@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.52

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { extractClientCredentialsFromRequest } from "./credentials.mjs";
+import { extractClientCredentialsFromRequest, readStringField } from "./credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./guess.mjs";
-export { extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest };
+import { readRealmHint } from "./realm.mjs";
+export { extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/adapters/oauth2/grant-types/utils/realm.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Read the realm hint (`realm_id` ?? `realm_name`) from the given request
+ * sources (checked in order). Both fields denote the same realm key and each
+ * accepts a realm UUID or name. Values are canonicalized at the ingress
+ * (`trim().toLowerCase()`, canonical identifier form layer 3) since no
+ * validator runs on the token body.
+ */
+export declare function readRealmHint(...sources: (Record<string, any> | undefined)[]): string | undefined;
+//# sourceMappingURL=realm.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/realm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/realm.ts"],"names":[],"mappings":"AASA;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,GAAG,SAAS,CAejG"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/realm.mjs

@@ -0,0 +1,21 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { readStringField } from "./credentials.mjs";
+//#region src/adapters/http/adapters/oauth2/grant-types/utils/realm.ts
+/**
+* Read the realm hint (`realm_id` ?? `realm_name`) from the given request
+* sources (checked in order). Both fields denote the same realm key and each
+* accepts a realm UUID or name. Values are canonicalized at the ingress
+* (`trim().toLowerCase()`, canonical identifier form layer 3) since no
+* validator runs on the token body.
+*/ function readRealmHint(...sources) {
+	for (const source of sources) {
+		const hint = [readStringField(source, "realm_id"), readStringField(source, "realm_name")].map((value) => value?.trim().toLowerCase()).find((value) => !!value);
+		if (hint) return hint;
+	}
+}
+//#endregion
+export { readRealmHint };
+
+//# sourceMappingURL=realm.mjs.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/realm.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm.mjs","names":["readStringField","readRealmHint","sources","source","hint","map","value","trim","toLowerCase","find","undefined"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/realm.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { readStringField } from './credentials.ts';\n\n/**\n * Read the realm hint (`realm_id` ?? `realm_name`) from the given request\n * sources (checked in order). Both fields denote the same realm key and each\n * accepts a realm UUID or name. Values are canonicalized at the ingress\n * (`trim().toLowerCase()`, canonical identifier form layer 3) since no\n * validator runs on the token body.\n */\nexport function readRealmHint(...sources: (Record<string, any> | undefined)[]): string | undefined {\n    for (const source of sources) {\n        const hint = [\n            readStringField(source, 'realm_id'),\n            readStringField(source, 'realm_name'),\n        ]\n            .map((value) => value?.trim().toLowerCase())\n            .find((value) => !!value);\n\n        if (hint) {\n            return hint;\n        }\n    }\n\n    return undefined;\n}\n"],"mappings":";;;;;;;;;;;GAgBA,SAAgBC,cAAc,GAAGC,SAA4C;CACzE,KAAK,MAAMC,UAAUD,SAAS;EAC1B,MAAME,OAAO,CACTJ,gBAAgBG,QAAQ,UAAA,GACxBH,gBAAgBG,QAAQ,YAAA,CAAA,CAC3B,CACIE,KAAKC,UAAUA,OAAOC,KAAAA,CAAAA,CAAOC,YAAAA,CAAAA,CAAAA,CAC7BC,MAAMH,UAAU,CAAC,CAACA,KAAAA;EAEvB,IAAIF,MACA,OAAOA;CAEf;AAGJ"}

package/dist/adapters/http/adapters/oauth2/index.mjs

@@ -3,8 +3,9 @@ import "node:url";
 import.meta.url;
 import { HTTPOAuth2Authorizer } from "./authorization/module.mjs";
 import "./authorization/index.mjs";
-import { extractClientCredentialsFromRequest } from "./grant-types/utils/credentials.mjs";
+import { extractClientCredentialsFromRequest, readStringField } from "./grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./grant-types/utils/guess.mjs";
+import { readRealmHint } from "./grant-types/utils/realm.mjs";
 import { HTTPOAuth2AuthorizeGrant } from "./grant-types/authorize.mjs";
 import { HTTPClientCredentialsGrant } from "./grant-types/client-credentials.mjs";
 import { HTTPOAuth2IdentityGrantType } from "./grant-types/identity.mjs";
@@ -12,4 +13,4 @@ import { HTTPPasswordGrant } from "./grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./grant-types/refresh_token.mjs";
 import { HTTPRobotCredentialsGrant } from "./grant-types/robot-credentials.mjs";
 import "./grant-types/index.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/controllers/entities/client/module.mjs

@@ -8,14 +8,14 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
 import { useRequestScopes } from "../../../request/helpers/scopes.mjs";
 import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import { isSelfToken } from "../../../../../utils/self-id.mjs";
 import "../../../../../utils/index.mjs";
-import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
 import { EntityNotFoundError } from "@authup/errors";
 import { OAuth2SubKind } from "@authup/specs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/client/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/client-permission/module.mjs

@@ -5,8 +5,8 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/client-permission/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/client-role/module.mjs

@@ -5,8 +5,8 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/client-role/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/client-scope/module.mjs

@@ -5,8 +5,8 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/client-scope/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/identity-provide-role/module.mjs

@@ -5,8 +5,8 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/identity-provide-role/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EAAE,gBAAgB,EAAkC,MAAM,kBAAkB,CAAC;AAgBzF,OAAO,KAAK,EACR,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,gBAAgB,EAEnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,EAE1C,MAAM,8BAA8B,CAAC;AAWtC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;gBAI1C,GAAG,EAAE,iCAAiC;IAc5C,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IA+BhD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gBAAgB,CAAC;IA0BtB,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IA6BvB,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAOvB,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IAgD1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;YA2ElB,KAAK;YA4FL,OAAO;YAYP,sBAAsB;YAWtB,wBAAwB;CAWzC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EAAE,gBAAgB,EAAkC,MAAM,kBAAkB,CAAC;AAgBzF,OAAO,KAAK,EACR,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,gBAAgB,EAEnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,EAE1C,MAAM,8BAA8B,CAAC;AAWtC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;gBAI1C,GAAG,EAAE,iCAAiC;IAc5C,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IA+BhD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,gBAAgB,CAAC;IA0BtB,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAKvB,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IA6BvB,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAOvB,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IAgD1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;YA8ElB,KAAK;YA6FL,OAAO;YAYP,sBAAsB;YAWtB,wBAAwB;CAWzC"}

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs

@@ -10,20 +10,20 @@ import { getBodyRealmID } from "../../../request/helpers/body-realm-id.mjs";
 import { getRequestParamID, useRequestParamID } from "../../../request/helpers/param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
 import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import { resolveURL } from "../../../../../utils/url.mjs";
 import "../../../../../utils/index.mjs";
-import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
 import { ValidatorGroup, base64URLDecode, isUUID } from "@authup/kit";
 import { IdentityProviderAttributesValidator, IdentityProviderValidator, IdentityType, PermissionName, isOAuth2IdentityProvider, isOpenIDIdentityProvider } from "@authup/core-kit";
-import { BuiltInPolicyType, PolicyData } from "@authup/access";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 import { OAuth2RequestError } from "@authup/specs";
 import { URL } from "node:url";
 import { getRequestHeader, getRequestIP, sendRedirect } from "routup";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 import { readRequestBody } from "@routup/basic/body";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/identity-provider/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -66,7 +66,10 @@ var IdentityProviderController = class {
 			for (const datum of data) try {
 				await permissionEvaluator.evaluate({
 					name: PermissionName.IDENTITY_PROVIDER_READ,
-					input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum })
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: datum,
+						[BuiltInPolicyType.REALM_MATCH]: datum.realm_id ?? null
+					})
 				});
 			} catch {}
 		} catch {}
@@ -82,7 +85,10 @@ var IdentityProviderController = class {
 		try {
 			await useRequestPermissionEvaluator(event).evaluate({
 				name: PermissionName.IDENTITY_PROVIDER_READ,
-				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					[BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null
+				})
 			});
 		} catch {}
 		return entity;
@@ -101,7 +107,10 @@ var IdentityProviderController = class {
 		if (!entity) throw new EntityNotFoundError();
 		await permissionEvaluator.evaluate({
 			name: PermissionName.IDENTITY_PROVIDER_DELETE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				[BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null
+			})
 		});
 		const { id: entityId } = entity;
 		await this.repository.remove(entity);
@@ -172,7 +181,8 @@ var IdentityProviderController = class {
 			const url = new URL(resolveURL(this.options.baseURL, "authorize"));
 			for (const codeRequestKey_ of codeRequestKeys) {
 				const codeRequestKey = codeRequestKey_;
-				if (data.codeRequest[codeRequestKey]) url.searchParams.set(codeRequestKey, data.codeRequest[codeRequestKey]);
+				const codeRequestValue = data.codeRequest[codeRequestKey];
+				if (typeof codeRequestValue !== "undefined" && codeRequestValue !== null) url.searchParams.set(codeRequestKey, String(codeRequestValue));
 			}
 			url.searchParams.set("code", authorizationCode.id);
 			return sendRedirect(event, url.href);
@@ -209,16 +219,22 @@ var IdentityProviderController = class {
 		await this.repository.validateJoinColumns(data);
 		if (entity) await permissionEvaluator.evaluate({
 			name: PermissionName.IDENTITY_PROVIDER_UPDATE,
-			input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: {
-				...entity,
-				...data
-			} })
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: {
+					...entity,
+					...data
+				},
+				[BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? entity.realm_id ?? null
+			})
 		});
 		else {
 			if (!data.realm_id) data.realm_id = useRequestIdentityOrFail(event).realmId;
 			await permissionEvaluator.evaluate({
 				name: PermissionName.IDENTITY_PROVIDER_CREATE,
-				input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data })
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: data,
+					[BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? null
+				})
 			});
 		}
 		await this.repository.checkUniqueness(data, entity || void 0);

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","PolicyData","ValidatorGroup","base64URLDecode","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityNotFoundError","resolveURL","useRequestQuery","readRequestBody","OAuth2RequestError","URL","OAuth2AuthorizationCodeRequestValidator","createIdentityProviderOAuth2Authenticator","applyRouteRealmIDToBody","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","realmRepository","accountManager","codeRequestVerifier","codeRequestValidator","stateManager","codeIssuer","ctx","getProviders","event","data","meta","findMany","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_READ","datum","evaluate","input","ATTRIBUTES","getProvider","id","paramId","entity","findOneByIdOrName","editProvider","user","write","updateOnly","put","dropProvider","IDENTITY_PROVIDER_DELETE","findOneBy","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","authenticator","provider","baseURL","parameters","codeRequest","query","codeRequestDecoded","JSON","parse","malformed","codeRequestValidated","run","verify","client","realm_id","state","saveAuthorizationState","buildRedirectURL","authorizeIn","Error","protocol","verifyAuthorizationState","code","clientId","client_id","authenticate","realm","authorizationCode","issue","response_type","redirect_uri","scope","type","USER","codeRequestKeys","Object","keys","url","codeRequestKey_","codeRequestKey","searchParams","set","href","group","body","realmId","where","IDENTITY_PROVIDER_UPDATE","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","identity","checkUniqueness","undefined","merge","saveWithEA","create","findOneById","save","ip","trustProxy","userAgent","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport { ValidatorGroup, base64URLDecode, isUUID } from '@authup/kit';\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DPut,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n    getRequestHeader,\n    getRequestIP,\n    sendRedirect,\n} from 'routup';\nimport type { IdentityProvider, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n\n    IdentityProviderAttributesValidator,\n    IdentityProviderValidator,\n    IdentityType,\n    PermissionName,\n    isOAuth2IdentityProvider,\n    isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { resolveURL } from '../../../../../utils/index.ts';\nimport type { AuthorizeParameters } from '@hapic/oauth2';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { readRequestBody } from '@routup/basic/body';\nimport { OAuth2RequestError } from '@authup/specs';\nimport type {\n    EntityCollectionResponse,\n    IdentityProviderCreatePayload,\n    IdentityProviderSavePayload,\n    IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n    IIdentityProviderAccountManager,\n    IIdentityProviderRepository,\n    IOAuth2AuthorizationCodeIssuer,\n    IOAuth2AuthorizationCodeRequestVerifier,\n    IOAuth2AuthorizationStateManager,\n    IRealmRepository,\n    OAuth2AuthorizationState,\n} from '../../../../../core/index.ts';\nimport {\n    OAuth2AuthorizationCodeRequestValidator,\n    createIdentityProviderOAuth2Authenticator,\n} from '../../../../../core/index.ts';\nimport {\n    applyRouteRealmIDToBody,\n    getBodyRealmID,\n    getRequestParamID,\n    getRequestRealmID,\n    useRequestIdentityOrFail,\n    useRequestParamID,\n    useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n    protected options: IdentityProviderControllerOptions;\n\n    protected repository: IIdentityProviderRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected stateManager : IOAuth2AuthorizationStateManager;\n\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: IdentityProviderControllerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.accountManager = ctx.accountManager;\n        this.codeIssuer = ctx.codeIssuer;\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n        this.stateManager = ctx.stateManager;\n    }\n\n    // ---------------------------------------------------------\n\n    @DGet('', [])\n    async getProviders(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<IdentityProvider>> {\n        const {\n            data, \n            meta, \n        } = await this.repository.findMany(useRequestQuery(event));\n\n        try {\n            const permissionEvaluator = useRequestPermissionEvaluator(event);\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });\n\n            for (const datum of data) {\n                try {\n                    await permissionEvaluator.evaluate({\n                        name: PermissionName.IDENTITY_PROVIDER_READ,\n                        input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum }),\n                    });\n                } catch {\n                    // do nothing\n                }\n            }\n        } catch {\n            // do nothing\n        }\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DGet('/:id', [])\n    async getProvider(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<IdentityProvider> {\n        const paramId = useRequestParamID(event, { isUUID: false });\n\n        const entity = await this.repository.findOneByIdOrName(\n            paramId,\n            getRequestRealmID(event),\n        );\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        try {\n            const permissionEvaluator = useRequestPermissionEvaluator(event);\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_READ,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n            });\n        } catch {\n            // do nothing\n        }\n\n        return entity;\n    }\n\n    @DPost('/:id', [ForceLoggedInMiddleware])\n    async editProvider(\n        @DPath('id') id: string,\n        @DBody() user: IdentityProviderUpdatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        return this.write(event, { updateOnly: true });\n    }\n\n    @DPut('/:id', [ForceLoggedInMiddleware])\n    async put(\n        @DPath('id') id: string,\n        @DBody() user: IdentityProviderSavePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        return this.write(event);\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async dropProvider(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        const paramId = useRequestParamID(event);\n\n        const permissionEvaluator = useRequestPermissionEvaluator(event);\n        await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n        const entity = await this.repository.findOneBy({ id: paramId });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_DELETE,\n            input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n\n        await this.repository.remove(entity);\n\n        entity.id = entityId;\n\n        event.response.status = 202;\n\n        return entity;\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async addProvider(\n        @DBody() user: IdentityProviderCreatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        return this.write(event);\n    }\n\n    // ---------------------------------------------------------\n\n    @DGet('/:id/authorize-out', [])\n    async authorizeOut(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) {\n        const id = useRequestParamID(event);\n        const entity = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n            throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n        }\n\n        const authenticator = createIdentityProviderOAuth2Authenticator({\n            accountManager: this.accountManager,\n            provider: entity,\n            options: { baseURL: this.options.baseURL },\n        });\n\n        const parameters : AuthorizeParameters = {};\n\n        let codeRequest: OAuth2AuthorizationCodeRequest | undefined;\n        const query = useRequestQuery(event);\n        if (typeof query.codeRequest === 'string') {\n            let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n            try {\n                codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n            } catch {\n                throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n            }\n\n            const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n            const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n            if (\n                data.client.realm_id &&\n                entity.realm_id &&\n                entity.realm_id !== data.client.realm_id\n            ) {\n                throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n            }\n\n            codeRequest = data.data;\n        }\n\n        parameters.state = await this.saveAuthorizationState(event, codeRequest);\n\n        return sendRedirect(event, authenticator.buildRedirectURL(parameters));\n    }\n\n    @DGet('/:id/authorize-in', [])\n    async authorizeIn(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) {\n        const id = useRequestParamID(event);\n\n        const entity = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n            throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n        }\n\n        const data = await this.verifyAuthorizationState(event);\n        if (\n            entity.realm_id &&\n            data.codeRequest &&\n            data.codeRequest.realm_id &&\n            data.codeRequest.realm_id !== entity.realm_id\n        ) {\n            throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n        }\n\n        const { code } = useRequestQuery(event);\n\n        const authenticator = createIdentityProviderOAuth2Authenticator({\n            accountManager: this.accountManager,\n            provider: entity,\n            options: {\n                baseURL: this.options.baseURL,\n                clientId: data.codeRequest?.client_id,\n            },\n        });\n\n        const user = await authenticator.authenticate(code);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n\n        const authorizationCode = await this.codeIssuer.issue(\n            {\n                response_type: 'code',\n                client_id: data.codeRequest?.client_id,\n                redirect_uri: data.codeRequest?.redirect_uri,\n                scope: data.codeRequest?.scope,\n            },\n            {\n                type: IdentityType.USER,\n                data: {\n                    ...user,\n                    realm,\n                },\n            },\n        );\n\n        if (data.codeRequest) {\n            const codeRequestKeys = Object.keys(data.codeRequest);\n\n            const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n            for (const codeRequestKey_ of codeRequestKeys) {\n                const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n                if (data.codeRequest[codeRequestKey]) {\n                    url.searchParams.set(codeRequestKey, data.codeRequest[codeRequestKey]);\n                }\n            }\n\n            url.searchParams.set('code', authorizationCode.id);\n\n            return sendRedirect(event, url.href);\n        }\n\n        const url = new URL(this.options.baseURL);\n        url.searchParams.set('code', authorizationCode.id);\n\n        return sendRedirect(event, url.href);\n    }\n\n    // ---------------------------------------------------------\n\n    private async write(event: IAppEvent, options: {\n        updateOnly?: boolean\n    } = {}): Promise<IdentityProvider> {\n        let group: string;\n        const id = getRequestParamID(event, { isUUID: false });\n        const body = await readRequestBody(event);\n        applyRouteRealmIDToBody(event, body);\n        const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n        let entity: IdentityProvider | null | undefined;\n        if (id) {\n            const where: Record<string, any> = {};\n            if (isUUID(id)) {\n                where.id = id;\n            } else {\n                where.name = id;\n            }\n\n            if (realmId) {\n                where.realm_id = realmId;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        const permissionEvaluator = useRequestPermissionEvaluator(event);\n        if (entity) {\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validator = new IdentityProviderValidator();\n        const data = await validator.run(body, { group });\n\n        const attributesValidator = new IdentityProviderAttributesValidator();\n        const attributes = await attributesValidator.run(body);\n\n        await this.repository.validateJoinColumns(data);\n\n        if (entity) {\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n                input: new PolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...data,\n                    },\n                }),\n            });\n        } else {\n            if (!data.realm_id) {\n                const identity = useRequestIdentityOrFail(event);\n                data.realm_id = identity.realmId;\n            }\n\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_CREATE,\n                input: new PolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data }),\n            });\n        }\n\n        await this.repository.checkUniqueness(data, entity || undefined);\n\n        if (entity) {\n            entity = this.repository.merge(entity, data);\n            await this.repository.saveWithEA(entity, attributes);\n\n            event.response.status = 202;\n\n            return entity;\n        }\n\n        entity = this.repository.create(data);\n        await this.repository.saveWithEA(entity, attributes);\n\n        event.response.status = 201;\n\n        return entity;\n    }\n\n    // ---------------------------------------------------------\n\n    private async resolve(id: string) {\n        const entity = await this.repository.findOneById(id);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    // ---------------------------------------------------------\n\n    private async saveAuthorizationState(\n        event: IAppEvent,\n        codeRequest?: OAuth2AuthorizationCodeRequest,\n    ) : Promise<string> {\n        return this.stateManager.save({\n            codeRequest,\n            ip: getRequestIP(event, { trustProxy: true }) ?? '',\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n\n    private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n        const query = useRequestQuery(event);\n        if (typeof query.state !== 'string') {\n            throw OAuth2RequestError.stateInvalid();\n        }\n\n        return this.stateManager.verify(query.state, {\n            ip: getRequestIP(event, { trustProxy: true }) ?? '',\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,IAAawC,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKR,UAAUQ,IAAIR;EACnB,KAAKC,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKI,aAAaC,IAAID;EACtB,KAAKH,sBAAsBI,IAAIJ;EAC/B,KAAKC,uBAAuB,IAAIhB,wCAAAA;EAChC,KAAKiB,eAAeE,IAAIF;CAC5B;CAIA,MACMG,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKX,WAAWY,SAAS5B,gBAAgByB,KAAAA,CAAAA;EAEnD,IAAI;GACA,MAAMI,sBAAsBjB,8BAA8Ba,KAAAA;GAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAesC,uBAAuB,CAAA;GAEpF,KAAK,MAAMC,SAASP,MAChB,IAAI;IACA,MAAMG,oBAAoBK,SAAS;KAC/BH,MAAMrC,eAAesC;KACrBG,OAAO,IAAI5D,WAAW,GAAGD,kBAAkB8D,aAAaH,MAAM,CAAA;IAClE,CAAA;GACJ,QAAQ,CAER;EAER,QAAQ,CAER;EAEA,OAAO;GACHP;GACAC;EACJ;CACJ;CAEA,MACMU,YACF,IACA,OACyB;EACzB,MAAME,UAAU5B,kBAAkBc,OAAO,EAAE/C,QAAQ,MAAM,CAAA;EAEzD,MAAM8D,SAAS,MAAM,KAAKxB,WAAWyB,kBACjCF,SACA9B,kBAAkBgB,KAAAA,CAAAA;EAGtB,IAAI,CAACe,QACD,MAAM,IAAI1C,oBAAAA;EAGd,IAAI;GAEA,MAD4Bc,8BAA8Ba,KACpDI,CAAAA,CAAoBK,SAAS;IAC/BH,MAAMrC,eAAesC;IACrBG,OAAO,IAAI5D,WAAW,GAAGD,kBAAkB8D,aAAaI,OAAO,CAAA;GACnE,CAAA;EACJ,QAAQ,CAER;EAEA,OAAOA;CACX;CAEA,MACME,aACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKE,MAAMnB,OAAO,EAAEoB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKF,MAAMnB,KAAAA;CACtB;CAEA,MACMsB,aACF,IACA,OAC0B;EAC1B,MAAMR,UAAU5B,kBAAkBc,KAAAA;EAElC,MAAMI,sBAAsBjB,8BAA8Ba,KAAAA;EAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAesD,yBAAyB,CAAA;EAEtF,MAAMR,SAAS,MAAM,KAAKxB,WAAWiC,UAAU,EAAEX,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAI1C,oBAAAA;EAGd,MAAM+B,oBAAoBK,SAAS;GAC/BH,MAAMrC,eAAesD;GACrBb,OAAO,IAAI5D,WAAW,GAAGD,kBAAkB8D,aAAaI,OAAO,CAAA;EACnE,CAAA;EAEA,MAAM,EAAEF,IAAIY,aAAaV;EAEzB,MAAM,KAAKxB,WAAWmC,OAAOX,MAAAA;EAE7BA,OAAOF,KAAKY;EAEZzB,MAAM2B,SAASC,SAAS;EAExB,OAAOb;CACX;CAEA,MACMc,YACF,MACA,OAC0B;EAC1B,OAAO,KAAKV,MAAMnB,KAAAA;CACtB;CAIA,MACM8B,aACF,KACA,OACF;EACE,MAAMjB,KAAK3B,kBAAkBc,KAAAA;EAC7B,MAAMe,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC3C,yBAAyB6C,MAAAA,KAAW,CAAC5C,yBAAyB4C,MAAAA,GAC/D,MAAM,IAAI3C,gBAAgB,oFAAA;EAG9B,MAAM6D,gBAAgBrD,0CAA0C;GAC5Da,gBAAgB,KAAKA;GACrByC,UAAUnB;GACVzB,SAAS,EAAE6C,SAAS,KAAK7C,QAAQ6C,QAAQ;EAC7C,CAAA;EAEA,MAAMC,aAAmC,CAAC;EAE1C,IAAIC;EACJ,MAAMC,QAAQ/D,gBAAgByB,KAAAA;EAC9B,IAAI,OAAOsC,MAAMD,gBAAgB,UAAU;GACvC,IAAIE;GAEJ,IAAI;IACAA,qBAAqBC,KAAKC,MAAMzF,gBAAgBsF,MAAMD,WAAW,CAAA;GACrE,QAAQ;IACJ,MAAM5D,mBAAmBiE,UAAU,sDAAA;GACvC;GAEA,MAAMC,uBAAuB,MAAM,KAAKhD,qBAAqBiD,IAAIL,kBAAAA;GACjE,MAAMtC,OAAO,MAAM,KAAKP,oBAAoBmD,OAAOF,oBAAAA;GAEnD,IACI1C,KAAK6C,OAAOC,YACZhC,OAAOgC,YACPhC,OAAOgC,aAAa9C,KAAK6C,OAAOC,UAEhC,MAAMtE,mBAAmBiE,UAAU,6CAAA;GAGvCL,cAAcpC,KAAKA;EACvB;EAEAmC,WAAWY,QAAQ,MAAM,KAAKC,uBAAuBjD,OAAOqC,WAAAA;EAE5D,OAAOxE,aAAamC,OAAOiC,cAAciB,iBAAiBd,UAAAA,CAAAA;CAC9D;CAEA,MACMe,YACF,KACA,OACF;EACE,MAAMtC,KAAK3B,kBAAkBc,KAAAA;EAE7B,MAAMe,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC3C,yBAAyB6C,MAAAA,KAAW,CAAC5C,yBAAyB4C,MAAAA,GAC/D,MAAM,IAAIqC,MAAM,yBAAyBrC,OAAOsC,SAAS,eAAe;EAG5E,MAAMpD,OAAO,MAAM,KAAKqD,yBAAyBtD,KAAAA;EACjD,IACIe,OAAOgC,YACP9C,KAAKoC,eACLpC,KAAKoC,YAAYU,YACjB9C,KAAKoC,YAAYU,aAAahC,OAAOgC,UAErC,MAAMtE,mBAAmBiE,UAAU,6CAAA;EAGvC,MAAM,EAAEa,SAAShF,gBAAgByB,KAAAA;EAWjC,MAAMkB,OAAO,MATStC,0CAA0C;GAC5Da,gBAAgB,KAAKA;GACrByC,UAAUnB;GACVzB,SAAS;IACL6C,SAAS,KAAK7C,QAAQ6C;IACtBqB,UAAUvD,KAAKoC,aAAaoB;GAChC;EACJ,CAEmBxB,CAAAA,CAAcyB,aAAaH,IAAAA;EAE9C,MAAMI,QAAQ,MAAM,KAAKnE,gBAAgBwC,QAAQjB,OAAOgC,UAAU,IAAA;EAElE,MAAMa,oBAAoB,MAAM,KAAK/D,WAAWgE,MAC5C;GACIC,eAAe;GACfL,WAAWxD,KAAKoC,aAAaoB;GAC7BM,cAAc9D,KAAKoC,aAAa0B;GAChCC,OAAO/D,KAAKoC,aAAa2B;EAC7B,GACA;GACIC,MAAMjG,aAAakG;GACnBjE,MAAM;IACF,GAAGiB;IACHyC;GACJ;EACJ,CAAA;EAGJ,IAAI1D,KAAKoC,aAAa;GAClB,MAAM8B,kBAAkBC,OAAOC,KAAKpE,KAAKoC,WAAW;GAEpD,MAAMiC,MAAM,IAAI5F,IAAIJ,WAAW,KAAKgB,QAAQ6C,SAAS,WAAA,CAAA;GACrD,KAAK,MAAMoC,mBAAmBJ,iBAAiB;IAC3C,MAAMK,iBAAiBD;IACvB,IAAItE,KAAKoC,YAAYmC,iBACjBF,IAAIG,aAAaC,IAAIF,gBAAgBvE,KAAKoC,YAAYmC,eAAe;GAE7E;GAEAF,IAAIG,aAAaC,IAAI,QAAQd,kBAAkB/C,EAAE;GAEjD,OAAOhD,aAAamC,OAAOsE,IAAIK,IAAI;EACvC;EAEA,MAAML,MAAM,IAAI5F,IAAI,KAAKY,QAAQ6C,OAAO;EACxCmC,IAAIG,aAAaC,IAAI,QAAQd,kBAAkB/C,EAAE;EAEjD,OAAOhD,aAAamC,OAAOsE,IAAIK,IAAI;CACvC;CAIA,MAAcxD,MAAMnB,OAAkBV,UAElC,CAAC,GAA8B;EAC/B,IAAIsF;EACJ,MAAM/D,KAAK9B,kBAAkBiB,OAAO,EAAE/C,QAAQ,MAAM,CAAA;EACpD,MAAM4H,OAAO,MAAMrG,gBAAgBwB,KAAAA;EACnCnB,wBAAwBmB,OAAO6E,IAAAA;EAC/B,MAAMC,UAAU9F,kBAAkBgB,KAAAA,KAAUlB,eAAe+F,IAAAA;EAE3D,IAAI9D;EACJ,IAAIF,IAAI;GACJ,MAAMkE,QAA6B,CAAC;GACpC,IAAI9H,OAAO4D,EAAAA,GACPkE,MAAMlE,KAAKA;QAEXkE,MAAMzE,OAAOO;GAGjB,IAAIiE,SACAC,MAAMhC,WAAW+B;GAGrB/D,SAAS,MAAM,KAAKxB,WAAWiC,UAAUuD,KAAAA;GACzC,IAAI,CAAChE,UAAUzB,QAAQ8B,YACnB,MAAM,IAAI/C,oBAAAA;EAElB,OAAO,IAAIiB,QAAQ8B,YACf,MAAM,IAAI/C,oBAAAA;EAGd,MAAM+B,sBAAsBjB,8BAA8Ba,KAAAA;EAC1D,IAAIe,QAAQ;GACR,MAAMX,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAe+G,yBAAyB,CAAA;GAEtFJ,QAAQ7H,eAAekI;EAC3B,OAAO;GACH,MAAM7E,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAeiH,yBAAyB,CAAA;GAEtFN,QAAQ7H,eAAeoI;EAC3B;EAGA,MAAMlF,OAAO,MAAMmF,IADGrH,0BACHqH,CAAAA,CAAUxC,IAAIiC,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMU,aAAa,MAAMD,IADOvH,oCACPuH,CAAAA,CAAoBzC,IAAIiC,IAAAA;EAEjD,MAAM,KAAKtF,WAAWgG,oBAAoBtF,IAAAA;EAE1C,IAAIc,QACA,MAAMX,oBAAoBK,SAAS;GAC/BH,MAAMrC,eAAe+G;GACrBtE,OAAO,IAAI5D,WAAW,GACjBD,kBAAkB8D,aAAa;IAC5B,GAAGI;IACH,GAAGd;GACP,EACJ,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACA,KAAK8C,UAEN9C,KAAK8C,WADY9D,yBAAyBe,KAC1BwF,CAAAA,CAASV;GAG7B,MAAM1E,oBAAoBK,SAAS;IAC/BH,MAAMrC,eAAeiH;IACrBxE,OAAO,IAAI5D,WAAW,GAAGD,kBAAkB8D,aAAaV,KAAK,CAAA;GACjE,CAAA;EACJ;EAEA,MAAM,KAAKV,WAAWkG,gBAAgBxF,MAAMc,UAAU2E,KAAAA,CAAAA;EAEtD,IAAI3E,QAAQ;GACRA,SAAS,KAAKxB,WAAWoG,MAAM5E,QAAQd,IAAAA;GACvC,MAAM,KAAKV,WAAWqG,WAAW7E,QAAQuE,UAAAA;GAEzCtF,MAAM2B,SAASC,SAAS;GAExB,OAAOb;EACX;EAEAA,SAAS,KAAKxB,WAAWsG,OAAO5F,IAAAA;EAChC,MAAM,KAAKV,WAAWqG,WAAW7E,QAAQuE,UAAAA;EAEzCtF,MAAM2B,SAASC,SAAS;EAExB,OAAOb;CACX;CAIA,MAAciB,QAAQnB,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAKxB,WAAWuG,YAAYjF,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAI1C,oBAAAA;EAGd,OAAO0C;CACX;CAIA,MAAckC,uBACVjD,OACAqC,aACgB;EAChB,OAAO,KAAKzC,aAAamG,KAAK;GAC1B1D;GACA2D,IAAIpI,aAAaoC,OAAO,EAAEiG,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWvI,iBAAiBqC,OAAO,YAAA,KAAiB0F,KAAAA;EACxD,CAAA;CACJ;CAEA,MAAcpC,yBAAyBtD,OAAqD;EACxF,MAAMsC,QAAQ/D,gBAAgByB,KAAAA;EAC9B,IAAI,OAAOsC,MAAMU,UAAU,UACvB,MAAMvE,mBAAmB0H,aAAY;EAGzC,OAAO,KAAKvG,aAAaiD,OAAOP,MAAMU,OAAO;GACzCgD,IAAIpI,aAAaoC,OAAO,EAAEiG,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWvI,iBAAiBqC,OAAO,YAAA,KAAiB0F,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;;;;;;;;;gBA1ToBtG,uBAAAA,CAAAA;;;;;;;;;;;;;eASDA,uBAAAA,CAAAA;;;;;;;;;;;;;kBASGA,uBAAAA,CAAAA;;;;;;;;YAgCNA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;cAjJF,uBAAuB,qCAAA,CAAA"}
+{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","base64URLDecode","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityNotFoundError","resolveURL","useRequestQuery","readRequestBody","OAuth2RequestError","URL","OAuth2AuthorizationCodeRequestValidator","createIdentityProviderOAuth2Authenticator","applyRouteRealmIDToBody","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","realmRepository","accountManager","codeRequestVerifier","codeRequestValidator","stateManager","codeIssuer","ctx","getProviders","event","data","meta","findMany","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_READ","datum","evaluate","ATTRIBUTES","REALM_MATCH","realm_id","getProvider","id","paramId","entity","findOneByIdOrName","editProvider","user","write","updateOnly","put","dropProvider","IDENTITY_PROVIDER_DELETE","findOneBy","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","authenticator","provider","baseURL","parameters","codeRequest","query","codeRequestDecoded","JSON","parse","malformed","codeRequestValidated","run","verify","client","state","saveAuthorizationState","buildRedirectURL","authorizeIn","Error","protocol","verifyAuthorizationState","code","clientId","client_id","authenticate","realm","authorizationCode","issue","response_type","redirect_uri","scope","type","USER","codeRequestKeys","Object","keys","url","codeRequestKey_","codeRequestKey","codeRequestValue","searchParams","set","String","href","group","body","realmId","where","IDENTITY_PROVIDER_UPDATE","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","identity","checkUniqueness","undefined","merge","saveWithEA","create","findOneById","save","ip","trustProxy","userAgent","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, base64URLDecode, isUUID } from '@authup/kit';\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DPut,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n    getRequestHeader,\n    getRequestIP,\n    sendRedirect,\n} from 'routup';\nimport type { IdentityProvider, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n\n    IdentityProviderAttributesValidator,\n    IdentityProviderValidator,\n    IdentityType,\n    PermissionName,\n    isOAuth2IdentityProvider,\n    isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { resolveURL } from '../../../../../utils/index.ts';\nimport type { AuthorizeParameters } from '@hapic/oauth2';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { readRequestBody } from '@routup/basic/body';\nimport { OAuth2RequestError } from '@authup/specs';\nimport type {\n    EntityCollectionResponse,\n    IdentityProviderCreatePayload,\n    IdentityProviderSavePayload,\n    IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n    IIdentityProviderAccountManager,\n    IIdentityProviderRepository,\n    IOAuth2AuthorizationCodeIssuer,\n    IOAuth2AuthorizationCodeRequestVerifier,\n    IOAuth2AuthorizationStateManager,\n    IRealmRepository,\n    OAuth2AuthorizationState,\n} from '../../../../../core/index.ts';\nimport {\n    OAuth2AuthorizationCodeRequestValidator,\n    createIdentityProviderOAuth2Authenticator,\n} from '../../../../../core/index.ts';\nimport {\n    applyRouteRealmIDToBody,\n    getBodyRealmID,\n    getRequestParamID,\n    getRequestRealmID,\n    useRequestIdentityOrFail,\n    useRequestParamID,\n    useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n    protected options: IdentityProviderControllerOptions;\n\n    protected repository: IIdentityProviderRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected stateManager : IOAuth2AuthorizationStateManager;\n\n    protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: IdentityProviderControllerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.accountManager = ctx.accountManager;\n        this.codeIssuer = ctx.codeIssuer;\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n        this.stateManager = ctx.stateManager;\n    }\n\n    // ---------------------------------------------------------\n\n    @DGet('', [])\n    async getProviders(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<IdentityProvider>> {\n        const {\n            data,\n            meta,\n        } = await this.repository.findMany(useRequestQuery(event));\n\n        try {\n            const permissionEvaluator = useRequestPermissionEvaluator(event);\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });\n\n            for (const datum of data) {\n                try {\n                    await permissionEvaluator.evaluate({\n                        name: PermissionName.IDENTITY_PROVIDER_READ,\n                        data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum, [BuiltInPolicyType.REALM_MATCH]: datum.realm_id ?? null }),\n                    });\n                } catch {\n                    // do nothing\n                }\n            }\n        } catch {\n            // do nothing\n        }\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DGet('/:id', [])\n    async getProvider(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<IdentityProvider> {\n        const paramId = useRequestParamID(event, { isUUID: false });\n\n        const entity = await this.repository.findOneByIdOrName(\n            paramId,\n            getRequestRealmID(event),\n        );\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        try {\n            const permissionEvaluator = useRequestPermissionEvaluator(event);\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_READ,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null }),\n            });\n        } catch {\n            // do nothing\n        }\n\n        return entity;\n    }\n\n    @DPost('/:id', [ForceLoggedInMiddleware])\n    async editProvider(\n        @DPath('id') id: string,\n        @DBody() user: IdentityProviderUpdatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        return this.write(event, { updateOnly: true });\n    }\n\n    @DPut('/:id', [ForceLoggedInMiddleware])\n    async put(\n        @DPath('id') id: string,\n        @DBody() user: IdentityProviderSavePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        return this.write(event);\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async dropProvider(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        const paramId = useRequestParamID(event);\n\n        const permissionEvaluator = useRequestPermissionEvaluator(event);\n        await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n        const entity = await this.repository.findOneBy({ id: paramId });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realm_id ?? null }),\n        });\n\n        const { id: entityId } = entity;\n\n        await this.repository.remove(entity);\n\n        entity.id = entityId;\n\n        event.response.status = 202;\n\n        return entity;\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async addProvider(\n        @DBody() user: IdentityProviderCreatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<IdentityProvider> {\n        return this.write(event);\n    }\n\n    // ---------------------------------------------------------\n\n    @DGet('/:id/authorize-out', [])\n    async authorizeOut(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) {\n        const id = useRequestParamID(event);\n        const entity = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n            throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n        }\n\n        const authenticator = createIdentityProviderOAuth2Authenticator({\n            accountManager: this.accountManager,\n            provider: entity,\n            options: { baseURL: this.options.baseURL },\n        });\n\n        const parameters : AuthorizeParameters = {};\n\n        let codeRequest: OAuth2AuthorizationCodeRequest | undefined;\n        const query = useRequestQuery(event);\n        if (typeof query.codeRequest === 'string') {\n            let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n            try {\n                codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n            } catch {\n                throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n            }\n\n            const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n            const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n            if (\n                data.client.realm_id &&\n                entity.realm_id &&\n                entity.realm_id !== data.client.realm_id\n            ) {\n                throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n            }\n\n            codeRequest = data.data;\n        }\n\n        parameters.state = await this.saveAuthorizationState(event, codeRequest);\n\n        return sendRedirect(event, authenticator.buildRedirectURL(parameters));\n    }\n\n    @DGet('/:id/authorize-in', [])\n    async authorizeIn(\n        @DPath('id') _id: string,\n        @DContext() event: IAppEvent,\n    ) {\n        const id = useRequestParamID(event);\n\n        const entity = await this.resolve(id);\n\n        if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n            throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n        }\n\n        const data = await this.verifyAuthorizationState(event);\n        if (\n            entity.realm_id &&\n            data.codeRequest &&\n            data.codeRequest.realm_id &&\n            data.codeRequest.realm_id !== entity.realm_id\n        ) {\n            throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n        }\n\n        const { code } = useRequestQuery(event);\n\n        const authenticator = createIdentityProviderOAuth2Authenticator({\n            accountManager: this.accountManager,\n            provider: entity,\n            options: {\n                baseURL: this.options.baseURL,\n                clientId: data.codeRequest?.client_id,\n            },\n        });\n\n        const user = await authenticator.authenticate(code);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n\n        const authorizationCode = await this.codeIssuer.issue(\n            {\n                response_type: 'code',\n                client_id: data.codeRequest?.client_id,\n                redirect_uri: data.codeRequest?.redirect_uri,\n                scope: data.codeRequest?.scope,\n            },\n            {\n                type: IdentityType.USER,\n                data: {\n                    ...user,\n                    realm,\n                },\n            },\n        );\n\n        if (data.codeRequest) {\n            const codeRequestKeys = Object.keys(data.codeRequest);\n\n            const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n            for (const codeRequestKey_ of codeRequestKeys) {\n                const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n                const codeRequestValue = data.codeRequest[codeRequestKey];\n                // Preserve meaningful falsy values (e.g. max_age=0, which OIDC\n                // treats as prompt=login) — only skip absent ones.\n                if (typeof codeRequestValue !== 'undefined' && codeRequestValue !== null) {\n                    url.searchParams.set(codeRequestKey, String(codeRequestValue));\n                }\n            }\n\n            url.searchParams.set('code', authorizationCode.id);\n\n            return sendRedirect(event, url.href);\n        }\n\n        const url = new URL(this.options.baseURL);\n        url.searchParams.set('code', authorizationCode.id);\n\n        return sendRedirect(event, url.href);\n    }\n\n    // ---------------------------------------------------------\n\n    private async write(event: IAppEvent, options: {\n        updateOnly?: boolean\n    } = {}): Promise<IdentityProvider> {\n        let group: string;\n        const id = getRequestParamID(event, { isUUID: false });\n        const body = await readRequestBody(event);\n        applyRouteRealmIDToBody(event, body);\n        const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n        let entity: IdentityProvider | null | undefined;\n        if (id) {\n            const where: Record<string, any> = {};\n            if (isUUID(id)) {\n                where.id = id;\n            } else {\n                where.name = id;\n            }\n\n            if (realmId) {\n                where.realm_id = realmId;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        const permissionEvaluator = useRequestPermissionEvaluator(event);\n        if (entity) {\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validator = new IdentityProviderValidator();\n        const data = await validator.run(body, { group });\n\n        const attributesValidator = new IdentityProviderAttributesValidator();\n        const attributes = await attributesValidator.run(body);\n\n        await this.repository.validateJoinColumns(data);\n\n        if (entity) {\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...data,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? entity.realm_id ?? null,\n                }),\n            });\n        } else {\n            if (!data.realm_id) {\n                const identity = useRequestIdentityOrFail(event);\n                data.realm_id = identity.realmId;\n            }\n\n            await permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_CREATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data, [BuiltInPolicyType.REALM_MATCH]: data.realm_id ?? null }),\n            });\n        }\n\n        await this.repository.checkUniqueness(data, entity || undefined);\n\n        if (entity) {\n            entity = this.repository.merge(entity, data);\n            await this.repository.saveWithEA(entity, attributes);\n\n            event.response.status = 202;\n\n            return entity;\n        }\n\n        entity = this.repository.create(data);\n        await this.repository.saveWithEA(entity, attributes);\n\n        event.response.status = 201;\n\n        return entity;\n    }\n\n    // ---------------------------------------------------------\n\n    private async resolve(id: string) {\n        const entity = await this.repository.findOneById(id);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    // ---------------------------------------------------------\n\n    private async saveAuthorizationState(\n        event: IAppEvent,\n        codeRequest?: OAuth2AuthorizationCodeRequest,\n    ) : Promise<string> {\n        return this.stateManager.save({\n            codeRequest,\n            ip: getRequestIP(event, { trustProxy: true }) ?? '',\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n\n    private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n        const query = useRequestQuery(event);\n        if (typeof query.state !== 'string') {\n            throw OAuth2RequestError.stateInvalid();\n        }\n\n        return this.stateManager.verify(query.state, {\n            ip: getRequestIP(event, { trustProxy: true }) ?? '',\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,IAAawC,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKR,UAAUQ,IAAIR;EACnB,KAAKC,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKI,aAAaC,IAAID;EACtB,KAAKH,sBAAsBI,IAAIJ;EAC/B,KAAKC,uBAAuB,IAAIhB,wCAAAA;EAChC,KAAKiB,eAAeE,IAAIF;CAC5B;CAIA,MACMG,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKX,WAAWY,SAAS5B,gBAAgByB,KAAAA,CAAAA;EAEnD,IAAI;GACA,MAAMI,sBAAsBjB,8BAA8Ba,KAAAA;GAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAesC,uBAAuB,CAAA;GAEpF,KAAK,MAAMC,SAASP,MAChB,IAAI;IACA,MAAMG,oBAAoBK,SAAS;KAC/BH,MAAMrC,eAAesC;KACrBN,MAAMnD,iBAAiB;OAAGD,kBAAkB6D,aAAaF;OAAQ3D,kBAAkB8D,cAAcH,MAAMI,YAAY;KAAK,CAAA;IAC5H,CAAA;GACJ,QAAQ,CAER;EAER,QAAQ,CAER;EAEA,OAAO;GACHX;GACAC;EACJ;CACJ;CAEA,MACMW,YACF,IACA,OACyB;EACzB,MAAME,UAAU7B,kBAAkBc,OAAO,EAAE/C,QAAQ,MAAM,CAAA;EAEzD,MAAM+D,SAAS,MAAM,KAAKzB,WAAW0B,kBACjCF,SACA/B,kBAAkBgB,KAAAA,CAAAA;EAGtB,IAAI,CAACgB,QACD,MAAM,IAAI3C,oBAAAA;EAGd,IAAI;GAEA,MAD4Bc,8BAA8Ba,KACpDI,CAAAA,CAAoBK,SAAS;IAC/BH,MAAMrC,eAAesC;IACrBN,MAAMnD,iBAAiB;MAAGD,kBAAkB6D,aAAaM;MAASnE,kBAAkB8D,cAAcK,OAAOJ,YAAY;IAAK,CAAA;GAC9H,CAAA;EACJ,QAAQ,CAER;EAEA,OAAOI;CACX;CAEA,MACME,aACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKE,MAAMpB,OAAO,EAAEqB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OAC0B;EAC1B,OAAO,KAAKF,MAAMpB,KAAAA;CACtB;CAEA,MACMuB,aACF,IACA,OAC0B;EAC1B,MAAMR,UAAU7B,kBAAkBc,KAAAA;EAElC,MAAMI,sBAAsBjB,8BAA8Ba,KAAAA;EAC1D,MAAMI,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAeuD,yBAAyB,CAAA;EAEtF,MAAMR,SAAS,MAAM,KAAKzB,WAAWkC,UAAU,EAAEX,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAI3C,oBAAAA;EAGd,MAAM+B,oBAAoBK,SAAS;GAC/BH,MAAMrC,eAAeuD;GACrBvB,MAAMnD,iBAAiB;KAAGD,kBAAkB6D,aAAaM;KAASnE,kBAAkB8D,cAAcK,OAAOJ,YAAY;GAAK,CAAA;EAC9H,CAAA;EAEA,MAAM,EAAEE,IAAIY,aAAaV;EAEzB,MAAM,KAAKzB,WAAWoC,OAAOX,MAAAA;EAE7BA,OAAOF,KAAKY;EAEZ1B,MAAM4B,SAASC,SAAS;EAExB,OAAOb;CACX;CAEA,MACMc,YACF,MACA,OAC0B;EAC1B,OAAO,KAAKV,MAAMpB,KAAAA;CACtB;CAIA,MACM+B,aACF,KACA,OACF;EACE,MAAMjB,KAAK5B,kBAAkBc,KAAAA;EAC7B,MAAMgB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC5C,yBAAyB8C,MAAAA,KAAW,CAAC7C,yBAAyB6C,MAAAA,GAC/D,MAAM,IAAI5C,gBAAgB,oFAAA;EAG9B,MAAM8D,gBAAgBtD,0CAA0C;GAC5Da,gBAAgB,KAAKA;GACrB0C,UAAUnB;GACV1B,SAAS,EAAE8C,SAAS,KAAK9C,QAAQ8C,QAAQ;EAC7C,CAAA;EAEA,MAAMC,aAAmC,CAAC;EAE1C,IAAIC;EACJ,MAAMC,QAAQhE,gBAAgByB,KAAAA;EAC9B,IAAI,OAAOuC,MAAMD,gBAAgB,UAAU;GACvC,IAAIE;GAEJ,IAAI;IACAA,qBAAqBC,KAAKC,MAAM1F,gBAAgBuF,MAAMD,WAAW,CAAA;GACrE,QAAQ;IACJ,MAAM7D,mBAAmBkE,UAAU,sDAAA;GACvC;GAEA,MAAMC,uBAAuB,MAAM,KAAKjD,qBAAqBkD,IAAIL,kBAAAA;GACjE,MAAMvC,OAAO,MAAM,KAAKP,oBAAoBoD,OAAOF,oBAAAA;GAEnD,IACI3C,KAAK8C,OAAOnC,YACZI,OAAOJ,YACPI,OAAOJ,aAAaX,KAAK8C,OAAOnC,UAEhC,MAAMnC,mBAAmBkE,UAAU,6CAAA;GAGvCL,cAAcrC,KAAKA;EACvB;EAEAoC,WAAWW,QAAQ,MAAM,KAAKC,uBAAuBjD,OAAOsC,WAAAA;EAE5D,OAAOzE,aAAamC,OAAOkC,cAAcgB,iBAAiBb,UAAAA,CAAAA;CAC9D;CAEA,MACMc,YACF,KACA,OACF;EACE,MAAMrC,KAAK5B,kBAAkBc,KAAAA;EAE7B,MAAMgB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC5C,yBAAyB8C,MAAAA,KAAW,CAAC7C,yBAAyB6C,MAAAA,GAC/D,MAAM,IAAIoC,MAAM,yBAAyBpC,OAAOqC,SAAS,eAAe;EAG5E,MAAMpD,OAAO,MAAM,KAAKqD,yBAAyBtD,KAAAA;EACjD,IACIgB,OAAOJ,YACPX,KAAKqC,eACLrC,KAAKqC,YAAY1B,YACjBX,KAAKqC,YAAY1B,aAAaI,OAAOJ,UAErC,MAAMnC,mBAAmBkE,UAAU,6CAAA;EAGvC,MAAM,EAAEY,SAAShF,gBAAgByB,KAAAA;EAWjC,MAAMmB,OAAO,MATSvC,0CAA0C;GAC5Da,gBAAgB,KAAKA;GACrB0C,UAAUnB;GACV1B,SAAS;IACL8C,SAAS,KAAK9C,QAAQ8C;IACtBoB,UAAUvD,KAAKqC,aAAamB;GAChC;EACJ,CAEmBvB,CAAAA,CAAcwB,aAAaH,IAAAA;EAE9C,MAAMI,QAAQ,MAAM,KAAKnE,gBAAgByC,QAAQjB,OAAOJ,UAAU,IAAA;EAElE,MAAMgD,oBAAoB,MAAM,KAAK/D,WAAWgE,MAC5C;GACIC,eAAe;GACfL,WAAWxD,KAAKqC,aAAamB;GAC7BM,cAAc9D,KAAKqC,aAAayB;GAChCC,OAAO/D,KAAKqC,aAAa0B;EAC7B,GACA;GACIC,MAAMjG,aAAakG;GACnBjE,MAAM;IACF,GAAGkB;IACHwC;GACJ;EACJ,CAAA;EAGJ,IAAI1D,KAAKqC,aAAa;GAClB,MAAM6B,kBAAkBC,OAAOC,KAAKpE,KAAKqC,WAAW;GAEpD,MAAMgC,MAAM,IAAI5F,IAAIJ,WAAW,KAAKgB,QAAQ8C,SAAS,WAAA,CAAA;GACrD,KAAK,MAAMmC,mBAAmBJ,iBAAiB;IAC3C,MAAMK,iBAAiBD;IACvB,MAAME,mBAAmBxE,KAAKqC,YAAYkC;IAG1C,IAAI,OAAOC,qBAAqB,eAAeA,qBAAqB,MAChEH,IAAII,aAAaC,IAAIH,gBAAgBI,OAAOH,gBAAAA,CAAAA;GAEpD;GAEAH,IAAII,aAAaC,IAAI,QAAQf,kBAAkB9C,EAAE;GAEjD,OAAOjD,aAAamC,OAAOsE,IAAIO,IAAI;EACvC;EAEA,MAAMP,MAAM,IAAI5F,IAAI,KAAKY,QAAQ8C,OAAO;EACxCkC,IAAII,aAAaC,IAAI,QAAQf,kBAAkB9C,EAAE;EAEjD,OAAOjD,aAAamC,OAAOsE,IAAIO,IAAI;CACvC;CAIA,MAAczD,MAAMpB,OAAkBV,UAElC,CAAC,GAA8B;EAC/B,IAAIwF;EACJ,MAAMhE,KAAK/B,kBAAkBiB,OAAO,EAAE/C,QAAQ,MAAM,CAAA;EACpD,MAAM8H,OAAO,MAAMvG,gBAAgBwB,KAAAA;EACnCnB,wBAAwBmB,OAAO+E,IAAAA;EAC/B,MAAMC,UAAUhG,kBAAkBgB,KAAAA,KAAUlB,eAAeiG,IAAAA;EAE3D,IAAI/D;EACJ,IAAIF,IAAI;GACJ,MAAMmE,QAA6B,CAAC;GACpC,IAAIhI,OAAO6D,EAAAA,GACPmE,MAAMnE,KAAKA;QAEXmE,MAAM3E,OAAOQ;GAGjB,IAAIkE,SACAC,MAAMrE,WAAWoE;GAGrBhE,SAAS,MAAM,KAAKzB,WAAWkC,UAAUwD,KAAAA;GACzC,IAAI,CAACjE,UAAU1B,QAAQ+B,YACnB,MAAM,IAAIhD,oBAAAA;EAElB,OAAO,IAAIiB,QAAQ+B,YACf,MAAM,IAAIhD,oBAAAA;EAGd,MAAM+B,sBAAsBjB,8BAA8Ba,KAAAA;EAC1D,IAAIgB,QAAQ;GACR,MAAMZ,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAeiH,yBAAyB,CAAA;GAEtFJ,QAAQ/H,eAAeoI;EAC3B,OAAO;GACH,MAAM/E,oBAAoBC,YAAY,EAAEC,MAAMrC,eAAemH,yBAAyB,CAAA;GAEtFN,QAAQ/H,eAAesI;EAC3B;EAGA,MAAMpF,OAAO,MAAMqF,IADGvH,0BACHuH,CAAAA,CAAUzC,IAAIkC,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMU,aAAa,MAAMD,IADOzH,oCACPyH,CAAAA,CAAoB1C,IAAIkC,IAAAA;EAEjD,MAAM,KAAKxF,WAAWkG,oBAAoBxF,IAAAA;EAE1C,IAAIe,QACA,MAAMZ,oBAAoBK,SAAS;GAC/BH,MAAMrC,eAAeiH;GACrBjF,MAAMnD,iBAAiB;KAClBD,kBAAkB6D,aAAa;KAC5B,GAAGM;KACH,GAAGf;IACP;KACCpD,kBAAkB8D,cAAcV,KAAKW,YAAYI,OAAOJ,YAAY;GACzE,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACX,KAAKW,UAENX,KAAKW,WADY3B,yBAAyBe,KAC1B0F,CAAAA,CAASV;GAG7B,MAAM5E,oBAAoBK,SAAS;IAC/BH,MAAMrC,eAAemH;IACrBnF,MAAMnD,iBAAiB;MAAGD,kBAAkB6D,aAAaT;MAAOpD,kBAAkB8D,cAAcV,KAAKW,YAAY;IAAK,CAAA;GAC1H,CAAA;EACJ;EAEA,MAAM,KAAKrB,WAAWoG,gBAAgB1F,MAAMe,UAAU4E,KAAAA,CAAAA;EAEtD,IAAI5E,QAAQ;GACRA,SAAS,KAAKzB,WAAWsG,MAAM7E,QAAQf,IAAAA;GACvC,MAAM,KAAKV,WAAWuG,WAAW9E,QAAQwE,UAAAA;GAEzCxF,MAAM4B,SAASC,SAAS;GAExB,OAAOb;EACX;EAEAA,SAAS,KAAKzB,WAAWwG,OAAO9F,IAAAA;EAChC,MAAM,KAAKV,WAAWuG,WAAW9E,QAAQwE,UAAAA;EAEzCxF,MAAM4B,SAASC,SAAS;EAExB,OAAOb;CACX;CAIA,MAAciB,QAAQnB,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAKzB,WAAWyG,YAAYlF,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAI3C,oBAAAA;EAGd,OAAO2C;CACX;CAIA,MAAciC,uBACVjD,OACAsC,aACgB;EAChB,OAAO,KAAK1C,aAAaqG,KAAK;GAC1B3D;GACA4D,IAAItI,aAAaoC,OAAO,EAAEmG,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWzI,iBAAiBqC,OAAO,YAAA,KAAiB4F,KAAAA;EACxD,CAAA;CACJ;CAEA,MAActC,yBAAyBtD,OAAqD;EACxF,MAAMuC,QAAQhE,gBAAgByB,KAAAA;EAC9B,IAAI,OAAOuC,MAAMS,UAAU,UACvB,MAAMvE,mBAAmB4H,aAAY;EAGzC,OAAO,KAAKzG,aAAakD,OAAOP,MAAMS,OAAO;GACzCkD,IAAItI,aAAaoC,OAAO,EAAEmG,YAAY,KAAK,CAAA,KAAM;GACjDC,WAAWzI,iBAAiBqC,OAAO,YAAA,KAAiB4F,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;;;;;;;;;gBA9ToBxG,uBAAAA,CAAAA;;;;;;;;;;;;;eASDA,uBAAAA,CAAAA;;;;;;;;;;;;;kBASGA,uBAAAA,CAAAA;;;;;;;;YAgCNA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;cAjJF,uBAAuB,qCAAA,CAAA"}

package/dist/adapters/http/controllers/entities/index.d.ts

@@ -15,6 +15,7 @@ export * from './role-attribute/index.ts';
 export * from './role-permission/index.ts';
 export * from './policy/index.ts';
 export * from './scope/index.ts';
+export * from './session/index.ts';
 export * from './user/index.ts';
 export * from './user-attribute/index.ts';
 export * from './user-permission/index.ts';

package/dist/adapters/http/controllers/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kCAAkC,CAAC;AACjD,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kCAAkC,CAAC;AACjD,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}

package/dist/adapters/http/controllers/entities/index.mjs

@@ -44,6 +44,8 @@ import { PolicyValidator } from "./policy/utils/validation.mjs";
 import "./policy/index.mjs";
 import { ScopeController } from "./scope/module.mjs";
 import "./scope/index.mjs";
+import { SessionController } from "./session/module.mjs";
+import "./session/index.mjs";
 import { UserController } from "./user/module.mjs";
 import "./user/index.mjs";
 import { UserAttributeController } from "./user-attribute/module.mjs";
@@ -55,4 +57,4 @@ import "./user-permission/index.mjs";
 import { UserRoleController } from "./user-role/module.mjs";
 import { UserRoleRequestValidator } from "./user-role/utils/validation.mjs";
 import "./user-role/index.mjs";
-export { ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, IdentityProviderController, IdentityProviderRoleMappingController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, UserAttributeController, UserAttributeRequestValidator, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator };
+export { ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, IdentityProviderController, IdentityProviderRoleMappingController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RobotController, RobotPermissionController, RobotPermissionRequestValidator, RobotRoleController, RobotRoleRequestValidator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, UserAttributeController, UserAttributeRequestValidator, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator };

package/dist/adapters/http/controllers/entities/permission/module.mjs

@@ -7,8 +7,8 @@ import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
 import { serializeError } from "@authup/errors";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/permission/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/permission-policy/module.mjs

@@ -5,8 +5,8 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/permission-policy/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/policy/module.mjs

@@ -7,8 +7,8 @@ import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
 import { serializeError } from "@authup/errors";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/policy/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/realm/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/realm/module.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAE9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EACR,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAMvE,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAA;CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,sBAAsB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;CACxC,CAAC;AAEF,qBAEa,eAAe;IACxB,SAAS,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAE1C,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC;IAEjC,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;gBAEnC,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAarC,GAAG,CACI,IAAI,EAAE,kBAAkB,EACrB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;IAUZ,GAAG,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAK5C,sBAAsB,CACX,EAAE,EAAE,MAAM,GACxB,OAAO,CAAC,sBAAsB,CAAC;IA+C5B,QAAQ,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IAMxE,OAAO,CACI,EAAE,EAAE,MAAM,EACP,KAAK,EAAE,MAAM,GAC9B,OAAO,CAAC,gBAAgB,CAAC;IAMtB,IAAI,CACO,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,kBAAkB,EACrB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;IAcZ,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,EACnB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;IAgBZ,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;CAQrB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/realm/module.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAE9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EACR,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAMvE,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAA;CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,sBAAsB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;CACxC,CAAC;AAEF,qBAEa,eAAe;IACxB,SAAS,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAE1C,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC;IAEjC,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;gBAEnC,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAarC,GAAG,CACI,IAAI,EAAE,kBAAkB,EACrB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;IAUZ,GAAG,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAK5C,sBAAsB,CACX,EAAE,EAAE,MAAM,GACxB,OAAO,CAAC,sBAAsB,CAAC;IA+D5B,QAAQ,CAAc,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IAMxE,OAAO,CACI,EAAE,EAAE,MAAM,EACP,KAAK,EAAE,MAAM,GAC9B,OAAO,CAAC,gBAAgB,CAAC;IAMtB,IAAI,CACO,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,kBAAkB,EACrB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;IAcZ,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,EACnB,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;IAgBZ,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC;CAQrB"}

package/dist/adapters/http/controllers/entities/realm/module.mjs

@@ -3,15 +3,15 @@ import "node:url";
 import.meta.url;
 import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import { resolveURL } from "../../../../../utils/url.mjs";
 import "../../../../../utils/index.mjs";
-import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "../../workflows/jwks/handlers/read.mjs";
 import "../../workflows/index.mjs";
-import { OAuth2AuthorizationResponseType } from "@authup/specs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
+import { OAuth2AuthorizationPrompt, OAuth2AuthorizationResponseType } from "@authup/specs";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/realm/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -58,11 +58,14 @@ var RealmController = class {
 		return {
 			issuer: resolveURL(baseURL, `realms/${entity.name}`).replace(/\/+$/, ""),
 			authorization_endpoint: resolveURL(baseURL, "authorize"),
+			end_session_endpoint: resolveURL(baseURL, "logout"),
 			jwks_uri: resolveURL(baseURL, `realms/${entity.name}/jwks`),
-			response_types_supported: [
-				OAuth2AuthorizationResponseType.CODE,
-				OAuth2AuthorizationResponseType.TOKEN,
-				OAuth2AuthorizationResponseType.NONE
+			response_types_supported: [OAuth2AuthorizationResponseType.CODE],
+			prompt_values_supported: [
+				OAuth2AuthorizationPrompt.NONE,
+				OAuth2AuthorizationPrompt.LOGIN,
+				OAuth2AuthorizationPrompt.CONSENT,
+				OAuth2AuthorizationPrompt.SELECT_ACCOUNT
 			],
 			subject_types_supported: ["public"],
 			id_token_signing_alg_values_supported: [
@@ -76,7 +79,7 @@ var RealmController = class {
 			],
 			token_endpoint: resolveURL(baseURL, "token"),
 			introspection_endpoint: resolveURL(baseURL, "token/introspect"),
-			revocation_endpoint: resolveURL(baseURL, "token"),
+			revocation_endpoint: resolveURL(baseURL, "token/revoke"),
 			service_documentation: "https://authup.org/",
 			userinfo_endpoint: resolveURL(baseURL, "users/@me")
 		};

package/dist/adapters/http/controllers/entities/realm/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","OAuth2AuthorizationResponseType","useRequestQuery","getJwkRouteHandler","getJwksRouteHandler","ForceLoggedInMiddleware","buildActorContext","resolveURL","RealmController","options","service","keyRepository","ctx","getMany","event","data","meta","add","actor","entity","create","response","status","get","id","getOne","getOpenIdConfiguration","baseURL","issuer","name","replace","authorization_endpoint","jwks_uri","response_types_supported","CODE","TOKEN","NONE","subject_types_supported","id_token_signing_alg_values_supported","token_endpoint","introspection_endpoint","revocation_endpoint","service_documentation","userinfo_endpoint","getCerts","getCert","keyId","edit","update","put","created","save","undefined","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/realm/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DPut,\n    DTags,\n} from '@routup/decorators';\nimport type { OAuth2JsonWebKey, OpenIDProviderMetadata } from '@authup/specs';\nimport { OAuth2AuthorizationResponseType } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { Repository } from 'typeorm';\nimport type {\n    EntityCollectionResponse,\n    RealmCreatePayload,\n    RealmSavePayload,\n    RealmUpdatePayload,\n} from '@authup/core-http-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { IRealmService } from '../../../../../core/index.ts';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { getJwkRouteHandler, getJwksRouteHandler } from '../../workflows/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext } from '../../../request/index.ts';\nimport { resolveURL } from '../../../../../utils/index.ts';\n\nexport type RealmControllerOptions = {\n    baseURL: string\n};\n\nexport type RealmControllerContext = {\n    options: RealmControllerOptions,\n    service: IRealmService,\n    keyRepository: Repository<KeyEntity>,\n};\n\n@DTags('realm')\n@DController('/realms')\nexport class RealmController {\n    protected options: RealmControllerOptions;\n\n    protected service: IRealmService;\n\n    protected keyRepository: Repository<KeyEntity>;\n\n    constructor(ctx: RealmControllerContext) {\n        this.options = ctx.options;\n        this.service = ctx.service;\n        this.keyRepository = ctx.keyRepository;\n    }\n\n    @DGet('', [])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<Realm>> {\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event));\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async add(\n        @DBody() data: RealmCreatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<Realm> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.create(data, actor);\n\n        event.response.status = 201;\n\n        return entity;\n    }\n\n    @DGet('/:id', [])\n    async get(@DPath('id') id: string): Promise<Realm> {\n        return this.service.getOne(id);\n    }\n\n    @DGet('/:id/.well-known/openid-configuration', [])\n    async getOpenIdConfiguration(\n        @DPath('id') id: string,\n    ): Promise<OpenIDProviderMetadata> {\n        const entity = await this.service.getOne(id);\n\n        const { baseURL } = this.options;\n\n        return {\n            issuer: resolveURL(baseURL, `realms/${entity.name}`).replace(/\\/+$/, ''),\n\n            authorization_endpoint: resolveURL(baseURL, 'authorize'),\n\n            jwks_uri: resolveURL(baseURL, `realms/${entity.name}/jwks`),\n\n            response_types_supported: [\n                OAuth2AuthorizationResponseType.CODE,\n                OAuth2AuthorizationResponseType.TOKEN,\n                OAuth2AuthorizationResponseType.NONE,\n            ],\n\n            subject_types_supported: [\n                'public',\n            ],\n\n            id_token_signing_alg_values_supported: [\n                'HS256',\n                'HS384',\n                'HS512',\n                'RS256',\n                'RS384',\n                'RS512',\n                'none',\n            ],\n\n            token_endpoint: resolveURL(baseURL, 'token'),\n\n            introspection_endpoint: resolveURL(baseURL, 'token/introspect'),\n\n            revocation_endpoint: resolveURL(baseURL, 'token'),\n\n            // -----------------------------------------------------------\n\n            service_documentation: 'https://authup.org/',\n\n            userinfo_endpoint: resolveURL(baseURL, 'users/@me'),\n        };\n    }\n\n    @DGet('/:id/jwks', [])\n    async getCerts(@DPath('id') id: string): Promise<{ keys: OAuth2JsonWebKey[] }> {\n        const entity = await this.service.getOne(id);\n        return getJwksRouteHandler(this.keyRepository, entity.id);\n    }\n\n    @DGet('/:id/jwks/:keyId', [])\n    async getCert(\n        @DPath('id') id: string,\n        @DPath('keyId') keyId: string,\n    ): Promise<OAuth2JsonWebKey> {\n        const entity = await this.service.getOne(id);\n        return getJwkRouteHandler(this.keyRepository, keyId, entity.id);\n    }\n\n    @DPost('/:id', [ForceLoggedInMiddleware])\n    async edit(\n        @DPath('id') id: string,\n        @DBody() data: RealmUpdatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<Realm> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.update(\n            id,\n            data,\n            actor,\n        );\n\n        event.response.status = 202;\n\n        return entity;\n    }\n\n    @DPut('/:id', [ForceLoggedInMiddleware])\n    async put(\n        @DPath('id') id: string,\n        @DBody() data: RealmSavePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<Realm> {\n        const actor = buildActorContext(event);\n        const {\n            entity,\n            created,\n        } = await this.service.save(\n            id || undefined,\n            data,\n            actor,\n        );\n\n        event.response.status = created ? 201 : 202;\n        return entity;\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ) : Promise<Realm> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.delete(id, actor);\n\n        event.response.status = 202;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,IAAagB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;EACrC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,UAAUE,IAAIF;EACnB,KAAKC,gBAAgBC,IAAID;CAC7B;CAEA,MACME,QACF,OACwC;EACxC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQG,QAAQX,gBAAgBY,KAAAA,CAAAA;EAE/C,OAAO;GACHC;GACAC;EACJ;CACJ;CAEA,MACMC,IACF,MACA,OACe;EACf,MAAMC,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKT,QAAQU,OAAOL,MAAMG,KAAAA;EAE/CJ,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;CAEA,MACMI,IAAI,IAAyC;EAC/C,OAAO,KAAKb,QAAQe,OAAOD,EAAAA;CAC/B;CAEA,MACME,uBACF,IAC+B;EAC/B,MAAMP,SAAS,MAAM,KAAKT,QAAQe,OAAOD,EAAAA;EAEzC,MAAM,EAAEG,YAAY,KAAKlB;EAEzB,OAAO;GACHmB,QAAQrB,WAAWoB,SAAS,UAAUR,OAAOU,MAAM,CAAA,CAAEC,QAAQ,QAAQ,EAAA;GAErEC,wBAAwBxB,WAAWoB,SAAS,WAAA;GAE5CK,UAAUzB,WAAWoB,SAAS,UAAUR,OAAOU,KAAK,MAAM;GAE1DI,0BAA0B;IACtBhC,gCAAgCiC;IAChCjC,gCAAgCkC;IAChClC,gCAAgCmC;;GAGpCC,yBAAyB,CACrB,QAAA;GAGJC,uCAAuC;IACnC;IACA;IACA;IACA;IACA;IACA;IACA;;GAGJC,gBAAgBhC,WAAWoB,SAAS,OAAA;GAEpCa,wBAAwBjC,WAAWoB,SAAS,kBAAA;GAE5Cc,qBAAqBlC,WAAWoB,SAAS,OAAA;GAIzCe,uBAAuB;GAEvBC,mBAAmBpC,WAAWoB,SAAS,WAAA;EAC3C;CACJ;CAEA,MACMiB,SAAS,IAAgE;EAC3E,MAAMzB,SAAS,MAAM,KAAKT,QAAQe,OAAOD,EAAAA;EACzC,OAAOpB,oBAAoB,KAAKO,eAAeQ,OAAOK,EAAE;CAC5D;CAEA,MACMqB,QACF,IACA,OACyB;EACzB,MAAM1B,SAAS,MAAM,KAAKT,QAAQe,OAAOD,EAAAA;EACzC,OAAOrB,mBAAmB,KAAKQ,eAAemC,OAAO3B,OAAOK,EAAE;CAClE;CAEA,MACMuB,KACF,IACA,MACA,OACe;EACf,MAAM7B,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKT,QAAQsC,OAC9BxB,IACAT,MACAG,KAAAA;EAGJJ,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;CAEA,MACM8B,IACF,IACA,MACA,OACe;EACf,MAAM/B,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAM,EACFK,QACA+B,YACA,MAAM,KAAKxC,QAAQyC,KACnB3B,MAAM4B,KAAAA,GACNrC,MACAG,KAAAA;EAGJJ,MAAMO,SAASC,SAAS4B,UAAU,MAAM;EACxC,OAAO/B;CACX;CAEA,MACMkC,KACF,IACA,OACe;EACf,MAAMnC,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKT,QAAQ4C,OAAO9B,IAAIN,KAAAA;EAE7CJ,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;AACJ;;;;;;;;;YApIgBd,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAkFIA,uBAAAA,CAAAA;;;;;;;;;;;;;eAkBDA,uBAAAA,CAAAA;;;;;;;;;;;;;kBAoBGA,uBAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","OAuth2AuthorizationPrompt","OAuth2AuthorizationResponseType","useRequestQuery","getJwkRouteHandler","getJwksRouteHandler","ForceLoggedInMiddleware","buildActorContext","resolveURL","RealmController","options","service","keyRepository","ctx","getMany","event","data","meta","add","actor","entity","create","response","status","get","id","getOne","getOpenIdConfiguration","baseURL","issuer","name","replace","authorization_endpoint","end_session_endpoint","jwks_uri","response_types_supported","CODE","prompt_values_supported","NONE","LOGIN","CONSENT","SELECT_ACCOUNT","subject_types_supported","id_token_signing_alg_values_supported","token_endpoint","introspection_endpoint","revocation_endpoint","service_documentation","userinfo_endpoint","getCerts","getCert","keyId","edit","update","put","created","save","undefined","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/realm/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DPost,\n    DPut,\n    DTags,\n} from '@routup/decorators';\nimport type { OAuth2JsonWebKey, OpenIDProviderMetadata } from '@authup/specs';\nimport { OAuth2AuthorizationPrompt, OAuth2AuthorizationResponseType } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { Repository } from 'typeorm';\nimport type {\n    EntityCollectionResponse,\n    RealmCreatePayload,\n    RealmSavePayload,\n    RealmUpdatePayload,\n} from '@authup/core-http-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { IRealmService } from '../../../../../core/index.ts';\nimport type { KeyEntity } from '../../../../database/domains/index.ts';\nimport { getJwkRouteHandler, getJwksRouteHandler } from '../../workflows/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext } from '../../../request/index.ts';\nimport { resolveURL } from '../../../../../utils/index.ts';\n\nexport type RealmControllerOptions = {\n    baseURL: string\n};\n\nexport type RealmControllerContext = {\n    options: RealmControllerOptions,\n    service: IRealmService,\n    keyRepository: Repository<KeyEntity>,\n};\n\n@DTags('realm')\n@DController('/realms')\nexport class RealmController {\n    protected options: RealmControllerOptions;\n\n    protected service: IRealmService;\n\n    protected keyRepository: Repository<KeyEntity>;\n\n    constructor(ctx: RealmControllerContext) {\n        this.options = ctx.options;\n        this.service = ctx.service;\n        this.keyRepository = ctx.keyRepository;\n    }\n\n    @DGet('', [])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<Realm>> {\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event));\n\n        return {\n            data,\n            meta,\n        };\n    }\n\n    @DPost('', [ForceLoggedInMiddleware])\n    async add(\n        @DBody() data: RealmCreatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<Realm> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.create(data, actor);\n\n        event.response.status = 201;\n\n        return entity;\n    }\n\n    @DGet('/:id', [])\n    async get(@DPath('id') id: string): Promise<Realm> {\n        return this.service.getOne(id);\n    }\n\n    @DGet('/:id/.well-known/openid-configuration', [])\n    async getOpenIdConfiguration(\n        @DPath('id') id: string,\n    ): Promise<OpenIDProviderMetadata> {\n        const entity = await this.service.getOne(id);\n\n        const { baseURL } = this.options;\n\n        return {\n            issuer: resolveURL(baseURL, `realms/${entity.name}`).replace(/\\/+$/, ''),\n\n            authorization_endpoint: resolveURL(baseURL, 'authorize'),\n\n            end_session_endpoint: resolveURL(baseURL, 'logout'),\n\n            jwks_uri: resolveURL(baseURL, `realms/${entity.name}/jwks`),\n\n            // OAuth 2.1 posture: the authorization endpoint issues codes\n            // only — implicit/hybrid response types were dropped (plan 042).\n            response_types_supported: [\n                OAuth2AuthorizationResponseType.CODE,\n            ],\n\n            // `none` (silent authentication) is handled by the hosted SSR\n            // authorize page (the kit `Authorize.vue`): it either completes a\n            // built_in client's auto-consent silently or redirects the OIDC\n            // error (login_required / consent_required / interaction_required)\n            // to a verified redirect_uri — zero UI. The server GET cannot do\n            // this server-side (auth is header-only; a top-level navigation\n            // carries no bearer), so the SSR page owns it (plan 042 item 10).\n            prompt_values_supported: [\n                OAuth2AuthorizationPrompt.NONE,\n                OAuth2AuthorizationPrompt.LOGIN,\n                OAuth2AuthorizationPrompt.CONSENT,\n                OAuth2AuthorizationPrompt.SELECT_ACCOUNT,\n            ],\n\n            subject_types_supported: [\n                'public',\n            ],\n\n            id_token_signing_alg_values_supported: [\n                'HS256',\n                'HS384',\n                'HS512',\n                'RS256',\n                'RS384',\n                'RS512',\n                'none',\n            ],\n\n            token_endpoint: resolveURL(baseURL, 'token'),\n\n            introspection_endpoint: resolveURL(baseURL, 'token/introspect'),\n\n            revocation_endpoint: resolveURL(baseURL, 'token/revoke'),\n\n            // -----------------------------------------------------------\n\n            service_documentation: 'https://authup.org/',\n\n            userinfo_endpoint: resolveURL(baseURL, 'users/@me'),\n        };\n    }\n\n    @DGet('/:id/jwks', [])\n    async getCerts(@DPath('id') id: string): Promise<{ keys: OAuth2JsonWebKey[] }> {\n        const entity = await this.service.getOne(id);\n        return getJwksRouteHandler(this.keyRepository, entity.id);\n    }\n\n    @DGet('/:id/jwks/:keyId', [])\n    async getCert(\n        @DPath('id') id: string,\n        @DPath('keyId') keyId: string,\n    ): Promise<OAuth2JsonWebKey> {\n        const entity = await this.service.getOne(id);\n        return getJwkRouteHandler(this.keyRepository, keyId, entity.id);\n    }\n\n    @DPost('/:id', [ForceLoggedInMiddleware])\n    async edit(\n        @DPath('id') id: string,\n        @DBody() data: RealmUpdatePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<Realm> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.update(\n            id,\n            data,\n            actor,\n        );\n\n        event.response.status = 202;\n\n        return entity;\n    }\n\n    @DPut('/:id', [ForceLoggedInMiddleware])\n    async put(\n        @DPath('id') id: string,\n        @DBody() data: RealmSavePayload,\n        @DContext() event: IAppEvent,\n    ) : Promise<Realm> {\n        const actor = buildActorContext(event);\n        const {\n            entity,\n            created,\n        } = await this.service.save(\n            id || undefined,\n            data,\n            actor,\n        );\n\n        event.response.status = created ? 201 : 202;\n        return entity;\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ) : Promise<Realm> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.delete(id, actor);\n\n        event.response.status = 202;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,IAAaiB,kBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;EACrC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,UAAUE,IAAIF;EACnB,KAAKC,gBAAgBC,IAAID;CAC7B;CAEA,MACME,QACF,OACwC;EACxC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQG,QAAQX,gBAAgBY,KAAAA,CAAAA;EAE/C,OAAO;GACHC;GACAC;EACJ;CACJ;CAEA,MACMC,IACF,MACA,OACe;EACf,MAAMC,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKT,QAAQU,OAAOL,MAAMG,KAAAA;EAE/CJ,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;CAEA,MACMI,IAAI,IAAyC;EAC/C,OAAO,KAAKb,QAAQe,OAAOD,EAAAA;CAC/B;CAEA,MACME,uBACF,IAC+B;EAC/B,MAAMP,SAAS,MAAM,KAAKT,QAAQe,OAAOD,EAAAA;EAEzC,MAAM,EAAEG,YAAY,KAAKlB;EAEzB,OAAO;GACHmB,QAAQrB,WAAWoB,SAAS,UAAUR,OAAOU,MAAM,CAAA,CAAEC,QAAQ,QAAQ,EAAA;GAErEC,wBAAwBxB,WAAWoB,SAAS,WAAA;GAE5CK,sBAAsBzB,WAAWoB,SAAS,QAAA;GAE1CM,UAAU1B,WAAWoB,SAAS,UAAUR,OAAOU,KAAK,MAAM;GAI1DK,0BAA0B,CACtBjC,gCAAgCkC,IAAAA;GAUpCC,yBAAyB;IACrBpC,0BAA0BqC;IAC1BrC,0BAA0BsC;IAC1BtC,0BAA0BuC;IAC1BvC,0BAA0BwC;;GAG9BC,yBAAyB,CACrB,QAAA;GAGJC,uCAAuC;IACnC;IACA;IACA;IACA;IACA;IACA;IACA;;GAGJC,gBAAgBpC,WAAWoB,SAAS,OAAA;GAEpCiB,wBAAwBrC,WAAWoB,SAAS,kBAAA;GAE5CkB,qBAAqBtC,WAAWoB,SAAS,cAAA;GAIzCmB,uBAAuB;GAEvBC,mBAAmBxC,WAAWoB,SAAS,WAAA;EAC3C;CACJ;CAEA,MACMqB,SAAS,IAAgE;EAC3E,MAAM7B,SAAS,MAAM,KAAKT,QAAQe,OAAOD,EAAAA;EACzC,OAAOpB,oBAAoB,KAAKO,eAAeQ,OAAOK,EAAE;CAC5D;CAEA,MACMyB,QACF,IACA,OACyB;EACzB,MAAM9B,SAAS,MAAM,KAAKT,QAAQe,OAAOD,EAAAA;EACzC,OAAOrB,mBAAmB,KAAKQ,eAAeuC,OAAO/B,OAAOK,EAAE;CAClE;CAEA,MACM2B,KACF,IACA,MACA,OACe;EACf,MAAMjC,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKT,QAAQ0C,OAC9B5B,IACAT,MACAG,KAAAA;EAGJJ,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;CAEA,MACMkC,IACF,IACA,MACA,OACe;EACf,MAAMnC,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAM,EACFK,QACAmC,YACA,MAAM,KAAK5C,QAAQ6C,KACnB/B,MAAMgC,KAAAA,GACNzC,MACAG,KAAAA;EAGJJ,MAAMO,SAASC,SAASgC,UAAU,MAAM;EACxC,OAAOnC;CACX;CAEA,MACMsC,KACF,IACA,OACe;EACf,MAAMvC,QAAQZ,kBAAkBQ,KAAAA;EAChC,MAAMK,SAAS,MAAM,KAAKT,QAAQgD,OAAOlC,IAAIN,KAAAA;EAE7CJ,MAAMO,SAASC,SAAS;EAExB,OAAOH;CACX;AACJ;;;;;;;;;YApJgBd,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAkGIA,uBAAAA,CAAAA;;;;;;;;;;;;;eAkBDA,uBAAAA,CAAAA;;;;;;;;;;;;;kBAoBGA,uBAAAA,CAAAA"}

package/dist/adapters/http/controllers/entities/robot/module.mjs

@@ -10,15 +10,15 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
 import { useRequestScopes } from "../../../request/helpers/scopes.mjs";
 import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import { isSelfToken } from "../../../../../utils/self-id.mjs";
 import "../../../../../utils/index.mjs";
-import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
 import { isUUID } from "@authup/kit";
 import { EntityNotFoundError } from "@authup/errors";
 import { OAuth2SubKind } from "@authup/specs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/robot/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

package/dist/adapters/http/controllers/entities/robot-permission/module.mjs

@@ -5,8 +5,8 @@ import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
-import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/robot-permission/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;