@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.52

package/dist/app/modules/oauth2/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["CacheInjectionKey","ModuleName","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2KeyRepository","OAuth2ScopeRepository","OAuth2TokenRepository","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","KeyRepository","DataSource","TokenSigner","keyRepository","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\n\nimport {\n    OAuth2AuthorizationCodeRepository,\n    OAuth2AuthorizationStateRepository,\n    OAuth2ClientRepository,\n    OAuth2KeyRepository,\n    OAuth2ScopeRepository,\n    OAuth2TokenRepository,\n} from './repositories/index.ts';\nimport {\n    OAuth2AccessTokenIssuer,\n    OAuth2AuthorizationCodeIssuer,\n    OAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeVerifier,\n    OAuth2AuthorizationStateManager,\n    OAuth2OpenIDTokenIssuer,\n    OAuth2RefreshTokenIssuer,\n    OAuth2TokenRevoker,\n    OAuth2TokenSigner,\n    OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.OAUTH2;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n    }\n\n    async setup(container: IContainer) : Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        container.register(OAuth2InjectionToken.ClientRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n                return new OAuth2ClientRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.ScopeRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n                return new OAuth2ScopeRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationCodeRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationStateRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2TokenRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.KeyRepository, {\n            // todo: cache use here\n            useFactory: (c) => new OAuth2KeyRepository(c.resolve(DatabaseInjectionKey.DataSource)),\n        });\n\n        container.register(OAuth2InjectionToken.TokenSigner, {\n            useFactory: (c) => {\n                const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n                return new OAuth2TokenSigner(keyRepository);\n            },\n        });\n\n        // authorization code issuer\n        container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeIssuer(\n                    codeRepository,\n                    {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                    },\n                );\n            },\n        });\n        container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeVerifier(codeRepository);\n            },\n        });\n\n        // authorization code request verifier\n        container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n            useFactory: (c) => {\n                const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n                const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n                return new OAuth2AuthorizationCodeRequestVerifier({\n                    clientRepository,\n                    scopeRepository: clientScopeRepository,\n                });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n            useFactory: (c) => {\n                const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n                return new OAuth2AuthorizationStateManager(stateRepository);\n            },\n        });\n\n        // token revoker\n        container.register(OAuth2InjectionToken.TokenRevoker, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                return new OAuth2TokenRevoker(tokenRepository);\n            },\n        });\n\n        // token verifier\n        container.register(OAuth2InjectionToken.TokenVerifier, {\n            useFactory: (c) => {\n                const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n                return new OAuth2TokenVerifier(keyRepository, tokenRepository);\n            },\n        });\n\n        // access token issuer\n        container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n                return new OAuth2AccessTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    identityRoleProvider,\n                );\n            },\n        });\n\n        // refresh token issuer\n        container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n                return new OAuth2RefreshTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenRefreshMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                );\n            },\n        });\n\n        // open-id token issuer\n        container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n            useFactory: (c) => {\n                const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n                return new OAuth2OpenIDTokenIssuer({\n                    repository,\n                    signer,\n\n                    identityResolver,\n\n                    options: {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,IAAawB,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOxB,WAAW0B;EACvB,KAAKD,eAAe;GAACzB,WAAW2B;GAAU3B,WAAW4B;GAAO5B,WAAW6B;GAAQ7B,WAAW8B;;CAC9F;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GAET,OAAO,IAAInC,uBADQmC,EAAEJ,QAAkCf,YACrBoB,CAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GAET,OAAO,IAAIjC,sBADQiC,EAAEJ,QAAuCd,iBAC3BmB,CAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GAET,OAAO,IAAIrC,kCADGqC,EAAEJ,QAAQnC,iBACqB2C,CAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GAET,OAAO,IAAIpC,mCADGoC,EAAEJ,QAAQnC,iBACsB2C,CAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GAET,OAAO,IAAIhC,sBADGgC,EAAEJ,QAAQnC,iBACS2C,CAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,eAAe,EAEnDR,aAAaC,MAAM,IAAIlC,oBAAoBkC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EACxF,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,aAAa,EACjDV,aAAaC,MAAAA;GAET,OAAO,IAAIvB,kBADWuB,EAAEJ,QAAQjB,qBAAqB4B,aACxBG,CAAAA;EACjC,EACJ,CAAA;EAGAhB,UAAUG,SAASlB,qBAAqBgC,yBAAyB,EAC7DZ,aAAaC,MAAAA;GAGT,OAAO,IAAI9B,8BAFY8B,EAAEJ,QAAQjB,qBAAqBwB,2BAGlDS,GACA,EAEIC,QAAQlB,OAAOmB,kBACnB,CAAA;EAER,EACJ,CAAA;EACApB,UAAUG,SAASlB,qBAAqBoC,2BAA2B,EAC/DhB,aAAaC,MAAAA;GAGT,OAAO,IAAI5B,gCAFY4B,EAAEJ,QAAQjB,qBAAqBwB,2BAEXS,CAAAA;EAC/C,EACJ,CAAA;EAGAlB,UAAUG,SAASlB,qBAAqBqC,kCAAkC,EACtEjB,aAAaC,MAAAA;GAIT,OAAO,IAAI7B,uCAAuC;IAC9C8C,kBAJqBjB,EAAEJ,QAAQjB,qBAAqBmB,gBAIpDmB;IACAE,iBAJ0BnB,EAAEJ,QAAQjB,qBAAqBuB,eAIxCgB;GACrB,CAAA;EACJ,EACJ,CAAA;EAEAxB,UAAUG,SAASlB,qBAAqByC,2BAA2B,EAC/DrB,aAAaC,MAAAA;GAGT,OAAO,IAAI3B,gCAFa2B,EAAEJ,QAAQjB,qBAAqB0B,4BAEZgB,CAAAA;EAC/C,EACJ,CAAA;EAGA3B,UAAUG,SAASlB,qBAAqB2C,cAAc,EAClDvB,aAAaC,MAAAA;GAET,OAAO,IAAIxB,mBADawB,EAAEJ,QAAQjB,qBAAqB2B,eACzBiB,CAAAA;EAClC,EACJ,CAAA;EAGA7B,UAAUG,SAASlB,qBAAqB6C,eAAe,EACnDzB,aAAaC,MAAAA;GAIT,OAAO,IAAItB,oBAHWsB,EAAEJ,QAAQjB,qBAAqB4B,aAGtBG,GAFPV,EAAEJ,QAAQjB,qBAAqB2B,eAETiB,CAAAA;EAClD,EACJ,CAAA;EAGA7B,UAAUG,SAASlB,qBAAqB8C,mBAAmB,EACvD1B,aAAaC,MAAAA;GACT,MAAMuB,kBAAkBvB,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAMoB,cAAc1B,EAAEJ,QAAQjB,qBAAqB8B,WAAW;GAC9D,MAAMkB,uBAAuB3B,EAAEJ,QAAQhB,qBAAqBgD,YAAY;GACxE,OAAO,IAAI3D,wBACPsD,iBACAG,aACA;IACIb,QAAQlB,OAAOmB;IACfe,QAAQlC,OAAOmC;GACnB,GACAH,oBAAAA;EAER,EACJ,CAAA;EAGAjC,UAAUG,SAASlB,qBAAqBoD,oBAAoB,EACxDhC,aAAaC,MAAAA;GAIT,OAAO,IAAIzB,yBAHayB,EAAEJ,QAAQjB,qBAAqB2B,eAInDiB,GAHgBvB,EAAEJ,QAAQjB,qBAAqB8B,WAI/CiB,GACA;IACIb,QAAQlB,OAAOqC;IACfH,QAAQlC,OAAOmC;GACnB,CAAA;EAER,EACJ,CAAA;EAGApC,UAAUG,SAASlB,qBAAqBsD,mBAAmB,EACvDlC,aAAaC,MAAAA;GAKT,OAAO,IAAI1B,wBAAwB;IAC/B2B,YALeD,EAAEJ,QAAQjB,qBAAqB2B,eAK9CL;IACAiC,QALWlC,EAAEJ,QAAQjB,qBAAqB8B,WAK1CyB;IAEAC,kBANqBnC,EAAEJ,QAAQhB,qBAAqBwD,QAMpDD;IAEAE,SAAS;KAELxB,QAAQlB,OAAOmB;KACfe,QAAQlC,OAAOmC;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["CacheInjectionKey","ModuleName","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2KeyRepository","OAuth2ScopeRepository","OAuth2TokenRepository","SessionTokenRepositoryAdapter","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","SessionTokenRepository","DataSource","KeyRepository","TokenSigner","keyRepository","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","sessionTokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\n\nimport {\n    OAuth2AuthorizationCodeRepository,\n    OAuth2AuthorizationStateRepository,\n    OAuth2ClientRepository,\n    OAuth2KeyRepository,\n    OAuth2ScopeRepository,\n    OAuth2TokenRepository,\n    SessionTokenRepositoryAdapter,\n} from './repositories/index.ts';\nimport {\n    OAuth2AccessTokenIssuer,\n    OAuth2AuthorizationCodeIssuer,\n    OAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeVerifier,\n    OAuth2AuthorizationStateManager,\n    OAuth2OpenIDTokenIssuer,\n    OAuth2RefreshTokenIssuer,\n    OAuth2TokenRevoker,\n    OAuth2TokenSigner,\n    OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.OAUTH2;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n    }\n\n    async setup(container: IContainer) : Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        container.register(OAuth2InjectionToken.ClientRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n                return new OAuth2ClientRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.ScopeRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n                return new OAuth2ScopeRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationCodeRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationStateRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2TokenRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.SessionTokenRepository, {\n            useFactory: (c) => new SessionTokenRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.KeyRepository, {\n            // todo: cache use here\n            useFactory: (c) => new OAuth2KeyRepository(c.resolve(DatabaseInjectionKey.DataSource)),\n        });\n\n        container.register(OAuth2InjectionToken.TokenSigner, {\n            useFactory: (c) => {\n                const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n                return new OAuth2TokenSigner(keyRepository);\n            },\n        });\n\n        // authorization code issuer\n        container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeIssuer(\n                    codeRepository,\n                    {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                    },\n                );\n            },\n        });\n        container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeVerifier(codeRepository);\n            },\n        });\n\n        // authorization code request verifier\n        container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n            useFactory: (c) => {\n                const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n                const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n                return new OAuth2AuthorizationCodeRequestVerifier({\n                    clientRepository,\n                    scopeRepository: clientScopeRepository,\n                });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n            useFactory: (c) => {\n                const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n                return new OAuth2AuthorizationStateManager(stateRepository);\n            },\n        });\n\n        // token revoker\n        container.register(OAuth2InjectionToken.TokenRevoker, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2TokenRevoker(tokenRepository, sessionTokenRepository);\n            },\n        });\n\n        // token verifier\n        container.register(OAuth2InjectionToken.TokenVerifier, {\n            useFactory: (c) => {\n                const keyRepository = c.resolve(OAuth2InjectionToken.KeyRepository);\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n                return new OAuth2TokenVerifier(keyRepository, tokenRepository);\n            },\n        });\n\n        // access token issuer\n        container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2AccessTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    identityRoleProvider,\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // refresh token issuer\n        container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n\n                return new OAuth2RefreshTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenRefreshMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // open-id token issuer\n        container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n            useFactory: (c) => {\n                const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n                return new OAuth2OpenIDTokenIssuer({\n                    repository,\n                    signer,\n\n                    identityResolver,\n\n                    options: {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAayB,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOzB,WAAW2B;EACvB,KAAKD,eAAe;GAAC1B,WAAW4B;GAAU5B,WAAW6B;GAAO7B,WAAW8B;GAAQ9B,WAAW+B;;CAC9F;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GAET,OAAO,IAAIpC,uBADQoC,EAAEJ,QAAkCf,YACrBoB,CAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GAET,OAAO,IAAIlC,sBADQkC,EAAEJ,QAAuCd,iBAC3BmB,CAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GAET,OAAO,IAAItC,kCADGsC,EAAEJ,QAAQpC,iBACqB4C,CAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GAET,OAAO,IAAIrC,mCADGqC,EAAEJ,QAAQpC,iBACsB4C,CAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GAET,OAAO,IAAIjC,sBADGiC,EAAEJ,QAAQpC,iBACS4C,CAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,wBAAwB,EAC5DR,aAAaC,MAAM,IAAIhC,8BACnBgC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,eAAe,EAEnDV,aAAaC,MAAM,IAAInC,oBAAoBmC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EACxF,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB+B,aAAa,EACjDX,aAAaC,MAAAA;GAET,OAAO,IAAIvB,kBADWuB,EAAEJ,QAAQjB,qBAAqB8B,aACxBE,CAAAA;EACjC,EACJ,CAAA;EAGAjB,UAAUG,SAASlB,qBAAqBiC,yBAAyB,EAC7Db,aAAaC,MAAAA;GAGT,OAAO,IAAI9B,8BAFY8B,EAAEJ,QAAQjB,qBAAqBwB,2BAGlDU,GACA,EAEIC,QAAQnB,OAAOoB,kBACnB,CAAA;EAER,EACJ,CAAA;EACArB,UAAUG,SAASlB,qBAAqBqC,2BAA2B,EAC/DjB,aAAaC,MAAAA;GAGT,OAAO,IAAI5B,gCAFY4B,EAAEJ,QAAQjB,qBAAqBwB,2BAEXU,CAAAA;EAC/C,EACJ,CAAA;EAGAnB,UAAUG,SAASlB,qBAAqBsC,kCAAkC,EACtElB,aAAaC,MAAAA;GAIT,OAAO,IAAI7B,uCAAuC;IAC9C+C,kBAJqBlB,EAAEJ,QAAQjB,qBAAqBmB,gBAIpDoB;IACAE,iBAJ0BpB,EAAEJ,QAAQjB,qBAAqBuB,eAIxCiB;GACrB,CAAA;EACJ,EACJ,CAAA;EAEAzB,UAAUG,SAASlB,qBAAqB0C,2BAA2B,EAC/DtB,aAAaC,MAAAA;GAGT,OAAO,IAAI3B,gCAFa2B,EAAEJ,QAAQjB,qBAAqB0B,4BAEZiB,CAAAA;EAC/C,EACJ,CAAA;EAGA5B,UAAUG,SAASlB,qBAAqB4C,cAAc,EAClDxB,aAAaC,MAAAA;GAGT,OAAO,IAAIxB,mBAFawB,EAAEJ,QAAQjB,qBAAqB2B,eAEzBkB,GADCxB,EAAEJ,QAAQjB,qBAAqB4B,sBACfkB,CAAAA;EACnD,EACJ,CAAA;EAGA/B,UAAUG,SAASlB,qBAAqB+C,eAAe,EACnD3B,aAAaC,MAAAA;GAIT,OAAO,IAAItB,oBAHWsB,EAAEJ,QAAQjB,qBAAqB8B,aAGtBE,GAFPX,EAAEJ,QAAQjB,qBAAqB2B,eAETkB,CAAAA;EAClD,EACJ,CAAA;EAGA9B,UAAUG,SAASlB,qBAAqBgD,mBAAmB,EACvD5B,aAAaC,MAAAA;GACT,MAAMwB,kBAAkBxB,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAMsB,cAAc5B,EAAEJ,QAAQjB,qBAAqB+B,WAAW;GAC9D,MAAMmB,uBAAuB7B,EAAEJ,QAAQhB,qBAAqBkD,YAAY;GACxE,MAAML,yBAAyBzB,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAItC,wBACPuD,iBACAI,aACA;IACId,QAAQnB,OAAOoB;IACfgB,QAAQpC,OAAOqC;GACnB,GACAH,sBACAJ,sBAAAA;EAER,EACJ,CAAA;EAGA/B,UAAUG,SAASlB,qBAAqBsD,oBAAoB,EACxDlC,aAAaC,MAAAA;GACT,MAAMwB,kBAAkBxB,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAMsB,cAAc5B,EAAEJ,QAAQjB,qBAAqB+B,WAAW;GAC9D,MAAMe,yBAAyBzB,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GAEpF,OAAO,IAAIhC,yBACPiD,iBACAI,aACA;IACId,QAAQnB,OAAOuC;IACfH,QAAQpC,OAAOqC;GACnB,GACAP,sBAAAA;EAER,EACJ,CAAA;EAGA/B,UAAUG,SAASlB,qBAAqBwD,mBAAmB,EACvDpC,aAAaC,MAAAA;GAKT,OAAO,IAAI1B,wBAAwB;IAC/B2B,YALeD,EAAEJ,QAAQjB,qBAAqB2B,eAK9CL;IACAmC,QALWpC,EAAEJ,QAAQjB,qBAAqB+B,WAK1C0B;IAEAC,kBANqBrC,EAAEJ,QAAQhB,qBAAqB0D,QAMpDD;IAEAE,SAAS;KAELzB,QAAQnB,OAAOoB;KACfgB,QAAQpC,OAAOqC;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}

package/dist/app/modules/oauth2/repositories/index.d.ts

@@ -2,5 +2,6 @@ export * from './authorize/index.ts';
 export * from './client/index.ts';
 export * from './scope/index.ts';
 export * from './key/index.ts';
+export * from './session-token/index.ts';
 export * from './token/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/app/modules/oauth2/repositories/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}

package/dist/app/modules/oauth2/repositories/index.mjs

@@ -9,6 +9,8 @@ import "./client/index.mjs";
 import { OAuth2ScopeRepository } from "./scope/repository.mjs";
 import { OAuth2KeyRepository } from "./key/repository.mjs";
 import "./key/index.mjs";
+import { SessionTokenRepositoryAdapter } from "./session-token/repository.mjs";
+import "./session-token/index.mjs";
 import { OAuth2TokenRepository } from "./token/repository.mjs";
 import "./token/index.mjs";
-export { OAuth2AuthorizationCodeRepository, OAuth2AuthorizationStateRepository, OAuth2ClientRepository, OAuth2KeyRepository, OAuth2ScopeRepository, OAuth2TokenRepository };
+export { OAuth2AuthorizationCodeRepository, OAuth2AuthorizationStateRepository, OAuth2ClientRepository, OAuth2KeyRepository, OAuth2ScopeRepository, OAuth2TokenRepository, SessionTokenRepositoryAdapter };

package/dist/app/modules/oauth2/repositories/session-token/index.d.ts

@@ -0,0 +1,2 @@
+export * from './repository.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/app/modules/oauth2/repositories/session-token/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,iBAAiB,CAAC"}

package/dist/app/modules/oauth2/repositories/session-token/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SessionTokenRepositoryAdapter } from "./repository.mjs";
+export { SessionTokenRepositoryAdapter };

package/dist/app/modules/oauth2/repositories/session-token/repository.d.ts

@@ -0,0 +1,17 @@
+import type { SessionToken } from '@authup/core-kit';
+import type { DataSource, Repository } from 'typeorm';
+import { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';
+import type { ISessionTokenRepository, SessionTokenCreateInput, SessionTokenRef } from '../../../../../core/index.ts';
+export declare class SessionTokenRepositoryAdapter implements ISessionTokenRepository {
+    protected repository: Repository<SessionTokenEntity>;
+    constructor(dataSource: DataSource);
+    create(input: SessionTokenCreateInput): Promise<SessionToken>;
+    findOneById(id: string): Promise<SessionToken | null>;
+    findBySessionId(sessionId: string): Promise<SessionToken[]>;
+    markRefreshConsumed(id: string, at: string): Promise<boolean>;
+    hasConsumedChild(parentId: string): Promise<boolean>;
+    revokeById(id: string, at: string): Promise<void>;
+    revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]>;
+    deleteExpired(before: string): Promise<number>;
+}
+//# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/oauth2/repositories/session-token/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AACvF,OAAO,KAAK,EACR,uBAAuB,EACvB,uBAAuB,EACvB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAEtC,qBAAa,6BAA8B,YAAW,uBAAuB;IACzE,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;gBAEzC,UAAU,EAAE,UAAU;IAI5B,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC;IAyB7D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIrD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI3D,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASpD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAsB5E,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAKvD"}

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs

@@ -0,0 +1,63 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SessionTokenEntity } from "../../../../../adapters/database/domains/session-token/entity.mjs";
+import "../../../../../adapters/database/domains/index.mjs";
+import { In, LessThan } from "typeorm";
+//#region src/app/modules/oauth2/repositories/session-token/repository.ts
+var SessionTokenRepositoryAdapter = class {
+	repository;
+	constructor(dataSource) {
+		this.repository = dataSource.getRepository(SessionTokenEntity);
+	}
+	async create(input) {
+		const entity = this.repository.create({
+			id: input.id,
+			session_id: input.session_id,
+			kind: input.kind,
+			parent_id: input.parent_id ?? null,
+			refresh_token_id: input.refresh_token_id ?? null,
+			ip_address: input.ip_address,
+			user_agent: input.user_agent,
+			consumed_at: null,
+			revoked_at: null,
+			expires_at: input.expires_at
+		});
+		await this.repository.insert(entity);
+		entity.created_at = entity.created_at ?? (/* @__PURE__ */ new Date()).toISOString();
+		return entity;
+	}
+	async findOneById(id) {
+		return this.repository.findOne({ where: { id } });
+	}
+	async findBySessionId(sessionId) {
+		return this.repository.find({ where: { session_id: sessionId } });
+	}
+	async markRefreshConsumed(id, at) {
+		return ((await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ consumed_at: at }).where("id = :id", { id }).andWhere("kind = :kind", { kind: "refresh" }).andWhere("consumed_at IS NULL").andWhere("revoked_at IS NULL").execute()).affected ?? 0) > 0;
+	}
+	async hasConsumedChild(parentId) {
+		return await this.repository.createQueryBuilder().where("parent_id = :parentId", { parentId }).andWhere("consumed_at IS NOT NULL").getCount() > 0;
+	}
+	async revokeById(id, at) {
+		await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revoked_at: at }).where("id = :id", { id }).andWhere("revoked_at IS NULL").execute();
+	}
+	async revokeBySessionId(sessionId, at) {
+		const refs = (await this.repository.find({
+			where: { session_id: sessionId },
+			select: ["id", "expires_at"]
+		})).map((row) => ({
+			id: row.id,
+			expires_at: row.expires_at
+		}));
+		if (refs.length > 0) await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revoked_at: at }).where({ id: In(refs.map((ref) => ref.id)) }).andWhere("revoked_at IS NULL").execute();
+		return refs;
+	}
+	async deleteExpired(before) {
+		return (await this.repository.delete({ expires_at: LessThan(before) })).affected ?? 0;
+	}
+};
+//#endregion
+export { SessionTokenRepositoryAdapter };
+
+//# sourceMappingURL=repository.mjs.map

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.mjs","names":["In","LessThan","SessionTokenEntity","SessionTokenRepositoryAdapter","repository","dataSource","getRepository","create","input","entity","id","session_id","kind","parent_id","refresh_token_id","ip_address","user_agent","consumed_at","revoked_at","expires_at","insert","created_at","Date","toISOString","findOneById","findOne","where","findBySessionId","sessionId","find","markRefreshConsumed","at","result","createQueryBuilder","update","set","andWhere","execute","affected","hasConsumedChild","parentId","count","getCount","revokeById","revokeBySessionId","rows","select","refs","map","row","length","ref","deleteExpired","before","delete"],"sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { SessionToken } from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { In, LessThan } from 'typeorm';\nimport { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';\nimport type {\n    ISessionTokenRepository,\n    SessionTokenCreateInput,\n    SessionTokenRef,\n} from '../../../../../core/index.ts';\n\nexport class SessionTokenRepositoryAdapter implements ISessionTokenRepository {\n    protected repository: Repository<SessionTokenEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(SessionTokenEntity);\n    }\n\n    async create(input: SessionTokenCreateInput): Promise<SessionToken> {\n        const entity = this.repository.create({\n            id: input.id,\n            session_id: input.session_id,\n            kind: input.kind,\n            parent_id: input.parent_id ?? null,\n            refresh_token_id: input.refresh_token_id ?? null,\n            ip_address: input.ip_address,\n            user_agent: input.user_agent,\n            consumed_at: null,\n            revoked_at: null,\n            expires_at: input.expires_at,\n        });\n\n        await this.repository.insert(entity);\n\n        // insert() does not hydrate @CreateDateColumn back onto the in-memory\n        // entity (the DB fills created_at via its DEFAULT). Stamp it so the\n        // returned object satisfies the SessionToken contract instead of\n        // carrying an undefined created_at.\n        entity.created_at = entity.created_at ?? new Date().toISOString();\n\n        return entity;\n    }\n\n    async findOneById(id: string): Promise<SessionToken | null> {\n        return this.repository.findOne({ where: { id } });\n    }\n\n    async findBySessionId(sessionId: string): Promise<SessionToken[]> {\n        return this.repository.find({ where: { session_id: sessionId } });\n    }\n\n    async markRefreshConsumed(id: string, at: string): Promise<boolean> {\n        const result = await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ consumed_at: at })\n            .where('id = :id', { id })\n            .andWhere('kind = :kind', { kind: 'refresh' })\n            .andWhere('consumed_at IS NULL')\n            .andWhere('revoked_at IS NULL')\n            .execute();\n\n        return (result.affected ?? 0) > 0;\n    }\n\n    async hasConsumedChild(parentId: string): Promise<boolean> {\n        const count = await this.repository.createQueryBuilder()\n            .where('parent_id = :parentId', { parentId })\n            .andWhere('consumed_at IS NOT NULL')\n            .getCount();\n\n        return count > 0;\n    }\n\n    async revokeById(id: string, at: string): Promise<void> {\n        await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ revoked_at: at })\n            .where('id = :id', { id })\n            .andWhere('revoked_at IS NULL')\n            .execute();\n    }\n\n    async revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]> {\n        const rows = await this.repository.find({\n            where: { session_id: sessionId },\n            select: ['id', 'expires_at'],\n        });\n\n        const refs: SessionTokenRef[] = rows.map((row) => ({\n            id: row.id,\n            expires_at: row.expires_at,\n        }));\n        if (refs.length > 0) {\n            await this.repository.createQueryBuilder()\n                .update(SessionTokenEntity)\n                .set({ revoked_at: at })\n                .where({ id: In(refs.map((ref) => ref.id)) })\n                .andWhere('revoked_at IS NULL')\n                .execute();\n        }\n\n        return refs;\n    }\n\n    async deleteExpired(before: string): Promise<number> {\n        const result = await this.repository.delete({ expires_at: LessThan(before) });\n\n        return result.affected ?? 0;\n    }\n}\n"],"mappings":";;;;;;;AAiBA,IAAaG,gCAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcJ,kBAAAA;CAC/C;CAEA,MAAMK,OAAOC,OAAuD;EAChE,MAAMC,SAAS,KAAKL,WAAWG,OAAO;GAClCG,IAAIF,MAAME;GACVC,YAAYH,MAAMG;GAClBC,MAAMJ,MAAMI;GACZC,WAAWL,MAAMK,aAAa;GAC9BC,kBAAkBN,MAAMM,oBAAoB;GAC5CC,YAAYP,MAAMO;GAClBC,YAAYR,MAAMQ;GAClBC,aAAa;GACbC,YAAY;GACZC,YAAYX,MAAMW;EACtB,CAAA;EAEA,MAAM,KAAKf,WAAWgB,OAAOX,MAAAA;EAM7BA,OAAOY,aAAaZ,OAAOY,+BAAc,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAE/D,OAAOd;CACX;CAEA,MAAMe,YAAYd,IAA0C;EACxD,OAAO,KAAKN,WAAWqB,QAAQ,EAAEC,OAAO,EAAEhB,GAAG,EAAE,CAAA;CACnD;CAEA,MAAMiB,gBAAgBC,WAA4C;EAC9D,OAAO,KAAKxB,WAAWyB,KAAK,EAAEH,OAAO,EAAEf,YAAYiB,UAAU,EAAE,CAAA;CACnE;CAEA,MAAME,oBAAoBpB,IAAYqB,IAA8B;EAUhE,SAAQC,MATa,KAAK5B,WAAW6B,mBAAkB,CAAA,CAClDC,OAAOhC,kBAAAA,CAAAA,CACPiC,IAAI,EAAElB,aAAac,GAAG,CAAA,CAAA,CACtBL,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvB0B,SAAS,gBAAgB,EAAExB,MAAM,UAAU,CAAA,CAAA,CAC3CwB,SAAS,qBAAA,CAAA,CACTA,SAAS,oBAAA,CAAA,CACTC,QAAO,EAAA,CAEGC,YAAY,KAAK;CACpC;CAEA,MAAMC,iBAAiBC,UAAoC;EAMvD,OAAOC,MALa,KAAKrC,WAAW6B,mBAAkB,CAAA,CACjDP,MAAM,yBAAyB,EAAEc,SAAS,CAAA,CAAA,CAC1CJ,SAAS,yBAAA,CAAA,CACTM,SAAQ,IAEE;CACnB;CAEA,MAAMC,WAAWjC,IAAYqB,IAA2B;EACpD,MAAM,KAAK3B,WAAW6B,mBAAkB,CAAA,CACnCC,OAAOhC,kBAAAA,CAAAA,CACPiC,IAAI,EAAEjB,YAAYa,GAAG,CAAA,CAAA,CACrBL,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvB0B,SAAS,oBAAA,CAAA,CACTC,QAAO;CAChB;CAEA,MAAMO,kBAAkBhB,WAAmBG,IAAwC;EAM/E,MAAMgB,QAA0BF,MALb,KAAKzC,WAAWyB,KAAK;GACpCH,OAAO,EAAEf,YAAYiB,UAAU;GAC/BkB,QAAQ,CAAC,MAAM,YAAA;EACnB,CAAA,EAAA,CAEqCE,KAAKC,SAAS;GAC/CvC,IAAIuC,IAAIvC;GACRS,YAAY8B,IAAI9B;EACpB,EAAA;EACA,IAAI4B,KAAKG,SAAS,GACd,MAAM,KAAK9C,WAAW6B,mBAAkB,CAAA,CACnCC,OAAOhC,kBAAAA,CAAAA,CACPiC,IAAI,EAAEjB,YAAYa,GAAG,CAAA,CAAA,CACrBL,MAAM,EAAEhB,IAAIV,GAAG+C,KAAKC,KAAKG,QAAQA,IAAIzC,EAAE,CAAA,EAAG,CAAA,CAAA,CAC1C0B,SAAS,oBAAA,CAAA,CACTC,QAAO;EAGhB,OAAOU;CACX;CAEA,MAAMK,cAAcC,QAAiC;EAGjD,QAAOrB,MAFc,KAAK5B,WAAWkD,OAAO,EAAEnC,YAAYlB,SAASoD,MAAAA,EAAQ,CAAA,EAAA,CAE7Df,YAAY;CAC9B;AACJ"}

package/dist/app/modules/provisioning/sources/default/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAMxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IA6F3C,gBAAgB,IAAI,4BAA4B,EAAE;IA6BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IAmEhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IA8F/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAMxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IA6F3C,gBAAgB,IAAI,4BAA4B,EAAE;IA6BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IAoEhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IA8F/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}

package/dist/app/modules/provisioning/sources/default/module.mjs

@@ -168,6 +168,7 @@ var DefaultProvisioningSource = class {
 					PermissionName.SCOPE_CREATE,
 					PermissionName.SCOPE_UPDATE,
 					PermissionName.SCOPE_DELETE,
+					PermissionName.SESSION_DELETE,
 					PermissionName.USER_CREATE,
 					PermissionName.USER_UPDATE,
 					PermissionName.USER_DELETE

package/dist/app/modules/provisioning/sources/default/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","RobotCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","built_in","realm_id","extraAttributes","decision_strategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","ROBOT_NAMES_SELF_MANAGE","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","ROBOT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","is_confidential","secret","clientSystemSecret","secret_hashed","clientSystemEnabled","robotCredentialsService","robotStrategy","robotAdminSecretReset","robots","robotAdminSecret","robotAdminEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n    Client, \n    Permission, \n    Robot, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    RobotCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                    },\n                ],\n            },\n            // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n            // Each `names` entry is what self-edit must REJECT; everything else\n            // is permitted. New columns added to the entity are self-editable\n            // by default — extend the denylist when adding admin-only state.\n            {\n                attributes: {\n                    name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        // FK + lifecycle\n                        'active',\n                        'realm_id',\n                        // Security-critical: a self-edit must not change the\n                        // client's confidentiality (toggling this clears the\n                        // secret) or downgrade the secret-storage format\n                        // (which would persist the secret in plaintext).\n                        'is_confidential',\n                        'secret_hashed',\n                        'secret_encrypted',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'realm_id',\n                        'user_id',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'name_locked',\n                        'status',\n                        'status_message',\n                        'realm_id',\n                    ],\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        const policiesByPermission: Partial<Record<string, string[]>> = {\n            [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n            [PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],\n            [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n        };\n\n        return Object.values(PermissionName)\n            .map((name) => {\n                const entity: PermissionProvisioningEntity = {\n                    strategy: {\n                        type: ProvisioningEntityStrategyType.MERGE,\n                        attributes: ['built_in'] as (keyof Permission)[],\n                    },\n                    attributes: {\n                        name,\n                        built_in: true,\n                    },\n                };\n\n                const policies = policiesByPermission[name];\n                if (policies) {\n                    entity.relations = { policies };\n                }\n\n                return entity;\n            });\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    built_in: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    built_in: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    // Global admin: unrestricted realm reach (any realm + null/global).\n                    globalPermissionsRealmScope: RealmScope.ANY,\n                },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    built_in: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    // realm_admin: own realm + null/global by default (so it can\n                    // read/assign global building blocks), but strictly own-realm for\n                    // direct entity CUD (cannot create/modify global entities).\n                    globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n                    globalPermissionsRealmScopeOverrides: {\n                        [RealmScope.OWN]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROBOT_CREATE,\n                            PermissionName.ROBOT_UPDATE,\n                            PermissionName.ROBOT_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                built_in: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in', 'is_confidential', 'secret', 'secret_hashed', 'secret_encrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in', 'is_confidential'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    built_in: true,\n                    is_confidential: true,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),\n                    secret_hashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const robotCredentialsService = new RobotCredentialsService();\n\n        let robotStrategy : ProvisioningEntityStrategy<Robot> | undefined;\n        if (config.robotAdminSecretReset) {\n            robotStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['secret'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.robots = [\n            {\n                strategy: robotStrategy,\n                attributes: {\n                    name: 'system',\n                    secret: await robotCredentialsService.protect(config.robotAdminSecret),\n                    active: config.robotAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2CA,IAAae,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMhB,iBAAiBiB;KACvBC,MAAMpB,kBAAkBqB;KACxBC,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EAAEC,mBAAmBtB,iBAAiBuB,UAAU;IACjEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMhB,iBAAiB0B;KACvBR,MAAMpB,kBAAkB4B;KACxBN,UAAU;KACVC,UAAU;IACd,EACJ,GACA,EACIN,YAAY;KACRC,MAAMhB,iBAAiB2B;KACvBT,MAAMpB,kBAAkB6B;KACxBP,UAAU;KACVC,UAAU;IACd,EACJ,CAAA;GAER;GAKA;IACIN,YAAY;KACRC,MAAMhB,iBAAiB4B;KACvBV,MAAMpB,kBAAkB+B;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAKA;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMhB,iBAAiBgC;KACvBd,MAAMpB,kBAAkB+B;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMhB,iBAAiBiC;KACvBf,MAAMpB,kBAAkB+B;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;MAER;GACJ;;CAER;CAEAG,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3DjC,eAAekC,qBAAqB,CAACpC,iBAAiBiB,SAASjB,iBAAiB4B,wBAAAA;IAChF1B,eAAemC,oBAAoB,CAACrC,iBAAiBiB,SAASjB,iBAAiBgC,uBAAAA;IAC/E9B,eAAeoC,mBAAmB,CAACtC,iBAAiBiB,SAASjB,iBAAiBiC,sBAAAA;EACnF;EAEA,OAAOM,OAAOC,OAAOtC,cAAAA,CAAAA,CAChBuC,KAAKzB,SAAAA;GACF,MAAM0B,SAAuC;IACzCC,UAAU;KACNzB,MAAMN,+BAA+BgC;KACrC7B,YAAY,CAAC,UAAA;IACjB;IACAA,YAAY;KACRC;KACAI,UAAU;IACd;GACJ;GAEA,MAAMyB,WAAWV,qBAAqBnB;GACtC,IAAI6B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAOlC,SAAAA,CAAAA,CAChBmC,KAAKzB,UAAU;GACZ2B,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC;IACAI,UAAU;GACd;EACJ,EAAA;CACR;CAEA4B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMZ;IACNgB,UAAU;GACd;GACA0B,WAAW;IACPG,mBAAmB,CAAC,GAAA;IAEpBC,6BAA6BnD,WAAWoD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMX;IACNe,UAAU;GACd;GACA0B,WAAW;IACPG,mBAAmB,CAAC,GAAA;IACpBG,0BAA0B;KACtBlD,eAAemD;KACfnD,eAAeoD;KACfpD,eAAeqD;;IAKnBL,6BAA6BnD,WAAWyD;IACxCC,sCAAsC,GACjC1D,WAAW2D,MAAM;KACdxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;MAEvB;GACJ;EACJ,CAAA;CAER;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1CvC,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMb;IACNiB,UAAU;GACd;GACA0B,WAAW,CAAC;EAChB;EAEA,MAAMqC,yBAAyB,IAAIzE,uBAAAA;EAEnC,IAAI0E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXlE,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,UAAA;EACjB;EAGJmE,YAAYpC,YAAYoC,YAAYpC,aAAa,CAAC;EAClDoC,YAAYpC,UAAUwC,QAAQ,CAC1B;GACI3C,UAAUyC;GACVrE,YAAY;IACRC,MAAM;IACNuE,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOnF,mBAAmB,OAAA;IAC1BoF,QAAQV,OAAOW;GACnB;GACA9C,WAAW,EAAE+C,aAAa,CAACzF,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAM0F,2BAA2B,IAAItF,yBAAAA;EAErC,IAAIuF;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACb7E,MAAMN,+BAA+BgC;GACrC7B,YAAY;IAAC;IAAY;IAAmB;IAAU;IAAiB;;EAC3E;OAEAgF,iBAAiB;GACb7E,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,YAAY,iBAAA;EAC7B;EAGJmE,YAAYpC,YAAYoC,YAAYpC,aAAa,CAAC;EAClDoC,YAAYpC,UAAUmD,UAAU,CAC5B;GACItD,UAAUoD;GACVhF,YAAY;IACRK,UAAU;IACV8E,iBAAiB;IACjBlF,MAAM;IACNmF,QAAQ,MAAML,yBAAyBN,QAAQP,OAAOmB,oBAAoB,EAAEC,eAAe,MAAM,CAAA;IACjGA,eAAe;IACfV,QAAQV,OAAOqB;GACnB;GACAxD,WAAW,EAAE+C,aAAa,CAACzF,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAMmG,0BAA0B,IAAI9F,wBAAAA;EAEpC,IAAI+F;EACJ,IAAIvB,OAAOwB,uBACPD,gBAAgB;GACZtF,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,QAAA;EACjB;EAGJmE,YAAYpC,YAAYoC,YAAYpC,aAAa,CAAC;EAClDoC,YAAYpC,UAAU4D,SAAS,CAC3B;GACI/D,UAAU6D;GACVzF,YAAY;IACRC,MAAM;IACNmF,QAAQ,MAAMI,wBAAwBf,QAAQP,OAAO0B,gBAAgB;IACrEhB,QAAQV,OAAO2B;GACnB;GACA9D,WAAW,EAAE+C,aAAa,CAACzF,eAAAA,EAAiB;EAChD,CAAA;EAGJ,OAAO,CAAC8E,WAAAA;CACZ;CAEA,MAAM2B,KAAKC,WAAwD;EAC/D,MAAM7B,SAAS6B,UAAUC,QAAQpG,kBAAAA;EAEjC,OAAO;GACHkC,UAAU,KAAK/B,cAAa;GAC5BkG,aAAa,KAAK9E,iBAAgB;GAClC+E,QAAQ,KAAKlE,YAAW;GACxBmE,OAAO,KAAKlE,WAAU;GACtBmE,QAAQ,MAAM,KAAKnC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","RobotCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","built_in","realm_id","extraAttributes","decision_strategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","ROBOT_NAMES_SELF_MANAGE","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","ROBOT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","SESSION_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","is_confidential","secret","clientSystemSecret","secret_hashed","clientSystemEnabled","robotCredentialsService","robotStrategy","robotAdminSecretReset","robots","robotAdminSecret","robotAdminEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n    Client, \n    Permission, \n    Robot, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    RobotCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                    },\n                ],\n            },\n            // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n            // Each `names` entry is what self-edit must REJECT; everything else\n            // is permitted. New columns added to the entity are self-editable\n            // by default — extend the denylist when adding admin-only state.\n            {\n                attributes: {\n                    name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        // FK + lifecycle\n                        'active',\n                        'realm_id',\n                        // Security-critical: a self-edit must not change the\n                        // client's confidentiality (toggling this clears the\n                        // secret) or downgrade the secret-storage format\n                        // (which would persist the secret in plaintext).\n                        'is_confidential',\n                        'secret_hashed',\n                        'secret_encrypted',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'realm_id',\n                        'user_id',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'name_locked',\n                        'status',\n                        'status_message',\n                        'realm_id',\n                    ],\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        const policiesByPermission: Partial<Record<string, string[]>> = {\n            [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n            [PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],\n            [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n        };\n\n        return Object.values(PermissionName)\n            .map((name) => {\n                const entity: PermissionProvisioningEntity = {\n                    strategy: {\n                        type: ProvisioningEntityStrategyType.MERGE,\n                        attributes: ['built_in'] as (keyof Permission)[],\n                    },\n                    attributes: {\n                        name,\n                        built_in: true,\n                    },\n                };\n\n                const policies = policiesByPermission[name];\n                if (policies) {\n                    entity.relations = { policies };\n                }\n\n                return entity;\n            });\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    built_in: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    built_in: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    // Global admin: unrestricted realm reach (any realm + null/global).\n                    globalPermissionsRealmScope: RealmScope.ANY,\n                },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    built_in: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    // realm_admin: own realm + null/global by default (so it can\n                    // read/assign global building blocks), but strictly own-realm for\n                    // direct entity CUD (cannot create/modify global entities).\n                    globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n                    globalPermissionsRealmScopeOverrides: {\n                        [RealmScope.OWN]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROBOT_CREATE,\n                            PermissionName.ROBOT_UPDATE,\n                            PermissionName.ROBOT_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.SESSION_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                built_in: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in', 'is_confidential', 'secret', 'secret_hashed', 'secret_encrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in', 'is_confidential'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    built_in: true,\n                    is_confidential: true,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),\n                    secret_hashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const robotCredentialsService = new RobotCredentialsService();\n\n        let robotStrategy : ProvisioningEntityStrategy<Robot> | undefined;\n        if (config.robotAdminSecretReset) {\n            robotStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['secret'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.robots = [\n            {\n                strategy: robotStrategy,\n                attributes: {\n                    name: 'system',\n                    secret: await robotCredentialsService.protect(config.robotAdminSecret),\n                    active: config.robotAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2CA,IAAae,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMhB,iBAAiBiB;KACvBC,MAAMpB,kBAAkBqB;KACxBC,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EAAEC,mBAAmBtB,iBAAiBuB,UAAU;IACjEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMhB,iBAAiB0B;KACvBR,MAAMpB,kBAAkB4B;KACxBN,UAAU;KACVC,UAAU;IACd,EACJ,GACA,EACIN,YAAY;KACRC,MAAMhB,iBAAiB2B;KACvBT,MAAMpB,kBAAkB6B;KACxBP,UAAU;KACVC,UAAU;IACd,EACJ,CAAA;GAER;GAKA;IACIN,YAAY;KACRC,MAAMhB,iBAAiB4B;KACvBV,MAAMpB,kBAAkB+B;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAKA;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMhB,iBAAiBgC;KACvBd,MAAMpB,kBAAkB+B;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMhB,iBAAiBiC;KACvBf,MAAMpB,kBAAkB+B;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;MAER;GACJ;;CAER;CAEAG,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3DjC,eAAekC,qBAAqB,CAACpC,iBAAiBiB,SAASjB,iBAAiB4B,wBAAAA;IAChF1B,eAAemC,oBAAoB,CAACrC,iBAAiBiB,SAASjB,iBAAiBgC,uBAAAA;IAC/E9B,eAAeoC,mBAAmB,CAACtC,iBAAiBiB,SAASjB,iBAAiBiC,sBAAAA;EACnF;EAEA,OAAOM,OAAOC,OAAOtC,cAAAA,CAAAA,CAChBuC,KAAKzB,SAAAA;GACF,MAAM0B,SAAuC;IACzCC,UAAU;KACNzB,MAAMN,+BAA+BgC;KACrC7B,YAAY,CAAC,UAAA;IACjB;IACAA,YAAY;KACRC;KACAI,UAAU;IACd;GACJ;GAEA,MAAMyB,WAAWV,qBAAqBnB;GACtC,IAAI6B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAOlC,SAAAA,CAAAA,CAChBmC,KAAKzB,UAAU;GACZ2B,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC;IACAI,UAAU;GACd;EACJ,EAAA;CACR;CAEA4B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMZ;IACNgB,UAAU;GACd;GACA0B,WAAW;IACPG,mBAAmB,CAAC,GAAA;IAEpBC,6BAA6BnD,WAAWoD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMX;IACNe,UAAU;GACd;GACA0B,WAAW;IACPG,mBAAmB,CAAC,GAAA;IACpBG,0BAA0B;KACtBlD,eAAemD;KACfnD,eAAeoD;KACfpD,eAAeqD;;IAKnBL,6BAA6BnD,WAAWyD;IACxCC,sCAAsC,GACjC1D,WAAW2D,MAAM;KACdxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;MAEvB;GACJ;EACJ,CAAA;CAER;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1CxC,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMb;IACNiB,UAAU;GACd;GACA0B,WAAW,CAAC;EAChB;EAEA,MAAMsC,yBAAyB,IAAI1E,uBAAAA;EAEnC,IAAI2E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXnE,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,UAAA;EACjB;EAGJoE,YAAYrC,YAAYqC,YAAYrC,aAAa,CAAC;EAClDqC,YAAYrC,UAAUyC,QAAQ,CAC1B;GACI5C,UAAU0C;GACVtE,YAAY;IACRC,MAAM;IACNwE,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOpF,mBAAmB,OAAA;IAC1BqF,QAAQV,OAAOW;GACnB;GACA/C,WAAW,EAAEgD,aAAa,CAAC1F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAM2F,2BAA2B,IAAIvF,yBAAAA;EAErC,IAAIwF;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACb9E,MAAMN,+BAA+BgC;GACrC7B,YAAY;IAAC;IAAY;IAAmB;IAAU;IAAiB;;EAC3E;OAEAiF,iBAAiB;GACb9E,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,YAAY,iBAAA;EAC7B;EAGJoE,YAAYrC,YAAYqC,YAAYrC,aAAa,CAAC;EAClDqC,YAAYrC,UAAUoD,UAAU,CAC5B;GACIvD,UAAUqD;GACVjF,YAAY;IACRK,UAAU;IACV+E,iBAAiB;IACjBnF,MAAM;IACNoF,QAAQ,MAAML,yBAAyBN,QAAQP,OAAOmB,oBAAoB,EAAEC,eAAe,MAAM,CAAA;IACjGA,eAAe;IACfV,QAAQV,OAAOqB;GACnB;GACAzD,WAAW,EAAEgD,aAAa,CAAC1F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAMoG,0BAA0B,IAAI/F,wBAAAA;EAEpC,IAAIgG;EACJ,IAAIvB,OAAOwB,uBACPD,gBAAgB;GACZvF,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,QAAA;EACjB;EAGJoE,YAAYrC,YAAYqC,YAAYrC,aAAa,CAAC;EAClDqC,YAAYrC,UAAU6D,SAAS,CAC3B;GACIhE,UAAU8D;GACV1F,YAAY;IACRC,MAAM;IACNoF,QAAQ,MAAMI,wBAAwBf,QAAQP,OAAO0B,gBAAgB;IACrEhB,QAAQV,OAAO2B;GACnB;GACA/D,WAAW,EAAEgD,aAAa,CAAC1F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,OAAO,CAAC+E,WAAAA;CACZ;CAEA,MAAM2B,KAAKC,WAAwD;EAC/D,MAAM7B,SAAS6B,UAAUC,QAAQrG,kBAAAA;EAEjC,OAAO;GACHkC,UAAU,KAAK/B,cAAa;GAC5BmG,aAAa,KAAK/E,iBAAgB;GAClCgF,QAAQ,KAAKnE,YAAW;GACxBoE,OAAO,KAAKnE,WAAU;GACtBoE,QAAQ,MAAM,KAAKnC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}

package/dist/app/modules/provisioning/sources/file/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAElE,qBAAa,sBAAuB,YAAW,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,OAAO,EAAE,+BAA+B;IAM9C,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;CAmBhD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAElE,qBAAa,sBAAuB,YAAW,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,OAAO,EAAE,+BAA+B;IAM9C,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;CAmBhD"}

package/dist/app/modules/provisioning/sources/file/module.mjs

@@ -4,6 +4,7 @@ import.meta.url;
 import { RootProvisioningValidator } from "../../../../../core/provisioning/entities/root/validator.mjs";
 import "../../../../../core/provisioning/entities/index.mjs";
 import { CompositeProvisioningSource } from "../composite/module.mjs";
+import { ValidatorGroup } from "@authup/kit";
 import path from "node:path";
 import { load, locateMany } from "locter";
 //#region src/app/modules/provisioning/sources/file/module.ts
@@ -20,7 +21,7 @@ var FileProvisioningSource = class {
 		const output = {};
 		for (const location of locations) {
 			const raw = await load(location);
-			const data = await this.rootValidator.run(raw.default);
+			const data = await this.rootValidator.run(raw.default, { group: ValidatorGroup.PROVISIONING });
 			compositeSource.merge(output, data);
 		}
 		return output;

package/dist/app/modules/provisioning/sources/file/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["load","locateMany","path","RootProvisioningValidator","CompositeProvisioningSource","FileProvisioningSource","options","rootValidator","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","data","run","default","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { load, locateMany } from 'locter';\nimport path from 'node:path';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\nexport class FileProvisioningSource implements IProvisioningSource {\n    protected options: FileEntitySchemaImporterOptions;\n\n    protected rootValidator: RootProvisioningValidator;\n\n    constructor(options: FileEntitySchemaImporterOptions) {\n        this.options = options;\n\n        this.rootValidator = new RootProvisioningValidator();\n    }\n\n    async load(): Promise<RootProvisioningEntity> {\n        const cwd = path.isAbsolute(this.options.cwd) ?\n            this.options.cwd :\n            path.join(process.cwd(), this.options.cwd);\n\n        const locations = await locateMany('*.{json,yaml,yml,ts,mts,mjs,js}', { path: cwd });\n\n        const compositeSource = new CompositeProvisioningSource([]);\n\n        const output : RootProvisioningEntity = {};\n        for (const location of locations) {\n            const raw = await load(location);\n            const data = await this.rootValidator.run(raw.default);\n\n            compositeSource.merge(output, data);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;AAeA,IAAaK,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIJ,0BAAAA;CAC7B;CAEA,MAAMH,OAAwC;EAK1C,MAAMY,YAAY,MAAMX,WAAW,mCAAmC,EAAEC,MAJ5DA,KAAKO,WAAW,KAAKH,QAAQE,GAAG,IACxC,KAAKF,QAAQE,MACbN,KAAKQ,KAAKC,QAAQH,IAAG,GAAI,KAAKF,QAAQE,GAAG,EAEqC,CAAA;EAElF,MAAMK,kBAAkB,IAAIT,4BAA4B,CAAA,CAAE;EAE1D,MAAMU,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,MAAMhB,KAAKe,QAAAA;GACvB,MAAME,OAAO,MAAM,KAAKV,cAAcW,IAAIF,IAAIG,OAAO;GAErDN,gBAAgBO,MAAMN,QAAQG,IAAAA;EAClC;EAEA,OAAOH;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["ValidatorGroup","load","locateMany","path","RootProvisioningValidator","CompositeProvisioningSource","FileProvisioningSource","options","rootValidator","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","data","run","default","group","PROVISIONING","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { ValidatorGroup } from '@authup/kit';\nimport { load, locateMany } from 'locter';\nimport path from 'node:path';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\nexport class FileProvisioningSource implements IProvisioningSource {\n    protected options: FileEntitySchemaImporterOptions;\n\n    protected rootValidator: RootProvisioningValidator;\n\n    constructor(options: FileEntitySchemaImporterOptions) {\n        this.options = options;\n\n        this.rootValidator = new RootProvisioningValidator();\n    }\n\n    async load(): Promise<RootProvisioningEntity> {\n        const cwd = path.isAbsolute(this.options.cwd) ?\n            this.options.cwd :\n            path.join(process.cwd(), this.options.cwd);\n\n        const locations = await locateMany('*.{json,yaml,yml,ts,mts,mjs,js}', { path: cwd });\n\n        const compositeSource = new CompositeProvisioningSource([]);\n\n        const output : RootProvisioningEntity = {};\n        for (const location of locations) {\n            const raw = await load(location);\n            const data = await this.rootValidator.run(raw.default, { group: ValidatorGroup.PROVISIONING });\n\n            compositeSource.merge(output, data);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;;AAgBA,IAAaM,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIJ,0BAAAA;CAC7B;CAEA,MAAMH,OAAwC;EAK1C,MAAMY,YAAY,MAAMX,WAAW,mCAAmC,EAAEC,MAJ5DA,KAAKO,WAAW,KAAKH,QAAQE,GAAG,IACxC,KAAKF,QAAQE,MACbN,KAAKQ,KAAKC,QAAQH,IAAG,GAAI,KAAKF,QAAQE,GAAG,EAEqC,CAAA;EAElF,MAAMK,kBAAkB,IAAIT,4BAA4B,CAAA,CAAE;EAE1D,MAAMU,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,MAAMhB,KAAKe,QAAAA;GACvB,MAAME,OAAO,MAAM,KAAKV,cAAcW,IAAIF,IAAIG,SAAS,EAAEC,OAAOrB,eAAesB,aAAa,CAAA;GAE5FR,gBAAgBS,MAAMR,QAAQG,IAAAA;EAClC;EAEA,OAAOH;CACX;AACJ"}

package/dist/cli/commands/migration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/migration.ts"],"names":[],"mappings":"AA4BA,aAAK,kBAAkB;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,GAAG,QAAQ;CACd;AAuHD,wBAAgB,yBAAyB;;;;;;;GAyCxC"}
+{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/migration.ts"],"names":[],"mappings":"AA4BA,aAAK,kBAAkB;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,GAAG,QAAQ;CACd;AAsID,wBAAgB,yBAAyB;;;;;;;GAyCxC"}

package/dist/cli/commands/migration.mjs

@@ -47,13 +47,17 @@ async function runMigrationOperation(container, operation) {
 			"migration"
 		]
 	});
-	await dataSource.initialize();
 	try {
+		await dataSource.initialize();
 		if (operation === "revert") await dataSource.undoLastMigration();
 		else if (operation === "status") await dataSource.showMigrations();
 		else await dataSource.runMigrations();
 	} finally {
-		await dataSource.destroy();
+		if (dataSource.isInitialized) try {
+			await dataSource.destroy();
+		} catch (e) {
+			logger.error(`Failed to destroy data source after migration operation: ${e}`);
+		}
 	}
 }
 async function generateMigrations() {
@@ -84,8 +88,8 @@ async function generateMigrations() {
 			synchronize: false
 		});
 		const dataSource = new DataSource(dataSourceOptions);
-		await dataSource.initialize();
 		try {
+			await dataSource.initialize();
 			await dataSource.runMigrations();
 			await generateMigration({
 				dataSource,
@@ -95,7 +99,11 @@ async function generateMigrations() {
 				prettify: true
 			});
 		} finally {
-			await dataSource.destroy();
+			if (dataSource.isInitialized) try {
+				await dataSource.destroy();
+			} catch (e) {
+				console.error(e);
+			}
 		}
 	}
 }

package/dist/cli/commands/migration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"migration.mjs","names":["defineCommand","path","process","checkDatabase","createDatabase","dropDatabase","generateMigration","transformFilePath","DataSource","DataSourceOptionsBuilder","ApplicationBuilder","ConfigInjectionKey","LoggerInjectionKey","ModuleName","CODE_PATH","MigrationOperation","runMigrationOperation","container","operation","config","resolve","logger","optionsBuilder","options","db","buildWith","buildWithEnv","debug","type","database","Array","isArray","migrations","i","length","check","exists","synchronize","ifNotExist","dataSource","logging","initialize","undoLastMigration","showMigrations","runMigrations","destroy","generateMigrations","connections","host","port","username","password","baseDirectory","join","timestamp","Date","now","connection","dataSourceOptions","directoryPath","name","prettify","defineCLIMigrationCommand","meta","args","required","Object","values","valueHint","setup","context","app","withConfig","withLogger","build","addModule","DATABASE","dependencies","CONFIG","LOGGER","exit","e","console","error"],"sources":["../../../src/cli/commands/migration.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport path from 'node:path';\nimport process from 'node:process';\nimport {\n    checkDatabase,\n    createDatabase, \n    dropDatabase, \n    generateMigration, \n    transformFilePath,\n} from 'typeorm-extension';\nimport { DataSource, type DataSourceOptions } from 'typeorm';\nimport { DataSourceOptionsBuilder } from '../../adapters/database/index.ts';\nimport {\n    ApplicationBuilder, \n    ConfigInjectionKey, \n    LoggerInjectionKey, \n    ModuleName,\n} from '../../app/index.ts';\nimport type { IContainer } from 'eldin';\nimport { CODE_PATH } from '../../path.ts';\n\nenum MigrationOperation {\n    GENERATE = 'generate',\n    REVERT = 'revert',\n    STATUS = 'status',\n    RUN = 'run',\n}\n\nasync function runMigrationOperation(\n    container: IContainer,\n    operation: string,\n): Promise<void> {\n    const config = container.resolve(ConfigInjectionKey);\n    const logger = container.resolve(LoggerInjectionKey);\n\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    let options: DataSourceOptions;\n    if (config.db) {\n        options = optionsBuilder.buildWith(config.db);\n    } else {\n        options = optionsBuilder.buildWithEnv();\n    }\n\n    logger.debug(`Type: ${options.type}`);\n    logger.debug(`Database: ${options.database}`);\n\n    if (Array.isArray(options.migrations)) {\n        for (let i = 0; i < options.migrations.length; i++) {\n            if (typeof options.migrations[i] === 'string') {\n                logger.debug(`Migration-Directory: ${options.migrations[i]}`);\n            }\n        }\n    } else if (typeof options.migrations === 'string') {\n        logger.debug(`Migration-Directory: ${options.migrations}`);\n    }\n\n    const check = await checkDatabase({ options });\n\n    if (!check.exists) {\n        await createDatabase({\n            options,\n            synchronize: false,\n            ifNotExist: true, \n        });\n    }\n\n    const dataSource = new DataSource({\n        ...options,\n        logging: ['error', 'schema', 'migration'],\n    });\n    await dataSource.initialize();\n\n    try {\n        if (operation === MigrationOperation.REVERT) {\n            await dataSource.undoLastMigration();\n        } else if (operation === MigrationOperation.STATUS) {\n            await dataSource.showMigrations();\n        } else {\n            await dataSource.runMigrations();\n        }\n    } finally {\n        await dataSource.destroy();\n    }\n}\n\nasync function generateMigrations(): Promise<void> {\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    const connections: DataSourceOptions[] = [\n        {\n            type: 'postgres',\n            database: 'migrations',\n            host: 'localhost',\n            port: 5432,\n            username: 'postgres',\n            password: 'start123',\n        },\n        {\n            type: 'mysql',\n            database: 'migrations',\n            host: 'localhost',\n            port: 3306,\n            username: 'root',\n            password: 'start123',\n        },\n    ];\n\n    const baseDirectory = transformFilePath(\n        path.join(CODE_PATH, 'adapters', 'database', 'migrations'),\n        './src',\n        './dist',\n    );\n\n    const timestamp = Date.now();\n\n    for (const connection of connections) {\n        const dataSourceOptions = optionsBuilder.buildWith(connection);\n        const directoryPath = path.join(baseDirectory, dataSourceOptions.type);\n\n        await dropDatabase({ options: dataSourceOptions });\n        await createDatabase({\n            options: dataSourceOptions,\n            synchronize: false, \n        });\n\n        const dataSource = new DataSource(dataSourceOptions);\n        await dataSource.initialize();\n\n        try {\n            await dataSource.runMigrations();\n\n            await generateMigration({\n                dataSource,\n                name: 'Default',\n                directoryPath,\n                timestamp,\n                prettify: true,\n            });\n        } finally {\n            await dataSource.destroy();\n        }\n    }\n}\n\nexport function defineCLIMigrationCommand() {\n    return defineCommand({\n        meta: { name: 'migration' },\n        args: {\n            operation: {\n                required: true,\n                type: 'positional',\n                options: Object.values(MigrationOperation),\n                valueHint: Object.values(MigrationOperation).join('|'),\n            },\n        },\n        async setup(context) {\n            try {\n                if (context.args.operation === MigrationOperation.GENERATE) {\n                    await generateMigrations();\n                } else {\n                    const app = new ApplicationBuilder()\n                        .withConfig()\n                        .withLogger()\n                        .build();\n\n                    app.addModule({\n                        name: ModuleName.DATABASE,\n                        dependencies: [ModuleName.CONFIG, ModuleName.LOGGER],\n                        async setup(container: IContainer): Promise<void> {\n                            await runMigrationOperation(container, context.args.operation);\n                        },\n                    });\n\n                    await app.setup();\n                }\n\n                process.exit(0);\n            } catch (e) {\n                // eslint-disable-next-line no-console\n                console.error(e);\n\n                process.exit(1);\n            }\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA4BA,IAAA,qBAAKe,uBAAAA,oBAAAA;;;;;QAAAA;EAAAA,sBAAAA,CAAAA,CAAAA;AAOL,eAAeC,sBACXC,WACAC,WAAiB;CAEjB,MAAMC,SAASF,UAAUG,QAAQT,kBAAAA;CACjC,MAAMU,SAASJ,UAAUG,QAAQR,kBAAAA;CAEjC,MAAMU,iBAAiB,IAAIb,yBAAAA;CAE3B,IAAIc;CACJ,IAAIJ,OAAOK,IACPD,UAAUD,eAAeG,UAAUN,OAAOK,EAAE;MAE5CD,UAAUD,eAAeI,aAAY;CAGzCL,OAAOM,MAAM,SAASJ,QAAQK,MAAM;CACpCP,OAAOM,MAAM,aAAaJ,QAAQM,UAAU;CAE5C,IAAIC,MAAMC,QAAQR,QAAQS,UAAU;OAC3B,IAAIC,IAAI,GAAGA,IAAIV,QAAQS,WAAWE,QAAQD,KAC3C,IAAI,OAAOV,QAAQS,WAAWC,OAAO,UACjCZ,OAAOM,MAAM,wBAAwBJ,QAAQS,WAAWC,IAAI;CAAA,OAGjE,IAAI,OAAOV,QAAQS,eAAe,UACrCX,OAAOM,MAAM,wBAAwBJ,QAAQS,YAAY;CAK7D,IAAI,EAACG,MAFehC,cAAc,EAAEoB,QAAQ,CAAA,EAAA,CAEjCa,QACP,MAAMhC,eAAe;EACjBmB;EACAc,aAAa;EACbC,YAAY;CAChB,CAAA;CAGJ,MAAMC,aAAa,IAAI/B,WAAW;EAC9B,GAAGe;EACHiB,SAAS;GAAC;GAAS;GAAU;;CACjC,CAAA;CACA,MAAMD,WAAWE,WAAU;CAE3B,IAAI;EACA,IAAIvB,cAAAA,UACA,MAAMqB,WAAWG,kBAAiB;OAC/B,IAAIxB,cAAAA,UACP,MAAMqB,WAAWI,eAAc;OAE/B,MAAMJ,WAAWK,cAAa;CAEtC,UAAU;EACN,MAAML,WAAWM,QAAO;CAC5B;AACJ;AAEA,eAAeC,qBAAAA;CACX,MAAMxB,iBAAiB,IAAIb,yBAAAA;CAE3B,MAAMsC,cAAmC,CACrC;EACInB,MAAM;EACNC,UAAU;EACVmB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,GACA;EACIvB,MAAM;EACNC,UAAU;EACVmB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,CAAA;CAGJ,MAAMC,gBAAgB7C,kBAClBN,KAAKoD,KAAKvC,WAAW,YAAY,YAAY,YAAA,GAC7C,SACA,QAAA;CAGJ,MAAMwC,YAAYC,KAAKC,IAAG;CAE1B,KAAK,MAAMC,cAAcV,aAAa;EAClC,MAAMW,oBAAoBpC,eAAeG,UAAUgC,UAAAA;EACnD,MAAME,gBAAgB1D,KAAKoD,KAAKD,eAAeM,kBAAkB9B,IAAI;EAErE,MAAMvB,aAAa,EAAEkB,SAASmC,kBAAkB,CAAA;EAChD,MAAMtD,eAAe;GACjBmB,SAASmC;GACTrB,aAAa;EACjB,CAAA;EAEA,MAAME,aAAa,IAAI/B,WAAWkD,iBAAAA;EAClC,MAAMnB,WAAWE,WAAU;EAE3B,IAAI;GACA,MAAMF,WAAWK,cAAa;GAE9B,MAAMtC,kBAAkB;IACpBiC;IACAqB,MAAM;IACND;IACAL;IACAO,UAAU;GACd,CAAA;EACJ,UAAU;GACN,MAAMtB,WAAWM,QAAO;EAC5B;CACJ;AACJ;AAEA,SAAgBiB,4BAAAA;CACZ,OAAO9D,cAAc;EACjB+D,MAAM,EAAEH,MAAM,YAAY;EAC1BI,MAAM,EACF9C,WAAW;GACP+C,UAAU;GACVrC,MAAM;GACNL,SAAS2C,OAAOC,OAAOpD,kBAAAA;GACvBqD,WAAWF,OAAOC,OAAOpD,kBAAAA,CAAAA,CAAoBsC,KAAK,GAAA;EACtD,EACJ;EACA,MAAMgB,MAAMC,SAAO;GACf,IAAI;IACA,IAAIA,QAAQN,KAAK9C,cAAS,YACtB,MAAM4B,mBAAAA;SACH;KACH,MAAMyB,MAAM,IAAI7D,mBAAAA,CAAAA,CACX8D,WAAU,CAAA,CACVC,WAAU,CAAA,CACVC,MAAK;KAEVH,IAAII,UAAU;MACVf,MAAM/C,WAAW+D;MACjBC,cAAc,CAAChE,WAAWiE,QAAQjE,WAAWkE,MAAAA;MAC7C,MAAMV,MAAMpD,WAAqB;OAC7B,MAAMD,sBAAsBC,WAAWqD,QAAQN,KAAK9C,SAAS;MACjE;KACJ,CAAA;KAEA,MAAMqD,IAAIF,MAAK;IACnB;IAEAnE,QAAQ8E,KAAK,CAAA;GACjB,SAASC,GAAG;IAERC,QAAQC,MAAMF,CAAAA;IAEd/E,QAAQ8E,KAAK,CAAA;GACjB;EACJ;CACJ,CAAA;AACJ"}
+{"version":3,"file":"migration.mjs","names":["defineCommand","path","process","checkDatabase","createDatabase","dropDatabase","generateMigration","transformFilePath","DataSource","DataSourceOptionsBuilder","ApplicationBuilder","ConfigInjectionKey","LoggerInjectionKey","ModuleName","CODE_PATH","MigrationOperation","runMigrationOperation","container","operation","config","resolve","logger","optionsBuilder","options","db","buildWith","buildWithEnv","debug","type","database","Array","isArray","migrations","i","length","check","exists","synchronize","ifNotExist","dataSource","logging","initialize","undoLastMigration","showMigrations","runMigrations","isInitialized","destroy","e","error","generateMigrations","connections","host","port","username","password","baseDirectory","join","timestamp","Date","now","connection","dataSourceOptions","directoryPath","name","prettify","console","defineCLIMigrationCommand","meta","args","required","Object","values","valueHint","setup","context","app","withConfig","withLogger","build","addModule","DATABASE","dependencies","CONFIG","LOGGER","exit"],"sources":["../../../src/cli/commands/migration.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport path from 'node:path';\nimport process from 'node:process';\nimport {\n    checkDatabase,\n    createDatabase, \n    dropDatabase, \n    generateMigration, \n    transformFilePath,\n} from 'typeorm-extension';\nimport { DataSource, type DataSourceOptions } from 'typeorm';\nimport { DataSourceOptionsBuilder } from '../../adapters/database/index.ts';\nimport {\n    ApplicationBuilder, \n    ConfigInjectionKey, \n    LoggerInjectionKey, \n    ModuleName,\n} from '../../app/index.ts';\nimport type { IContainer } from 'eldin';\nimport { CODE_PATH } from '../../path.ts';\n\nenum MigrationOperation {\n    GENERATE = 'generate',\n    REVERT = 'revert',\n    STATUS = 'status',\n    RUN = 'run',\n}\n\nasync function runMigrationOperation(\n    container: IContainer,\n    operation: string,\n): Promise<void> {\n    const config = container.resolve(ConfigInjectionKey);\n    const logger = container.resolve(LoggerInjectionKey);\n\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    let options: DataSourceOptions;\n    if (config.db) {\n        options = optionsBuilder.buildWith(config.db);\n    } else {\n        options = optionsBuilder.buildWithEnv();\n    }\n\n    logger.debug(`Type: ${options.type}`);\n    logger.debug(`Database: ${options.database}`);\n\n    if (Array.isArray(options.migrations)) {\n        for (let i = 0; i < options.migrations.length; i++) {\n            if (typeof options.migrations[i] === 'string') {\n                logger.debug(`Migration-Directory: ${options.migrations[i]}`);\n            }\n        }\n    } else if (typeof options.migrations === 'string') {\n        logger.debug(`Migration-Directory: ${options.migrations}`);\n    }\n\n    const check = await checkDatabase({ options });\n\n    if (!check.exists) {\n        await createDatabase({\n            options,\n            synchronize: false,\n            ifNotExist: true, \n        });\n    }\n\n    const dataSource = new DataSource({\n        ...options,\n        logging: ['error', 'schema', 'migration'],\n    });\n\n    try {\n        await dataSource.initialize();\n\n        if (operation === MigrationOperation.REVERT) {\n            await dataSource.undoLastMigration();\n        } else if (operation === MigrationOperation.STATUS) {\n            await dataSource.showMigrations();\n        } else {\n            await dataSource.runMigrations();\n        }\n    } finally {\n        if (dataSource.isInitialized) {\n            try {\n                await dataSource.destroy();\n            } catch (e) {\n                logger.error(`Failed to destroy data source after migration operation: ${e}`);\n            }\n        }\n    }\n}\n\nasync function generateMigrations(): Promise<void> {\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    const connections: DataSourceOptions[] = [\n        {\n            type: 'postgres',\n            database: 'migrations',\n            host: 'localhost',\n            port: 5432,\n            username: 'postgres',\n            password: 'start123',\n        },\n        {\n            type: 'mysql',\n            database: 'migrations',\n            host: 'localhost',\n            port: 3306,\n            username: 'root',\n            password: 'start123',\n        },\n    ];\n\n    const baseDirectory = transformFilePath(\n        path.join(CODE_PATH, 'adapters', 'database', 'migrations'),\n        './src',\n        './dist',\n    );\n\n    const timestamp = Date.now();\n\n    for (const connection of connections) {\n        const dataSourceOptions = optionsBuilder.buildWith(connection);\n        const directoryPath = path.join(baseDirectory, dataSourceOptions.type);\n\n        await dropDatabase({ options: dataSourceOptions });\n        await createDatabase({\n            options: dataSourceOptions,\n            synchronize: false, \n        });\n\n        const dataSource = new DataSource(dataSourceOptions);\n\n        try {\n            await dataSource.initialize();\n\n            await dataSource.runMigrations();\n\n            await generateMigration({\n                dataSource,\n                name: 'Default',\n                directoryPath,\n                timestamp,\n                prettify: true,\n            });\n        } finally {\n            if (dataSource.isInitialized) {\n                try {\n                    await dataSource.destroy();\n                } catch (e) {\n                    // eslint-disable-next-line no-console\n                    console.error(e);\n                }\n            }\n        }\n    }\n}\n\nexport function defineCLIMigrationCommand() {\n    return defineCommand({\n        meta: { name: 'migration' },\n        args: {\n            operation: {\n                required: true,\n                type: 'positional',\n                options: Object.values(MigrationOperation),\n                valueHint: Object.values(MigrationOperation).join('|'),\n            },\n        },\n        async setup(context) {\n            try {\n                if (context.args.operation === MigrationOperation.GENERATE) {\n                    await generateMigrations();\n                } else {\n                    const app = new ApplicationBuilder()\n                        .withConfig()\n                        .withLogger()\n                        .build();\n\n                    app.addModule({\n                        name: ModuleName.DATABASE,\n                        dependencies: [ModuleName.CONFIG, ModuleName.LOGGER],\n                        async setup(container: IContainer): Promise<void> {\n                            await runMigrationOperation(container, context.args.operation);\n                        },\n                    });\n\n                    await app.setup();\n                }\n\n                process.exit(0);\n            } catch (e) {\n                // eslint-disable-next-line no-console\n                console.error(e);\n\n                process.exit(1);\n            }\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA4BA,IAAA,qBAAKe,uBAAAA,oBAAAA;;;;;QAAAA;EAAAA,sBAAAA,CAAAA,CAAAA;AAOL,eAAeC,sBACXC,WACAC,WAAiB;CAEjB,MAAMC,SAASF,UAAUG,QAAQT,kBAAAA;CACjC,MAAMU,SAASJ,UAAUG,QAAQR,kBAAAA;CAEjC,MAAMU,iBAAiB,IAAIb,yBAAAA;CAE3B,IAAIc;CACJ,IAAIJ,OAAOK,IACPD,UAAUD,eAAeG,UAAUN,OAAOK,EAAE;MAE5CD,UAAUD,eAAeI,aAAY;CAGzCL,OAAOM,MAAM,SAASJ,QAAQK,MAAM;CACpCP,OAAOM,MAAM,aAAaJ,QAAQM,UAAU;CAE5C,IAAIC,MAAMC,QAAQR,QAAQS,UAAU;OAC3B,IAAIC,IAAI,GAAGA,IAAIV,QAAQS,WAAWE,QAAQD,KAC3C,IAAI,OAAOV,QAAQS,WAAWC,OAAO,UACjCZ,OAAOM,MAAM,wBAAwBJ,QAAQS,WAAWC,IAAI;CAAA,OAGjE,IAAI,OAAOV,QAAQS,eAAe,UACrCX,OAAOM,MAAM,wBAAwBJ,QAAQS,YAAY;CAK7D,IAAI,EAACG,MAFehC,cAAc,EAAEoB,QAAQ,CAAA,EAAA,CAEjCa,QACP,MAAMhC,eAAe;EACjBmB;EACAc,aAAa;EACbC,YAAY;CAChB,CAAA;CAGJ,MAAMC,aAAa,IAAI/B,WAAW;EAC9B,GAAGe;EACHiB,SAAS;GAAC;GAAS;GAAU;;CACjC,CAAA;CAEA,IAAI;EACA,MAAMD,WAAWE,WAAU;EAE3B,IAAIvB,cAAAA,UACA,MAAMqB,WAAWG,kBAAiB;OAC/B,IAAIxB,cAAAA,UACP,MAAMqB,WAAWI,eAAc;OAE/B,MAAMJ,WAAWK,cAAa;CAEtC,UAAU;EACN,IAAIL,WAAWM,eACX,IAAI;GACA,MAAMN,WAAWO,QAAO;EAC5B,SAASC,GAAG;GACR1B,OAAO2B,MAAM,4DAA4DD,GAAG;EAChF;CAER;AACJ;AAEA,eAAeE,qBAAAA;CACX,MAAM3B,iBAAiB,IAAIb,yBAAAA;CAE3B,MAAMyC,cAAmC,CACrC;EACItB,MAAM;EACNC,UAAU;EACVsB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,GACA;EACI1B,MAAM;EACNC,UAAU;EACVsB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,CAAA;CAGJ,MAAMC,gBAAgBhD,kBAClBN,KAAKuD,KAAK1C,WAAW,YAAY,YAAY,YAAA,GAC7C,SACA,QAAA;CAGJ,MAAM2C,YAAYC,KAAKC,IAAG;CAE1B,KAAK,MAAMC,cAAcV,aAAa;EAClC,MAAMW,oBAAoBvC,eAAeG,UAAUmC,UAAAA;EACnD,MAAME,gBAAgB7D,KAAKuD,KAAKD,eAAeM,kBAAkBjC,IAAI;EAErE,MAAMvB,aAAa,EAAEkB,SAASsC,kBAAkB,CAAA;EAChD,MAAMzD,eAAe;GACjBmB,SAASsC;GACTxB,aAAa;EACjB,CAAA;EAEA,MAAME,aAAa,IAAI/B,WAAWqD,iBAAAA;EAElC,IAAI;GACA,MAAMtB,WAAWE,WAAU;GAE3B,MAAMF,WAAWK,cAAa;GAE9B,MAAMtC,kBAAkB;IACpBiC;IACAwB,MAAM;IACND;IACAL;IACAO,UAAU;GACd,CAAA;EACJ,UAAU;GACN,IAAIzB,WAAWM,eACX,IAAI;IACA,MAAMN,WAAWO,QAAO;GAC5B,SAASC,GAAG;IAERkB,QAAQjB,MAAMD,CAAAA;GAClB;EAER;CACJ;AACJ;AAEA,SAAgBmB,4BAAAA;CACZ,OAAOlE,cAAc;EACjBmE,MAAM,EAAEJ,MAAM,YAAY;EAC1BK,MAAM,EACFlD,WAAW;GACPmD,UAAU;GACVzC,MAAM;GACNL,SAAS+C,OAAOC,OAAOxD,kBAAAA;GACvByD,WAAWF,OAAOC,OAAOxD,kBAAAA,CAAAA,CAAoByC,KAAK,GAAA;EACtD,EACJ;EACA,MAAMiB,MAAMC,SAAO;GACf,IAAI;IACA,IAAIA,QAAQN,KAAKlD,cAAS,YACtB,MAAM+B,mBAAAA;SACH;KACH,MAAM0B,MAAM,IAAIjE,mBAAAA,CAAAA,CACXkE,WAAU,CAAA,CACVC,WAAU,CAAA,CACVC,MAAK;KAEVH,IAAII,UAAU;MACVhB,MAAMlD,WAAWmE;MACjBC,cAAc,CAACpE,WAAWqE,QAAQrE,WAAWsE,MAAAA;MAC7C,MAAMV,MAAMxD,WAAqB;OAC7B,MAAMD,sBAAsBC,WAAWyD,QAAQN,KAAKlD,SAAS;MACjE;KACJ,CAAA;KAEA,MAAMyD,IAAIF,MAAK;IACnB;IAEAvE,QAAQkF,KAAK,CAAA;GACjB,SAASrC,GAAG;IAERkB,QAAQjB,MAAMD,CAAAA;IAEd7C,QAAQkF,KAAK,CAAA;GACjB;EACJ;CACJ,CAAA;AACJ"}

package/dist/components/oauth2-cleaner/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/components/oauth2-cleaner/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,UAAU,GAAI,SAAS,CAmB/E"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/components/oauth2-cleaner/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,UAAU,GAAI,SAAS,CA0B/E"}

package/dist/components/oauth2-cleaner/module.mjs

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { SessionEntity } from "../../adapters/database/domains/session/entity.mjs";
+import { SessionTokenEntity } from "../../adapters/database/domains/session-token/entity.mjs";
 import "../../adapters/database/domains/index.mjs";
 import { LessThan } from "typeorm";
 import cron from "node-cron";
@@ -9,8 +10,10 @@ import cron from "node-cron";
 function createOAuth2CleanerComponent(dataSource) {
 	return { async start() {
 		const sessionRepository = dataSource.getRepository(SessionEntity);
+		const sessionTokenRepository = dataSource.getRepository(SessionTokenEntity);
 		const execute = async () => {
 			const isoDate = (/* @__PURE__ */ new Date()).toISOString();
+			await sessionTokenRepository.delete({ expires_at: LessThan(isoDate) });
 			await sessionRepository.delete({ expires_at: LessThan(isoDate) });
 		};
 		await execute();

package/dist/components/oauth2-cleaner/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["cron","LessThan","SessionEntity","createOAuth2CleanerComponent","dataSource","start","sessionRepository","getRepository","execute","isoDate","Date","toISOString","delete","expires_at","schedule"],"sources":["../../../src/components/oauth2-cleaner/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport cron from 'node-cron';\nimport type { DataSource } from 'typeorm';\nimport { LessThan } from 'typeorm';\nimport { SessionEntity } from '../../adapters/database/domains/index.ts';\nimport type { Component } from '../types.ts';\n\nexport function createOAuth2CleanerComponent(dataSource: DataSource) : Component {\n    return {\n        async start() {\n            const sessionRepository = dataSource.getRepository(SessionEntity);\n\n            const execute = async () => {\n                const isoDate = new Date().toISOString();\n\n                await sessionRepository\n                    .delete({ expires_at: LessThan(isoDate) });\n            };\n\n            await execute();\n\n            cron.schedule('* * * * *', async () => {\n                await execute();\n            });\n        },\n    };\n}\n"],"mappings":";;;;;;;;AAaA,SAAgBG,6BAA6BC,YAAsB;CAC/D,OAAO,EACH,MAAMC,QAAAA;EACF,MAAMC,oBAAoBF,WAAWG,cAAcL,aAAAA;EAEnD,MAAMM,UAAU,YAAA;GACZ,MAAMC,2BAAU,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;GAEtC,MAAML,kBACDM,OAAO,EAAEC,YAAYZ,SAASQ,OAAAA,EAAS,CAAA;EAChD;EAEA,MAAMD,QAAAA;EAENR,KAAKc,SAAS,aAAa,YAAA;GACvB,MAAMN,QAAAA;EACV,CAAA;CACJ,EACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["cron","LessThan","SessionEntity","SessionTokenEntity","createOAuth2CleanerComponent","dataSource","start","sessionRepository","getRepository","sessionTokenRepository","execute","isoDate","Date","toISOString","delete","expires_at","schedule"],"sources":["../../../src/components/oauth2-cleaner/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport cron from 'node-cron';\nimport type { DataSource } from 'typeorm';\nimport { LessThan } from 'typeorm';\nimport { SessionEntity, SessionTokenEntity } from '../../adapters/database/domains/index.ts';\nimport type { Component } from '../types.ts';\n\nexport function createOAuth2CleanerComponent(dataSource: DataSource) : Component {\n    return {\n        async start() {\n            const sessionRepository = dataSource.getRepository(SessionEntity);\n            const sessionTokenRepository = dataSource.getRepository(SessionTokenEntity);\n\n            const execute = async () => {\n                const isoDate = new Date().toISOString();\n\n                // Sweep expired session-token rows first: the auth_session_tokens\n                // volume dominates (one row per access token, ~15min TTL) and a\n                // deleted session cascade-drops its remaining rows anyway.\n                await sessionTokenRepository\n                    .delete({ expires_at: LessThan(isoDate) });\n\n                await sessionRepository\n                    .delete({ expires_at: LessThan(isoDate) });\n            };\n\n            await execute();\n\n            cron.schedule('* * * * *', async () => {\n                await execute();\n            });\n        },\n    };\n}\n"],"mappings":";;;;;;;;;AAaA,SAAgBI,6BAA6BC,YAAsB;CAC/D,OAAO,EACH,MAAMC,QAAAA;EACF,MAAMC,oBAAoBF,WAAWG,cAAcN,aAAAA;EACnD,MAAMO,yBAAyBJ,WAAWG,cAAcL,kBAAAA;EAExD,MAAMO,UAAU,YAAA;GACZ,MAAMC,2BAAU,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;GAKtC,MAAMJ,uBACDK,OAAO,EAAEC,YAAYd,SAASU,OAAAA,EAAS,CAAA;GAE5C,MAAMJ,kBACDO,OAAO,EAAEC,YAAYd,SAASU,OAAAA,EAAS,CAAA;EAChD;EAEA,MAAMD,QAAAA;EAENV,KAAKgB,SAAS,aAAa,YAAA;GACvB,MAAMN,QAAAA;EACV,CAAA;CACJ,EACJ;AACJ"}

package/dist/core/authentication/index.mjs

@@ -12,5 +12,6 @@ import { UserAuthenticator } from "./entities/user/module.mjs";
 import "./entities/index.mjs";
 import { CredentialsAuthenticator } from "./module.mjs";
 import { SessionManager } from "./session/module.mjs";
+import { SESSION_FILTER_KEYS } from "./session/types.mjs";
 import "./session/index.mjs";
-export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsService, CredentialsAuthenticator, RobotAuthenticator, RobotCredentialsService, SessionManager, UserAuthenticator, UserCredentialsService };
+export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsService, CredentialsAuthenticator, RobotAuthenticator, RobotCredentialsService, SESSION_FILTER_KEYS, SessionManager, UserAuthenticator, UserCredentialsService };

package/dist/core/authentication/session/index.mjs

@@ -2,4 +2,5 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { SessionManager } from "./module.mjs";
-export { SessionManager };
+import { SESSION_FILTER_KEYS } from "./types.mjs";
+export { SESSION_FILTER_KEYS, SessionManager };

package/dist/core/authentication/session/module.d.ts

@@ -19,6 +19,7 @@ export declare class SessionManager implements ISessionManager {
      * @throws JWTError
      */
     findOneById(id: string): Promise<Session | null>;
+    revoke(id: string): Promise<void>;
     verify(session: Session): Promise<void>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/authentication/session/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EACR,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAEpB,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAI7B,GAAG,EAAE,qBAAqB;IAOtC;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BjD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAcjD;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMhD,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAShD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EACR,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAEpB,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAI7B,GAAG,EAAE,qBAAqB;IAOtC;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BjD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAcjD;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMhD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAShD"}

package/dist/core/authentication/session/module.mjs

@@ -54,6 +54,9 @@ var SessionManager = class {
 	*/ async findOneById(id) {
 		return this.repository.findOneById(id);
 	}
+	async revoke(id) {
+		await this.repository.removeById(id);
+	}
 	async verify(session) {
 		const ms = new Date(session.expires_at).getTime();
 		if (Date.now() > ms) {