PermissionCheckerServiceContext) {\n        this.ctx = ctx;\n    }\n\n    async check(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<void> {\n        let criteria: Record<string, any>;\n        if (isUUID(idOrName)) {\n            criteria = { id: idOrName };\n        } else {\n            const realmEntity = await this.ctx.realmRepository.resolve(realm);\n            criteria = {\n                name: idOrName,\n                ...(realmEntity ? { realm_id: realmEntity.id } : {}),\n            };\n        }\n\n        const entity = await this.ctx.repository.findOneBy(criteria);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const input = { ...data };\n        if (typeof input[BuiltInPolicyType.IDENTITY] === 'undefined') {\n            input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n        }\n\n        const evaluationContext: PermissionEvaluationContext = {\n            name: entity.name,\n            input: new PolicyData(input),\n        };\n\n        const evaluator = new PermissionEvaluator({\n            provider: this.ctx.permissionProvider,\n            policyEngine: new PolicyEngine(this.ctx.identityPermissionProvider),\n        });\n\n        if (\n            evaluationContext.input &&\n            evaluationContext.input.has(BuiltInPolicyType.ATTRIBUTES)\n        ) {\n            await evaluator.evaluate(evaluationContext);\n        } else {\n            await evaluator.preEvaluate(evaluationContext);\n        }\n    }\n\n    async safeCheck(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Result<null>> {\n        try {\n            await this.check(idOrName, data, actor, realm);\n            return { success: true, data: null };\n        } catch (e) {\n            return { success: false, error: normalizeError(e) };\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaQ,2BAAb,MAAaA;CACCC;CAEV,YAAYA,KAAsC;EAC9C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACH,MAAMM,cAAc,MAAM,KAAKR,IAAIS,gBAAgBC,QAAQL,KAAAA;GAC3DC,WAAW;IACPK,MAAMT;IACN,GAAIM,cAAc,EAAEI,UAAUJ,YAAYD,GAAG,IAAI,CAAC;GACtD;EACJ;EAEA,MAAMM,SAAS,MAAM,KAAKb,IAAIc,WAAWC,UAAUT,QAAAA;EACnD,IAAI,CAACO,QACD,MAAM,IAAIlB,oBAAAA;EAGd,MAAMqB,QAAQ,EAAE,GAAGb,KAAK;EACxB,IAAI,OAAOa,MAAMzB,kBAAkB0B,cAAc,aAC7CD,MAAMzB,kBAAkB0B,YAAYnB,qBAAqBM,MAAMc,QAAQ;EAG3E,MAAMC,oBAAiD;GACnDR,MAAME,OAAOF;GACbK,OAAO,IAAIvB,WAAWuB,KAAAA;EAC1B;EAEA,MAAMI,YAAY,IAAI5B,oBAAoB;GACtC6B,UAAU,KAAKrB,IAAIsB;GACnBC,cAAc,IAAI1B,eAAa,KAAKG,IAAIwB,0BAA0B;EACtE,CAAA;EAEA,IACIL,kBAAkBH,SAClBG,kBAAkBH,MAAMS,IAAIlC,kBAAkBmC,UAAU,GAExD,MAAMN,UAAUO,SAASR,iBAAAA;OAEzB,MAAMC,UAAUQ,YAAYT,iBAAAA;CAEpC;CAEA,MAAMU,UACF3B,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAEyB,SAAS;IAAM3B,MAAM;GAAK;EACvC,SAAS4B,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAOpC,eAAemC,CAAAA;GAAG;EACtD;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionEvaluator","definePolicyData","hasOwnProperty","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PermissionCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","name","realmId","realmRepository","resolveId","realm_id","entity","repository","findOneBy","input","IDENTITY","identity","attributes","ATTRIBUTES","REALM_MATCH","evaluationContext","evaluator","provider","permissionProvider","policyEngine","identityPermissionProvider","has","evaluate","preEvaluate","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/permission/checker/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PermissionEvaluationContext } from '@authup/access';\nimport { BuiltInPolicyType, PermissionEvaluator, definePolicyData } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { hasOwnProperty, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../identity-policy-data.ts';\nimport type {\n    IPermissionCheckerService,\n    PermissionCheckerServiceContext,\n} from './types.ts';\n\nexport class PermissionCheckerService implements IPermissionCheckerService {\n    protected ctx: PermissionCheckerServiceContext;\n\n    constructor(ctx: PermissionCheckerServiceContext) {\n        this.ctx = ctx;\n    }\n\n    async check(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<void> {\n        let criteria: Record<string, any>;\n        if (isUUID(idOrName)) {\n            criteria = { id: idOrName };\n        } else {\n            criteria = { name: idOrName };\n\n            if (realm) {\n                const realmId = await this.ctx.realmRepository.resolveId(realm);\n                if (!realmId) {\n                    throw new EntityNotFoundError();\n                }\n                criteria.realm_id = realmId;\n            }\n        }\n\n        const entity = await this.ctx.repository.findOneBy(criteria);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const input = { ...data };\n        if (typeof input[BuiltInPolicyType.IDENTITY] === 'undefined') {\n            input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n        }\n        // Surface the resource realm to the realm_scope reach factor (realm-match scope mode).\n        // Only when the body carries an ATTRIBUTES realm — so a realm-less check still rides\n        // the preEvaluate path below and neutral-passes.\n        const attributes = input[BuiltInPolicyType.ATTRIBUTES] as Record<string, any> | undefined;\n        if (attributes && hasOwnProperty(attributes, 'realm_id')) {\n            input[BuiltInPolicyType.REALM_MATCH] = attributes.realm_id ?? null;\n        }\n\n        const evaluationContext: PermissionEvaluationContext = {\n            name: entity.name,\n            data: definePolicyData(input),\n        };\n\n        const evaluator = new PermissionEvaluator({\n            provider: this.ctx.permissionProvider,\n            policyEngine: new PolicyEngine(this.ctx.identityPermissionProvider),\n        });\n\n        if (\n            evaluationContext.data &&\n            evaluationContext.data.has(BuiltInPolicyType.ATTRIBUTES)\n        ) {\n            await evaluator.evaluate(evaluationContext);\n        } else {\n            await evaluator.preEvaluate(evaluationContext);\n        }\n    }\n\n    async safeCheck(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Result<null>> {\n        try {\n            await this.check(idOrName, data, actor, realm);\n            return { success: true, data: null };\n        } catch (e) {\n            return { success: false, error: normalizeError(e) };\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaS,2BAAb,MAAaA;CACCC;CAEV,YAAYA,KAAsC;EAC9C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACHI,WAAW,EAAEE,MAAMN,SAAS;GAE5B,IAAIG,OAAO;IACP,MAAMI,UAAU,MAAM,KAAKT,IAAIU,gBAAgBC,UAAUN,KAAAA;IACzD,IAAI,CAACI,SACD,MAAM,IAAId,oBAAAA;IAEdW,SAASM,WAAWH;GACxB;EACJ;EAEA,MAAMI,SAAS,MAAM,KAAKb,IAAIc,WAAWC,UAAUT,QAAAA;EACnD,IAAI,CAACO,QACD,MAAM,IAAIlB,oBAAAA;EAGd,MAAMqB,QAAQ,EAAE,GAAGb,KAAK;EACxB,IAAI,OAAOa,MAAM1B,kBAAkB2B,cAAc,aAC7CD,MAAM1B,kBAAkB2B,YAAYnB,qBAAqBM,MAAMc,QAAQ;EAK3E,MAAMC,aAAaH,MAAM1B,kBAAkB8B;EAC3C,IAAID,cAAc1B,eAAe0B,YAAY,UAAA,GACzCH,MAAM1B,kBAAkB+B,eAAeF,WAAWP,YAAY;EAGlE,MAAMU,oBAAiD;GACnDd,MAAMK,OAAOL;GACbL,MAAMX,iBAAiBwB,KAAAA;EAC3B;EAEA,MAAMO,YAAY,IAAIhC,oBAAoB;GACtCiC,UAAU,KAAKxB,IAAIyB;GACnBC,cAAc,IAAI7B,eAAa,KAAKG,IAAI2B,0BAA0B;EACtE,CAAA;EAEA,IACIL,kBAAkBnB,QAClBmB,kBAAkBnB,KAAKyB,IAAItC,kBAAkB8B,UAAU,GAEvD,MAAMG,UAAUM,SAASP,iBAAAA;OAEzB,MAAMC,UAAUO,YAAYR,iBAAAA;CAEpC;CAEA,MAAMS,UACF7B,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAE2B,SAAS;IAAM7B,MAAM;GAAK;EACvC,SAAS8B,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAOtC,eAAeqC,CAAAA;GAAG;EACtD;CACJ;AACJ"}

package/dist/core/identity/permission/index.d.ts

@@ -1,4 +1,5 @@
 export * from './checker/index.ts';
+export * from './junction-grant.ts';
 export * from './module.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/identity/permission/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/permission/index.mjs

@@ -1,7 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { applyJunctionCreateGrant, buildJunctionUpdateData } from "./junction-grant.mjs";
 import { PermissionCheckerService } from "./checker/service.mjs";
 import "./checker/index.mjs";
 import { IdentityPermissionProvider } from "./module.mjs";
-export { IdentityPermissionProvider, PermissionCheckerService };
+export { IdentityPermissionProvider, PermissionCheckerService, applyJunctionCreateGrant, buildJunctionUpdateData };

package/dist/core/identity/permission/junction-grant.d.ts

@@ -0,0 +1,49 @@
+import { RealmScope } from '@authup/access';
+import type { ResolveJunctionGrantResult } from './types.ts';
+/**
+ * The privilege-escalation boundary for permission-binding junctions, shared verbatim by
+ * role/user/client/robot-permission. Kept in ONE place (rather than copied into each service)
+ * so the fail-closed cap/inherit rule is audited and changed once — see #3160 / #3158 / #3159,
+ * which each had to patch this rule across all four services.
+ *
+ * It depends on a server-core type (`ResolveJunctionGrantResult`) and so cannot live on the
+ * generic `JunctionEntityService` in `@authup/server-kit` (that would invert the layering).
+ */
+/**
+ * Cap a junction CREATE to the actor's request-relative selected grant and inherit its policy.
+ *
+ * - `realm_scope` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).
+ * - The policy follows the grant: only a genuinely unrestricted actor (an UNCAPPED `any` reach
+ *   AND no policy) may keep an explicitly-requested `policy_id`; any restricted/policy-bound
+ *   actor inherits its own grant's policy (it can neither attach an unowned policy nor detach to
+ *   widen). The check reads `grant.realmScope` UNCAPPED precisely to distinguish that case — the
+ *   grant is returned uncapped by `resolveJunctionGrant` for exactly this reason.
+ *
+ * Mutates `validated` in place (mirrors the surrounding service style).
+ */
+export declare function applyJunctionCreateGrant(validated: Record<string, any>, grant: ResolveJunctionGrantResult): void;
+export type BuildJunctionUpdateDataInput = {
+    /** The validated update payload (UPDATE group) — presence of a key signals caller intent. */
+    data: Record<string, any>;
+    /** The persisted junction's current reach (used to re-cap a policy-only edit). */
+    existingScope: `${RealmScope}`;
+    /** The actor's UNCAPPED selected reach for this permission (`any` for system context). */
+    actorScope: `${RealmScope}`;
+    /** Whether the actor's selected grant carries no policy. */
+    actorPolicyFree: boolean;
+    /** The id of the actor's selected grant policy (null when policy-free). */
+    actorPolicyId: string | null;
+};
+/**
+ * Build the `{ realm_scope?, policy_id? }` delta for a junction UPDATE, capped to the actor's
+ * request-relative grant.
+ *
+ * - An unrestricted (`any`, policy-free) actor may set/clear `policy_id` explicitly and is never
+ *   narrowed.
+ * - A restricted/policy-bound actor that touches the binding inherits its own grant's policy AND
+ *   has the reach re-capped — including the EXISTING `realm_scope` when the update omits it, so a
+ *   policy-only edit cannot leave a wider pre-existing reach standing (fail-OPEN otherwise: the
+ *   persisted binding must always be dominated by a grant the actor really holds — #3160).
+ */
+export declare function buildJunctionUpdateData(input: BuildJunctionUpdateDataInput): Record<string, any>;
+//# sourceMappingURL=junction-grant.d.ts.map

package/dist/core/identity/permission/junction-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"junction-grant.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/junction-grant.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAiB,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAE7D;;;;;;;;GAQG;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,KAAK,EAAE,0BAA0B,GAClC,IAAI,CAMN;AAED,MAAM,MAAM,4BAA4B,GAAG;IACvC,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,kFAAkF;IAClF,aAAa,EAAE,GAAG,UAAU,EAAE,CAAC;IAC/B,0FAA0F;IAC1F,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC;IAC5B,4DAA4D;IAC5D,eAAe,EAAE,OAAO,CAAC;IACzB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAkChG"}