@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/app/modules/database/repositories/identity-provider/repository.mjs

@@ -3,9 +3,9 @@ import "node:url";
 import.meta.url;
 import { IdentityProviderEntity } from "../../../../../adapters/database/domains/identity-provider/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
+import { translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
 import "../../../../../adapters/database/index.mjs";
-import { translateWhereConditions } from "../helpers.mjs";
 import { RealmRepositoryAdapter } from "../realm/repository.mjs";
 import { isUUID } from "@authup/kit";
 import { applyQuery, isEntityUnique, validateEntityJoinColumns } from "typeorm-extension";
@@ -71,8 +71,9 @@ var IdentityProviderRepositoryAdapter = class {
 		const qb = this.repository.createQueryBuilder("provider");
 		qb.where("provider.name = :name", { name });
 		if (realmKey) {
-			const realm = await this.realmRepository.resolve(realmKey);
-			if (realm) qb.andWhere("provider.realm_id = :realmId", { realmId: realm.id });
+			const realmId = await this.realmRepository.resolveId(realmKey);
+			if (!realmId) return null;
+			qb.andWhere("provider.realm_id = :realmId", { realmId });
 		}
 		const entity = await qb.getOne();
 		if (entity) await this.repository.extendOneWithEA(entity);
@@ -123,11 +124,10 @@ var IdentityProviderRepositoryAdapter = class {
 	async findByProtocol(protocol, realmKey) {
 		const qb = this.repository.createQueryBuilder("provider");
 		qb.where("provider.protocol = :protocol", { protocol });
-		if (realmKey) if (isUUID(realmKey)) qb.andWhere("provider.realm_id = :realmId", { realmId: realmKey });
-		else {
-			const realm = await this.realmRepository.resolve(realmKey);
-			if (!realm) return [];
-			qb.andWhere("provider.realm_id = :realmId", { realmId: realm.id });
+		if (realmKey) {
+			const realmId = await this.realmRepository.resolveId(realmKey);
+			if (!realmId) return [];
+			qb.andWhere("provider.realm_id = :realmId", { realmId });
 		}
 		const entities = await qb.getMany();
 		await this.repository.extendManyWithEA(entities);

package/dist/app/modules/database/repositories/identity-provider/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["isUUID","applyQuery","isEntityUnique","validateEntityJoinColumns","DatabaseConflictError","IdentityProviderEntity","translateWhereConditions","RealmRepositoryAdapter","IdentityProviderRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","defaultAlias","relations","allowed","onJoin","_property","key","q","addGroupBy","fields","default","filters","sort","maxLimit","entities","total","getManyAndCount","data","meta","findOneById","id","entity","findOneBy","extendOneWithEA","findOneByName","name","realmKey","where","realm","resolve","andWhere","realmId","getOne","findOneByIdOrName","idOrName","findManyBy","findBy","create","merge","save","saveWithEA","attributes","saveOneWithEA","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting","findByProtocol","protocol","getMany","extendManyWithEA"],"sources":["../../../../../../src/app/modules/database/repositories/identity-provider/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProvider, IdentityProviderProtocol, Realm } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { applyQuery, isEntityUnique, validateEntityJoinColumns } from 'typeorm-extension';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IIdentityProviderRepository, IRealmRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport type { IdentityProviderRepository } from '../../../../../adapters/database/domains/index.ts';\nimport { IdentityProviderEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type IdentityProviderRepositoryAdapterContext = {\n    repository: IdentityProviderRepository,\n    realmRepository: Repository<Realm>,\n};\n\nexport class IdentityProviderRepositoryAdapter implements IIdentityProviderRepository {\n    private readonly repository: IdentityProviderRepository;\n\n    private readonly realmRepository: IRealmRepository;\n\n    constructor(ctx: IdentityProviderRepositoryAdapterContext) {\n        this.repository = ctx.repository;\n        this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n    }\n\n    async findMany(query: Record<string, any>): Promise<EntityRepositoryFindManyResult<IdentityProvider>> {\n        const qb = this.repository.createQueryBuilder('provider');\n        qb.groupBy('provider.id');\n\n        const { pagination } = applyQuery(qb, query, {\n            defaultAlias: 'provider',\n            relations: {\n                allowed: ['realm'],\n                onJoin: (_property: string, key: string, q: any) => {\n                    q.addGroupBy(`${key}.id`);\n                },\n            },\n            fields: {\n                default: [\n                    'id',\n                    'name',\n                    'display_name',\n                    'protocol',\n                    'preset',\n                    'enabled',\n                    'realm_id',\n                    'created_at',\n                    'updated_at',\n                ],\n            },\n            filters: { allowed: ['name', 'protocol', 'enabled', 'realm_id', 'realm.name'] },\n            sort: { allowed: ['id', 'created_at', 'updated_at'] },\n            pagination: { maxLimit: 50 },\n        });\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<IdentityProvider | null> {\n        const entity = await this.findOneBy({ id });\n        if (entity) {\n            await this.repository.extendOneWithEA(entity);\n        }\n        return entity;\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<IdentityProvider | null> {\n        const qb = this.repository.createQueryBuilder('provider');\n        qb.where('provider.name = :name', { name });\n\n        if (realmKey) {\n            const realm = await this.realmRepository.resolve(realmKey);\n            if (realm) {\n                qb.andWhere('provider.realm_id = :realmId', { realmId: realm.id });\n            }\n        }\n\n        const entity = await qb.getOne();\n        if (entity) {\n            await this.repository.extendOneWithEA(entity);\n        }\n        return entity;\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<IdentityProvider | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<IdentityProvider[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<IdentityProvider | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<IdentityProvider>): IdentityProvider {\n        return this.repository.create(data);\n    }\n\n    merge(entity: IdentityProvider, data: Partial<IdentityProvider>): IdentityProvider {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: IdentityProvider): Promise<IdentityProvider> {\n        return this.repository.save(entity);\n    }\n\n    async saveWithEA(entity: IdentityProvider, attributes?: Record<string, any>): Promise<IdentityProvider> {\n        await this.repository.saveOneWithEA(entity, attributes);\n        return entity;\n    }\n\n    async extendOneWithEA(entity: IdentityProvider): Promise<void> {\n        await this.repository.extendOneWithEA(entity);\n    }\n\n    async remove(entity: IdentityProvider): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<IdentityProvider>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: IdentityProviderEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<IdentityProvider>, existing?: IdentityProvider): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.repository.manager.connection,\n            entityTarget: IdentityProviderEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async findByProtocol(protocol: IdentityProviderProtocol, realmKey?: string): Promise<IdentityProvider[]> {\n        const qb = this.repository.createQueryBuilder('provider');\n        qb.where('provider.protocol = :protocol', { protocol });\n\n        if (realmKey) {\n            if (isUUID(realmKey)) {\n                qb.andWhere('provider.realm_id = :realmId', { realmId: realmKey });\n            } else {\n                const realm = await this.realmRepository.resolve(realmKey);\n                if (!realm) {\n                    return [];\n                }\n\n                qb.andWhere('provider.realm_id = :realmId', { realmId: realm.id });\n            }\n        }\n\n        const entities = await qb.getMany();\n        await this.repository.extendManyWithEA(entities);\n        return entities;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAwBA,IAAaQ,oCAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAA+C;EACvD,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAAuF;EAClG,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,UAAA;EAC9CD,GAAGE,QAAQ,aAAA;EAEX,MAAM,EAAEC,eAAehB,WAAWa,IAAID,OAAO;GACzCK,cAAc;GACdC,WAAW;IACPC,SAAS,CAAC,OAAA;IACVC,SAASC,WAAmBC,KAAaC,MAAAA;KACrCA,EAAEC,WAAW,GAAGF,IAAI,IAAI;IAC5B;GACJ;GACAG,QAAQ,EACJC,SAAS;IACL;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;KAER;GACAC,SAAS,EAAER,SAAS;IAAC;IAAQ;IAAY;IAAW;IAAY;KAAc;GAC9ES,MAAM,EAAET,SAAS;IAAC;IAAM;IAAc;KAAc;GACpDH,YAAY,EAAEa,UAAU,GAAG;EAC/B,CAAA;EAEA,MAAM,CAACC,UAAUC,SAAS,MAAMlB,GAAGmB,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGf;GACP;EACJ;CACJ;CAEA,MAAMmB,YAAYC,IAA8C;EAC5D,MAAMC,SAAS,MAAM,KAAKC,UAAU,EAAEF,GAAG,CAAA;EACzC,IAAIC,QACA,MAAM,KAAK7B,WAAW+B,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMG,cAAcC,MAAcC,UAAqD;EACnF,MAAM7B,KAAK,KAAKL,WAAWM,mBAAmB,UAAA;EAC9CD,GAAG8B,MAAM,yBAAyB,EAAEF,KAAK,CAAA;EAEzC,IAAIC,UAAU;GACV,MAAME,QAAQ,MAAM,KAAKnC,gBAAgBoC,QAAQH,QAAAA;GACjD,IAAIE,OACA/B,GAAGiC,SAAS,gCAAgC,EAAEC,SAASH,MAAMR,GAAG,CAAA;EAExE;EAEA,MAAMC,SAAS,MAAMxB,GAAGmC,OAAM;EAC9B,IAAIX,QACA,MAAM,KAAK7B,WAAW+B,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMY,kBAAkBC,UAAkBN,OAAkD;EACxF,OAAO7C,OAAOmD,QAAAA,IACV,KAAKf,YAAYe,QAAAA,IACjB,KAAKV,cAAcU,UAAUN,KAAAA;CACrC;CAEA,MAAMO,WAAWR,OAAyD;EACtE,OAAO,KAAKnC,WAAW4C,OAAO/C,yBAAyBsC,KAAAA,CAAAA;CAC3D;CAEA,MAAML,UAAUK,OAA8D;EAC1E,OAAO,KAAKnC,WAAW8B,UAAUjC,yBAAyBsC,KAAAA,CAAAA;CAC9D;CAEAU,OAAOpB,MAAmD;EACtD,OAAO,KAAKzB,WAAW6C,OAAOpB,IAAAA;CAClC;CAEAqB,MAAMjB,QAA0BJ,MAAmD;EAC/E,OAAO,KAAKzB,WAAW8C,MAAMjB,QAAQJ,IAAAA;CACzC;CAEA,MAAMsB,KAAKlB,QAAqD;EAC5D,OAAO,KAAK7B,WAAW+C,KAAKlB,MAAAA;CAChC;CAEA,MAAMmB,WAAWnB,QAA0BoB,YAA6D;EACpG,MAAM,KAAKjD,WAAWkD,cAAcrB,QAAQoB,UAAAA;EAC5C,OAAOpB;CACX;CAEA,MAAME,gBAAgBF,QAAyC;EAC3D,MAAM,KAAK7B,WAAW+B,gBAAgBF,MAAAA;CAC1C;CAEA,MAAMsB,OAAOtB,QAAyC;EAClD,MAAM,KAAK7B,WAAWmD,OAAOtB,MAAAA;CACjC;CAEA,MAAMuB,oBAAoB3B,MAAgD;EACtE,MAAM/B,0BAA0B+B,MAAM;GAClC4B,YAAY,KAAKrD,WAAWsD,QAAQC;GACpCC,cAAc5D;EAClB,CAAA;CACJ;CAEA,MAAM6D,gBAAgBhC,MAAiCiC,UAA4C;EAQ/F,IAAI,CAACC,MAPkBlE,eAAe;GAClC4D,YAAY,KAAKrD,WAAWsD,QAAQC;GACpCC,cAAc5D;GACdiC,QAAQJ;GACRmC,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAI/D,sBAAAA;CAElB;CAEA,MAAMkE,eAAeC,UAAoC5B,UAAgD;EACrG,MAAM7B,KAAK,KAAKL,WAAWM,mBAAmB,UAAA;EAC9CD,GAAG8B,MAAM,iCAAiC,EAAE2B,SAAS,CAAA;EAErD,IAAI5B,UACA,IAAI3C,OAAO2C,QAAAA,GACP7B,GAAGiC,SAAS,gCAAgC,EAAEC,SAASL,SAAS,CAAA;OAC7D;GACH,MAAME,QAAQ,MAAM,KAAKnC,gBAAgBoC,QAAQH,QAAAA;GACjD,IAAI,CAACE,OACD,OAAO,CAAA;GAGX/B,GAAGiC,SAAS,gCAAgC,EAAEC,SAASH,MAAMR,GAAG,CAAA;EACpE;EAGJ,MAAMN,WAAW,MAAMjB,GAAG0D,QAAO;EACjC,MAAM,KAAK/D,WAAWgE,iBAAiB1C,QAAAA;EACvC,OAAOA;CACX;AACJ"}
+{"version":3,"file":"repository.mjs","names":["isUUID","applyQuery","isEntityUnique","validateEntityJoinColumns","DatabaseConflictError","IdentityProviderEntity","translateWhereConditions","RealmRepositoryAdapter","IdentityProviderRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","defaultAlias","relations","allowed","onJoin","_property","key","q","addGroupBy","fields","default","filters","sort","maxLimit","entities","total","getManyAndCount","data","meta","findOneById","id","entity","findOneBy","extendOneWithEA","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOneByIdOrName","idOrName","realm","findManyBy","findBy","create","merge","save","saveWithEA","attributes","saveOneWithEA","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting","findByProtocol","protocol","getMany","extendManyWithEA"],"sources":["../../../../../../src/app/modules/database/repositories/identity-provider/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProvider, IdentityProviderProtocol, Realm } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { applyQuery, isEntityUnique, validateEntityJoinColumns } from 'typeorm-extension';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IIdentityProviderRepository, IRealmRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport type { IdentityProviderRepository } from '../../../../../adapters/database/domains/index.ts';\nimport { IdentityProviderEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type IdentityProviderRepositoryAdapterContext = {\n    repository: IdentityProviderRepository,\n    realmRepository: Repository<Realm>,\n};\n\nexport class IdentityProviderRepositoryAdapter implements IIdentityProviderRepository {\n    private readonly repository: IdentityProviderRepository;\n\n    private readonly realmRepository: IRealmRepository;\n\n    constructor(ctx: IdentityProviderRepositoryAdapterContext) {\n        this.repository = ctx.repository;\n        this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n    }\n\n    async findMany(query: Record<string, any>): Promise<EntityRepositoryFindManyResult<IdentityProvider>> {\n        const qb = this.repository.createQueryBuilder('provider');\n        qb.groupBy('provider.id');\n\n        const { pagination } = applyQuery(qb, query, {\n            defaultAlias: 'provider',\n            relations: {\n                allowed: ['realm'],\n                onJoin: (_property: string, key: string, q: any) => {\n                    q.addGroupBy(`${key}.id`);\n                },\n            },\n            fields: {\n                default: [\n                    'id',\n                    'name',\n                    'display_name',\n                    'protocol',\n                    'preset',\n                    'enabled',\n                    'realm_id',\n                    'created_at',\n                    'updated_at',\n                ],\n            },\n            filters: { allowed: ['name', 'protocol', 'enabled', 'realm_id', 'realm.name'] },\n            sort: { allowed: ['id', 'created_at', 'updated_at'] },\n            pagination: { maxLimit: 50 },\n        });\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<IdentityProvider | null> {\n        const entity = await this.findOneBy({ id });\n        if (entity) {\n            await this.repository.extendOneWithEA(entity);\n        }\n        return entity;\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<IdentityProvider | null> {\n        const qb = this.repository.createQueryBuilder('provider');\n        qb.where('provider.name = :name', { name });\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n            qb.andWhere('provider.realm_id = :realmId', { realmId });\n        }\n\n        const entity = await qb.getOne();\n        if (entity) {\n            await this.repository.extendOneWithEA(entity);\n        }\n        return entity;\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<IdentityProvider | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<IdentityProvider[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<IdentityProvider | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<IdentityProvider>): IdentityProvider {\n        return this.repository.create(data);\n    }\n\n    merge(entity: IdentityProvider, data: Partial<IdentityProvider>): IdentityProvider {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: IdentityProvider): Promise<IdentityProvider> {\n        return this.repository.save(entity);\n    }\n\n    async saveWithEA(entity: IdentityProvider, attributes?: Record<string, any>): Promise<IdentityProvider> {\n        await this.repository.saveOneWithEA(entity, attributes);\n        return entity;\n    }\n\n    async extendOneWithEA(entity: IdentityProvider): Promise<void> {\n        await this.repository.extendOneWithEA(entity);\n    }\n\n    async remove(entity: IdentityProvider): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<IdentityProvider>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: IdentityProviderEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<IdentityProvider>, existing?: IdentityProvider): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.repository.manager.connection,\n            entityTarget: IdentityProviderEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async findByProtocol(protocol: IdentityProviderProtocol, realmKey?: string): Promise<IdentityProvider[]> {\n        const qb = this.repository.createQueryBuilder('provider');\n        qb.where('provider.protocol = :protocol', { protocol });\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return [];\n            }\n            qb.andWhere('provider.realm_id = :realmId', { realmId });\n        }\n\n        const entities = await qb.getMany();\n        await this.repository.extendManyWithEA(entities);\n        return entities;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAwBA,IAAaQ,oCAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAA+C;EACvD,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAAuF;EAClG,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,UAAA;EAC9CD,GAAGE,QAAQ,aAAA;EAEX,MAAM,EAAEC,eAAehB,WAAWa,IAAID,OAAO;GACzCK,cAAc;GACdC,WAAW;IACPC,SAAS,CAAC,OAAA;IACVC,SAASC,WAAmBC,KAAaC,MAAAA;KACrCA,EAAEC,WAAW,GAAGF,IAAI,IAAI;IAC5B;GACJ;GACAG,QAAQ,EACJC,SAAS;IACL;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;KAER;GACAC,SAAS,EAAER,SAAS;IAAC;IAAQ;IAAY;IAAW;IAAY;KAAc;GAC9ES,MAAM,EAAET,SAAS;IAAC;IAAM;IAAc;KAAc;GACpDH,YAAY,EAAEa,UAAU,GAAG;EAC/B,CAAA;EAEA,MAAM,CAACC,UAAUC,SAAS,MAAMlB,GAAGmB,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGf;GACP;EACJ;CACJ;CAEA,MAAMmB,YAAYC,IAA8C;EAC5D,MAAMC,SAAS,MAAM,KAAKC,UAAU,EAAEF,GAAG,CAAA;EACzC,IAAIC,QACA,MAAM,KAAK7B,WAAW+B,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMG,cAAcC,MAAcC,UAAqD;EACnF,MAAM7B,KAAK,KAAKL,WAAWM,mBAAmB,UAAA;EAC9CD,GAAG8B,MAAM,yBAAyB,EAAEF,KAAK,CAAA;EAEzC,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKnC,gBAAgBoC,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEX/B,GAAGiC,SAAS,gCAAgC,EAAEF,QAAQ,CAAA;EAC1D;EAEA,MAAMP,SAAS,MAAMxB,GAAGkC,OAAM;EAC9B,IAAIV,QACA,MAAM,KAAK7B,WAAW+B,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMW,kBAAkBC,UAAkBC,OAAkD;EACxF,OAAOnD,OAAOkD,QAAAA,IACV,KAAKd,YAAYc,QAAAA,IACjB,KAAKT,cAAcS,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWR,OAAyD;EACtE,OAAO,KAAKnC,WAAW4C,OAAO/C,yBAAyBsC,KAAAA,CAAAA;CAC3D;CAEA,MAAML,UAAUK,OAA8D;EAC1E,OAAO,KAAKnC,WAAW8B,UAAUjC,yBAAyBsC,KAAAA,CAAAA;CAC9D;CAEAU,OAAOpB,MAAmD;EACtD,OAAO,KAAKzB,WAAW6C,OAAOpB,IAAAA;CAClC;CAEAqB,MAAMjB,QAA0BJ,MAAmD;EAC/E,OAAO,KAAKzB,WAAW8C,MAAMjB,QAAQJ,IAAAA;CACzC;CAEA,MAAMsB,KAAKlB,QAAqD;EAC5D,OAAO,KAAK7B,WAAW+C,KAAKlB,MAAAA;CAChC;CAEA,MAAMmB,WAAWnB,QAA0BoB,YAA6D;EACpG,MAAM,KAAKjD,WAAWkD,cAAcrB,QAAQoB,UAAAA;EAC5C,OAAOpB;CACX;CAEA,MAAME,gBAAgBF,QAAyC;EAC3D,MAAM,KAAK7B,WAAW+B,gBAAgBF,MAAAA;CAC1C;CAEA,MAAMsB,OAAOtB,QAAyC;EAClD,MAAM,KAAK7B,WAAWmD,OAAOtB,MAAAA;CACjC;CAEA,MAAMuB,oBAAoB3B,MAAgD;EACtE,MAAM/B,0BAA0B+B,MAAM;GAClC4B,YAAY,KAAKrD,WAAWsD,QAAQC;GACpCC,cAAc5D;EAClB,CAAA;CACJ;CAEA,MAAM6D,gBAAgBhC,MAAiCiC,UAA4C;EAQ/F,IAAI,CAACC,MAPkBlE,eAAe;GAClC4D,YAAY,KAAKrD,WAAWsD,QAAQC;GACpCC,cAAc5D;GACdiC,QAAQJ;GACRmC,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAI/D,sBAAAA;CAElB;CAEA,MAAMkE,eAAeC,UAAoC5B,UAAgD;EACrG,MAAM7B,KAAK,KAAKL,WAAWM,mBAAmB,UAAA;EAC9CD,GAAG8B,MAAM,iCAAiC,EAAE2B,SAAS,CAAA;EAErD,IAAI5B,UAAU;GACV,MAAME,UAAU,MAAM,KAAKnC,gBAAgBoC,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO,CAAA;GAEX/B,GAAGiC,SAAS,gCAAgC,EAAEF,QAAQ,CAAA;EAC1D;EAEA,MAAMd,WAAW,MAAMjB,GAAG0D,QAAO;EACjC,MAAM,KAAK/D,WAAWgE,iBAAiB1C,QAAAA;EACvC,OAAOA;CACX;AACJ"}

package/dist/app/modules/database/repositories/index.d.ts

@@ -2,7 +2,9 @@ export * from './client/index.ts';
 export * from './client-permission/index.ts';
 export * from './client-role/index.ts';
 export * from './client-scope/index.ts';
+export * from './event/index.ts';
 export * from './identity-provider/index.ts';
+export * from './key/index.ts';
 export * from './permission/index.ts';
 export * from './permission-policy/index.ts';
 export * from './permission-provider/index.ts';
@@ -15,8 +17,10 @@ export * from './role/index.ts';
 export * from './role-attribute/index.ts';
 export * from './role-permission/index.ts';
 export * from './scope/index.ts';
+export * from './trust-anchor/index.ts';
 export * from './user/index.ts';
 export * from './user-attribute/index.ts';
+export * from './user-authenticator/index.ts';
 export * from './user-permission/index.ts';
 export * from './user-role/index.ts';
 export * from './identity-provider-role-mapping/index.ts';

package/dist/app/modules/database/repositories/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}

package/dist/app/modules/database/repositories/index.mjs

@@ -10,8 +10,12 @@ import { ClientRoleRepositoryAdapter } from "./client-role/repository.mjs";
 import "./client-role/index.mjs";
 import { ClientScopeRepositoryAdapter } from "./client-scope/repository.mjs";
 import "./client-scope/index.mjs";
+import { EventRepositoryAdapter } from "./event/repository.mjs";
+import "./event/index.mjs";
 import { IdentityProviderRepositoryAdapter } from "./identity-provider/repository.mjs";
 import "./identity-provider/index.mjs";
+import { KeyRepositoryAdapter } from "./key/repository.mjs";
+import "./key/index.mjs";
 import { PermissionRepositoryAdapter } from "./permission/repository.mjs";
 import "./permission/index.mjs";
 import { PermissionPolicyRepositoryAdapter } from "./permission-policy/repository.mjs";
@@ -35,14 +39,18 @@ import { RolePermissionRepositoryAdapter } from "./role-permission/repository.mj
 import "./role-permission/index.mjs";
 import { ScopeRepositoryAdapter } from "./scope/repository.mjs";
 import "./scope/index.mjs";
+import { TrustAnchorRepositoryAdapter } from "./trust-anchor/repository.mjs";
+import "./trust-anchor/index.mjs";
 import { UserRepositoryAdapter } from "./user/repository.mjs";
 import "./user/index.mjs";
 import { UserAttributeRepositoryAdapter } from "./user-attribute/repository.mjs";
 import "./user-attribute/index.mjs";
+import { UserAuthenticatorRepositoryAdapter } from "./user-authenticator/repository.mjs";
+import "./user-authenticator/index.mjs";
 import { UserPermissionRepositoryAdapter } from "./user-permission/repository.mjs";
 import "./user-permission/index.mjs";
 import { UserRoleRepositoryAdapter } from "./user-role/repository.mjs";
 import "./user-role/index.mjs";
 import { IdentityProviderRoleMappingRepositoryAdapter } from "./identity-provider-role-mapping/repository.mjs";
 import "./identity-provider-role-mapping/index.mjs";
-export { ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepositoryAdapter, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, RealmRepositoryAdapter, RobotPermissionRepositoryAdapter, RobotRepositoryAdapter, RobotRoleRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, ScopeRepositoryAdapter, UserAttributeRepositoryAdapter, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter };
+export { ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, EventRepositoryAdapter, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, RealmRepositoryAdapter, RobotPermissionRepositoryAdapter, RobotRepositoryAdapter, RobotRoleRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, ScopeRepositoryAdapter, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter };

package/dist/app/modules/database/repositories/key/index.d.ts

@@ -0,0 +1,2 @@
+export * from './repository.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/app/modules/database/repositories/key/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/key/index.ts"],"names":[],"mappings":"AAOA,cAAc,iBAAiB,CAAC"}

package/dist/app/modules/database/repositories/key/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { KeyRepositoryAdapter } from "./repository.mjs";
+export { KeyRepositoryAdapter };

package/dist/app/modules/database/repositories/key/repository.d.ts

@@ -0,0 +1,50 @@
+import type { Key } from '@authup/core-kit';
+import { type EntityRepositoryFindManyResult, type ISymmetricCipher, type Logger } from '@authup/server-kit';
+import { JWKUse } from '@authup/specs';
+import type { DataSource, Repository } from 'typeorm';
+import { KeyEntity } from '../../../../../adapters/database/index.ts';
+import type { IKeyRepository, IKeyStore, IRealmRepository } from '../../../../../core/index.ts';
+export type KeyRepositoryAdapterOptions = {
+    /**
+     * Optional KEK (config secretsEncryptionKey) — when present, key
+     * material is persisted wrapped and unwrapped transparently on read.
+     */
+    secretsCipher?: ISymmetricCipher | null;
+    logger?: Logger;
+};
+/**
+ * One adapter, two ports: the entity CRUD surface (IKeyRepository) for the
+ * key management API and the material-resolving store (IKeyStore) for the
+ * signer / verifier / realm cipher. Entity reads never select
+ * decryption_key; only the IKeyStore surface hands out (unwrapped) material.
+ */
+export declare class KeyRepositoryAdapter implements IKeyRepository, IKeyStore {
+    protected dataSource: DataSource;
+    protected secretsCipher: ISymmetricCipher | null;
+    protected realmRepository: IRealmRepository;
+    protected logger?: Logger;
+    constructor(dataSource: DataSource, options?: KeyRepositoryAdapterOptions);
+    protected get repository(): Repository<KeyEntity>;
+    resolveOrCreate(realmId: string, use: `${JWKUse}`): Promise<Key>;
+    resolveById(id: string): Promise<Key | null>;
+    protected createSignatureKey(repository: Repository<KeyEntity>, realmId: string): Promise<Key>;
+    protected createEncryptionKey(repository: Repository<KeyEntity>, realmId: string): Promise<Key>;
+    protected generateName(use: `${JWKUse}`): string;
+    protected afterLoad(repository: Repository<KeyEntity>, entity: KeyEntity): Promise<Key>;
+    protected protect(material: string): Promise<string>;
+    findMany(query: Record<string, any>): Promise<EntityRepositoryFindManyResult<Key>>;
+    findOneById(id: string): Promise<Key | null>;
+    findOneByName(name: string, realmKey?: string): Promise<Key | null>;
+    findOneByIdOrName(idOrName: string, realm?: string): Promise<Key | null>;
+    findManyBy(where: Record<string, any>): Promise<Key[]>;
+    findOneBy(where: Record<string, any>): Promise<Key | null>;
+    create(data: Partial<Key>): Key;
+    merge(entity: Key, data: Partial<Key>): Key;
+    save(entity: Key): Promise<Key>;
+    remove(entity: Key): Promise<void>;
+    validateJoinColumns(data: Partial<Key>): Promise<void>;
+    checkUniqueness(data: Partial<Key>, existing?: Key): Promise<void>;
+    countBlobReferences(keyId: string): Promise<number>;
+    findHighestPriority(realmId: string, use: string): Promise<number | null>;
+}
+//# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/database/repositories/key/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/key/repository.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,EAGH,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACrB,KAAK,MAAM,EAEd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAW,MAAM,EAAgB,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAoB,UAAU,EAAE,MAAM,SAAS,CAAC;AAIxE,OAAO,EAEH,SAAS,EAGZ,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAUhG,MAAM,MAAM,2BAA2B,GAAG;IACtC;;;OAGG;IACH,aAAa,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,cAAc,EAAE,SAAS;IAClE,SAAS,CAAC,UAAU,EAAG,UAAU,CAAC;IAElC,SAAS,CAAC,aAAa,EAAG,gBAAgB,GAAG,IAAI,CAAC;IAElD,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAEf,UAAU,EAAE,UAAU,EAAE,OAAO,GAAE,2BAAgC;IAO7E,SAAS,KAAK,UAAU,IAAK,UAAU,CAAC,SAAS,CAAC,CAEjD;IAMK,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAmDhE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;cAkClC,kBAAkB,CAC9B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC;cA2BA,mBAAmB,CAC/B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC;IAwBhB,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,MAAM;cAIjC,SAAS,CACrB,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,MAAM,EAAE,SAAS,GACjB,OAAO,CAAC,GAAG,CAAC;cA6BA,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC;IAYrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC;IAuClF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAI5C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAenE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAMxE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAItD,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAIhE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG;IAI/B,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG;IAIrC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAgB/B,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAalE,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGlF"}

package/dist/app/modules/database/repositories/key/repository.mjs

@@ -0,0 +1,273 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RealmEntity } from "../../../../../adapters/database/domains/realm/entity.mjs";
+import { KeyEntity } from "../../../../../adapters/database/domains/key/entity.mjs";
+import { UserAuthenticatorEntity } from "../../../../../adapters/database/domains/user-authenticator/entity.mjs";
+import "../../../../../core/key/constants.mjs";
+import { isWrappedKeyMaterial, unwrapKeyMaterial, wrapKeyMaterial } from "../../../../../core/key/wrap.mjs";
+import "../../../../../core/index.mjs";
+import { applyRealmScopeSelect, translateWhereConditions } from "../helpers.mjs";
+import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
+import "../../../../../adapters/database/index.mjs";
+import { RealmRepositoryAdapter } from "../realm/repository.mjs";
+import { Like } from "typeorm";
+import { arrayBufferToBase64, createNanoID, isUUID } from "@authup/kit";
+import { KeyStatus } from "@authup/core-kit";
+import { AsymmetricKey, CryptoAsymmetricAlgorithm, createAsymmetricKeyPair } from "@authup/server-kit";
+import { AuthupError } from "@authup/errors";
+import { JWKType, JWKUse, JWTAlgorithm } from "@authup/specs";
+import { getRandomValues } from "uncrypto";
+import { applyQuery, isEntityUnique, validateEntityJoinColumns } from "typeorm-extension";
+//#region src/app/modules/database/repositories/key/repository.ts
+/**
+* One adapter, two ports: the entity CRUD surface (IKeyRepository) for the
+* key management API and the material-resolving store (IKeyStore) for the
+* signer / verifier / realm cipher. Entity reads never select
+* decryption_key; only the IKeyStore surface hands out (unwrapped) material.
+*/ var KeyRepositoryAdapter = class {
+	dataSource;
+	secretsCipher;
+	realmRepository;
+	logger;
+	constructor(dataSource, options = {}) {
+		this.dataSource = dataSource;
+		this.secretsCipher = options.secretsCipher ?? null;
+		this.logger = options.logger;
+		this.realmRepository = new RealmRepositoryAdapter(dataSource.getRepository(RealmEntity));
+	}
+	get repository() {
+		return this.dataSource.getRepository(KeyEntity);
+	}
+	async resolveOrCreate(realmId, use) {
+		const { repository } = this;
+		const entity = await repository.findOne({
+			select: {
+				id: true,
+				name: true,
+				type: true,
+				use: true,
+				status: true,
+				signature_algorithm: true,
+				encryption_key: true,
+				decryption_key: true,
+				realm_id: true
+			},
+			where: {
+				realm_id: realmId,
+				use,
+				status: KeyStatus.ACTIVE
+			},
+			order: {
+				priority: "DESC",
+				created_at: "DESC",
+				id: "ASC"
+			}
+		});
+		if (entity) return this.afterLoad(repository, entity);
+		const total = await repository.countBy({
+			realm_id: realmId,
+			use
+		});
+		if (total > 0) throw new AuthupError(`No active ${use} key is available for realm ${realmId} (${total} key(s) exist, none active).`);
+		if (use === JWKUse.ENCRYPTION) return this.createEncryptionKey(repository, realmId);
+		return this.createSignatureKey(repository, realmId);
+	}
+	async resolveById(id) {
+		const { repository } = this;
+		if (!isUUID(id)) return null;
+		const entity = await repository.findOne({
+			select: {
+				id: true,
+				name: true,
+				type: true,
+				use: true,
+				status: true,
+				signature_algorithm: true,
+				encryption_key: true,
+				decryption_key: true,
+				realm_id: true
+			},
+			where: { id }
+		});
+		if (!entity) return null;
+		return this.afterLoad(repository, entity);
+	}
+	async createSignatureKey(repository, realmId) {
+		const keyPair = await createAsymmetricKeyPair({ name: CryptoAsymmetricAlgorithm.RSASSA_PKCS1_V1_5 });
+		const privateKeyContainer = new AsymmetricKey(keyPair.privateKey);
+		const publicKeyContainer = new AsymmetricKey(keyPair.publicKey);
+		const material = await privateKeyContainer.toBase64();
+		const entity = repository.create({
+			name: this.generateName(JWKUse.SIGNATURE),
+			type: JWKType.RSA,
+			use: JWKUse.SIGNATURE,
+			status: KeyStatus.ACTIVE,
+			decryption_key: await this.protect(material),
+			encryption_key: await publicKeyContainer.toBase64(),
+			realm_id: realmId,
+			signature_algorithm: `${JWTAlgorithm.RS256}`
+		});
+		await repository.save(entity);
+		entity.decryption_key = material;
+		return entity;
+	}
+	async createEncryptionKey(repository, realmId) {
+		const raw = /* @__PURE__ */ new Uint8Array(32);
+		getRandomValues(raw);
+		const material = arrayBufferToBase64(raw.buffer);
+		const entity = repository.create({
+			name: this.generateName(JWKUse.ENCRYPTION),
+			type: JWKType.OCT,
+			use: JWKUse.ENCRYPTION,
+			status: KeyStatus.ACTIVE,
+			decryption_key: await this.protect(material),
+			encryption_key: null,
+			realm_id: realmId,
+			signature_algorithm: null
+		});
+		await repository.save(entity);
+		entity.decryption_key = material;
+		return entity;
+	}
+	generateName(use) {
+		return `${use}-${createNanoID(10)}`;
+	}
+	async afterLoad(repository, entity) {
+		if (!entity.decryption_key) return entity;
+		if (isWrappedKeyMaterial(entity.decryption_key)) {
+			entity.decryption_key = await unwrapKeyMaterial(this.secretsCipher, entity.decryption_key);
+			return entity;
+		}
+		if (this.secretsCipher) {
+			const material = entity.decryption_key;
+			try {
+				await repository.update(entity.id, { decryption_key: await wrapKeyMaterial(this.secretsCipher, material) });
+			} catch (e) {
+				this.logger?.warn(`Failed to wrap key material at rest for key ${entity.id}.`, { error: e });
+			}
+			entity.decryption_key = material;
+		}
+		return entity;
+	}
+	async protect(material) {
+		if (!this.secretsCipher) return material;
+		return wrapKeyMaterial(this.secretsCipher, material);
+	}
+	async findMany(query) {
+		const qb = this.repository.createQueryBuilder("keyEntity");
+		qb.groupBy("keyEntity.id");
+		const { pagination } = applyQuery(qb, query, {
+			defaultAlias: "keyEntity",
+			fields: {
+				default: [
+					"id",
+					"name",
+					"type",
+					"use",
+					"priority",
+					"status",
+					"signature_algorithm",
+					"realm_id",
+					"created_at",
+					"updated_at"
+				],
+				allowed: ["encryption_key", "certificate"]
+			},
+			filters: { allowed: [
+				"id",
+				"name",
+				"type",
+				"use",
+				"status",
+				"realm_id"
+			] },
+			pagination: { maxLimit: 50 },
+			sort: { allowed: [
+				"id",
+				"name",
+				"priority",
+				"use",
+				"status",
+				"created_at",
+				"updated_at"
+			] }
+		});
+		applyRealmScopeSelect(qb, "keyEntity");
+		const [entities, total] = await qb.getManyAndCount();
+		return {
+			data: entities,
+			meta: {
+				total,
+				...pagination
+			}
+		};
+	}
+	async findOneById(id) {
+		return this.findOneBy({ id });
+	}
+	async findOneByName(name, realmKey) {
+		const where = { name };
+		if (realmKey) {
+			const realmId = await this.realmRepository.resolveId(realmKey);
+			if (!realmId) return null;
+			where.realm_id = realmId;
+		}
+		return this.repository.findOneBy(where);
+	}
+	async findOneByIdOrName(idOrName, realm) {
+		return isUUID(idOrName) ? this.findOneById(idOrName) : this.findOneByName(idOrName, realm);
+	}
+	async findManyBy(where) {
+		return this.repository.findBy(translateWhereConditions(where));
+	}
+	async findOneBy(where) {
+		return this.repository.findOneBy(translateWhereConditions(where));
+	}
+	create(data) {
+		return this.repository.create(data);
+	}
+	merge(entity, data) {
+		return this.repository.merge(entity, data);
+	}
+	async save(entity) {
+		if (entity.decryption_key && this.secretsCipher && !isWrappedKeyMaterial(entity.decryption_key)) {
+			const material = entity.decryption_key;
+			entity.decryption_key = await wrapKeyMaterial(this.secretsCipher, material);
+			const saved = await this.repository.save(entity);
+			saved.decryption_key = material;
+			return saved;
+		}
+		return this.repository.save(entity);
+	}
+	async remove(entity) {
+		await this.repository.remove(entity);
+	}
+	async validateJoinColumns(data) {
+		await validateEntityJoinColumns(data, {
+			dataSource: this.dataSource,
+			entityTarget: KeyEntity
+		});
+	}
+	async checkUniqueness(data, existing) {
+		if (!await isEntityUnique({
+			dataSource: this.dataSource,
+			entityTarget: KeyEntity,
+			entity: data,
+			entityExisting: existing
+		})) throw new DatabaseConflictError();
+	}
+	async countBlobReferences(keyId) {
+		return this.dataSource.getRepository(UserAuthenticatorEntity).countBy({ secret: Like(`v1.${keyId}.%`) });
+	}
+	async findHighestPriority(realmId, use) {
+		return this.repository.maximum("priority", {
+			realm_id: realmId,
+			use
+		});
+	}
+};
+//#endregion
+export { KeyRepositoryAdapter };
+
+//# sourceMappingURL=repository.mjs.map

package/dist/app/modules/database/repositories/key/repository.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.mjs","names":["AuthupError","KeyStatus","arrayBufferToBase64","createNanoID","isUUID","AsymmetricKey","CryptoAsymmetricAlgorithm","createAsymmetricKeyPair","JWKType","JWKUse","JWTAlgorithm","Like","applyQuery","isEntityUnique","validateEntityJoinColumns","getRandomValues","DatabaseConflictError","KeyEntity","RealmEntity","UserAuthenticatorEntity","REALM_CIPHER_BLOB_VERSION","isWrappedKeyMaterial","unwrapKeyMaterial","wrapKeyMaterial","applyRealmScopeSelect","translateWhereConditions","RealmRepositoryAdapter","KeyRepositoryAdapter","dataSource","secretsCipher","realmRepository","logger","options","getRepository","repository","resolveOrCreate","realmId","use","entity","findOne","select","id","name","type","status","signature_algorithm","encryption_key","decryption_key","realm_id","where","ACTIVE","order","priority","created_at","afterLoad","total","countBy","ENCRYPTION","createEncryptionKey","createSignatureKey","resolveById","keyPair","RSASSA_PKCS1_V1_5","privateKeyContainer","privateKey","publicKeyContainer","publicKey","material","toBase64","create","generateName","SIGNATURE","RSA","protect","RS256","save","raw","Uint8Array","buffer","OCT","update","e","warn","error","findMany","query","qb","createQueryBuilder","groupBy","pagination","defaultAlias","fields","default","allowed","filters","maxLimit","sort","entities","getManyAndCount","data","meta","findOneById","findOneBy","findOneByName","realmKey","resolveId","findOneByIdOrName","idOrName","realm","findManyBy","findBy","merge","saved","remove","validateJoinColumns","entityTarget","checkUniqueness","existing","isUnique","entityExisting","countBlobReferences","keyId","secret","findHighestPriority","maximum"],"sources":["../../../../../../src/app/modules/database/repositories/key/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\nimport type { Key } from '@authup/core-kit';\nimport { KeyStatus } from '@authup/core-kit';\nimport { arrayBufferToBase64, createNanoID, isUUID } from '@authup/kit';\nimport {\n    AsymmetricKey,\n    CryptoAsymmetricAlgorithm,\n    type EntityRepositoryFindManyResult,\n    type ISymmetricCipher,\n    type Logger,\n    createAsymmetricKeyPair,\n} from '@authup/server-kit';\nimport { JWKType, JWKUse, JWTAlgorithm } from '@authup/specs';\nimport type { DataSource, FindOptionsWhere, Repository } from 'typeorm';\nimport { Like } from 'typeorm';\nimport { applyQuery, isEntityUnique, validateEntityJoinColumns } from 'typeorm-extension';\nimport { getRandomValues } from 'uncrypto';\nimport {\n    DatabaseConflictError,\n    KeyEntity,\n    RealmEntity,\n    UserAuthenticatorEntity,\n} from '../../../../../adapters/database/index.ts';\nimport type { IKeyRepository, IKeyStore, IRealmRepository } from '../../../../../core/index.ts';\nimport {\n    REALM_CIPHER_BLOB_VERSION,\n    isWrappedKeyMaterial,\n    unwrapKeyMaterial,\n    wrapKeyMaterial,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect, translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type KeyRepositoryAdapterOptions = {\n    /**\n     * Optional KEK (config secretsEncryptionKey) — when present, key\n     * material is persisted wrapped and unwrapped transparently on read.\n     */\n    secretsCipher?: ISymmetricCipher | null,\n    logger?: Logger,\n};\n\n/**\n * One adapter, two ports: the entity CRUD surface (IKeyRepository) for the\n * key management API and the material-resolving store (IKeyStore) for the\n * signer / verifier / realm cipher. Entity reads never select\n * decryption_key; only the IKeyStore surface hands out (unwrapped) material.\n */\nexport class KeyRepositoryAdapter implements IKeyRepository, IKeyStore {\n    protected dataSource : DataSource;\n\n    protected secretsCipher : ISymmetricCipher | null;\n\n    protected realmRepository : IRealmRepository;\n\n    protected logger? : Logger;\n\n    constructor(dataSource: DataSource, options: KeyRepositoryAdapterOptions = {}) {\n        this.dataSource = dataSource;\n        this.secretsCipher = options.secretsCipher ?? null;\n        this.logger = options.logger;\n        this.realmRepository = new RealmRepositoryAdapter(dataSource.getRepository(RealmEntity));\n    }\n\n    protected get repository() : Repository<KeyEntity> {\n        return this.dataSource.getRepository(KeyEntity);\n    }\n\n    // ------------------------------------------------------------------\n    // IKeyStore — material resolution (signer / verifier / realm cipher)\n    // ------------------------------------------------------------------\n\n    async resolveOrCreate(realmId: string, use: `${JWKUse}`): Promise<Key> {\n        const { repository } = this;\n\n        const entity = await repository.findOne({\n            select: {\n                id: true,\n                name: true,\n                type: true,\n                use: true,\n                status: true,\n                signature_algorithm: true,\n                encryption_key: true,\n                decryption_key: true,\n                realm_id: true,\n            },\n            where: {\n                realm_id: realmId,\n                use,\n                status: KeyStatus.ACTIVE,\n            },\n            // created_at + id break priority ties deterministically (e.g.\n            // duplicate mints from a concurrent zero-row backstop race —\n            // benign, both keys verify, but selection must be stable).\n            order: {\n                priority: 'DESC', \n                created_at: 'DESC', \n                id: 'ASC', \n            },\n        });\n\n        if (entity) {\n            return this.afterLoad(repository, entity);\n        }\n\n        const total = await repository.countBy({ realm_id: realmId, use });\n        if (total > 0) {\n            // an admin who disabled every key meant it — do not silently\n            // re-mint around the kill switch.\n            throw new AuthupError(\n                `No active ${use} key is available for realm ${realmId} ` +\n                `(${total} key(s) exist, none active).`,\n            );\n        }\n\n        if (use === JWKUse.ENCRYPTION) {\n            return this.createEncryptionKey(repository, realmId);\n        }\n\n        return this.createSignatureKey(repository, realmId);\n    }\n\n    async resolveById(id: string): Promise<Key | null> {\n        const { repository } = this;\n\n        // `id` reaches here from an attacker-controlled JWT `kid` header on the\n        // token-verification hot path. A non-UUID value binds against a\n        // postgres `uuid` column as a driver-level type error (500) instead of\n        // a clean miss — short-circuit to \"not found\" so a garbage kid is a\n        // plain verification failure.\n        if (!isUUID(id)) {\n            return null;\n        }\n\n        const entity = await repository.findOne({\n            select: {\n                id: true,\n                name: true,\n                type: true,\n                use: true,\n                status: true,\n                signature_algorithm: true,\n                encryption_key: true,\n                decryption_key: true,\n                realm_id: true,\n            },\n            where: { id },\n        });\n\n        if (!entity) {\n            return null;\n        }\n\n        return this.afterLoad(repository, entity);\n    }\n\n    protected async createSignatureKey(\n        repository: Repository<KeyEntity>,\n        realmId: string,\n    ) : Promise<Key> {\n        const keyPair = await createAsymmetricKeyPair({ name: CryptoAsymmetricAlgorithm.RSASSA_PKCS1_V1_5 });\n\n        const privateKeyContainer = new AsymmetricKey(keyPair.privateKey);\n        const publicKeyContainer = new AsymmetricKey(keyPair.publicKey);\n\n        const material = await privateKeyContainer.toBase64();\n\n        const entity = repository.create({\n            name: this.generateName(JWKUse.SIGNATURE),\n            type: JWKType.RSA,\n            use: JWKUse.SIGNATURE,\n            status: KeyStatus.ACTIVE,\n            decryption_key: await this.protect(material),\n            encryption_key: await publicKeyContainer.toBase64(),\n            realm_id: realmId,\n            signature_algorithm: `${JWTAlgorithm.RS256}`,\n        });\n\n        await repository.save(entity);\n\n        // hand the caller usable material regardless of the persisted form.\n        entity.decryption_key = material;\n\n        return entity;\n    }\n\n    protected async createEncryptionKey(\n        repository: Repository<KeyEntity>,\n        realmId: string,\n    ) : Promise<Key> {\n        const raw = new Uint8Array(32);\n        getRandomValues(raw);\n\n        const material = arrayBufferToBase64(raw.buffer);\n\n        const entity = repository.create({\n            name: this.generateName(JWKUse.ENCRYPTION),\n            type: JWKType.OCT,\n            use: JWKUse.ENCRYPTION,\n            status: KeyStatus.ACTIVE,\n            decryption_key: await this.protect(material),\n            encryption_key: null,\n            realm_id: realmId,\n            signature_algorithm: null,\n        });\n\n        await repository.save(entity);\n\n        entity.decryption_key = material;\n\n        return entity;\n    }\n\n    protected generateName(use: `${JWKUse}`) : string {\n        return `${use}-${createNanoID(10)}`;\n    }\n\n    protected async afterLoad(\n        repository: Repository<KeyEntity>,\n        entity: KeyEntity,\n    ) : Promise<Key> {\n        if (!entity.decryption_key) {\n            return entity;\n        }\n\n        if (isWrappedKeyMaterial(entity.decryption_key)) {\n            entity.decryption_key = await unwrapKeyMaterial(this.secretsCipher, entity.decryption_key);\n            return entity;\n        }\n\n        if (this.secretsCipher) {\n            // lazy wrap-on-read: a KEK added to a running deployment\n            // hardens existing rows without a migration step. Best-effort —\n            // the material stays readable either way.\n            const material = entity.decryption_key;\n            try {\n                await repository.update(entity.id, { decryption_key: await wrapKeyMaterial(this.secretsCipher, material) });\n            } catch (e) {\n                // Best-effort — the material stays readable and the next read\n                // retries. Surface it though: a persistent failure (e.g. a\n                // read-only replica) means the row is never hardened at rest.\n                this.logger?.warn(`Failed to wrap key material at rest for key ${entity.id}.`, { error: e });\n            }\n            entity.decryption_key = material;\n        }\n\n        return entity;\n    }\n\n    protected async protect(material: string) : Promise<string> {\n        if (!this.secretsCipher) {\n            return material;\n        }\n\n        return wrapKeyMaterial(this.secretsCipher, material);\n    }\n\n    // ------------------------------------------------------------------\n    // IKeyRepository — entity CRUD surface (key management API)\n    // ------------------------------------------------------------------\n\n    async findMany(query: Record<string, any>): Promise<EntityRepositoryFindManyResult<Key>> {\n        const qb = this.repository.createQueryBuilder('keyEntity');\n        qb.groupBy('keyEntity.id');\n\n        const { pagination } = applyQuery(qb, query, {\n            defaultAlias: 'keyEntity',\n            fields: {\n                default: [\n                    'id',\n                    'name',\n                    'type',\n                    'use',\n                    'priority',\n                    'status',\n                    'signature_algorithm',\n                    'realm_id',\n                    'created_at',\n                    'updated_at',\n                ],\n                allowed: ['encryption_key', 'certificate'],\n            },\n            filters: { allowed: ['id', 'name', 'type', 'use', 'status', 'realm_id'] },\n            pagination: { maxLimit: 50 },\n            sort: { allowed: ['id', 'name', 'priority', 'use', 'status', 'created_at', 'updated_at'] },\n        });\n\n        applyRealmScopeSelect(qb, 'keyEntity');\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Key | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<Key | null> {\n        const where : FindOptionsWhere<KeyEntity> = { name };\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n\n            where.realm_id = realmId;\n        }\n\n        return this.repository.findOneBy(where);\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<Key | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<Key[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<Key | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<Key>): Key {\n        return this.repository.create(data);\n    }\n\n    merge(entity: Key, data: Partial<Key>): Key {\n        return this.repository.merge(entity as KeyEntity, data);\n    }\n\n    async save(entity: Key): Promise<Key> {\n        if (\n            entity.decryption_key &&\n            this.secretsCipher &&\n            !isWrappedKeyMaterial(entity.decryption_key)\n        ) {\n            const material = entity.decryption_key;\n            entity.decryption_key = await wrapKeyMaterial(this.secretsCipher, material);\n            const saved = await this.repository.save(entity as KeyEntity);\n            saved.decryption_key = material;\n            return saved;\n        }\n\n        return this.repository.save(entity as KeyEntity);\n    }\n\n    async remove(entity: Key): Promise<void> {\n        await this.repository.remove(entity as KeyEntity);\n    }\n\n    async validateJoinColumns(data: Partial<Key>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.dataSource,\n            entityTarget: KeyEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<Key>, existing?: Key): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.dataSource,\n            entityTarget: KeyEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async countBlobReferences(keyId: string): Promise<number> {\n        return this.dataSource.getRepository(UserAuthenticatorEntity).countBy({ secret: Like(`${REALM_CIPHER_BLOB_VERSION}.${keyId}.%`) });\n    }\n\n    async findHighestPriority(realmId: string, use: string): Promise<number | null> {\n        return this.repository.maximum('priority', { realm_id: realmId, use: use as `${JWKUse}` });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDA,IAAa2B,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYH,YAAwBI,UAAuC,CAAC,GAAG;EAC3E,KAAKJ,aAAaA;EAClB,KAAKC,gBAAgBG,QAAQH,iBAAiB;EAC9C,KAAKE,SAASC,QAAQD;EACtB,KAAKD,kBAAkB,IAAIJ,uBAAuBE,WAAWK,cAAcf,WAAAA,CAAAA;CAC/E;CAEA,IAAcgB,aAAqC;EAC/C,OAAO,KAAKN,WAAWK,cAAchB,SAAAA;CACzC;CAMA,MAAMkB,gBAAgBC,SAAiBC,KAAgC;EACnE,MAAM,EAAEH,eAAe;EAEvB,MAAMI,SAAS,MAAMJ,WAAWK,QAAQ;GACpCC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNN,KAAK;IACLO,QAAQ;IACRC,qBAAqB;IACrBC,gBAAgB;IAChBC,gBAAgB;IAChBC,UAAU;GACd;GACAC,OAAO;IACHD,UAAUZ;IACVC;IACAO,QAAQ3C,UAAUiD;GACtB;GAIAC,OAAO;IACHC,UAAU;IACVC,YAAY;IACZZ,IAAI;GACR;EACJ,CAAA;EAEA,IAAIH,QACA,OAAO,KAAKgB,UAAUpB,YAAYI,MAAAA;EAGtC,MAAMiB,QAAQ,MAAMrB,WAAWsB,QAAQ;GAAER,UAAUZ;GAASC;EAAI,CAAA;EAChE,IAAIkB,QAAQ,GAGR,MAAM,IAAIvD,YACN,aAAaqC,IAAI,8BAA8BD,QAAQ,IACnDmB,MAAM,6BAA6B;EAI/C,IAAIlB,QAAQ5B,OAAOgD,YACf,OAAO,KAAKC,oBAAoBxB,YAAYE,OAAAA;EAGhD,OAAO,KAAKuB,mBAAmBzB,YAAYE,OAAAA;CAC/C;CAEA,MAAMwB,YAAYnB,IAAiC;EAC/C,MAAM,EAAEP,eAAe;EAOvB,IAAI,CAAC9B,OAAOqC,EAAAA,GACR,OAAO;EAGX,MAAMH,SAAS,MAAMJ,WAAWK,QAAQ;GACpCC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNN,KAAK;IACLO,QAAQ;IACRC,qBAAqB;IACrBC,gBAAgB;IAChBC,gBAAgB;IAChBC,UAAU;GACd;GACAC,OAAO,EAAER,GAAG;EAChB,CAAA;EAEA,IAAI,CAACH,QACD,OAAO;EAGX,OAAO,KAAKgB,UAAUpB,YAAYI,MAAAA;CACtC;CAEA,MAAgBqB,mBACZzB,YACAE,SACa;EACb,MAAMyB,UAAU,MAAMtD,wBAAwB,EAAEmC,MAAMpC,0BAA0BwD,kBAAkB,CAAA;EAElG,MAAMC,sBAAsB,IAAI1D,cAAcwD,QAAQG,UAAU;EAChE,MAAMC,qBAAqB,IAAI5D,cAAcwD,QAAQK,SAAS;EAE9D,MAAMC,WAAW,MAAMJ,oBAAoBK,SAAQ;EAEnD,MAAM9B,SAASJ,WAAWmC,OAAO;GAC7B3B,MAAM,KAAK4B,aAAa7D,OAAO8D,SAAS;GACxC5B,MAAMnC,QAAQgE;GACdnC,KAAK5B,OAAO8D;GACZ3B,QAAQ3C,UAAUiD;GAClBH,gBAAgB,MAAM,KAAK0B,QAAQN,QAAAA;GACnCrB,gBAAgB,MAAMmB,mBAAmBG,SAAQ;GACjDpB,UAAUZ;GACVS,qBAAqB,GAAGnC,aAAagE;EACzC,CAAA;EAEA,MAAMxC,WAAWyC,KAAKrC,MAAAA;EAGtBA,OAAOS,iBAAiBoB;EAExB,OAAO7B;CACX;CAEA,MAAgBoB,oBACZxB,YACAE,SACa;EACb,MAAMwC,sBAAM,IAAIC,WAAW,EAAA;EAC3B9D,gBAAgB6D,GAAAA;EAEhB,MAAMT,WAAWjE,oBAAoB0E,IAAIE,MAAM;EAE/C,MAAMxC,SAASJ,WAAWmC,OAAO;GAC7B3B,MAAM,KAAK4B,aAAa7D,OAAOgD,UAAU;GACzCd,MAAMnC,QAAQuE;GACd1C,KAAK5B,OAAOgD;GACZb,QAAQ3C,UAAUiD;GAClBH,gBAAgB,MAAM,KAAK0B,QAAQN,QAAAA;GACnCrB,gBAAgB;GAChBE,UAAUZ;GACVS,qBAAqB;EACzB,CAAA;EAEA,MAAMX,WAAWyC,KAAKrC,MAAAA;EAEtBA,OAAOS,iBAAiBoB;EAExB,OAAO7B;CACX;CAEUgC,aAAajC,KAA2B;EAC9C,OAAO,GAAGA,IAAI,GAAGlC,aAAa,EAAA;CAClC;CAEA,MAAgBmD,UACZpB,YACAI,QACa;EACb,IAAI,CAACA,OAAOS,gBACR,OAAOT;EAGX,IAAIjB,qBAAqBiB,OAAOS,cAAc,GAAG;GAC7CT,OAAOS,iBAAiB,MAAMzB,kBAAkB,KAAKO,eAAeS,OAAOS,cAAc;GACzF,OAAOT;EACX;EAEA,IAAI,KAAKT,eAAe;GAIpB,MAAMsC,WAAW7B,OAAOS;GACxB,IAAI;IACA,MAAMb,WAAW8C,OAAO1C,OAAOG,IAAI,EAAEM,gBAAgB,MAAMxB,gBAAgB,KAAKM,eAAesC,QAAAA,EAAU,CAAA;GAC7G,SAASc,GAAG;IAIR,KAAKlD,QAAQmD,KAAK,+CAA+C5C,OAAOG,GAAG,IAAI,EAAE0C,OAAOF,EAAE,CAAA;GAC9F;GACA3C,OAAOS,iBAAiBoB;EAC5B;EAEA,OAAO7B;CACX;CAEA,MAAgBmC,QAAQN,UAAoC;EACxD,IAAI,CAAC,KAAKtC,eACN,OAAOsC;EAGX,OAAO5C,gBAAgB,KAAKM,eAAesC,QAAAA;CAC/C;CAMA,MAAMiB,SAASC,OAA0E;EACrF,MAAMC,KAAK,KAAKpD,WAAWqD,mBAAmB,WAAA;EAC9CD,GAAGE,QAAQ,cAAA;EAEX,MAAM,EAAEC,eAAe7E,WAAW0E,IAAID,OAAO;GACzCK,cAAc;GACdC,QAAQ;IACJC,SAAS;KACL;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;;IAEJC,SAAS,CAAC,kBAAkB,aAAA;GAChC;GACAC,SAAS,EAAED,SAAS;IAAC;IAAM;IAAQ;IAAQ;IAAO;IAAU;KAAY;GACxEJ,YAAY,EAAEM,UAAU,GAAG;GAC3BC,MAAM,EAAEH,SAAS;IAAC;IAAM;IAAQ;IAAY;IAAO;IAAU;IAAc;KAAc;EAC7F,CAAA;EAEArE,sBAAsB8D,IAAI,WAAA;EAE1B,MAAM,CAACW,UAAU1C,SAAS,MAAM+B,GAAGY,gBAAe;EAElD,OAAO;GACHC,MAAMF;GACNG,MAAM;IACF7C;IACA,GAAGkC;GACP;EACJ;CACJ;CAEA,MAAMY,YAAY5D,IAAiC;EAC/C,OAAO,KAAK6D,UAAU,EAAE7D,GAAG,CAAA;CAC/B;CAEA,MAAM8D,cAAc7D,MAAc8D,UAAwC;EACtE,MAAMvD,QAAsC,EAAEP,KAAK;EAEnD,IAAI8D,UAAU;GACV,MAAMpE,UAAU,MAAM,KAAKN,gBAAgB2E,UAAUD,QAAAA;GACrD,IAAI,CAACpE,SACD,OAAO;GAGXa,MAAMD,WAAWZ;EACrB;EAEA,OAAO,KAAKF,WAAWoE,UAAUrD,KAAAA;CACrC;CAEA,MAAMyD,kBAAkBC,UAAkBC,OAAqC;EAC3E,OAAOxG,OAAOuG,QAAAA,IACV,KAAKN,YAAYM,QAAAA,IACjB,KAAKJ,cAAcI,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAW5D,OAA4C;EACzD,OAAO,KAAKf,WAAW4E,OAAOrF,yBAAyBwB,KAAAA,CAAAA;CAC3D;CAEA,MAAMqD,UAAUrD,OAAiD;EAC7D,OAAO,KAAKf,WAAWoE,UAAU7E,yBAAyBwB,KAAAA,CAAAA;CAC9D;CAEAoB,OAAO8B,MAAyB;EAC5B,OAAO,KAAKjE,WAAWmC,OAAO8B,IAAAA;CAClC;CAEAY,MAAMzE,QAAa6D,MAAyB;EACxC,OAAO,KAAKjE,WAAW6E,MAAMzE,QAAqB6D,IAAAA;CACtD;CAEA,MAAMxB,KAAKrC,QAA2B;EAClC,IACIA,OAAOS,kBACP,KAAKlB,iBACL,CAACR,qBAAqBiB,OAAOS,cAAc,GAC7C;GACE,MAAMoB,WAAW7B,OAAOS;GACxBT,OAAOS,iBAAiB,MAAMxB,gBAAgB,KAAKM,eAAesC,QAAAA;GAClE,MAAM6C,QAAQ,MAAM,KAAK9E,WAAWyC,KAAKrC,MAAAA;GACzC0E,MAAMjE,iBAAiBoB;GACvB,OAAO6C;EACX;EAEA,OAAO,KAAK9E,WAAWyC,KAAKrC,MAAAA;CAChC;CAEA,MAAM2E,OAAO3E,QAA4B;EACrC,MAAM,KAAKJ,WAAW+E,OAAO3E,MAAAA;CACjC;CAEA,MAAM4E,oBAAoBf,MAAmC;EACzD,MAAMrF,0BAA0BqF,MAAM;GAClCvE,YAAY,KAAKA;GACjBuF,cAAclG;EAClB,CAAA;CACJ;CAEA,MAAMmG,gBAAgBjB,MAAoBkB,UAA+B;EAQrE,IAAI,CAACC,MAPkBzG,eAAe;GAClCe,YAAY,KAAKA;GACjBuF,cAAclG;GACdqB,QAAQ6D;GACRoB,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAIrG,sBAAAA;CAElB;CAEA,MAAMwG,oBAAoBC,OAAgC;EACtD,OAAO,KAAK7F,WAAWK,cAAcd,uBAAAA,CAAAA,CAAyBqC,QAAQ,EAAEkE,QAAQ/G,KAAK,MAAgC8G,MAAM,GAAG,EAAE,CAAA;CACpI;CAEA,MAAME,oBAAoBvF,SAAiBC,KAAqC;EAC5E,OAAO,KAAKH,WAAW0F,QAAQ,YAAY;GAAE5E,UAAUZ;GAAcC;EAAmB,CAAA;CAC5F;AACJ"}

package/dist/app/modules/database/repositories/permission/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/permission/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAoB,MAAM,8BAA8B,CAAC;AAM5F,MAAM,MAAM,kCAAkC,GAAG;IAC7C,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IACnC,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACtC,CAAC;AAEF,qBAAa,2BAA4B,YAAW,qBAAqB;IACrE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyB;IAEpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmB;gBAEvC,GAAG,EAAE,kCAAkC;IAK7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAuB/F,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAI7C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAc1E,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAQ/E,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAI7D,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIvE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU;IAI7C,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU;IAI1D,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAI7C,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAO7D,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAYzF"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/permission/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAoB,MAAM,8BAA8B,CAAC;AAM5F,MAAM,MAAM,kCAAkC,GAAG;IAC7C,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IACnC,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACtC,CAAC;AAEF,qBAAa,2BAA4B,YAAW,qBAAqB;IACrE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyB;IAEpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmB;gBAEvC,GAAG,EAAE,kCAAkC;IAK7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAuB/F,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAI7C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAe1E,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAQ/E,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAI7D,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIvE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU;IAI7C,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU;IAI1D,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAI7C,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAO7D,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAYzF"}

package/dist/app/modules/database/repositories/permission/repository.mjs

@@ -3,9 +3,9 @@ import "node:url";
 import.meta.url;
 import { PermissionEntity } from "../../../../../adapters/database/domains/permission/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
+import { translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
 import "../../../../../adapters/database/index.mjs";
-import { translateWhereConditions } from "../helpers.mjs";
 import { RealmRepositoryAdapter } from "../realm/repository.mjs";
 import { isUUID } from "@authup/kit";
 import { applyQuery, isEntityUnique, validateEntityJoinColumns } from "typeorm-extension";
@@ -53,8 +53,9 @@ var PermissionRepositoryAdapter = class {
 		const qb = this.repository.createQueryBuilder("permission");
 		qb.where("permission.name = :name", { name });
 		if (realmKey) {
-			const realm = await this.realmRepository.resolve(realmKey);
-			if (realm) qb.andWhere("permission.realm_id = :realmId", { realmId: realm.id });
+			const realmId = await this.realmRepository.resolveId(realmKey);
+			if (!realmId) return null;
+			qb.andWhere("permission.realm_id = :realmId", { realmId });
 		}
 		return qb.getOne();
 	}