npm - @authup/server-core - Versions diffs - 1.0.0-beta.50 → 1.0.0-beta.52 - Mend

@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.52

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (656) hide show

package/dist/core/provisioning/synchronizer/role/module.mjs CHANGED Viewed

@@ -11,13 +11,11 @@ import { pickRecord } from "@authup/kit";
 //#region src/core/provisioning/synchronizer/role/module.ts
 var RoleProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 	repository;
-	policyRepository;
 	permissionResolver;
 	permissionJunction;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
-		this.policyRepository = ctx.policyRepository;
 		this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);
 		this.permissionJunction = new ProvisioningJunctionSynchronizer({
 			repository: ctx.rolePermissionRepository,
@@ -26,6 +24,7 @@ var RoleProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 		});
 	}
 	async synchronize(input) {
+		this.canonicalizeName(input.attributes);
 		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
 		let attributes = await this.repository.findOneBy({
 			name: input.attributes.name,
@@ -62,32 +61,27 @@ var RoleProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 		const realmPermissions = attributes.realm_id ? await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realm_id) : [];
 		const permissions = [...globalPermissions, ...realmPermissions];
 		if (permissions.length > 0) {
-			const policyMap = await this.resolvePolicyMap(input, attributes.name);
-			if (policyMap) for (const permission of permissions) {
-				const policyId = policyMap.overrides.get(permission.name) ?? policyMap.defaultPolicyId;
-				await this.permissionJunction.synchronize(attributes, [permission], "permission_id", "permission_realm_id", policyId ? { policy_id: policyId } : void 0);
-			}
-			else await this.permissionJunction.synchronize(attributes, permissions, "permission_id", "permission_realm_id");
+			const defaultScope = input.relations.globalPermissionsRealmScope;
+			if (defaultScope) {
+				const overrides = this.buildRealmScopeOverrides(input);
+				for (const permission of permissions) {
+					const realmScope = overrides.get(permission.name) ?? defaultScope;
+					await this.permissionJunction.synchronize(attributes, [permission], "permission_id", "permission_realm_id", { realm_scope: realmScope });
+				}
+			} else await this.permissionJunction.synchronize(attributes, permissions, "permission_id", "permission_realm_id");
 		}
 		return {
 			...input,
 			attributes
 		};
 	}
-	async resolvePolicyMap(input, roleName) {
-		if (!input.relations?.globalPermissionsPolicyName || !this.policyRepository) return;
-		const defaultPolicy = await this.policyRepository.findOneByName(input.relations.globalPermissionsPolicyName);
-		if (!defaultPolicy) throw new Error(`Provisioning: policy '${input.relations.globalPermissionsPolicyName}' not found for role '${roleName}'.`);
+	buildRealmScopeOverrides(input) {
 		const overrides = /* @__PURE__ */ new Map();
-		if (input.relations.globalPermissionsPolicyOverrides) for (const [policyName, permissionNames] of Object.entries(input.relations.globalPermissionsPolicyOverrides)) {
-			const policy = await this.policyRepository.findOneByName(policyName);
-			if (!policy) throw new Error(`Provisioning: override policy '${policyName}' not found for role '${roleName}'.`);
-			for (const permName of permissionNames) overrides.set(permName, policy.id);
+		if (input.relations?.globalPermissionsRealmScopeOverrides) for (const [realmScope, permissionNames] of Object.entries(input.relations.globalPermissionsRealmScopeOverrides)) {
+			if (!permissionNames) continue;
+			for (const permName of permissionNames) overrides.set(permName, realmScope);
 		}
-		return {
-			defaultPolicyId: defaultPolicy.id,
-			overrides
-		};
+		return overrides;
 	}
 };
 //#endregion

package/dist/core/provisioning/synchronizer/role/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RoleProvisioningSynchronizer","repository","policyRepository","permissionResolver","permissionJunction","ctx","permissionRepository","rolePermissionRepository","ownerKey","ownerRealmKey","synchronize","input","strategy","attributes","findOneBy","name","realm_id","client_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","globalPermissions","resolveGlobal","globalPermissionsExclude","length","excludeSet","Set","filter","p","has","realmPermissions","resolveRealm","permissions","policyMap","resolvePolicyMap","permission","policyId","overrides","get","defaultPolicyId","policy_id","undefined","roleName","globalPermissionsPolicyName","defaultPolicy","findOneByName","Error","Map","globalPermissionsPolicyOverrides","policyName","permissionNames","Object","entries","policy","permName","set"],"sources":["../../../../../src/core/provisioning/synchronizer/role/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IPolicyRepository, IRoleRepository } from '../../../entities/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RoleProvisioningSynchronizerContext } from './types.ts';\n\nexport class RoleProvisioningSynchronizer extends BaseProvisioningSynchronizer<RoleProvisioningEntity> {\n protected repository : IRoleRepository;\n\n protected policyRepository?: IPolicyRepository;\n\n protected permissionResolver : ProvisioningEntityResolver<Permission>;\n\n protected permissionJunction: ProvisioningJunctionSynchronizer<RolePermission>;\n\n constructor(ctx: RoleProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n this.policyRepository = ctx.policyRepository;\n this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n this.permissionJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.rolePermissionRepository,\n ownerKey: 'role_id',\n ownerRealmKey: 'role_realm_id',\n });\n }\n\n async synchronize(input: RoleProvisioningEntity): Promise<RoleProvisioningEntity> {\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n let attributes = await this.repository.findOneBy({\n name: input.attributes.name,\n realm_id: input.attributes.realm_id \|\| null,\n client_id: input.attributes.client_id \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n if (!input.relations) {\n return {\n ...input,\n attributes,\n };\n }\n\n let globalPermissions = await this.permissionResolver.resolveGlobal(input.relations.globalPermissions);\n\n if (input.relations.globalPermissionsExclude && input.relations.globalPermissionsExclude.length > 0) {\n const excludeSet = new Set(input.relations.globalPermissionsExclude);\n globalPermissions = globalPermissions.filter((p) => !excludeSet.has(p.name));\n }\n\n const realmPermissions = attributes.realm_id ?\n await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realm_id) :\n [];\n\n const permissions = [\n ...globalPermissions,\n ...realmPermissions,\n ];\n\n if (permissions.length > 0) {\n const policyMap = await this.resolvePolicyMap(input, attributes.name);\n\n if (policyMap) {\n for (const permission of permissions) {\n const policyId = policyMap.overrides.get(permission.name) ?? policyMap.defaultPolicyId;\n await this.permissionJunction.synchronize(\n attributes,\n [permission],\n 'permission_id',\n 'permission_realm_id',\n policyId ? { policy_id: policyId } : undefined,\n );\n }\n } else {\n await this.permissionJunction.synchronize(\n attributes,\n permissions,\n 'permission_id',\n 'permission_realm_id',\n );\n }\n }\n\n return {\n ...input,\n attributes,\n };\n }\n\n private async resolvePolicyMap(\n input: RoleProvisioningEntity,\n roleName: string \| undefined,\n ): Promise<{\n defaultPolicyId: string \| undefined,\n overrides: Map<string, string> \n } \| undefined> {\n if (!input.relations?.globalPermissionsPolicyName \|\| !this.policyRepository) {\n return undefined;\n }\n\n const defaultPolicy = await this.policyRepository.findOneByName(input.relations.globalPermissionsPolicyName);\n if (!defaultPolicy) {\n throw new Error(\n `Provisioning: policy '${input.relations.globalPermissionsPolicyName}' not found for role '${roleName}'.`,\n );\n }\n\n const overrides = new Map<string, string>();\n\n if (input.relations.globalPermissionsPolicyOverrides) {\n for (const [policyName, permissionNames] of Object.entries(input.relations.globalPermissionsPolicyOverrides)) {\n const policy = await this.policyRepository.findOneByName(policyName);\n if (!policy) {\n throw new Error(\n `Provisioning: override policy '${policyName}' not found for role '${roleName}'.`,\n );\n }\n for (const permName of permissionNames) {\n overrides.set(permName, policy.id);\n }\n }\n }\n\n return {\n defaultPolicyId: defaultPolicy.id,\n overrides,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;AAiBA,IAAaM,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,qBAAqB,IAAIL,2BAA2BO,IAAIC,oBAAoB;EACjF,KAAKF,qBAAqB,IAAIL,iCAAiC;GAC3DE,YAAYI,IAAIE;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAMC,YAAYC,OAAgE;EAC9E,MAAMC,WAAWhB,oCAAoCe,MAAMC,QAAQ;EACnE,IAAIC,aAAa,MAAM,KAAKZ,WAAWa,UAAU;GAC7CC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GACvCC,WAAWN,MAAME,WAAWI,aAAa;EAC7C,CAAA;EAEA,IAAIL,SAASM,SAASvB,+BAA+BwB,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKZ,WAAWmB,OAAOP,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQD,SAASM,MAAjB;GACI,KAAKvB,+BAA+B0B;IAChCR,aAAa,KAAKZ,WAAWqB,MACzBT,YACAD,SAASC,aACLnB,WAAWiB,MAAME,YAAYD,SAASC,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKZ,WAAWsB,KAAKV,UAAAA;IACxC;GACJ,KAAKlB,+BAA+B6B;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKZ,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOf,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKZ,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOf,MAAME,UAAU,CAAA;EAGnF,IAAI,CAACF,MAAMgB,WACP,OAAO;GACH,GAAGhB;GACHE;EACJ;EAGJ,IAAIe,oBAAoB,MAAM,KAAKzB,mBAAmB0B,cAAclB,MAAMgB,UAAUC,iBAAiB;EAErG,IAAIjB,MAAMgB,UAAUG,4BAA4BnB,MAAMgB,UAAUG,yBAAyBC,SAAS,GAAG;GACjG,MAAMC,aAAa,IAAIC,IAAItB,MAAMgB,UAAUG,wBAAwB;GACnEF,oBAAoBA,kBAAkBM,QAAQC,MAAM,CAACH,WAAWI,IAAID,EAAEpB,IAAI,CAAA;EAC9E;EAEA,MAAMsB,mBAAmBxB,WAAWG,WAChC,MAAM,KAAKb,mBAAmBmC,aAAa3B,MAAMgB,UAAUU,kBAAkBxB,WAAWG,QAAQ,IAChG,CAAA;EAEJ,MAAMuB,cAAc,CAAA,GACbX,mBAAAA,GACAS,gBAAAA;EAGP,IAAIE,YAAYR,SAAS,GAAG;GACxB,MAAMS,YAAY,MAAM,KAAKC,iBAAiB9B,OAAOE,WAAWE,IAAI;GAEpE,IAAIyB,WACA,KAAK,MAAME,cAAcH,aAAa;IAClC,MAAMI,WAAWH,UAAUI,UAAUC,IAAIH,WAAW3B,IAAI,KAAKyB,UAAUM;IACvE,MAAM,KAAK1C,mBAAmBM,YAC1BG,YACA,CAAC6B,UAAAA,GACD,iBACA,uBACAC,WAAW,EAAEI,WAAWJ,SAAS,IAAIK,KAAAA,CAAAA;GAE7C;QAEA,MAAM,KAAK5C,mBAAmBM,YAC1BG,YACA0B,aACA,iBACA,qBAAA;EAGZ;EAEA,OAAO;GACH,GAAG5B;GACHE;EACJ;CACJ;CAEA,MAAc4B,iBACV9B,OACAsC,UAIW;EACX,IAAI,CAACtC,MAAMgB,WAAWuB,+BAA+B,CAAC,KAAKhD,kBACvD;EAGJ,MAAMiD,gBAAgB,MAAM,KAAKjD,iBAAiBkD,cAAczC,MAAMgB,UAAUuB,2BAA2B;EAC3G,IAAI,CAACC,eACD,MAAM,IAAIE,MACN,yBAAyB1C,MAAMgB,UAAUuB,4BAA4B,wBAAwBD,SAAS,GAAG;EAIjH,MAAML,4BAAY,IAAIU,IAAAA;EAEtB,IAAI3C,MAAMgB,UAAU4B,kCAChB,KAAK,MAAM,CAACC,YAAYC,oBAAoBC,OAAOC,QAAQhD,MAAMgB,UAAU4B,gCAAgC,GAAG;GAC1G,MAAMK,SAAS,MAAM,KAAK1D,iBAAiBkD,cAAcI,UAAAA;GACzD,IAAI,CAACI,QACD,MAAM,IAAIP,MACN,kCAAkCG,WAAW,wBAAwBP,SAAS,GAAG;GAGzF,KAAK,MAAMY,YAAYJ,iBACnBb,UAAUkB,IAAID,UAAUD,OAAOnC,EAAE;EAEzC;EAGJ,OAAO;GACHqB,iBAAiBK,cAAc1B;GAC/BmB;EACJ;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RoleProvisioningSynchronizer","repository","permissionResolver","permissionJunction","ctx","permissionRepository","rolePermissionRepository","ownerKey","ownerRealmKey","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realm_id","client_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","globalPermissions","resolveGlobal","globalPermissionsExclude","length","excludeSet","Set","filter","p","has","realmPermissions","resolveRealm","permissions","defaultScope","globalPermissionsRealmScope","overrides","buildRealmScopeOverrides","permission","realmScope","get","realm_scope","Map","globalPermissionsRealmScopeOverrides","permissionNames","Object","entries","permName","set"],"sources":["../../../../../src/core/provisioning/synchronizer/role/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IRoleRepository } from '../../../entities/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RoleProvisioningSynchronizerContext } from './types.ts';\n\nexport class RoleProvisioningSynchronizer extends BaseProvisioningSynchronizer<RoleProvisioningEntity> {\n protected repository : IRoleRepository;\n\n protected permissionResolver : ProvisioningEntityResolver<Permission>;\n\n protected permissionJunction: ProvisioningJunctionSynchronizer<RolePermission>;\n\n constructor(ctx: RoleProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n this.permissionJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.rolePermissionRepository,\n ownerKey: 'role_id',\n ownerRealmKey: 'role_realm_id',\n });\n }\n\n async synchronize(input: RoleProvisioningEntity): Promise<RoleProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n let attributes = await this.repository.findOneBy({\n name: input.attributes.name,\n realm_id: input.attributes.realm_id \|\| null,\n client_id: input.attributes.client_id \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes,\n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n if (!input.relations) {\n return {\n ...input,\n attributes,\n };\n }\n\n let globalPermissions = await this.permissionResolver.resolveGlobal(input.relations.globalPermissions);\n\n if (input.relations.globalPermissionsExclude && input.relations.globalPermissionsExclude.length > 0) {\n const excludeSet = new Set(input.relations.globalPermissionsExclude);\n globalPermissions = globalPermissions.filter((p) => !excludeSet.has(p.name));\n }\n\n const realmPermissions = attributes.realm_id ?\n await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realm_id) :\n [];\n\n const permissions = [\n ...globalPermissions,\n ...realmPermissions,\n ];\n\n if (permissions.length > 0) {\n const defaultScope = input.relations.globalPermissionsRealmScope;\n\n if (defaultScope) {\n const overrides = this.buildRealmScopeOverrides(input);\n for (const permission of permissions) {\n const realmScope = overrides.get(permission.name) ?? defaultScope;\n await this.permissionJunction.synchronize(\n attributes,\n [permission],\n 'permission_id',\n 'permission_realm_id',\n { realm_scope: realmScope },\n );\n }\n } else {\n await this.permissionJunction.synchronize(\n attributes,\n permissions,\n 'permission_id',\n 'permission_realm_id',\n );\n }\n }\n\n return {\n ...input,\n attributes,\n };\n }\n\n private buildRealmScopeOverrides(input: RoleProvisioningEntity): Map<string, string> {\n const overrides = new Map<string, string>();\n if (input.relations?.globalPermissionsRealmScopeOverrides) {\n for (const [realmScope, permissionNames] of Object.entries(input.relations.globalPermissionsRealmScopeOverrides)) {\n if (!permissionNames) {\n continue;\n }\n for (const permName of permissionNames) {\n overrides.set(permName, realmScope);\n }\n }\n }\n return overrides;\n }\n}\n"],"mappings":";;;;;;;;;;;AAiBA,IAAaM,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,qBAAqB,IAAIJ,2BAA2BM,IAAIC,oBAAoB;EACjF,KAAKF,qBAAqB,IAAIJ,iCAAiC;GAC3DE,YAAYG,IAAIE;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAMC,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWjB,oCAAoCc,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,KAAKX,WAAWa,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,UAAUN,MAAME,WAAWI,YAAY;GACvCC,WAAWP,MAAME,WAAWK,aAAa;EAC7C,CAAA;EAEA,IAAIJ,SAASK,SAASvB,+BAA+BwB,QAAQ;GACzD,IAAIP,YACA,MAAM,KAAKX,WAAWmB,OAAOR,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASK,MAAjB;GACI,KAAKvB,+BAA+B0B;IAChCT,aAAa,KAAKX,WAAWqB,MACzBV,YACAC,SAASD,aACLlB,WAAWgB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKX,WAAWsB,KAAKX,UAAAA;IACxC;GACJ,KAAKjB,+BAA+B6B;IAChCd,MAAME,WAAWa,KAAKb,WAAWa;IACjCb,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;EAGnF,IAAI,CAACF,MAAMiB,WACP,OAAO;GACH,GAAGjB;GACHE;EACJ;EAGJ,IAAIgB,oBAAoB,MAAM,KAAK1B,mBAAmB2B,cAAcnB,MAAMiB,UAAUC,iBAAiB;EAErG,IAAIlB,MAAMiB,UAAUG,4BAA4BpB,MAAMiB,UAAUG,yBAAyBC,SAAS,GAAG;GACjG,MAAMC,aAAa,IAAIC,IAAIvB,MAAMiB,UAAUG,wBAAwB;GACnEF,oBAAoBA,kBAAkBM,QAAQC,MAAM,CAACH,WAAWI,IAAID,EAAEpB,IAAI,CAAA;EAC9E;EAEA,MAAMsB,mBAAmBzB,WAAWI,WAChC,MAAM,KAAKd,mBAAmBoC,aAAa5B,MAAMiB,UAAUU,kBAAkBzB,WAAWI,QAAQ,IAChG,CAAA;EAEJ,MAAMuB,cAAc,CAAA,GACbX,mBAAAA,GACAS,gBAAAA;EAGP,IAAIE,YAAYR,SAAS,GAAG;GACxB,MAAMS,eAAe9B,MAAMiB,UAAUc;GAErC,IAAID,cAAc;IACd,MAAME,YAAY,KAAKC,yBAAyBjC,KAAAA;IAChD,KAAK,MAAMkC,cAAcL,aAAa;KAClC,MAAMM,aAAaH,UAAUI,IAAIF,WAAW7B,IAAI,KAAKyB;KACrD,MAAM,KAAKrC,mBAAmBM,YAC1BG,YACA,CAACgC,UAAAA,GACD,iBACA,uBACA,EAAEG,aAAaF,WAAW,CAAA;IAElC;GACJ,OACI,MAAM,KAAK1C,mBAAmBM,YAC1BG,YACA2B,aACA,iBACA,qBAAA;EAGZ;EAEA,OAAO;GACH,GAAG7B;GACHE;EACJ;CACJ;CAEQ+B,yBAAyBjC,OAAoD;EACjF,MAAMgC,4BAAY,IAAIM,IAAAA;EACtB,IAAItC,MAAMiB,WAAWsB,sCACjB,KAAK,MAAM,CAACJ,YAAYK,oBAAoBC,OAAOC,QAAQ1C,MAAMiB,UAAUsB,oCAAoC,GAAG;GAC9G,IAAI,CAACC,iBACD;GAEJ,KAAK,MAAMG,YAAYH,iBACnBR,UAAUY,IAAID,UAAUR,UAAAA;EAEhC;EAEJ,OAAOH;CACX;AACJ"}

package/dist/core/provisioning/synchronizer/role/types.d.ts CHANGED Viewed

@@ -1,8 +1,7 @@
-import type { IPermissionRepository, IPolicyRepository, IRolePermissionRepository, IRoleRepository } from '../../../entities/index.ts';
+import type { IPermissionRepository, IRolePermissionRepository, IRoleRepository } from '../../../entities/index.ts';
 export type RoleProvisioningSynchronizerContext = {
     repository: IRoleRepository;
     permissionRepository: IPermissionRepository;
     rolePermissionRepository: IRolePermissionRepository;
-    policyRepository?: IPolicyRepository;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/role/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/role/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,qBAAqB,EACrB,~~iBAAiB,EACjB,~~yBAAyB,EACzB,eAAe,EAClB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,mCAAmC,GAAG;IAC9C,UAAU,EAAE,eAAe,CAAC;IAC5B,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,wBAAwB,EAAE,yBAAyB,CAAC;~~IACpD~~,~~gBAAgB,~~CAAC~~,EAAE,iBAAiB,CAAC;CACxC,CAAC~~"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/role/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,qBAAqB,EACrB,yBAAyB,EACzB,eAAe,EAClB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,mCAAmC,GAAG;IAC9C,UAAU,EAAE,eAAe,CAAC;IAC5B,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,wBAAwB,EAAE,yBAAyB,CAAC;CACvD,CAAC"}

package/dist/core/provisioning/synchronizer/scope/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/scope/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAEvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvE,qBAAa,6BAA8B,SAAQ,4BAA4B,CAAC,uBAAuB,CAAC;IACpG,SAAS,CAAC,UAAU,EAAG,gBAAgB,CAAC;gBAE5B,GAAG,EAAE,oCAAoC;IAM/C,WAAW,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;~~CA4CtF~~"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/scope/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAEvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvE,qBAAa,6BAA8B,SAAQ,4BAA4B,CAAC,uBAAuB,CAAC;IACpG,SAAS,CAAC,UAAU,EAAG,gBAAgB,CAAC;gBAE5B,GAAG,EAAE,oCAAoC;IAM/C,WAAW,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CA8CtF"}

package/dist/core/provisioning/synchronizer/scope/module.mjs CHANGED Viewed

@@ -14,6 +14,7 @@ var ScopeProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 		this.repository = ctx.repository;
 	}
 	async synchronize(input) {
+		this.canonicalizeName(input.attributes);
 		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
 		let attributes = await this.repository.findOneBy({
 			name: input.attributes.name,

package/dist/core/provisioning/synchronizer/scope/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ScopeProvisioningSynchronizer","repository","ctx","synchronize","input","~~strategy~~","attributes","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create"],"sources":["../../../../../src/core/provisioning/synchronizer/scope/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IScopeRepository } from '../../../entities/index.ts';\nimport type { ScopeProvisioningEntity } from '../../entities/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { ScopeProvisioningSynchronizerContext } from './types.ts';\n\nexport class ScopeProvisioningSynchronizer extends BaseProvisioningSynchronizer<ScopeProvisioningEntity> {\n protected repository : IScopeRepository;\n\n constructor(ctx: ScopeProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n }\n\n async synchronize(input: ScopeProvisioningEntity): Promise<ScopeProvisioningEntity> {\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n let attributes = await this.repository.findOneBy({\n name: input.attributes.name,\n realm_id: input.attributes.realm_id \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MAAME,YAAYC,OAAkE;EAChF,MAAMC,~~WAAWP~~,oCAAoCM,~~MAAMC~~,QAAQ;EAEnE,~~IAAIC~~,aAAa,MAAM,KAAKL,~~WAAWM~~,UAAU;GAC7CC,~~MAAMJ~~,MAAME,~~WAAWE~~;GACvBC,~~UAAUL~~,MAAME,~~WAAWG~~,YAAY;EAC3C,CAAA;EAEA,~~IAAIJ~~,~~SAASK~~,~~SAASb~~,+BAA+Bc,QAAQ;GACzD,~~IAAIL~~,YACA,MAAM,KAAKL,~~WAAWW~~,~~OAAON~~,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,~~QAAQD~~,~~SAASK~~,MAAjB;GACI,~~KAAKb~~,+BAA+~~BgB~~;~~IAChCP~~,aAAa,KAAKL,~~WAAWa~~,~~MACzBR~~,~~YACAD~~,~~SAASC~~,aACLV,WAAWQ,MAAME,~~YAAYD~~,~~SAASC~~,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKL,~~WAAWc~~,~~KAAKT~~,UAAAA;IACxC;GACJ,KAAKT,+BAA+~~BmB~~;~~IAChCZ~~,MAAME,~~WAAWW~~,~~KAAKX~~,~~WAAWW~~;~~IACjCX~~,aAAa,MAAM,KAAKL,~~WAAWc~~,KAAK,~~KAAKd~~,~~WAAWiB~~,~~OAAOd~~,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKL,~~WAAWc~~,KAAK,~~KAAKd~~,~~WAAWiB~~,~~OAAOd~~,MAAME,UAAU,CAAA;EAGnF,OAAO;GACH,GAAGF;GACHE;EACJ;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ScopeProvisioningSynchronizer","repository","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create"],"sources":["../../../../../src/core/provisioning/synchronizer/scope/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IScopeRepository } from '../../../entities/index.ts';\nimport type { ScopeProvisioningEntity } from '../../entities/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { ScopeProvisioningSynchronizerContext } from './types.ts';\n\nexport class ScopeProvisioningSynchronizer extends BaseProvisioningSynchronizer<ScopeProvisioningEntity> {\n protected repository : IScopeRepository;\n\n constructor(ctx: ScopeProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n }\n\n async synchronize(input: ScopeProvisioningEntity): Promise<ScopeProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n let attributes = await this.repository.findOneBy({\n name: input.attributes.name,\n realm_id: input.attributes.realm_id \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWT,oCAAoCM,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKL,WAAWO,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,UAAUN,MAAME,WAAWI,YAAY;EAC3C,CAAA;EAEA,IAAIH,SAASI,SAASd,+BAA+Be,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKL,WAAWY,OAAOP,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAKd,+BAA+BiB;IAChCR,aAAa,KAAKL,WAAWc,MACzBT,YACAC,SAASD,aACLV,WAAWQ,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKL,WAAWe,KAAKV,UAAAA;IACxC;GACJ,KAAKT,+BAA+BoB;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;EAGnF,OAAO;GACH,GAAGF;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/user/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,UAAU,EACV,IAAI,EACJ,cAAc,EACd,QAAQ,EACX,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EACR,iBAAiB,EACjB,eAAe,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEtE,qBAAa,4BAA6B,SAAQ,4BAA4B,CAAC,sBAAsB,CAAC;IAClG,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAErE,SAAS,CAAC,YAAY,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAEzD,SAAS,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,cAAc,CAAC,CAAC;IAE/E,SAAS,CAAC,YAAY,EAAE,gCAAgC,CAAC,QAAQ,CAAC,CAAC;gBAEvD,GAAG,EAAE,mCAAmC;IAqB9C,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;~~CA+IpF~~"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,UAAU,EACV,IAAI,EACJ,cAAc,EACd,QAAQ,EACX,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EACR,iBAAiB,EACjB,eAAe,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEtE,qBAAa,4BAA6B,SAAQ,4BAA4B,CAAC,sBAAsB,CAAC;IAClG,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAErE,SAAS,CAAC,YAAY,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAEzD,SAAS,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,cAAc,CAAC,CAAC;IAE/E,SAAS,CAAC,YAAY,EAAE,gCAAgC,CAAC,QAAQ,CAAC,CAAC;gBAEvD,GAAG,EAAE,mCAAmC;IAqB9C,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAiJpF"}

package/dist/core/provisioning/synchronizer/user/module.mjs CHANGED Viewed

@@ -35,6 +35,7 @@ var UserProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 		});
 	}
 	async synchronize(input) {
+		this.canonicalizeName(input.attributes);
 		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
 		let attributes = await this.userRepository.findOneBy({
 			name: input.attributes.name,

package/dist/core/provisioning/synchronizer/user/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["buildUserFakeEmail","pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","UserProvisioningSynchronizer","userRepository","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","userPermissionRepository","ownerKey","ownerRealmKey","userRoleRepository","synchronize","input","strategy","attributes","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","includes","email","merge","save","REPLACE","undefined","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","clientPermissions","clientKeys","Object","keys","clientKey","client","entities","resolveClient","push","length","roles","globalRoles","realmRoles","clientRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n Permission, \n Role, \n UserPermission, \n UserRole,\n} from '@authup/core-kit';\nimport { buildUserFakeEmail } from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type {\n IClientRepository,\n IUserRepository,\n} from '../../../entities/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { UserProvisioningSynchronizerContext } from './types.ts';\n\nexport class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {\n protected userRepository: IUserRepository;\n\n protected clientRepository: IClientRepository;\n\n protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n protected roleResolver: ProvisioningEntityResolver<Role>;\n\n protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;\n\n protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;\n\n constructor(ctx: UserProvisioningSynchronizerContext) {\n super();\n\n this.userRepository = ctx.userRepository;\n this.clientRepository = ctx.clientRepository;\n\n this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n this.permissionJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.userPermissionRepository,\n ownerKey: 'user_id',\n ownerRealmKey: 'user_realm_id',\n });\n this.roleJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.userRoleRepository,\n ownerKey: 'user_id',\n ownerRealmKey: 'user_realm_id',\n });\n }\n\n async synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity> {\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n let attributes = await this.userRepository.findOneBy({\n name: input.attributes.name,\n realm_id: input.attributes.realm_id \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.userRepository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n if (\n strategy.attributes &&\n strategy.attributes.includes('email')\n ) {\n input.attributes.email = input.attributes.email \|\|\n attributes.email \|\|\n buildUserFakeEmail(input.attributes.name \|\| attributes.name);\n }\n\n attributes = this.userRepository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.userRepository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.email = input.attributes.email \|\|\n attributes.email \|\|\n (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);\n\n input.attributes.id = attributes.id;\n attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n break;\n }\n } else {\n if (!input.attributes.email && input.attributes.name) {\n input.attributes.email = buildUserFakeEmail(input.attributes.name);\n }\n\n attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n }\n\n // Permissions (Global, Realm & Client)\n const permissions : Permission[] = [\n ...await this.permissionResolver.resolveGlobal(\n input.relations && input.relations.globalPermissions,\n ),\n ...(attributes.realm_id ?\n await this.permissionResolver.resolveRealm(\n input.relations && input.relations.realmPermissions,\n attributes.realm_id,\n ) :\n []),\n ];\n\n if (input.relations && input.relations.clientPermissions) {\n const clientKeys = Object.keys(input.relations.clientPermissions);\n for (const clientKey of clientKeys) {\n const client = await this.clientRepository.findOneBy({\n name: clientKey,\n realm_id: attributes.realm_id,\n });\n\n if (client) {\n const entities = await this.permissionResolver.resolveClient(\n input.relations.clientPermissions[clientKey],\n attributes.realm_id,\n client.id,\n );\n permissions.push(...entities);\n }\n }\n }\n\n if (permissions.length > 0) {\n await this.permissionJunction.synchronize(\n attributes,\n permissions,\n 'permission_id',\n 'permission_realm_id',\n );\n }\n\n // Roles (Global, Realm & Client)\n const roles : Role[] = [\n ...await this.roleResolver.resolveGlobal(\n input.relations && input.relations.globalRoles,\n ),\n ...(attributes.realm_id ?\n await this.roleResolver.resolveRealm(\n input.relations && input.relations.realmRoles,\n attributes.realm_id,\n ) :\n []),\n ];\n\n if (input.relations && input.relations.clientRoles) {\n const clientKeys = Object.keys(input.relations.clientRoles);\n for (const clientKey of clientKeys) {\n const client = await this.clientRepository.findOneBy({\n name: clientKey,\n realm_id: attributes.realm_id,\n });\n\n if (client) {\n const entities = await this.roleResolver.resolveClient(\n input.relations.clientRoles[clientKey],\n attributes.realm_id,\n client.id,\n );\n roles.push(...entities);\n }\n }\n }\n\n if (roles.length > 0) {\n await this.roleJunction.synchronize(\n attributes,\n roles,\n 'role_id',\n 'role_realm_id',\n );\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAaO,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKN,iBAAiBM,IAAIN;EAC1B,KAAKC,mBAAmBK,IAAIL;EAE5B,KAAKC,qBAAqB,IAAIL,2BAA2BS,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIN,2BAA2BS,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIN,iCAAiC;GAC3DW,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIP,iCAAiC;GACrDW,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAgE;EAC9E,MAAMC,WAAWrB,oCAAoCoB,MAAMC,QAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKjB,eAAekB,UAAU;GACjDC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;EAC3C,CAAA;EAEA,IAAIJ,SAASK,SAAS3B,+BAA+B4B,QAAQ;GACzD,IAAIL,YACA,MAAM,KAAKjB,eAAeuB,OAAON,UAAAA;GAErC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQD,SAASK,MAAjB;GACI,KAAK3B,+BAA+B8B;IAChC,IACIR,SAASC,cACTD,SAASC,WAAWQ,SAAS,OAAA,GAE7BV,MAAME,WAAWS,QAAQX,MAAME,WAAWS,SACtCT,WAAWS,SACXlC,mBAAmBuB,MAAME,WAAWE,QAAQF,WAAWE,IAAI;IAGnEF,aAAa,KAAKjB,eAAe2B,MAC7BV,YACAD,SAASC,aACLxB,WAAWsB,MAAME,YAAYD,SAASC,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKjB,eAAe4B,KAAKX,UAAAA;IAC5C;GACJ,KAAKvB,+BAA+BmC;IAChCd,MAAME,WAAWS,QAAQX,MAAME,WAAWS,SACtCT,WAAWS,UACVX,MAAME,WAAWE,OAAO3B,mBAAmBuB,MAAME,WAAWE,IAAI,IAAIW,KAAAA;IAEzEf,MAAME,WAAWc,KAAKd,WAAWc;IACjCd,aAAa,MAAM,KAAKjB,eAAe4B,KAAK,KAAK5B,eAAegC,OAAOjB,MAAME,UAAU,CAAA;IACvF;EACR;OACG;GACH,IAAI,CAACF,MAAME,WAAWS,SAASX,MAAME,WAAWE,MAC5CJ,MAAME,WAAWS,QAAQlC,mBAAmBuB,MAAME,WAAWE,IAAI;GAGrEF,aAAa,MAAM,KAAKjB,eAAe4B,KAAK,KAAK5B,eAAegC,OAAOjB,MAAME,UAAU,CAAA;EAC3F;EAGA,MAAMgB,cAA6B,CAAA,GAC5B,MAAM,KAAK/B,mBAAmBgC,cAC7BnB,MAAMoB,aAAapB,MAAMoB,UAAUC,iBAAiB,GAAA,GAEpDnB,WAAWG,WACX,MAAM,KAAKlB,mBAAmBmC,aAC1BtB,MAAMoB,aAAapB,MAAMoB,UAAUG,kBACnCrB,WAAWG,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIL,MAAMoB,aAAapB,MAAMoB,UAAUI,mBAAmB;GACtD,MAAMC,aAAaC,OAAOC,KAAK3B,MAAMoB,UAAUI,iBAAiB;GAChE,KAAK,MAAMI,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK3C,iBAAiBiB,UAAU;KACjDC,MAAMwB;KACNvB,UAAUH,WAAWG;IACzB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK3C,mBAAmB4C,cAC3C/B,MAAMoB,UAAUI,kBAAkBI,YAClC1B,WAAWG,UACXwB,OAAOb,EAAE;KAEbE,YAAYc,KAAI,GAAIF,QAAAA;IACxB;GACJ;EACJ;EAEA,IAAIZ,YAAYe,SAAS,GACrB,MAAM,KAAK5C,mBAAmBU,YAC1BG,YACAgB,aACA,iBACA,qBAAA;EAKR,MAAMgB,QAAiB,CAAA,GAChB,MAAM,KAAK9C,aAAa+B,cACvBnB,MAAMoB,aAAapB,MAAMoB,UAAUe,WAAW,GAAA,GAE9CjC,WAAWG,WACX,MAAM,KAAKjB,aAAakC,aACpBtB,MAAMoB,aAAapB,MAAMoB,UAAUgB,YACnClC,WAAWG,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIL,MAAMoB,aAAapB,MAAMoB,UAAUiB,aAAa;GAChD,MAAMZ,aAAaC,OAAOC,KAAK3B,MAAMoB,UAAUiB,WAAW;GAC1D,KAAK,MAAMT,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK3C,iBAAiBiB,UAAU;KACjDC,MAAMwB;KACNvB,UAAUH,WAAWG;IACzB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK1C,aAAa2C,cACrC/B,MAAMoB,UAAUiB,YAAYT,YAC5B1B,WAAWG,UACXwB,OAAOb,EAAE;KAEbkB,MAAMF,KAAI,GAAIF,QAAAA;IAClB;GACJ;EACJ;EAEA,IAAII,MAAMD,SAAS,GACf,MAAM,KAAK3C,aAAaS,YACpBG,YACAgC,OACA,WACA,eAAA;EAIR,OAAO;GACH,GAAGlC;GACHE;EACJ;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["buildUserFakeEmail","pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","UserProvisioningSynchronizer","userRepository","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","userPermissionRepository","ownerKey","ownerRealmKey","userRoleRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","includes","email","merge","save","REPLACE","undefined","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","clientPermissions","clientKeys","Object","keys","clientKey","client","entities","resolveClient","push","length","roles","globalRoles","realmRoles","clientRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n Permission, \n Role, \n UserPermission, \n UserRole,\n} from '@authup/core-kit';\nimport { buildUserFakeEmail } from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type {\n IClientRepository,\n IUserRepository,\n} from '../../../entities/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { UserProvisioningSynchronizerContext } from './types.ts';\n\nexport class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {\n protected userRepository: IUserRepository;\n\n protected clientRepository: IClientRepository;\n\n protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n protected roleResolver: ProvisioningEntityResolver<Role>;\n\n protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;\n\n protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;\n\n constructor(ctx: UserProvisioningSynchronizerContext) {\n super();\n\n this.userRepository = ctx.userRepository;\n this.clientRepository = ctx.clientRepository;\n\n this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n this.permissionJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.userPermissionRepository,\n ownerKey: 'user_id',\n ownerRealmKey: 'user_realm_id',\n });\n this.roleJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.userRoleRepository,\n ownerKey: 'user_id',\n ownerRealmKey: 'user_realm_id',\n });\n }\n\n async synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n let attributes = await this.userRepository.findOneBy({\n name: input.attributes.name,\n realm_id: input.attributes.realm_id \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.userRepository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n if (\n strategy.attributes &&\n strategy.attributes.includes('email')\n ) {\n input.attributes.email = input.attributes.email \|\|\n attributes.email \|\|\n buildUserFakeEmail(input.attributes.name \|\| attributes.name);\n }\n\n attributes = this.userRepository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.userRepository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.email = input.attributes.email \|\|\n attributes.email \|\|\n (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);\n\n input.attributes.id = attributes.id;\n attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n break;\n }\n } else {\n if (!input.attributes.email && input.attributes.name) {\n input.attributes.email = buildUserFakeEmail(input.attributes.name);\n }\n\n attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n }\n\n // Permissions (Global, Realm & Client)\n const permissions : Permission[] = [\n ...await this.permissionResolver.resolveGlobal(\n input.relations && input.relations.globalPermissions,\n ),\n ...(attributes.realm_id ?\n await this.permissionResolver.resolveRealm(\n input.relations && input.relations.realmPermissions,\n attributes.realm_id,\n ) :\n []),\n ];\n\n if (input.relations && input.relations.clientPermissions) {\n const clientKeys = Object.keys(input.relations.clientPermissions);\n for (const clientKey of clientKeys) {\n const client = await this.clientRepository.findOneBy({\n name: clientKey,\n realm_id: attributes.realm_id,\n });\n\n if (client) {\n const entities = await this.permissionResolver.resolveClient(\n input.relations.clientPermissions[clientKey],\n attributes.realm_id,\n client.id,\n );\n permissions.push(...entities);\n }\n }\n }\n\n if (permissions.length > 0) {\n await this.permissionJunction.synchronize(\n attributes,\n permissions,\n 'permission_id',\n 'permission_realm_id',\n );\n }\n\n // Roles (Global, Realm & Client)\n const roles : Role[] = [\n ...await this.roleResolver.resolveGlobal(\n input.relations && input.relations.globalRoles,\n ),\n ...(attributes.realm_id ?\n await this.roleResolver.resolveRealm(\n input.relations && input.relations.realmRoles,\n attributes.realm_id,\n ) :\n []),\n ];\n\n if (input.relations && input.relations.clientRoles) {\n const clientKeys = Object.keys(input.relations.clientRoles);\n for (const clientKey of clientKeys) {\n const client = await this.clientRepository.findOneBy({\n name: clientKey,\n realm_id: attributes.realm_id,\n });\n\n if (client) {\n const entities = await this.roleResolver.resolveClient(\n input.relations.clientRoles[clientKey],\n attributes.realm_id,\n client.id,\n );\n roles.push(...entities);\n }\n }\n }\n\n if (roles.length > 0) {\n await this.roleJunction.synchronize(\n attributes,\n roles,\n 'role_id',\n 'role_realm_id',\n );\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAaO,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKN,iBAAiBM,IAAIN;EAC1B,KAAKC,mBAAmBK,IAAIL;EAE5B,KAAKC,qBAAqB,IAAIL,2BAA2BS,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIN,2BAA2BS,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIN,iCAAiC;GAC3DW,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIP,iCAAiC;GACrDW,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWvB,oCAAoCoB,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKjB,eAAemB,UAAU;GACjDC,MAAML,MAAME,WAAWG;GACvBC,UAAUN,MAAME,WAAWI,YAAY;EAC3C,CAAA;EAEA,IAAIH,SAASI,SAAS5B,+BAA+B6B,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKjB,eAAewB,OAAOP,UAAAA;GAErC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAK5B,+BAA+B+B;IAChC,IACIP,SAASD,cACTC,SAASD,WAAWS,SAAS,OAAA,GAE7BX,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,SACXnC,mBAAmBuB,MAAME,WAAWG,QAAQH,WAAWG,IAAI;IAGnEH,aAAa,KAAKjB,eAAe4B,MAC7BX,YACAC,SAASD,aACLxB,WAAWsB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKjB,eAAe6B,KAAKZ,UAAAA;IAC5C;GACJ,KAAKvB,+BAA+BoC;IAChCf,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,UACVZ,MAAME,WAAWG,OAAO5B,mBAAmBuB,MAAME,WAAWG,IAAI,IAAIW,KAAAA;IAEzEhB,MAAME,WAAWe,KAAKf,WAAWe;IACjCf,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;IACvF;EACR;OACG;GACH,IAAI,CAACF,MAAME,WAAWU,SAASZ,MAAME,WAAWG,MAC5CL,MAAME,WAAWU,QAAQnC,mBAAmBuB,MAAME,WAAWG,IAAI;GAGrEH,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;EAC3F;EAGA,MAAMiB,cAA6B,CAAA,GAC5B,MAAM,KAAKhC,mBAAmBiC,cAC7BpB,MAAMqB,aAAarB,MAAMqB,UAAUC,iBAAiB,GAAA,GAEpDpB,WAAWI,WACX,MAAM,KAAKnB,mBAAmBoC,aAC1BvB,MAAMqB,aAAarB,MAAMqB,UAAUG,kBACnCtB,WAAWI,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUI,mBAAmB;GACtD,MAAMC,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUI,iBAAiB;GAChE,KAAK,MAAMI,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,UAAUJ,WAAWI;IACzB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK5C,mBAAmB6C,cAC3ChC,MAAMqB,UAAUI,kBAAkBI,YAClC3B,WAAWI,UACXwB,OAAOb,EAAE;KAEbE,YAAYc,KAAI,GAAIF,QAAAA;IACxB;GACJ;EACJ;EAEA,IAAIZ,YAAYe,SAAS,GACrB,MAAM,KAAK7C,mBAAmBU,YAC1BG,YACAiB,aACA,iBACA,qBAAA;EAKR,MAAMgB,QAAiB,CAAA,GAChB,MAAM,KAAK/C,aAAagC,cACvBpB,MAAMqB,aAAarB,MAAMqB,UAAUe,WAAW,GAAA,GAE9ClC,WAAWI,WACX,MAAM,KAAKlB,aAAamC,aACpBvB,MAAMqB,aAAarB,MAAMqB,UAAUgB,YACnCnC,WAAWI,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUiB,aAAa;GAChD,MAAMZ,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUiB,WAAW;GAC1D,KAAK,MAAMT,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,UAAUJ,WAAWI;IACzB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK3C,aAAa4C,cACrChC,MAAMqB,UAAUiB,YAAYT,YAC5B3B,WAAWI,UACXwB,OAAOb,EAAE;KAEbkB,MAAMF,KAAI,GAAIF,QAAAA;IAClB;GACJ;EACJ;EAEA,IAAII,MAAMD,SAAS,GACf,MAAM,KAAK5C,aAAaS,YACpBG,YACAiC,OACA,WACA,eAAA;EAIR,OAAO;GACH,GAAGnC;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/security/policy/evaluator.d.ts CHANGED Viewed

@@ -1,13 +1,13 @@
-import type { IPolicyEvaluator, PermissionPolicyBinding, PolicyEvaluationContext, PolicyEvaluationResult } from '@authup/access';
-import { AttributesPolicyEvaluator, IdentityPolicyEvaluator, PermissionBindingPolicyValidator } from '@authup/access';
+import type { IPolicyEvaluator, PermissionPolicyBindingAggregated, PolicyEvaluationContext, PolicyEvaluationResult } from '@authup/access';
+import { IdentityPolicyEvaluator, PermissionBindingPolicyValidator, RealmMatchPolicyEvaluator } from '@authup/access';
 import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
 export declare class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {
     protected validator: PermissionBindingPolicyValidator;
     protected identityEvaluator: IdentityPolicyEvaluator;
-    protected attributesEvaluator: AttributesPolicyEvaluator;
+    protected realmMatchEvaluator: RealmMatchPolicyEvaluator;
     protected identityPermissionProvider: IIdentityPermissionProvider;
     constructor(identityPermissionProvider: IIdentityPermissionProvider);
-    accessData(ctx: PolicyEvaluationContext): Promise<PermissionPolicyBinding | null>;
+    accessData(ctx: PolicyEvaluationContext): Promise<PermissionPolicyBindingAggregated | null>;
     evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }
 //# sourceMappingURL=evaluator.d.ts.map

package/dist/core/security/policy/evaluator.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/core/security/policy/evaluator.ts"],"names":[],"mappings":"~~AAOA~~,OAAO,KAAK,~~EAGR~~,gBAAgB,EAChB,~~uBAAuB~~,~~EACvB~~,uBAAuB,EACvB,sBAAsB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,~~EACH~~,~~yBAAyB,EAEzB,~~uBAAuB,EACvB,gCAAgC,~~EAMnC~~,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,qBAAa,gCAAiC,YAAW,gBAAgB;IACrE,SAAS,CAAC,SAAS,EAAG,gCAAgC,CAAC;IAEvD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,0BAA0B,EAAE,2BAA2B;IAO7D,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,~~uBAAuB~~,GAAG,IAAI,CAAC;~~IAiBlF~~,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;~~CA+E5G~~"}
1	+ {"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/core/security/policy/evaluator.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,gBAAgB,EAChB,iCAAiC,EACjC,uBAAuB,EACvB,sBAAsB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEH,uBAAuB,EACvB,gCAAgC,EAGhC,yBAAyB,EAI5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,qBAAa,gCAAiC,YAAW,gBAAgB;IACrE,SAAS,CAAC,SAAS,EAAG,gCAAgC,CAAC;IAEvD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,0BAA0B,EAAE,2BAA2B;IAO7D,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAiB5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA2G5G"}

package/dist/core/security/policy/evaluator.mjs CHANGED Viewed

@@ -1,17 +1,17 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { AttributesPolicyEvaluator, BuiltInPolicyType, IdentityPolicyEvaluator, PermissionBindingPolicyValidator, PolicyEngine, PolicyIssueCode, definePolicyIssueItem, maybeInvertPolicyOutcome, mergePermissionPolicyBindings } from "@authup/access";
+import { BuiltInPolicyType, IdentityPolicyEvaluator, PermissionBindingPolicyValidator, PolicyEngine, PolicyIssueCode, RealmMatchPolicyEvaluator, aggregatePermissionPolicyBindings, definePolicyIssueItem, maybeInvertPolicyOutcome } from "@authup/access";
 //#region src/core/security/policy/evaluator.ts
 var PermissionBindingPolicyEvaluator = class {
 	validator;
 	identityEvaluator;
-	attributesEvaluator;
+	realmMatchEvaluator;
 	identityPermissionProvider;
 	constructor(identityPermissionProvider) {
 		this.validator = new PermissionBindingPolicyValidator();
 		this.identityEvaluator = new IdentityPolicyEvaluator();
-		this.attributesEvaluator = new AttributesPolicyEvaluator();
+		this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();
 		this.identityPermissionProvider = identityPermissionProvider;
 	}
 	async accessData(ctx) {
@@ -47,22 +47,23 @@ var PermissionBindingPolicyEvaluator = class {
 			return (binding.permission.realm_id ?? null) === (item.permission.realm_id ?? null) && (binding.permission.client_id ?? null) === (item.permission.client_id ?? null);
 		}));
 		if (identityBindings.length === 0) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
-		const bindingsMerged = mergePermissionPolicyBindings(identityBindings);
-		if (bindingsMerged.length === 0) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
-		const policies = bindingsMerged.flatMap((b) => b.policies || []);
-		if (policies.length === 0) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
-		if (!ctx.evaluators) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
-		const compositePolicy = {
-			children: policies,
-			type: BuiltInPolicyType.COMPOSITE
-		};
-		const outcome = await new PolicyEngine(ctx.evaluators).evaluate(compositePolicy, {
-			...ctx,
-			path: [...ctx.path || [], ...compositePolicy.type ? [compositePolicy.type] : []]
-		});
+		const [aggr] = aggregatePermissionPolicyBindings(identityBindings);
+		if (!aggr) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+		const issues = [];
+		for (const grant of aggr.grants) {
+			if (!(await this.realmMatchEvaluator.evaluate({ scope: grant.realm_scope }, ctx)).success) continue;
+			if (!grant.policy) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+			const outcome = await new PolicyEngine(ctx.evaluators).evaluate(grant.policy, {
+				...ctx,
+				path: [...ctx.path || []]
+			});
+			if (outcome.success) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+			if (outcome.issues) issues.push(...outcome.issues);
+		}
+		const success = maybeInvertPolicyOutcome(false, policy.invert);
 		return {
-			...outcome,
-			success: maybeInvertPolicyOutcome(outcome.success, policy.invert)
+			success,
+			issues: success ? [] : issues
 		};
 	}
 };

package/dist/core/security/policy/evaluator.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"evaluator.mjs","names":["AttributesPolicyEvaluator","BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","definePolicyIssueItem","maybeInvertPolicyOutcome","mergePermissionPolicyBindings","PermissionBindingPolicyEvaluator","validator","identityEvaluator","attributesEvaluator","identityPermissionProvider","accessData","ctx","data","has","PERMISSION_BINDING","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realm_id","client_id","length","invert","bindingsMerged","policies","flatMap","b","evaluators","compositePolicy","children","type","COMPOSITE","engine","outcome"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/\n Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n BasePolicy,\n CompositePolicy,\n IPolicyEvaluator,\n PermissionPolicyBinding,\n PolicyEvaluationContext,\n PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n AttributesPolicyEvaluator,\n BuiltInPolicyType,\n IdentityPolicyEvaluator,\n PermissionBindingPolicyValidator,\n PolicyEngine,\n PolicyIssueCode,\n definePolicyIssueItem,\n maybeInvertPolicyOutcome,\n mergePermissionPolicyBindings,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n protected validator : PermissionBindingPolicyValidator;\n\n protected identityEvaluator: IdentityPolicyEvaluator;\n\n protected attributesEvaluator : AttributesPolicyEvaluator;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n this.validator = new PermissionBindingPolicyValidator();\n this.identityEvaluator = new IdentityPolicyEvaluator();\n this.attributesEvaluator = new AttributesPolicyEvaluator();\n this.identityPermissionProvider = identityPermissionProvider;\n }\n\n async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBinding \| null> {\n if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n return null;\n }\n\n if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n }\n\n const data = ctx.data.get<PermissionPolicyBinding>(BuiltInPolicyType.PERMISSION_BINDING);\n\n ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n return data;\n }\n\n async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n const policy = await this.validator.run(value);\n\n const identity = await this.identityEvaluator.accessData(ctx);\n if (!identity) {\n return {\n success: false,\n issues: [\n definePolicyIssueItem({\n code: PolicyIssueCode.DATA_MISSING,\n message: 'The data property identity is missing',\n path: ctx.path,\n }),\n ],\n };\n }\n const binding = await this.accessData(ctx);\n if (!binding) {\n return {\n success: false,\n issues: [\n definePolicyIssueItem({\n code: PolicyIssueCode.DATA_MISSING,\n message: 'The data property permission is missing',\n path: ctx.path,\n }),\n ],\n };\n }\n\n const identityBindings = await this.identityPermissionProvider.getFor(identity)\n .then((bindings) => bindings.filter((item) => {\n if (item.permission.name !== binding.permission.name) {\n return false;\n }\n\n return (binding.permission.realm_id ?? null) === (item.permission.realm_id ?? null) &&\n (binding.permission.client_id ?? null) === (item.permission.client_id ?? null);\n }));\n\n if (identityBindings.length === 0) {\n return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n }\n\n const bindingsMerged = mergePermissionPolicyBindings(identityBindings);\n if (bindingsMerged.length === 0) {\n return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n }\n\n const policies : BasePolicy[] = bindingsMerged\n .flatMap((b) => b.policies \|\| []);\n\n if (policies.length === 0) {\n return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n }\n\n if (!ctx.evaluators) {\n return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n }\n\n const compositePolicy : CompositePolicy = {\n children: policies,\n type: BuiltInPolicyType.COMPOSITE,\n };\n\n const engine = new PolicyEngine(ctx.evaluators);\n const outcome = await engine.evaluate(compositePolicy, {\n ...ctx,\n path: [\n ...(ctx.path \|\| []),\n ...(compositePolicy.type ? [compositePolicy.type] : []),\n ],\n });\n\n return {\n ...outcome,\n success: maybeInvertPolicyOutcome(outcome.success, policy.invert),\n };\n }\n}\n"],"mappings":";;;;;AA4BA,IAAaS,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;EACjE,KAAKH,YAAY,IAAIP,iCAAAA;EACrB,KAAKQ,oBAAoB,IAAIT,wBAAAA;EAC7B,KAAKU,sBAAsB,IAAIZ,0BAAAA;EAC/B,KAAKa,6BAA6BA;CACtC;CAEA,MAAMC,WAAWC,KAAwE;EACrF,IAAI,CAACA,IAAIC,KAAKC,IAAIhB,kBAAkBiB,kBAAkB,GAClD,OAAO;EAGX,IAAIH,IAAIC,KAAKG,YAAYlB,kBAAkBiB,kBAAkB,GACzD,OAAOH,IAAIC,KAAKI,IAAInB,kBAAkBiB,kBAAkB;EAG5D,MAAMF,OAAOD,IAAIC,KAAKI,IAA6BnB,kBAAkBiB,kBAAkB;EAEvFH,IAAIC,KAAKK,IAAIpB,kBAAkBiB,oBAAoBF,IAAAA;EACnDD,IAAIC,KAAKM,aAAarB,kBAAkBiB,kBAAkB;EAE1D,OAAOF;CACX;CAEA,MAAMO,SAASC,OAA4BT,KAA+D;EACtG,MAAMU,SAAS,MAAM,KAAKf,UAAUgB,IAAIF,KAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKhB,kBAAkBG,WAAWC,GAAAA;EACzD,IAAI,CAACY,UACD,OAAO;GACHC,SAAS;GACTC,QAAQ,CACJvB,sBAAsB;IAClBwB,MAAMzB,gBAAgB0B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;GACd,CAAA,CAAA;EAER;EAEJ,MAAMC,UAAU,MAAM,KAAKpB,WAAWC,GAAAA;EACtC,IAAI,CAACmB,SACD,OAAO;GACHN,SAAS;GACTC,QAAQ,CACJvB,sBAAsB;IAClBwB,MAAMzB,gBAAgB0B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;GACd,CAAA,CAAA;EAER;EAGJ,MAAME,mBAAmB,MAAM,KAAKtB,2BAA2BuB,OAAOT,QAAAA,CAAAA,CACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;GACjC,IAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,MAC5C,OAAO;GAGX,QAAQR,QAAQO,WAAWE,YAAY,WAAWH,KAAKC,WAAWE,YAAY,UACzET,QAAQO,WAAWG,aAAa,WAAWJ,KAAKC,WAAWG,aAAa;EACjF,CAAA,CAAA;EAEJ,IAAIT,iBAAiBU,WAAW,GAC5B,OAAO,EAAEjB,SAASrB,yBAAyB,OAAOkB,OAAOqB,MAAM,EAAE;EAGrE,MAAMC,iBAAiBvC,8BAA8B2B,gBAAAA;EACrD,IAAIY,eAAeF,WAAW,GAC1B,OAAO,EAAEjB,SAASrB,yBAAyB,OAAOkB,OAAOqB,MAAM,EAAE;EAGrE,MAAME,WAA0BD,eAC3BE,SAASC,MAAMA,EAAEF,YAAY,CAAA,CAAE;EAEpC,IAAIA,SAASH,WAAW,GACpB,OAAO,EAAEjB,SAASrB,yBAAyB,MAAMkB,OAAOqB,MAAM,EAAE;EAGpE,IAAI,CAAC/B,IAAIoC,YACL,OAAO,EAAEvB,SAASrB,yBAAyB,OAAOkB,OAAOqB,MAAM,EAAE;EAGrE,MAAMM,kBAAoC;GACtCC,UAAUL;GACVM,MAAMrD,kBAAkBsD;EAC5B;EAGA,MAAME,UAAU,MAAMD,IADHpD,aAAaW,IAAIoC,UACdK,CAAAA,CAAOjC,SAAS6B,iBAAiB;GACnD,GAAGrC;GACHkB,MAAM,CAAA,GACElB,IAAIkB,QAAQ,CAAA,GAAA,GACZmB,gBAAgBE,OAAO,CAACF,gBAAgBE,IAAAA,IAAQ,CAAA,CAAA;EAE5D,CAAA;EAEA,OAAO;GACH,GAAGG;GACH7B,SAASrB,yBAAyBkD,QAAQ7B,SAASH,OAAOqB,MAAM;EACpE;CACJ;AACJ"}
1	+ {"version":3,"file":"evaluator.mjs","names":["BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","RealmMatchPolicyEvaluator","aggregatePermissionPolicyBindings","definePolicyIssueItem","maybeInvertPolicyOutcome","PermissionBindingPolicyEvaluator","validator","identityEvaluator","realmMatchEvaluator","identityPermissionProvider","accessData","ctx","data","has","PERMISSION_BINDING","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realm_id","client_id","length","invert","aggr","grant","grants","realmOutcome","scope","realm_scope","engine","evaluators","outcome","push"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/\n Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Issue } from 'validup';\nimport type {\n IPolicyEvaluator,\n PermissionPolicyBindingAggregated,\n PolicyEvaluationContext,\n PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n BuiltInPolicyType,\n IdentityPolicyEvaluator,\n PermissionBindingPolicyValidator,\n PolicyEngine,\n PolicyIssueCode,\n RealmMatchPolicyEvaluator,\n aggregatePermissionPolicyBindings,\n definePolicyIssueItem,\n maybeInvertPolicyOutcome,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n protected validator : PermissionBindingPolicyValidator;\n\n protected identityEvaluator: IdentityPolicyEvaluator;\n\n protected realmMatchEvaluator : RealmMatchPolicyEvaluator;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n this.validator = new PermissionBindingPolicyValidator();\n this.identityEvaluator = new IdentityPolicyEvaluator();\n this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();\n this.identityPermissionProvider = identityPermissionProvider;\n }\n\n async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBindingAggregated \| null> {\n if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n return null;\n }\n\n if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n }\n\n const data = ctx.data.get<PermissionPolicyBindingAggregated>(BuiltInPolicyType.PERMISSION_BINDING);\n\n ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n return data;\n }\n\n async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n const policy = await this.validator.run(value);\n\n const identity = await this.identityEvaluator.accessData(ctx);\n if (!identity) {\n return {\n success: false,\n issues: [\n definePolicyIssueItem({\n code: PolicyIssueCode.DATA_MISSING,\n message: 'The data property identity is missing',\n path: ctx.path,\n }),\n ],\n };\n }\n const binding = await this.accessData(ctx);\n if (!binding) {\n return {\n success: false,\n issues: [\n definePolicyIssueItem({\n code: PolicyIssueCode.DATA_MISSING,\n message: 'The data property permission is missing',\n path: ctx.path,\n }),\n ],\n };\n }\n\n const identityBindings = await this.identityPermissionProvider.getFor(identity)\n .then((bindings) => bindings.filter((item) => {\n if (item.permission.name !== binding.permission.name) {\n return false;\n }\n\n return (binding.permission.realm_id ?? null) === (item.permission.realm_id ?? null) &&\n (binding.permission.client_id ?? null) === (item.permission.client_id ?? null);\n }));\n\n if (identityBindings.length === 0) {\n return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n }\n\n const [aggr] = aggregatePermissionPolicyBindings(identityBindings);\n if (!aggr) {\n return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n }\n\n // identityBindings is filtered to a single (name, realm_id, client_id) key, so the\n // aggregate yields exactly one entry whose `grants` are the actor's per-grant\n // (realm_scope, policy) disjunction terms; access is the DISJUNCTION over them:\n // ∃ grant . realmScopeMatches(grant.realm_scope, resource) ∧ (grant.policy passes)\n // Pairing each grant's realm reach with its OWN policy is what fixes both the mixed\n // policy-free + policy-bound UNDER-grant (a policy-free `own` grant must not mask a\n // policy-bound `any` grant's wider reach) and the symmetric OVER-grant (an `own`\n // grant's passing policy must not ride an `any` grant's wider reach).\n const issues : Issue[] = [];\n for (const grant of aggr.grants) {\n // Realm reach (coarse, actor-relative) — a SEPARATE factor from the grant's\n // policy, ANDed with it. The realm-match evaluator runs in SCOPE MODE: it reads the\n // resource realm from ctx.data[REALM_MATCH] (fallback ATTRIBUTES.realm_id) and\n // neutral-passes when absent (preEvaluate / gate checks / realm-less resources) —\n // key-PRESENCE is the discriminator. Invoked DIRECTLY (not via PolicyEngine —\n // REALM_MATCH is in policiesExcluded, so the engine would skip it).\n const realmOutcome = await this.realmMatchEvaluator.evaluate(\n { scope: grant.realm_scope },\n ctx,\n );\n if (!realmOutcome.success) {\n continue;\n }\n\n if (!grant.policy) {\n // Reach matches and this grant carries no further restriction.\n return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n }\n\n // Missing evaluators is a misconfiguration: let the engine fail CLOSED with a\n // surfaced POLICY_EVALUATOR_NOT_FOUND issue (new PolicyEngine(undefined) defaults\n // to an empty registry, so grant.policy resolves to no evaluator) rather than\n // swallowing the grant with a silent issue-less deny.\n const engine = new PolicyEngine(ctx.evaluators);\n const outcome = await engine.evaluate(grant.policy, {\n ...ctx,\n path: [\n ...(ctx.path \|\| []),\n ],\n });\n\n if (outcome.success) {\n return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n }\n\n if (outcome.issues) {\n issues.push(...outcome.issues);\n }\n }\n\n // No grant term satisfied (reach ∧ policies). Apply `invert` ONCE to the aggregated\n // disjunction outcome — never per term, which would corrupt the quantifier.\n const success = maybeInvertPolicyOutcome(false, policy.invert);\n return {\n success,\n issues: success ? [] : issues,\n };\n }\n}\n"],"mappings":";;;;;AA2BA,IAAaS,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;EACjE,KAAKH,YAAY,IAAIR,iCAAAA;EACrB,KAAKS,oBAAoB,IAAIV,wBAAAA;EAC7B,KAAKW,sBAAsB,IAAIP,0BAAAA;EAC/B,KAAKQ,6BAA6BA;CACtC;CAEA,MAAMC,WAAWC,KAAkF;EAC/F,IAAI,CAACA,IAAIC,KAAKC,IAAIjB,kBAAkBkB,kBAAkB,GAClD,OAAO;EAGX,IAAIH,IAAIC,KAAKG,YAAYnB,kBAAkBkB,kBAAkB,GACzD,OAAOH,IAAIC,KAAKI,IAAIpB,kBAAkBkB,kBAAkB;EAG5D,MAAMF,OAAOD,IAAIC,KAAKI,IAAuCpB,kBAAkBkB,kBAAkB;EAEjGH,IAAIC,KAAKK,IAAIrB,kBAAkBkB,oBAAoBF,IAAAA;EACnDD,IAAIC,KAAKM,aAAatB,kBAAkBkB,kBAAkB;EAE1D,OAAOF;CACX;CAEA,MAAMO,SAASC,OAA4BT,KAA+D;EACtG,MAAMU,SAAS,MAAM,KAAKf,UAAUgB,IAAIF,KAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKhB,kBAAkBG,WAAWC,GAAAA;EACzD,IAAI,CAACY,UACD,OAAO;GACHC,SAAS;GACTC,QAAQ,CACJtB,sBAAsB;IAClBuB,MAAM1B,gBAAgB2B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;GACd,CAAA,CAAA;EAER;EAEJ,MAAMC,UAAU,MAAM,KAAKpB,WAAWC,GAAAA;EACtC,IAAI,CAACmB,SACD,OAAO;GACHN,SAAS;GACTC,QAAQ,CACJtB,sBAAsB;IAClBuB,MAAM1B,gBAAgB2B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;GACd,CAAA,CAAA;EAER;EAGJ,MAAME,mBAAmB,MAAM,KAAKtB,2BAA2BuB,OAAOT,QAAAA,CAAAA,CACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;GACjC,IAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,MAC5C,OAAO;GAGX,QAAQR,QAAQO,WAAWE,YAAY,WAAWH,KAAKC,WAAWE,YAAY,UACzET,QAAQO,WAAWG,aAAa,WAAWJ,KAAKC,WAAWG,aAAa;EACjF,CAAA,CAAA;EAEJ,IAAIT,iBAAiBU,WAAW,GAC5B,OAAO,EAAEjB,SAASpB,yBAAyB,OAAOiB,OAAOqB,MAAM,EAAE;EAGrE,MAAM,CAACC,QAAQzC,kCAAkC6B,gBAAAA;EACjD,IAAI,CAACY,MACD,OAAO,EAAEnB,SAASpB,yBAAyB,OAAOiB,OAAOqB,MAAM,EAAE;EAWrE,MAAMjB,SAAmB,CAAA;EACzB,KAAK,MAAMmB,SAASD,KAAKE,QAAQ;GAW7B,IAAI,EAACC,MAJsB,KAAKtC,oBAAoBW,SAChD,EAAE4B,OAAOH,MAAMI,YAAY,GAC3BrC,GAAAA,EAAAA,CAEca,SACd;GAGJ,IAAI,CAACoB,MAAMvB,QAEP,OAAO,EAAEG,SAASpB,yBAAyB,MAAMiB,OAAOqB,MAAM,EAAE;GAQpE,MAAMS,UAAU,MAAMF,IADHlD,aAAaY,IAAIuC,UACdD,CAAAA,CAAO9B,SAASyB,MAAMvB,QAAQ;IAChD,GAAGV;IACHkB,MAAM,CAAA,GACElB,IAAIkB,QAAQ,CAAA,CAAA;GAExB,CAAA;GAEA,IAAIsB,QAAQ3B,SACR,OAAO,EAAEA,SAASpB,yBAAyB,MAAMiB,OAAOqB,MAAM,EAAE;GAGpE,IAAIS,QAAQ1B,QACRA,OAAO2B,KAAI,GAAID,QAAQ1B,MAAM;EAErC;EAIA,MAAMD,UAAUpB,yBAAyB,OAAOiB,OAAOqB,MAAM;EAC7D,OAAO;GACHlB;GACAC,QAAQD,UAAU,CAAA,IAAKC;EAC3B;CACJ;AACJ"}

package/dist/index.mjs CHANGED Viewed

@@ -50,6 +50,7 @@ import { IdentityProviderRoleSubscriber } from "./adapters/database/domains/iden
 import { RobotEntity } from "./adapters/database/domains/robot/entity.mjs";
 import { RobotSubscriber } from "./adapters/database/domains/robot/subscriber.mjs";
 import { SessionEntity } from "./adapters/database/domains/session/entity.mjs";
+import { SessionTokenEntity } from "./adapters/database/domains/session-token/entity.mjs";
 import { PermissionPolicyEntity } from "./adapters/database/domains/permission-policy/entity.mjs";
 import { RobotPermissionEntity } from "./adapters/database/domains/robot-permission/entity.mjs";
 import { RobotPermissionSubscriber } from "./adapters/database/domains/robot-permission/subscriber.mjs";
@@ -104,7 +105,7 @@ import { ComponentsModule } from "./app/modules/components/module.mjs";
 import { HTTPInjectionKey } from "./app/modules/http/constants.mjs";
 import { RequestHandlerOperation } from "./adapters/http/request/constants.mjs";
 import { setRequestPermissionEvaluator, useRequestPermissionEvaluator } from "./adapters/http/request/permission/helper.mjs";
-import { RequestIdentity, isRequestIdentityMasterRealmMember, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./adapters/http/request/helpers/identity.mjs";
+import { RequestIdentity, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./adapters/http/request/helpers/identity.mjs";
 import { buildActorContext } from "./adapters/http/request/helpers/actor.mjs";
 import { getBodyRealmID } from "./adapters/http/request/helpers/body-realm-id.mjs";
 import { LOCALE_COOKIE, useRequestLocale } from "./adapters/http/request/helpers/locale.mjs";
@@ -113,17 +114,9 @@ import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail,
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./adapters/http/request/helpers/realm-id.mjs";
 import { sanitizeRelativeRedirect } from "./adapters/http/request/helpers/redirect.mjs";
 import { setRequestScopes, useRequestScopes } from "./adapters/http/request/helpers/scopes.mjs";
+import { setRequestSessionId, useRequestSessionId } from "./adapters/http/request/helpers/session-id.mjs";
 import { setRequestToken, useRequestToken } from "./adapters/http/request/helpers/token.mjs";
 import { RequestPermissionEvaluator } from "./adapters/http/request/permission/module.mjs";
-import { HTTPOAuth2Authorizer } from "./adapters/http/adapters/oauth2/authorization/module.mjs";
-import { extractClientCredentialsFromRequest } from "./adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs";
-import { guessOauth2GrantTypeByRequest } from "./adapters/http/adapters/oauth2/grant-types/utils/guess.mjs";
-import { HTTPOAuth2AuthorizeGrant } from "./adapters/http/adapters/oauth2/grant-types/authorize.mjs";
-import { HTTPClientCredentialsGrant } from "./adapters/http/adapters/oauth2/grant-types/client-credentials.mjs";
-import { HTTPOAuth2IdentityGrantType } from "./adapters/http/adapters/oauth2/grant-types/identity.mjs";
-import { HTTPPasswordGrant } from "./adapters/http/adapters/oauth2/grant-types/password.mjs";
-import { HTTPOAuth2RefreshTokenGrant } from "./adapters/http/adapters/oauth2/grant-types/refresh_token.mjs";
-import { HTTPRobotCredentialsGrant } from "./adapters/http/adapters/oauth2/grant-types/robot-credentials.mjs";
 import { AuthorizationMiddleware } from "./adapters/http/middleware/built-in/authorization/module.mjs";
 import { createAuthorizationMiddleware } from "./adapters/http/middleware/built-in/authorization/factory.mjs";
 import { ForceLoggedInMiddleware } from "./adapters/http/middleware/built-in/loggedin/module.mjs";
@@ -134,11 +127,21 @@ import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./adapters/http
 import { registerBasicMiddleware } from "./adapters/http/middleware/built-in/basic.mjs";
 import { registerCorsMiddleware } from "./adapters/http/middleware/built-in/cors.mjs";
 import { registerErrorMiddleware } from "./adapters/http/middleware/built-in/error.mjs";
-import { createLoggerMiddleware } from "./adapters/http/middleware/built-in/logger.mjs";
+import { createLoggerMiddleware, redactSensitiveURLParams } from "./adapters/http/middleware/built-in/logger.mjs";
 import { registerPrometheusMiddleware } from "./adapters/http/middleware/built-in/prometheus.mjs";
 import { registerRateLimitMiddleware } from "./adapters/http/middleware/built-in/rate-limit.mjs";
 import { createSwaggerMiddleware } from "./adapters/http/middleware/built-in/swagger.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./adapters/http/middleware/built-in/ui-http-client.mjs";
+import { HTTPOAuth2Authorizer } from "./adapters/http/adapters/oauth2/authorization/module.mjs";
+import { extractClientCredentialsFromRequest, readStringField } from "./adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs";
+import { guessOauth2GrantTypeByRequest } from "./adapters/http/adapters/oauth2/grant-types/utils/guess.mjs";
+import { readRealmHint } from "./adapters/http/adapters/oauth2/grant-types/utils/realm.mjs";
+import { HTTPOAuth2AuthorizeGrant } from "./adapters/http/adapters/oauth2/grant-types/authorize.mjs";
+import { HTTPClientCredentialsGrant } from "./adapters/http/adapters/oauth2/grant-types/client-credentials.mjs";
+import { HTTPOAuth2IdentityGrantType } from "./adapters/http/adapters/oauth2/grant-types/identity.mjs";
+import { HTTPPasswordGrant } from "./adapters/http/adapters/oauth2/grant-types/password.mjs";
+import { HTTPOAuth2RefreshTokenGrant } from "./adapters/http/adapters/oauth2/grant-types/refresh_token.mjs";
+import { HTTPRobotCredentialsGrant } from "./adapters/http/adapters/oauth2/grant-types/robot-credentials.mjs";
 import { ClientController } from "./adapters/http/controllers/entities/client/module.mjs";
 import { ClientPermissionController } from "./adapters/http/controllers/entities/client-permission/module.mjs";
 import { ClientPermissionRequestValidator } from "./adapters/http/controllers/entities/client-permission/utils/validation.mjs";
@@ -154,6 +157,7 @@ import { ActivateController } from "./adapters/http/controllers/workflows/activa
 import { AuthorizeController } from "./adapters/http/controllers/workflows/authorize/module.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "./adapters/http/controllers/workflows/jwks/handlers/read.mjs";
 import { JwkController } from "./adapters/http/controllers/workflows/jwks/module.mjs";
+import { LogoutController } from "./adapters/http/controllers/workflows/logout/module.mjs";
 import { OpenIDController } from "./adapters/http/controllers/workflows/openid/module.mjs";
 import { PasswordForgotController } from "./adapters/http/controllers/workflows/password-forgot/module.mjs";
 import { PasswordResetController } from "./adapters/http/controllers/workflows/password-reset/module.mjs";
@@ -175,6 +179,7 @@ import { PolicyController } from "./adapters/http/controllers/entities/policy/mo
 import { PolicyAttributesValidator } from "./adapters/http/controllers/entities/policy/utils/attributes-validator.mjs";
 import { PolicyValidator } from "./adapters/http/controllers/entities/policy/utils/validation.mjs";
 import { ScopeController } from "./adapters/http/controllers/entities/scope/module.mjs";
+import { SessionController } from "./adapters/http/controllers/entities/session/module.mjs";
 import { UserController } from "./adapters/http/controllers/entities/user/module.mjs";
 import { UserAttributeController } from "./adapters/http/controllers/entities/user-attribute/module.mjs";
 import { UserAttributeRequestValidator } from "./adapters/http/controllers/entities/user-attribute/utils/validation.mjs";
@@ -213,4 +218,4 @@ import { defineCLIResetCommand } from "./cli/commands/reset.mjs";
 import { defineCLIStartCommand } from "./cli/commands/start.mjs";
 import "./cli/commands/index.mjs";
 import "reflect-metadata";
-export { ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthorizationMiddleware, AuthorizeController, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountEntity, IdentityProviderAccountRepository, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyEntity, LDAPInjectionKey, LOCALE_COOKIE, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, ProvisionerModule, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotEntity, RobotIdentityRepository, RobotPermissionController, RobotPermissionEntity, RobotPermissionRepositoryAdapter, RobotPermissionRequestValidator, RobotPermissionSubscriber, RobotRepositoryAdapter, RobotRoleController, RobotRoleEntity, RobotRoleRepositoryAdapter, RobotRoleRequestValidator, RobotRoleSubscriber, RobotSubscriber, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionEntity, SessionRepository, StatusController, TokenController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserController, UserEntity, UserIdentityRepository, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIResetCommand, defineCLIStartCommand, expandToOrigins, extractClientCredentialsFromRequest, getAppOrigins, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isRequestIdentityMasterRealmMember, readFromLocations, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestToken };
+export { ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthorizationMiddleware, AuthorizeController, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountEntity, IdentityProviderAccountRepository, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyEntity, LDAPInjectionKey, LOCALE_COOKIE, LdapModule, LoggerInjectionKey, LoggerModule, LogoutController, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, ProvisionerModule, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotEntity, RobotIdentityRepository, RobotPermissionController, RobotPermissionEntity, RobotPermissionRepositoryAdapter, RobotPermissionRequestValidator, RobotPermissionSubscriber, RobotRepositoryAdapter, RobotRoleController, RobotRoleEntity, RobotRoleRepositoryAdapter, RobotRoleRequestValidator, RobotRoleSubscriber, RobotSubscriber, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionController, SessionEntity, SessionRepository, SessionTokenEntity, StatusController, TokenController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserController, UserEntity, UserIdentityRepository, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIResetCommand, defineCLIStartCommand, expandToOrigins, extractClientCredentialsFromRequest, getAppOrigins, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };