@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.52

package/dist/core/authentication/session/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ip_address","user_agent","expires_at","Date","now","maxAge","toISOString","sub_kind","CLIENT","client_id","sub","ROBOT","robot_id","USER","user_id","save","ping","session","seen_at","seenAt","getTime","threshold","refresh","refreshed_at","findOneById","id","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n    ISessionManager, \n    ISessionRepository, \n    SessionManagerContext, \n    SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n    protected options: SessionManagerOptions;\n\n    protected repository: ISessionRepository;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionManagerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Create/Update session\n     *\n     * @param input\n     */\n    async create(input: Partial<Session>): Promise<Session> {\n        input.ip_address = input.ip_address || '127.0.0.1';\n        input.user_agent = input.user_agent || 'system';\n        input.expires_at = input.expires_at || new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        switch (input.sub_kind) {\n            case IdentityType.CLIENT: {\n                input.client_id = input.sub;\n                break;\n            }\n            case IdentityType.ROBOT: {\n                input.robot_id = input.sub;\n                break;\n            }\n            case IdentityType.USER: {\n                input.user_id = input.sub;\n                break;\n            }\n        }\n\n        return this.repository.save(input);\n    }\n\n    // -----------------------------------------------------\n\n    async ping(session: Session): Promise<Session> {\n        if (session.seen_at) {\n            const seenAt = new Date(session.seen_at).getTime();\n            const threshold = seenAt + (5 * 1_000);\n\n            if (threshold > Date.now()) {\n                return session;\n            }\n        }\n\n        session.seen_at = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async refresh(session: Session): Promise<Session> {\n        const now = new Date().toISOString();\n        session.refreshed_at = now;\n        session.seen_at = now;\n\n        session.expires_at = new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Verify session on token inspection/verification.\n     *\n     * @param id\n     * @throws JWTError\n     */\n    async findOneById(id: string): Promise<Session | null> {\n        return this.repository.findOneById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async verify(session: Session): Promise<void> {\n        const ms = new Date(session.expires_at).getTime();\n        if (Date.now() > ms) {\n            await this.repository.remove(session);\n\n            // todo: better error\n            throw JWTError.expired();\n        }\n    }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,aAAaD,MAAMC,cAAc;EACvCD,MAAME,aAAaF,MAAME,cAAc;EACvCF,MAAMG,aAAaH,MAAMG,cAAc,IAAIC,KACvCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,UAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,YAAYV,MAAMW;IACxB;GAEJ,KAAKlB,aAAamB;IACdZ,MAAMa,WAAWb,MAAMW;IACvB;GAEJ,KAAKlB,aAAaqB;IACdd,MAAMe,UAAUf,MAAMW;IACtB;EAER;EAEA,OAAO,KAAKd,WAAWmB,KAAKhB,KAAAA;CAChC;CAIA,MAAMiB,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC;OACO,IAAIf,KAAKc,QAAQC,OAAO,CAAA,CAAEE,QACvBD,IAAU,IAAI,MAEhBhB,KAAKC,IAAG,GACpB,OAAOa;EAAAA;EAIfA,QAAQC,2BAAU,IAAIf,KAAAA,EAAAA,CAAOG,YAAW;EAExC,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;CAIA,MAAMK,QAAQL,SAAoC;EAC9C,MAAMb,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCW,QAAQM,eAAenB;EACvBa,QAAQC,UAAUd;EAElBa,QAAQf,aAAa,IAAIC,KACrBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMO,YAAYC,IAAqC;EACnD,OAAO,KAAK7B,WAAW4B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOT,SAAiC;EAC1C,MAAMU,KAAK,IAAIxB,KAAKc,QAAQf,UAAU,CAAA,CAAEkB,QAAO;EAC/C,IAAIjB,KAAKC,IAAG,IAAKuB,IAAI;GACjB,MAAM,KAAK/B,WAAWgC,OAAOX,OAAAA;GAG7B,MAAMxB,SAASoC,QAAO;EAC1B;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ip_address","user_agent","expires_at","Date","now","maxAge","toISOString","sub_kind","CLIENT","client_id","sub","ROBOT","robot_id","USER","user_id","save","ping","session","seen_at","seenAt","getTime","threshold","refresh","refreshed_at","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n    ISessionManager, \n    ISessionRepository, \n    SessionManagerContext, \n    SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n    protected options: SessionManagerOptions;\n\n    protected repository: ISessionRepository;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionManagerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Create/Update session\n     *\n     * @param input\n     */\n    async create(input: Partial<Session>): Promise<Session> {\n        input.ip_address = input.ip_address || '127.0.0.1';\n        input.user_agent = input.user_agent || 'system';\n        input.expires_at = input.expires_at || new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        switch (input.sub_kind) {\n            case IdentityType.CLIENT: {\n                input.client_id = input.sub;\n                break;\n            }\n            case IdentityType.ROBOT: {\n                input.robot_id = input.sub;\n                break;\n            }\n            case IdentityType.USER: {\n                input.user_id = input.sub;\n                break;\n            }\n        }\n\n        return this.repository.save(input);\n    }\n\n    // -----------------------------------------------------\n\n    async ping(session: Session): Promise<Session> {\n        if (session.seen_at) {\n            const seenAt = new Date(session.seen_at).getTime();\n            const threshold = seenAt + (5 * 1_000);\n\n            if (threshold > Date.now()) {\n                return session;\n            }\n        }\n\n        session.seen_at = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async refresh(session: Session): Promise<Session> {\n        const now = new Date().toISOString();\n        session.refreshed_at = now;\n        session.seen_at = now;\n\n        session.expires_at = new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Verify session on token inspection/verification.\n     *\n     * @param id\n     * @throws JWTError\n     */\n    async findOneById(id: string): Promise<Session | null> {\n        return this.repository.findOneById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async revoke(id: string): Promise<void> {\n        await this.repository.removeById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async verify(session: Session): Promise<void> {\n        const ms = new Date(session.expires_at).getTime();\n        if (Date.now() > ms) {\n            await this.repository.remove(session);\n\n            // todo: better error\n            throw JWTError.expired();\n        }\n    }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,aAAaD,MAAMC,cAAc;EACvCD,MAAME,aAAaF,MAAME,cAAc;EACvCF,MAAMG,aAAaH,MAAMG,cAAc,IAAIC,KACvCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,UAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,YAAYV,MAAMW;IACxB;GAEJ,KAAKlB,aAAamB;IACdZ,MAAMa,WAAWb,MAAMW;IACvB;GAEJ,KAAKlB,aAAaqB;IACdd,MAAMe,UAAUf,MAAMW;IACtB;EAER;EAEA,OAAO,KAAKd,WAAWmB,KAAKhB,KAAAA;CAChC;CAIA,MAAMiB,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC;OACO,IAAIf,KAAKc,QAAQC,OAAO,CAAA,CAAEE,QACvBD,IAAU,IAAI,MAEhBhB,KAAKC,IAAG,GACpB,OAAOa;EAAAA;EAIfA,QAAQC,2BAAU,IAAIf,KAAAA,EAAAA,CAAOG,YAAW;EAExC,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;CAIA,MAAMK,QAAQL,SAAoC;EAC9C,MAAMb,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCW,QAAQM,eAAenB;EACvBa,QAAQC,UAAUd;EAElBa,QAAQf,aAAa,IAAIC,KACrBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMO,YAAYC,IAAqC;EACnD,OAAO,KAAK7B,WAAW4B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,KAAK7B,WAAW+B,WAAWF,EAAAA;CACrC;CAIA,MAAMG,OAAOX,SAAiC;EAC1C,MAAMY,KAAK,IAAI1B,KAAKc,QAAQf,UAAU,CAAA,CAAEkB,QAAO;EAC/C,IAAIjB,KAAKC,IAAG,IAAKyB,IAAI;GACjB,MAAM,KAAKjC,WAAWkC,OAAOb,OAAAA;GAG7B,MAAMxB,SAASsC,QAAO;EAC1B;CACJ;AACJ"}

package/dist/core/authentication/session/types.d.ts

@@ -1,6 +1,33 @@
 import type { Session } from '@authup/core-kit';
+import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
+export type SessionOwner = {
+    sub: string;
+    subKind: string;
+};
+/**
+ * Filter keys a session query (list + bulk revoke) may target. Shared by the
+ * repository's rapiq `filters.allowed` and the service's "is this a targeted
+ * bulk revoke?" discriminator, so the two can never drift.
+ */
+export declare const SESSION_FILTER_KEYS: readonly ["id", "sub", "sub_kind", "user_id", "client_id", "robot_id", "realm_id"];
+export type SessionFindManyOptions = {
+    /**
+     * Force the result to a single subject (self-service). Applied as a
+     * mandatory WHERE that a rapiq query filter cannot override.
+     */
+    owner?: SessionOwner;
+};
 export interface ISessionRepository {
     findOneById(id: string): Promise<Session | null> | null;
+    findMany(query: Record<string, any>, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;
+    findAllByOwner(owner: SessionOwner): Promise<Session[]>;
+    /**
+     * Load EVERY session matching a rapiq query filter — **unbounded** (no
+     * pagination cap), because a bulk revoke must reach every match. Used by
+     * the admin "force-logout" path; per-session authorization is enforced by
+     * the caller (`SessionService`).
+     */
+    findAllByQuery(query: Record<string, any>): Promise<Session[]>;
     save(session: Partial<Session>): Promise<Session>;
     removeById(id: string): Promise<void>;
     remove(session: Session): Promise<void>;
@@ -47,5 +74,12 @@ export interface ISessionManager {
      * @param id
      */
     findOneById(id: string): Promise<Session | null>;
+    /**
+     * Revoke (delete) a session by id, forcing re-authentication. Idempotent —
+     * a no-op when the session does not exist.
+     *
+     * @param id
+     */
+    revoke(id: string): Promise<void>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/core/authentication/session/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAExD,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAChC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpD;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;CACpD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,YAAY,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,oFAQtB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAExD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzH,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAExD;;;;;OAKG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAE/D,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAChC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpD;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}

package/dist/core/authentication/session/types.mjs

@@ -1,4 +1,21 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-export {};
+//#region src/core/authentication/session/types.ts
+/**
+* Filter keys a session query (list + bulk revoke) may target. Shared by the
+* repository's rapiq `filters.allowed` and the service's "is this a targeted
+* bulk revoke?" discriminator, so the two can never drift.
+*/ const SESSION_FILTER_KEYS = [
+	"id",
+	"sub",
+	"sub_kind",
+	"user_id",
+	"client_id",
+	"robot_id",
+	"realm_id"
+];
+//#endregion
+export { SESSION_FILTER_KEYS };
+
+//# sourceMappingURL=types.mjs.map

package/dist/core/authentication/session/types.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.mjs","names":["SESSION_FILTER_KEYS"],"sources":["../../../../src/core/authentication/session/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type SessionOwner = {\n    sub: string,\n    subKind: string,\n};\n\n/**\n * Filter keys a session query (list + bulk revoke) may target. Shared by the\n * repository's rapiq `filters.allowed` and the service's \"is this a targeted\n * bulk revoke?\" discriminator, so the two can never drift.\n */\nexport const SESSION_FILTER_KEYS = [\n    'id',\n    'sub',\n    'sub_kind',\n    'user_id',\n    'client_id',\n    'robot_id',\n    'realm_id',\n] as const;\n\nexport type SessionFindManyOptions = {\n    /**\n     * Force the result to a single subject (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    owner?: SessionOwner,\n};\n\nexport interface ISessionRepository {\n    findOneById(id: string): Promise<Session | null> | null;\n\n    findMany(query: Record<string, any>, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;\n\n    findAllByOwner(owner: SessionOwner): Promise<Session[]>;\n\n    /**\n     * Load EVERY session matching a rapiq query filter — **unbounded** (no\n     * pagination cap), because a bulk revoke must reach every match. Used by\n     * the admin \"force-logout\" path; per-session authorization is enforced by\n     * the caller (`SessionService`).\n     */\n    findAllByQuery(query: Record<string, any>): Promise<Session[]>;\n\n    save(session: Partial<Session>): Promise<Session>;\n\n    removeById(id: string): Promise<void>;\n\n    remove(session: Session) : Promise<void>;\n}\n\nexport type SessionManagerOptions = {\n    /**\n     * Max age in seconds (sec).\n     */\n    maxAge: number\n};\n\nexport type SessionManagerContext = {\n    options: SessionManagerOptions,\n    repository: ISessionRepository,\n};\n\nexport interface ISessionManager {\n    /**\n     * Create new session.\n     *\n     * @param session\n     */\n    create(session: Partial<Session>): Promise<Session>;\n\n    /**\n     * Updates seen_at with current time.\n     *\n     * @param session\n     */\n    ping(session: Session) : Promise<Session>;\n\n    /**\n     * Updates refreshed_at, seen_at with current time.\n     *\n     * @param session\n     */\n    refresh(session: Session) : Promise<Session>;\n\n    /**\n     * Check if session exists and is valid.\n     *\n     * @throws JWTError\n     * @param session\n     */\n    verify(session: Session): Promise<void>;\n\n    /**\n     * Find session by id.\n     *\n     * @param id\n     */\n    findOneById(id: string): Promise<Session | null>;\n\n    /**\n     * Revoke (delete) a session by id, forcing re-authentication. Idempotent —\n     * a no-op when the session does not exist.\n     *\n     * @param id\n     */\n    revoke(id: string): Promise<void>;\n}\n"],"mappings":";;;;;;;;GAoBA,MAAaA,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA"}

package/dist/core/entities/client/web-client.d.ts

@@ -15,9 +15,11 @@ export type WebClientProvisionerContext = {
  * `global` scope lets the issued token drive the management API (parity
  * with the legacy password-grant admin login); `openid` for the id-token.
  *
- * `grant_types` is metadata only — the auth-code grant issues a refresh
- * token regardless — but it documents the intended flow. `redirect_uri` is
- * one `<origin>/**` wildcard per trusted origin (matched by isSimpleMatch).
+ * `grant_types` is an enforced allowlist (`assertClientGrantAllowed` at the
+ * /token grants and the /authorize code-request verifier; null = allow-all),
+ * so it must list every flow the client uses. `redirect_uri` and
+ * `post_logout_redirect_uri` are each one `<origin>/**` wildcard per trusted
+ * origin (matched by isSimpleMatch).
  */
 export declare function buildWebClientAttributes(realm: Realm | {
     id: string;

package/dist/core/entities/client/web-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAMtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAsCrE"}
+{"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAMtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAsCrE"}

package/dist/core/entities/client/web-client.mjs

@@ -12,10 +12,13 @@ import { CLIENT_WEB_NAME, ScopeName } from "@authup/core-kit";
 * `global` scope lets the issued token drive the management API (parity
 * with the legacy password-grant admin login); `openid` for the id-token.
 *
-* `grant_types` is metadata only — the auth-code grant issues a refresh
-* token regardless — but it documents the intended flow. `redirect_uri` is
-* one `<origin>/**` wildcard per trusted origin (matched by isSimpleMatch).
+* `grant_types` is an enforced allowlist (`assertClientGrantAllowed` at the
+* /token grants and the /authorize code-request verifier; null = allow-all),
+* so it must list every flow the client uses. `redirect_uri` and
+* `post_logout_redirect_uri` are each one `<origin>/**` wildcard per trusted
+* origin (matched by isSimpleMatch).
 */ function buildWebClientAttributes(realm, appOrigins) {
+	const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(",");
 	return {
 		name: CLIENT_WEB_NAME,
 		realm_id: realm.id,
@@ -24,7 +27,8 @@ import { CLIENT_WEB_NAME, ScopeName } from "@authup/core-kit";
 		active: true,
 		grant_types: "authorization_code refresh_token",
 		scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,
-		redirect_uri: appOrigins.map((origin) => `${origin}/**`).join(",")
+		redirect_uri: originPatterns,
+		post_logout_redirect_uri: originPatterns
 	};
 }
 var WebClientProvisioner = class {

package/dist/core/entities/client/web-client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"web-client.mjs","names":["CLIENT_WEB_NAME","ScopeName","buildWebClientAttributes","realm","appOrigins","name","realm_id","id","is_confidential","built_in","active","grant_types","scope","GLOBAL","OPEN_ID","redirect_uri","map","origin","join","WebClientProvisioner","clientRepository","logger","ctx","ensureForRealm","attributes","existing","findOneBy","warn","isDirty","Object","keys","some","key","merged","merge","save","entity","create"],"sources":["../../../../src/core/entities/client/web-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { CLIENT_WEB_NAME, ScopeName  } from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientRepository, IWebClientProvisioner } from './types.ts';\n\nexport type WebClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * Build the attribute set for a realm's public `web` client.\n *\n * Public (PKCE) client used by authup's own client-web and any downstream\n * UI embedding client-web-kit. `built_in` makes it auto-consent in the\n * /authorize flow and protects it from the API reserved-name guard. The\n * `global` scope lets the issued token drive the management API (parity\n * with the legacy password-grant admin login); `openid` for the id-token.\n *\n * `grant_types` is metadata only — the auth-code grant issues a refresh\n * token regardless — but it documents the intended flow. `redirect_uri` is\n * one `<origin>/**` wildcard per trusted origin (matched by isSimpleMatch).\n */\nexport function buildWebClientAttributes(\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    return {\n        name: CLIENT_WEB_NAME,\n        realm_id: realm.id,\n        is_confidential: false,\n        built_in: true,\n        active: true,\n        grant_types: 'authorization_code refresh_token',\n        scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,\n        redirect_uri: appOrigins.map((origin) => `${origin}/**`).join(','),\n    };\n}\n\nexport class WebClientProvisioner implements IWebClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: WebClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const attributes = buildWebClientAttributes(realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: CLIENT_WEB_NAME,\n            realm_id: realm.id,\n        });\n\n        if (existing) {\n            // Never overwrite a non-built_in client that happens to be named\n            // `web` — that would be a user-owned client. Skip and warn.\n            if (!existing.built_in) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping web client provisioning for realm ${realm.id}: a non-built-in client named '${CLIENT_WEB_NAME}' already exists.`,\n                    );\n                }\n                return;\n            }\n\n            // MERGE: refresh attributes (e.g. redirect_uri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updated_at) per realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return;\n            }\n\n            const merged = this.clientRepository.merge(existing, attributes);\n            await this.clientRepository.save(merged);\n            return;\n        }\n\n        const entity = this.clientRepository.create(attributes);\n        await this.clientRepository.save(entity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;GA+BA,SAAgBE,yBACZC,OACAC,YAAoB;CAEpB,OAAO;EACHC,MAAML;EACNM,UAAUH,MAAMI;EAChBC,iBAAiB;EACjBC,UAAU;EACVC,QAAQ;EACRC,aAAa;EACbC,OAAO,GAAGX,UAAUY,OAAO,GAAGZ,UAAUa;EACxCC,cAAcX,WAAWY,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAClE;AACJ;AAEA,IAAaC,uBAAb,MAAaA;CACCC;CAEAhB;CAEAiB;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKhB,aAAakB,IAAIlB;EACtB,KAAKiB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAepB,OAA8C;EAC/D,MAAMqB,aAAatB,yBAAyBC,OAAO,KAAKC,UAAU;EAElE,MAAMqB,WAAW,MAAM,KAAKL,iBAAiBM,UAAU;GACnDrB,MAAML;GACNM,UAAUH,MAAMI;EACpB,CAAA;EAEA,IAAIkB,UAAU;GAGV,IAAI,CAACA,SAAShB,UAAU;IACpB,IAAI,KAAKY,QACL,KAAKA,OAAOM,KACR,8CAA8CxB,MAAMI,GAAG,iCAAiCP,gBAAgB,kBAAkB;IAGlI;GACJ;GAQA,IAAI,CAFY,OAAQ8B,KAAKN,UAAAA,CAAAA,CACxBO,MAAMC,QAAQP,SAASO,SAASR,WAAWQ,IAC3CJ,GACD;GAGJ,MAAMK,SAAS,KAAKb,iBAAiBc,MAAMT,UAAUD,UAAAA;GACrD,MAAM,KAAKJ,iBAAiBe,KAAKF,MAAAA;GACjC;EACJ;EAEA,MAAMG,SAAS,KAAKhB,iBAAiBiB,OAAOb,UAAAA;EAC5C,MAAM,KAAKJ,iBAAiBe,KAAKC,MAAAA;CACrC;AACJ"}
+{"version":3,"file":"web-client.mjs","names":["CLIENT_WEB_NAME","ScopeName","buildWebClientAttributes","realm","appOrigins","originPatterns","map","origin","join","name","realm_id","id","is_confidential","built_in","active","grant_types","scope","GLOBAL","OPEN_ID","redirect_uri","post_logout_redirect_uri","WebClientProvisioner","clientRepository","logger","ctx","ensureForRealm","attributes","existing","findOneBy","warn","isDirty","Object","keys","some","key","merged","merge","save","entity","create"],"sources":["../../../../src/core/entities/client/web-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { CLIENT_WEB_NAME, ScopeName  } from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientRepository, IWebClientProvisioner } from './types.ts';\n\nexport type WebClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * Build the attribute set for a realm's public `web` client.\n *\n * Public (PKCE) client used by authup's own client-web and any downstream\n * UI embedding client-web-kit. `built_in` makes it auto-consent in the\n * /authorize flow and protects it from the API reserved-name guard. The\n * `global` scope lets the issued token drive the management API (parity\n * with the legacy password-grant admin login); `openid` for the id-token.\n *\n * `grant_types` is an enforced allowlist (`assertClientGrantAllowed` at the\n * /token grants and the /authorize code-request verifier; null = allow-all),\n * so it must list every flow the client uses. `redirect_uri` and\n * `post_logout_redirect_uri` are each one `<origin>/**` wildcard per trusted\n * origin (matched by isSimpleMatch).\n */\nexport function buildWebClientAttributes(\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(',');\n\n    return {\n        name: CLIENT_WEB_NAME,\n        realm_id: realm.id,\n        is_confidential: false,\n        built_in: true,\n        active: true,\n        grant_types: 'authorization_code refresh_token',\n        scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,\n        redirect_uri: originPatterns,\n        post_logout_redirect_uri: originPatterns,\n    };\n}\n\nexport class WebClientProvisioner implements IWebClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: WebClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const attributes = buildWebClientAttributes(realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: CLIENT_WEB_NAME,\n            realm_id: realm.id,\n        });\n\n        if (existing) {\n            // Never overwrite a non-built_in client that happens to be named\n            // `web` — that would be a user-owned client. Skip and warn.\n            if (!existing.built_in) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping web client provisioning for realm ${realm.id}: a non-built-in client named '${CLIENT_WEB_NAME}' already exists.`,\n                    );\n                }\n                return;\n            }\n\n            // MERGE: refresh attributes (e.g. redirect_uri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updated_at) per realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return;\n            }\n\n            const merged = this.clientRepository.merge(existing, attributes);\n            await this.clientRepository.save(merged);\n            return;\n        }\n\n        const entity = this.clientRepository.create(attributes);\n        await this.clientRepository.save(entity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;GAiCA,SAAgBE,yBACZC,OACAC,YAAoB;CAEpB,MAAMC,iBAAiBD,WAAWE,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAEvE,OAAO;EACHC,MAAMT;EACNU,UAAUP,MAAMQ;EAChBC,iBAAiB;EACjBC,UAAU;EACVC,QAAQ;EACRC,aAAa;EACbC,OAAO,GAAGf,UAAUgB,OAAO,GAAGhB,UAAUiB;EACxCC,cAAcd;EACde,0BAA0Bf;CAC9B;AACJ;AAEA,IAAagB,uBAAb,MAAaA;CACCC;CAEAlB;CAEAmB;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKlB,aAAaoB,IAAIpB;EACtB,KAAKmB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAetB,OAA8C;EAC/D,MAAMuB,aAAaxB,yBAAyBC,OAAO,KAAKC,UAAU;EAElE,MAAMuB,WAAW,MAAM,KAAKL,iBAAiBM,UAAU;GACnDnB,MAAMT;GACNU,UAAUP,MAAMQ;EACpB,CAAA;EAEA,IAAIgB,UAAU;GAGV,IAAI,CAACA,SAASd,UAAU;IACpB,IAAI,KAAKU,QACL,KAAKA,OAAOM,KACR,8CAA8C1B,MAAMQ,GAAG,iCAAiCX,gBAAgB,kBAAkB;IAGlI;GACJ;GAQA,IAAI,CAFY,OAAQgC,KAAKN,UAAAA,CAAAA,CACxBO,MAAMC,QAAQP,SAASO,SAASR,WAAWQ,IAC3CJ,GACD;GAGJ,MAAMK,SAAS,KAAKb,iBAAiBc,MAAMT,UAAUD,UAAAA;GACrD,MAAM,KAAKJ,iBAAiBe,KAAKF,MAAAA;GACjC;EACJ;EAEA,MAAMG,SAAS,KAAKhB,iBAAiBiB,OAAOb,UAAAA;EAC5C,MAAM,KAAKJ,iBAAiBe,KAAKC,MAAAA;CACrC;AACJ"}

package/dist/core/entities/index.d.ts

@@ -14,6 +14,7 @@ export * from './role/index.ts';
 export * from './role-attribute/index.ts';
 export * from './role-permission/index.ts';
 export * from './scope/index.ts';
+export * from './session/index.ts';
 export * from './user/index.ts';
 export * from './user-attribute/index.ts';
 export * from './user-permission/index.ts';

package/dist/core/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}

package/dist/core/entities/index.mjs

@@ -32,6 +32,8 @@ import { RolePermissionService } from "./role-permission/service.mjs";
 import "./role-permission/index.mjs";
 import { ScopeService } from "./scope/service.mjs";
 import "./scope/index.mjs";
+import { SessionService } from "./session/service.mjs";
+import "./session/index.mjs";
 import { UserService } from "./user/service.mjs";
 import "./user/index.mjs";
 import { UserAttributeService } from "./user-attribute/service.mjs";
@@ -42,4 +44,4 @@ import { UserRoleService } from "./user-role/service.mjs";
 import "./user-role/index.mjs";
 import { IdentityProviderRoleMappingService } from "./identity-provider-role-mapping/service.mjs";
 import "./identity-provider-role-mapping/index.mjs";
-export { ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, IdentityProviderRoleMappingService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RobotPermissionService, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleService, ScopeService, UserAttributeService, UserPermissionService, UserRoleService, UserService, WebClientProvisioner, buildWebClientAttributes };
+export { ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, IdentityProviderRoleMappingService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RobotPermissionService, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleService, ScopeService, SessionService, UserAttributeService, UserPermissionService, UserRoleService, UserService, WebClientProvisioner, buildWebClientAttributes };

package/dist/core/entities/realm/types.d.ts

@@ -7,6 +7,15 @@ export interface IRealmRepository extends IEntityRepository<Realm> {
      */
     resolve(id: string | undefined, withFallback: true): Promise<Realm>;
     resolve(id: string | undefined, withFallback?: boolean): Promise<Realm | null>;
+    /**
+     * Resolve a realm key (UUID or name) to a realm id for use in a
+     * realm_id predicate. A UUID key is returned as-is without existence
+     * verification (binding an unknown UUID matches zero rows — fail-closed
+     * by construction). A name key resolves through the canonicalizing
+     * findOneByName; null means "no such realm" and the caller MUST fail
+     * closed (return null / [] / throw), never drop the predicate.
+     */
+    resolveId(key: string): Promise<string | null>;
 }
 export interface IRealmService {
     getMany(query: Record<string, any>): Promise<EntityRepositoryFindManyResult<Realm>>;

package/dist/core/entities/realm/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/realm/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB,CAAC,KAAK,CAAC;IAC9D;;;OAGG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,EAAE,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,aAAa;IAC1B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IACpF,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACzF,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CAC3D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/realm/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB,CAAC,KAAK,CAAC;IAC9D;;;OAGG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,EAAE,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAE/E;;;;;;;OAOG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,aAAa;IAC1B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IACpF,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACzF,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CAC3D"}

package/dist/core/entities/session/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/session/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/entities/session/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SessionService } from "./service.mjs";
+export { SessionService };

package/dist/core/entities/session/service.d.ts

@@ -0,0 +1,27 @@
+import type { Session } from '@authup/core-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { ISessionRepository } from '../../authentication/index.ts';
+import type { ISessionService, SessionDeleteManyOptions, SessionDeleteManyResult } from './types.ts';
+export type SessionServiceContext = {
+    repository: ISessionRepository;
+};
+export declare class SessionService extends AbstractEntityService implements ISessionService {
+    protected repository: ISessionRepository;
+    constructor(ctx: SessionServiceContext);
+    protected isOwnedBy(session: Session, actor: ActorContext): boolean;
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<Session>>;
+    getOne(id: string, actor: ActorContext): Promise<Session>;
+    delete(id: string, actor: ActorContext): Promise<Session>;
+    deleteMany(actor: ActorContext, options?: SessionDeleteManyOptions): Promise<SessionDeleteManyResult>;
+    /**
+     * True when the query carries at least one recognized target filter — the
+     * discriminator between the admin bulk-revoke path and self-service. An
+     * unrecognized / empty filter falls through to self-service (fail-safe: a
+     * typo can never trigger an unconstrained mass delete).
+     */
+    protected hasTargetFilter(query?: Record<string, any>): boolean;
+    protected deleteManyForSelf(actor: ActorContext, currentSessionId?: string): Promise<SessionDeleteManyResult>;
+    protected deleteManyByQuery(actor: ActorContext, query: Record<string, any>): Promise<SessionDeleteManyResult>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/session/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/service.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAExE,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAErG,MAAM,MAAM,qBAAqB,GAAG;IAChC,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,qBAAa,cAAe,SAAQ,qBAAsB,YAAW,eAAe;IAChF,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAE7B,GAAG,EAAE,qBAAqB;IAKtC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAM7D,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAuD7C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBzD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBzD,UAAU,CACZ,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,wBAA6B,GACvC,OAAO,CAAC,uBAAuB,CAAC;IAYnC;;;;;OAKG;IACH,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;cAY/C,iBAAiB,CAC7B,KAAK,EAAE,YAAY,EACnB,gBAAgB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,uBAAuB,CAAC;cAkBnB,iBAAiB,CAC7B,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,uBAAuB,CAAC;CAgCtC"}

package/dist/core/entities/session/service.mjs

@@ -0,0 +1,151 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SESSION_FILTER_KEYS } from "../../authentication/session/types.mjs";
+import "../../authentication/index.mjs";
+import { isObject } from "@authup/kit";
+import { PermissionName } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { EntityNotFoundError, UnauthorizedError } from "@authup/errors";
+//#region src/core/entities/session/service.ts
+var SessionService = class extends AbstractEntityService {
+	repository;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+	}
+	isOwnedBy(session, actor) {
+		return !!actor.identity && session.sub === actor.identity.data.id && session.sub_kind === actor.identity.type;
+	}
+	async getMany(query, actor) {
+		let canReadAll = true;
+		try {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });
+		} catch (e) {
+			if (!actor.identity) throw e;
+			canReadAll = false;
+		}
+		if (!canReadAll) return this.repository.findMany(query, { owner: {
+			sub: actor.identity.data.id,
+			subKind: actor.identity.type
+		} });
+		const { data: entities, meta } = await this.repository.findMany(query);
+		const data = [];
+		let { total } = meta;
+		for (const entity of entities) {
+			if (this.isOwnedBy(entity, actor)) {
+				data.push(entity);
+				continue;
+			}
+			try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.SESSION_READ,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: entity,
+						...this.resourceRealmMatch(entity)
+					})
+				});
+				data.push(entity);
+			} catch {
+				total -= 1;
+			}
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(id, actor) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.SESSION_READ,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		return entity;
+	}
+	async delete(id, actor) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.SESSION_DELETE,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+	async deleteMany(actor, options = {}) {
+		if (!actor.identity) throw new UnauthorizedError();
+		if (this.hasTargetFilter(options.query)) return this.deleteManyByQuery(actor, options.query);
+		return this.deleteManyForSelf(actor, options.currentSessionId);
+	}
+	/**
+	* True when the query carries at least one recognized target filter — the
+	* discriminator between the admin bulk-revoke path and self-service. An
+	* unrecognized / empty filter falls through to self-service (fail-safe: a
+	* typo can never trigger an unconstrained mass delete).
+	*/ hasTargetFilter(query) {
+		const filter = query?.filter;
+		if (!isObject(filter)) return false;
+		return SESSION_FILTER_KEYS.some((key) => {
+			const value = filter[key];
+			return typeof value !== "undefined" && value !== "";
+		});
+	}
+	async deleteManyForSelf(actor, currentSessionId) {
+		const sessions = await this.repository.findAllByOwner({
+			sub: actor.identity.data.id,
+			subKind: actor.identity.type
+		});
+		let count = 0;
+		for (const session of sessions) {
+			if (currentSessionId && session.id === currentSessionId) continue;
+			await this.repository.remove(session);
+			count += 1;
+		}
+		return { count };
+	}
+	async deleteManyByQuery(actor, query) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });
+		const sessions = await this.repository.findAllByQuery(query);
+		let count = 0;
+		for (const session of sessions) {
+			if (!this.isOwnedBy(session, actor)) try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.SESSION_DELETE,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: session,
+						...this.resourceRealmMatch(session)
+					})
+				});
+			} catch {
+				continue;
+			}
+			await this.repository.remove(session);
+			count += 1;
+		}
+		return { count };
+	}
+};
+//#endregion
+export { SessionService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/session/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityNotFoundError","UnauthorizedError","isObject","PermissionName","AbstractEntityService","SESSION_FILTER_KEYS","SessionService","repository","ctx","isOwnedBy","session","actor","identity","sub","data","id","sub_kind","type","getMany","query","canReadAll","permissionEvaluator","preEvaluate","name","SESSION_READ","e","findMany","owner","subKind","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","delete","SESSION_DELETE","entityId","remove","deleteMany","options","hasTargetFilter","deleteManyByQuery","deleteManyForSelf","currentSessionId","filter","some","key","value","sessions","findAllByOwner","count","findAllByQuery"],"sources":["../../../../src/core/entities/session/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError, UnauthorizedError } from '@authup/errors';\nimport { isObject } from '@authup/kit';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Session } from '@authup/core-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { ISessionRepository } from '../../authentication/index.ts';\nimport { SESSION_FILTER_KEYS } from '../../authentication/index.ts';\nimport type { ISessionService, SessionDeleteManyOptions, SessionDeleteManyResult } from './types.ts';\n\nexport type SessionServiceContext = {\n    repository: ISessionRepository,\n};\n\nexport class SessionService extends AbstractEntityService implements ISessionService {\n    protected repository: ISessionRepository;\n\n    constructor(ctx: SessionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n    }\n\n    protected isOwnedBy(session: Session, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            session.sub === actor.identity.data.id &&\n            session.sub_kind === actor.identity.type;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own sessions\n            return this.repository.findMany(query, {\n                owner: {\n                    sub: actor.identity!.data.id,\n                    subKind: actor.identity!.type,\n                },\n            });\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(query);\n\n        const data: Session[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.SESSION_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext): Promise<Session> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SESSION_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n\n    async delete(id: string, actor: ActorContext): Promise<Session> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SESSION_DELETE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    async deleteMany(\n        actor: ActorContext,\n        options: SessionDeleteManyOptions = {},\n    ): Promise<SessionDeleteManyResult> {\n        if (!actor.identity) {\n            throw new UnauthorizedError();\n        }\n\n        if (this.hasTargetFilter(options.query)) {\n            return this.deleteManyByQuery(actor, options.query!);\n        }\n\n        return this.deleteManyForSelf(actor, options.currentSessionId);\n    }\n\n    /**\n     * True when the query carries at least one recognized target filter — the\n     * discriminator between the admin bulk-revoke path and self-service. An\n     * unrecognized / empty filter falls through to self-service (fail-safe: a\n     * typo can never trigger an unconstrained mass delete).\n     */\n    protected hasTargetFilter(query?: Record<string, any>): boolean {\n        const filter = query?.filter;\n        if (!isObject(filter)) {\n            return false;\n        }\n\n        return SESSION_FILTER_KEYS.some((key) => {\n            const value = filter[key];\n            return typeof value !== 'undefined' && value !== '';\n        });\n    }\n\n    protected async deleteManyForSelf(\n        actor: ActorContext,\n        currentSessionId?: string,\n    ): Promise<SessionDeleteManyResult> {\n        const sessions = await this.repository.findAllByOwner({\n            sub: actor.identity!.data.id,\n            subKind: actor.identity!.type,\n        });\n\n        let count = 0;\n        for (const session of sessions) {\n            if (currentSessionId && session.id === currentSessionId) {\n                continue;\n            }\n            await this.repository.remove(session);\n            count += 1;\n        }\n\n        return { count };\n    }\n\n    protected async deleteManyByQuery(\n        actor: ActorContext,\n        query: Record<string, any>,\n    ): Promise<SessionDeleteManyResult> {\n        // Gate: an actor without SESSION_DELETE cannot force-logout anyone → 403.\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n\n        const sessions = await this.repository.findAllByQuery(query);\n\n        let count = 0;\n        for (const session of sessions) {\n            // Own sessions are always deletable by the actor (mirrors getMany).\n            // Otherwise per-session realm-match: a realm_admin only reaches\n            // sessions in its realm — cross-realm rows are skipped, not failed,\n            // so filter breadth cannot escalate beyond the actor's reach.\n            if (!this.isOwnedBy(session, actor)) {\n                try {\n                    await actor.permissionEvaluator.evaluate({\n                        name: PermissionName.SESSION_DELETE,\n                        data: definePolicyData({\n                            [BuiltInPolicyType.ATTRIBUTES]: session,\n                            ...this.resourceRealmMatch(session),\n                        }),\n                    });\n                } catch {\n                    continue;\n                }\n            }\n\n            await this.repository.remove(session);\n            count += 1;\n        }\n\n        return { count };\n    }\n}\n"],"mappings":";;;;;;;;;;;AAsBA,IAAaQ,iBAAb,cAAoCF,sBAAAA;CACtBG;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,aAAaL,MAAMC,SAASK;CAC5C;CAEA,MAAMC,QACFC,OACAR,OACgD;EAChD,IAAIS,aAAa;EACjB,IAAI;GACA,MAAMT,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqB,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAACd,MAAMC,UACP,MAAMa;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKb,WAAWmB,SAASP,OAAO,EACnCQ,OAAO;GACHd,KAAKF,MAAMC,SAAUE,KAAKC;GAC1Ba,SAASjB,MAAMC,SAAUK;EAC7B,EACJ,CAAA;EAGJ,MAAM,EAAEH,MAAMe,UAAUC,SAAS,MAAM,KAAKvB,WAAWmB,SAASP,KAAAA;EAEhE,MAAML,OAAkB,CAAA;EACxB,IAAI,EAAEiB,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAKpB,UAAUuB,QAAQrB,KAAAA,GAAQ;IAC/BG,KAAKmB,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMrB,MAAMU,oBAAoBa,SAAS;KACrCX,MAAMpB,eAAeqB;KACrBV,MAAMf,iBAAiB;OAClBD,kBAAkBqC,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAlB,KAAKmB,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHjB;GACAgB,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAOtB,IAAYJ,OAAuC;EAC5D,MAAMqB,SAAS,MAAM,KAAKzB,WAAW+B,YAAYvB,EAAAA;EACjD,IAAI,CAACiB,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAAC,KAAKS,UAAUuB,QAAQrB,KAAAA,GAAQ;GAChC,MAAMA,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqB,aAAa,CAAA;GAChF,MAAMb,MAAMU,oBAAoBa,SAAS;IACrCX,MAAMpB,eAAeqB;IACrBV,MAAMf,iBAAiB;MAClBD,kBAAkBqC,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMO,OAAOxB,IAAYJ,OAAuC;EAC5D,MAAMqB,SAAS,MAAM,KAAKzB,WAAW+B,YAAYvB,EAAAA;EACjD,IAAI,CAACiB,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAAC,KAAKS,UAAUuB,QAAQrB,KAAAA,GAAQ;GAChC,MAAMA,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqC,eAAe,CAAA;GAClF,MAAM7B,MAAMU,oBAAoBa,SAAS;IACrCX,MAAMpB,eAAeqC;IACrB1B,MAAMf,iBAAiB;MAClBD,kBAAkBqC,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAEjB,IAAI0B,aAAaT;EACzB,MAAM,KAAKzB,WAAWmC,OAAOV,MAAAA;EAC7BA,OAAOjB,KAAK0B;EAEZ,OAAOT;CACX;CAEA,MAAMW,WACFhC,OACAiC,UAAoC,CAAC,GACL;EAChC,IAAI,CAACjC,MAAMC,UACP,MAAM,IAAIX,kBAAAA;EAGd,IAAI,KAAK4C,gBAAgBD,QAAQzB,KAAK,GAClC,OAAO,KAAK2B,kBAAkBnC,OAAOiC,QAAQzB,KAAK;EAGtD,OAAO,KAAK4B,kBAAkBpC,OAAOiC,QAAQI,gBAAgB;CACjE;;;;;;IAQA,gBAA0B7B,OAAsC;EAC5D,MAAM8B,SAAS9B,OAAO8B;EACtB,IAAI,CAAC/C,SAAS+C,MAAAA,GACV,OAAO;EAGX,OAAO5C,oBAAoB6C,MAAMC,QAAAA;GAC7B,MAAMC,QAAQH,OAAOE;GACrB,OAAO,OAAOC,UAAU,eAAeA,UAAU;EACrD,CAAA;CACJ;CAEA,MAAgBL,kBACZpC,OACAqC,kBACgC;EAChC,MAAMK,WAAW,MAAM,KAAK9C,WAAW+C,eAAe;GAClDzC,KAAKF,MAAMC,SAAUE,KAAKC;GAC1Ba,SAASjB,MAAMC,SAAUK;EAC7B,CAAA;EAEA,IAAIsC,QAAQ;EACZ,KAAK,MAAM7C,WAAW2C,UAAU;GAC5B,IAAIL,oBAAoBtC,QAAQK,OAAOiC,kBACnC;GAEJ,MAAM,KAAKzC,WAAWmC,OAAOhC,OAAAA;GAC7B6C,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;CAEA,MAAgBT,kBACZnC,OACAQ,OACgC;EAEhC,MAAMR,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqC,eAAe,CAAA;EAElF,MAAMa,WAAW,MAAM,KAAK9C,WAAWiD,eAAerC,KAAAA;EAEtD,IAAIoC,QAAQ;EACZ,KAAK,MAAM7C,WAAW2C,UAAU;GAK5B,IAAI,CAAC,KAAK5C,UAAUC,SAASC,KAAAA,GACzB,IAAI;IACA,MAAMA,MAAMU,oBAAoBa,SAAS;KACrCX,MAAMpB,eAAeqC;KACrB1B,MAAMf,iBAAiB;OAClBD,kBAAkBqC,aAAazB;MAChC,GAAG,KAAK0B,mBAAmB1B,OAAAA;KAC/B,CAAA;IACJ,CAAA;GACJ,QAAQ;IACJ;GACJ;GAGJ,MAAM,KAAKH,WAAWmC,OAAOhC,OAAAA;GAC7B6C,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;AACJ"}

package/dist/core/entities/session/types.d.ts

@@ -0,0 +1,48 @@
+import type { Session } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+export type SessionDeleteManyResult = {
+    count: number;
+};
+export type SessionDeleteManyOptions = {
+    /**
+     * The parsed request query. When it carries a recognized target filter
+     * (`SESSION_FILTER_KEYS`, e.g. `filter[user_id]`) the call is an admin
+     * bulk revoke; otherwise it is the self-service path.
+     */
+    query?: Record<string, any>;
+    /**
+     * The caller's current session id (from the bearer). Preserved on the
+     * self-service path so "log out my other devices" keeps this device.
+     */
+    currentSessionId?: string;
+};
+export interface ISessionService {
+    /**
+     * List sessions. An actor without `SESSION_READ` is scoped to its own
+     * sessions (self-service); an actor with `SESSION_READ` sees every session
+     * its realm reach permits.
+     */
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<Session>>;
+    /**
+     * Read a single session by id. Own sessions need no permission.
+     */
+    getOne(id: string, actor: ActorContext): Promise<Session>;
+    /**
+     * Revoke (delete) a single session by id. Own sessions need no permission.
+     */
+    delete(id: string, actor: ActorContext): Promise<Session>;
+    /**
+     * Bulk revoke.
+     *
+     * - **No recognized target filter** → self-service: revoke every session of
+     *   the actor except the current one ("log out my other devices"). No
+     *   permission required.
+     * - **A recognized target filter** (`SESSION_FILTER_KEYS`, e.g.
+     *   `filter[user_id]`, `filter[realm_id]`) → admin "force-logout": revoke
+     *   every matching session. Requires `SESSION_DELETE`, and each session is
+     *   additionally realm-matched (drop-unauthorized), so a `realm_admin` only
+     *   revokes sessions in its reach and filter breadth cannot escalate.
+     */
+    deleteMany(actor: ActorContext, options?: SessionDeleteManyOptions): Promise<SessionDeleteManyResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/session/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,MAAM,uBAAuB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3G;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1D;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1D;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACzG"}

package/dist/core/entities/session/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/entities/user/service.d.ts

@@ -7,6 +7,7 @@ import type { IUserRepository, IUserService } from './types.ts';
 export type UserServiceContext = {
     repository: IUserRepository;
     realmRepository: IRealmRepository;
+    passwordMinLength?: number;
 };
 export declare class UserService extends AbstractEntityService implements IUserService {
     protected repository: IUserRepository;

package/dist/core/entities/user/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAEH,aAAa,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,WAAY,SAAQ,qBAAsB,YAAW,YAAY;IAC1E,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;gBAEvB,GAAG,EAAE,kBAAkB;IAO7B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAoD1C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IAsCV,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAsII,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;CA2BnB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAEH,aAAa,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,qBAAa,WAAY,SAAQ,qBAAsB,YAAW,YAAY;IAC1E,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;gBAEvB,GAAG,EAAE,kBAAkB;IAO7B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAoD1C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IAsCV,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAsII,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;CA2BnB"}

package/dist/core/entities/user/service.mjs

@@ -16,7 +16,7 @@ var UserService = class extends AbstractEntityService {
 		super();
 		this.repository = ctx.repository;
 		this.realmRepository = ctx.realmRepository;
-		this.validator = new UserValidator();
+		this.validator = new UserValidator({ passwordMinLength: ctx.passwordMinLength });
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [