@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/core/entities/client/web-client.mjs

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { CLIENT_WEB_NAME, ScopeName } from "@authup/core-kit";
+import { CLIENT_WEB_NAME, ClientAuthMethod, ClientTokenBindingMethod, ScopeName } from "@authup/core-kit";
 //#region src/core/entities/client/web-client.ts
 /**
 * Build the attribute set for a realm's public `web` client.
@@ -12,19 +12,24 @@ import { CLIENT_WEB_NAME, ScopeName } from "@authup/core-kit";
 * `global` scope lets the issued token drive the management API (parity
 * with the legacy password-grant admin login); `openid` for the id-token.
 *
-* `grant_types` is metadata only — the auth-code grant issues a refresh
-* token regardless — but it documents the intended flow. `redirect_uri` is
-* one `<origin>/**` wildcard per trusted origin (matched by isSimpleMatch).
+* `grant_types` is an enforced allowlist (`assertClientGrantAllowed` at the
+* /token grants and the /authorize code-request verifier; null = allow-all),
+* so it must list every flow the client uses. `redirect_uri` and
+* `post_logout_redirect_uri` are each one `<origin>/**` wildcard per trusted
+* origin (matched by isSimpleMatch).
 */ function buildWebClientAttributes(realm, appOrigins) {
+	const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(",");
 	return {
 		name: CLIENT_WEB_NAME,
 		realm_id: realm.id,
-		is_confidential: false,
+		auth_method: ClientAuthMethod.NONE,
+		token_binding_method: ClientTokenBindingMethod.NONE,
 		built_in: true,
 		active: true,
 		grant_types: "authorization_code refresh_token",
 		scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,
-		redirect_uri: appOrigins.map((origin) => `${origin}/**`).join(",")
+		redirect_uri: originPatterns,
+		post_logout_redirect_uri: originPatterns
 	};
 }
 var WebClientProvisioner = class {

package/dist/core/entities/client/web-client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"web-client.mjs","names":["CLIENT_WEB_NAME","ScopeName","buildWebClientAttributes","realm","appOrigins","name","realm_id","id","is_confidential","built_in","active","grant_types","scope","GLOBAL","OPEN_ID","redirect_uri","map","origin","join","WebClientProvisioner","clientRepository","logger","ctx","ensureForRealm","attributes","existing","findOneBy","warn","isDirty","Object","keys","some","key","merged","merge","save","entity","create"],"sources":["../../../../src/core/entities/client/web-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { CLIENT_WEB_NAME, ScopeName  } from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientRepository, IWebClientProvisioner } from './types.ts';\n\nexport type WebClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * Build the attribute set for a realm's public `web` client.\n *\n * Public (PKCE) client used by authup's own client-web and any downstream\n * UI embedding client-web-kit. `built_in` makes it auto-consent in the\n * /authorize flow and protects it from the API reserved-name guard. The\n * `global` scope lets the issued token drive the management API (parity\n * with the legacy password-grant admin login); `openid` for the id-token.\n *\n * `grant_types` is metadata only — the auth-code grant issues a refresh\n * token regardless — but it documents the intended flow. `redirect_uri` is\n * one `<origin>/**` wildcard per trusted origin (matched by isSimpleMatch).\n */\nexport function buildWebClientAttributes(\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    return {\n        name: CLIENT_WEB_NAME,\n        realm_id: realm.id,\n        is_confidential: false,\n        built_in: true,\n        active: true,\n        grant_types: 'authorization_code refresh_token',\n        scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,\n        redirect_uri: appOrigins.map((origin) => `${origin}/**`).join(','),\n    };\n}\n\nexport class WebClientProvisioner implements IWebClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: WebClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const attributes = buildWebClientAttributes(realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: CLIENT_WEB_NAME,\n            realm_id: realm.id,\n        });\n\n        if (existing) {\n            // Never overwrite a non-built_in client that happens to be named\n            // `web` — that would be a user-owned client. Skip and warn.\n            if (!existing.built_in) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping web client provisioning for realm ${realm.id}: a non-built-in client named '${CLIENT_WEB_NAME}' already exists.`,\n                    );\n                }\n                return;\n            }\n\n            // MERGE: refresh attributes (e.g. redirect_uri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updated_at) per realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return;\n            }\n\n            const merged = this.clientRepository.merge(existing, attributes);\n            await this.clientRepository.save(merged);\n            return;\n        }\n\n        const entity = this.clientRepository.create(attributes);\n        await this.clientRepository.save(entity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;GA+BA,SAAgBE,yBACZC,OACAC,YAAoB;CAEpB,OAAO;EACHC,MAAML;EACNM,UAAUH,MAAMI;EAChBC,iBAAiB;EACjBC,UAAU;EACVC,QAAQ;EACRC,aAAa;EACbC,OAAO,GAAGX,UAAUY,OAAO,GAAGZ,UAAUa;EACxCC,cAAcX,WAAWY,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAClE;AACJ;AAEA,IAAaC,uBAAb,MAAaA;CACCC;CAEAhB;CAEAiB;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKhB,aAAakB,IAAIlB;EACtB,KAAKiB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAepB,OAA8C;EAC/D,MAAMqB,aAAatB,yBAAyBC,OAAO,KAAKC,UAAU;EAElE,MAAMqB,WAAW,MAAM,KAAKL,iBAAiBM,UAAU;GACnDrB,MAAML;GACNM,UAAUH,MAAMI;EACpB,CAAA;EAEA,IAAIkB,UAAU;GAGV,IAAI,CAACA,SAAShB,UAAU;IACpB,IAAI,KAAKY,QACL,KAAKA,OAAOM,KACR,8CAA8CxB,MAAMI,GAAG,iCAAiCP,gBAAgB,kBAAkB;IAGlI;GACJ;GAQA,IAAI,CAFY,OAAQ8B,KAAKN,UAAAA,CAAAA,CACxBO,MAAMC,QAAQP,SAASO,SAASR,WAAWQ,IAC3CJ,GACD;GAGJ,MAAMK,SAAS,KAAKb,iBAAiBc,MAAMT,UAAUD,UAAAA;GACrD,MAAM,KAAKJ,iBAAiBe,KAAKF,MAAAA;GACjC;EACJ;EAEA,MAAMG,SAAS,KAAKhB,iBAAiBiB,OAAOb,UAAAA;EAC5C,MAAM,KAAKJ,iBAAiBe,KAAKC,MAAAA;CACrC;AACJ"}
+{"version":3,"file":"web-client.mjs","names":["CLIENT_WEB_NAME","ClientAuthMethod","ClientTokenBindingMethod","ScopeName","buildWebClientAttributes","realm","appOrigins","originPatterns","map","origin","join","name","realm_id","id","auth_method","NONE","token_binding_method","built_in","active","grant_types","scope","GLOBAL","OPEN_ID","redirect_uri","post_logout_redirect_uri","WebClientProvisioner","clientRepository","logger","ctx","ensureForRealm","attributes","existing","findOneBy","warn","isDirty","Object","keys","some","key","merged","merge","save","entity","create"],"sources":["../../../../src/core/entities/client/web-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    CLIENT_WEB_NAME,\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    ScopeName,\n} from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientRepository, IWebClientProvisioner } from './types.ts';\n\nexport type WebClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * Build the attribute set for a realm's public `web` client.\n *\n * Public (PKCE) client used by authup's own client-web and any downstream\n * UI embedding client-web-kit. `built_in` makes it auto-consent in the\n * /authorize flow and protects it from the API reserved-name guard. The\n * `global` scope lets the issued token drive the management API (parity\n * with the legacy password-grant admin login); `openid` for the id-token.\n *\n * `grant_types` is an enforced allowlist (`assertClientGrantAllowed` at the\n * /token grants and the /authorize code-request verifier; null = allow-all),\n * so it must list every flow the client uses. `redirect_uri` and\n * `post_logout_redirect_uri` are each one `<origin>/**` wildcard per trusted\n * origin (matched by isSimpleMatch).\n */\nexport function buildWebClientAttributes(\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(',');\n\n    return {\n        name: CLIENT_WEB_NAME,\n        realm_id: realm.id,\n        auth_method: ClientAuthMethod.NONE,\n        token_binding_method: ClientTokenBindingMethod.NONE,\n        built_in: true,\n        active: true,\n        grant_types: 'authorization_code refresh_token',\n        scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,\n        redirect_uri: originPatterns,\n        post_logout_redirect_uri: originPatterns,\n    };\n}\n\nexport class WebClientProvisioner implements IWebClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: WebClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const attributes = buildWebClientAttributes(realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: CLIENT_WEB_NAME,\n            realm_id: realm.id,\n        });\n\n        if (existing) {\n            // Never overwrite a non-built_in client that happens to be named\n            // `web` — that would be a user-owned client. Skip and warn.\n            if (!existing.built_in) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping web client provisioning for realm ${realm.id}: a non-built-in client named '${CLIENT_WEB_NAME}' already exists.`,\n                    );\n                }\n                return;\n            }\n\n            // MERGE: refresh attributes (e.g. redirect_uri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updated_at) per realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return;\n            }\n\n            const merged = this.clientRepository.merge(existing, attributes);\n            await this.clientRepository.save(merged);\n            return;\n        }\n\n        const entity = this.clientRepository.create(attributes);\n        await this.clientRepository.save(entity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;GAsCA,SAAgBI,yBACZC,OACAC,YAAoB;CAEpB,MAAMC,iBAAiBD,WAAWE,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAEvE,OAAO;EACHC,MAAMX;EACNY,UAAUP,MAAMQ;EAChBC,aAAab,iBAAiBc;EAC9BC,sBAAsBd,yBAAyBa;EAC/CE,UAAU;EACVC,QAAQ;EACRC,aAAa;EACbC,OAAO,GAAGjB,UAAUkB,OAAO,GAAGlB,UAAUmB;EACxCC,cAAchB;EACdiB,0BAA0BjB;CAC9B;AACJ;AAEA,IAAakB,uBAAb,MAAaA;CACCC;CAEApB;CAEAqB;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKpB,aAAasB,IAAItB;EACtB,KAAKqB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAexB,OAA8C;EAC/D,MAAMyB,aAAa1B,yBAAyBC,OAAO,KAAKC,UAAU;EAElE,MAAMyB,WAAW,MAAM,KAAKL,iBAAiBM,UAAU;GACnDrB,MAAMX;GACNY,UAAUP,MAAMQ;EACpB,CAAA;EAEA,IAAIkB,UAAU;GAGV,IAAI,CAACA,SAASd,UAAU;IACpB,IAAI,KAAKU,QACL,KAAKA,OAAOM,KACR,8CAA8C5B,MAAMQ,GAAG,iCAAiCb,gBAAgB,kBAAkB;IAGlI;GACJ;GAQA,IAAI,CAFY,OAAQoC,KAAKN,UAAAA,CAAAA,CACxBO,MAAMC,QAAQP,SAASO,SAASR,WAAWQ,IAC3CJ,GACD;GAGJ,MAAMK,SAAS,KAAKb,iBAAiBc,MAAMT,UAAUD,UAAAA;GACrD,MAAM,KAAKJ,iBAAiBe,KAAKF,MAAAA;GACjC;EACJ;EAEA,MAAMG,SAAS,KAAKhB,iBAAiBiB,OAAOb,UAAAA;EAC5C,MAAM,KAAKJ,iBAAiBe,KAAKC,MAAAA;CACrC;AACJ"}

package/dist/core/entities/consent/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/consent/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/entities/consent/index.mjs

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH } from "./types.mjs";
+import { ConsentService } from "./service.mjs";
+export { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ConsentService };

package/dist/core/entities/consent/service.d.ts

@@ -0,0 +1,19 @@
+import type { Consent } from '@authup/core-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { ConsentCoveringInput, ConsentRecordInput, ConsentServiceReadOptions, IConsentRepository, IConsentService } from './types.ts';
+export type ConsentServiceContext = {
+    repository: IConsentRepository;
+};
+export declare class ConsentService extends AbstractEntityService implements IConsentService {
+    protected repository: IConsentRepository;
+    constructor(ctx: ConsentServiceContext);
+    protected isOwnedBy(consent: Consent, actor: ActorContext): boolean;
+    protected normalizeScopeTokens(scope: string | string[] | null): string[];
+    getMany(query: Record<string, any>, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<EntityRepositoryFindManyResult<Consent>>;
+    getOne(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;
+    delete(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;
+    record(input: ConsentRecordInput): Promise<void>;
+    isCovering(input: ConsentCoveringInput): Promise<boolean>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/consent/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAIvF,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,eAAe,EAClB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,qBAAqB,GAAG;IAChC,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,qBAAa,cAAe,SAAQ,qBAAsB,YAAW,eAAe;IAChF,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAE7B,GAAG,EAAE,qBAAqB;IAKtC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAMnE,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,GAAG,MAAM,EAAE;IAYnE,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,yBAA8B,GACxC,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAwD7C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,yBAA8B,GAAG,OAAO,CAAC,OAAO,CAAC;IAsBlG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,yBAA8B,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBlG,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAchD,UAAU,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;CAclE"}

package/dist/core/entities/consent/service.mjs

@@ -0,0 +1,122 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import "./types.mjs";
+import { PermissionName } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { EntityNotFoundError } from "@authup/errors";
+import { unwrapOAuth2Scope } from "@authup/specs";
+//#region src/core/entities/consent/service.ts
+var ConsentService = class extends AbstractEntityService {
+	repository;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+	}
+	isOwnedBy(consent, actor) {
+		return !!actor.identity && consent.sub === actor.identity.data.id && consent.sub_kind === actor.identity.type;
+	}
+	normalizeScopeTokens(scope) {
+		const tokens = unwrapOAuth2Scope(scope ?? []).filter((token) => token.length > 0 && token.length <= 128);
+		return Array.from(new Set(tokens));
+	}
+	async getMany(query, actor, options = {}) {
+		let canReadAll = true;
+		try {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });
+		} catch (e) {
+			if (!actor.identity) throw e;
+			canReadAll = false;
+		}
+		if (!canReadAll) return this.repository.findMany(query, {
+			owner: {
+				sub: actor.identity.data.id,
+				subKind: actor.identity.type
+			},
+			...options.realmId ? { realmId: options.realmId } : {}
+		});
+		const { data: entities, meta } = await this.repository.findMany(query, { ...options.realmId ? { realmId: options.realmId } : {} });
+		const data = [];
+		let { total } = meta;
+		for (const entity of entities) {
+			if (this.isOwnedBy(entity, actor)) {
+				data.push(entity);
+				continue;
+			}
+			try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.CONSENT_READ,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: entity,
+						...this.resourceRealmMatch(entity)
+					})
+				});
+				data.push(entity);
+			} catch {
+				total -= 1;
+			}
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(id, actor, options = {}) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity || options.realmId && entity.realm_id !== options.realmId) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.CONSENT_READ,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		return entity;
+	}
+	async delete(id, actor, options = {}) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity || options.realmId && entity.realm_id !== options.realmId) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_DELETE });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.CONSENT_DELETE,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+	async record(input) {
+		const tokens = this.normalizeScopeTokens(input.scope);
+		if (tokens.length === 0) return;
+		await this.repository.insertMissing({
+			clientId: input.clientId,
+			realmId: input.realmId,
+			owner: input.owner,
+			scopes: tokens
+		});
+	}
+	async isCovering(input) {
+		const tokens = this.normalizeScopeTokens(input.scope);
+		if (tokens.length === 0) return true;
+		const rows = await this.repository.findAllBySubjectClient(input.clientId, input.owner);
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		return tokens.every((token) => rows.some((row) => row.scope === token && (row.expires_at === null || row.expires_at > now)));
+	}
+};
+//#endregion
+export { ConsentService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/consent/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityNotFoundError","PermissionName","unwrapOAuth2Scope","AbstractEntityService","CONSENT_SCOPE_MAX_LENGTH","ConsentService","repository","ctx","isOwnedBy","consent","actor","identity","sub","data","id","sub_kind","type","normalizeScopeTokens","scope","tokens","filter","token","length","Array","from","Set","getMany","query","options","canReadAll","permissionEvaluator","preEvaluate","name","CONSENT_READ","e","findMany","owner","subKind","realmId","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","realm_id","delete","CONSENT_DELETE","entityId","remove","record","input","insertMissing","clientId","scopes","isCovering","rows","findAllBySubjectClient","now","Date","toISOString","every","some","row","expires_at"],"sources":["../../../../src/core/entities/consent/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Consent } from '@authup/core-kit';\nimport { unwrapOAuth2Scope } from '@authup/specs';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport {\n    CONSENT_SCOPE_MAX_LENGTH,\n} from './types.ts';\nimport type {\n    ConsentCoveringInput,\n    ConsentRecordInput,\n    ConsentServiceReadOptions,\n    IConsentRepository,\n    IConsentService,\n} from './types.ts';\n\nexport type ConsentServiceContext = {\n    repository: IConsentRepository,\n};\n\nexport class ConsentService extends AbstractEntityService implements IConsentService {\n    protected repository: IConsentRepository;\n\n    constructor(ctx: ConsentServiceContext) {\n        super();\n        this.repository = ctx.repository;\n    }\n\n    protected isOwnedBy(consent: Consent, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            consent.sub === actor.identity.data.id &&\n            consent.sub_kind === actor.identity.type;\n    }\n\n    protected normalizeScopeTokens(scope: string | string[] | null): string[] {\n        const tokens = unwrapOAuth2Scope(scope ?? [])\n            // Drop empty tokens and any token that does not fit the scope\n            // column (varchar 128). An over-long token — only reachable via a\n            // non-standard scope riding the `global` verifier bypass — is\n            // simply not persisted (never remembered), rather than aborting\n            // the whole write and losing the sibling tokens ordered after it.\n            .filter((token) => token.length > 0 && token.length <= CONSENT_SCOPE_MAX_LENGTH);\n\n        return Array.from(new Set(tokens));\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: ConsentServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Consent>> {\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own consents\n            return this.repository.findMany(query, {\n                owner: {\n                    sub: actor.identity!.data.id,\n                    subKind: actor.identity!.type,\n                },\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(query, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n\n        const data: Consent[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CONSENT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext, options: ConsentServiceReadOptions = {}): Promise<Consent> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realm_id !== options.realmId)) {\n            // A realm mismatch on the nested mount fails as not-found (no\n            // cross-realm existence oracle).\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.CONSENT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n\n    async delete(id: string, actor: ActorContext, options: ConsentServiceReadOptions = {}): Promise<Consent> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realm_id !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_DELETE });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.CONSENT_DELETE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    async record(input: ConsentRecordInput): Promise<void> {\n        const tokens = this.normalizeScopeTokens(input.scope);\n        if (tokens.length === 0) {\n            return;\n        }\n\n        await this.repository.insertMissing({\n            clientId: input.clientId,\n            realmId: input.realmId,\n            owner: input.owner,\n            scopes: tokens,\n        });\n    }\n\n    async isCovering(input: ConsentCoveringInput): Promise<boolean> {\n        const tokens = this.normalizeScopeTokens(input.scope);\n        if (tokens.length === 0) {\n            return true;\n        }\n\n        const rows = await this.repository.findAllBySubjectClient(input.clientId, input.owner);\n        const now = new Date().toISOString();\n\n        return tokens.every((token) => rows.some(\n            (row) => row.scope === token &&\n                (row.expires_at === null || row.expires_at > now),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;AA6BA,IAAaO,iBAAb,cAAoCF,sBAAAA;CACtBG;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,aAAaL,MAAMC,SAASK;CAC5C;CAEUC,qBAAqBC,OAA2C;EACtE,MAAMC,SAASjB,kBAAkBgB,SAAS,CAAA,CAAE,CACxC,CAKCE,QAAQC,UAAUA,MAAMC,SAAS,KAAKD,MAAMC,UAAAA,GAAUlB;EAE3D,OAAOmB,MAAMC,KAAK,IAAIC,IAAIN,MAAAA,CAAAA;CAC9B;CAEA,MAAMO,QACFC,OACAjB,OACAkB,UAAqC,CAAC,GACU;EAChD,IAAIC,aAAa;EACjB,IAAI;GACA,MAAMnB,MAAMoB,oBAAoBC,YAAY,EAAEC,MAAM/B,eAAegC,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAACxB,MAAMC,UACP,MAAMuB;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKvB,WAAW6B,SAASR,OAAO;GACnCS,OAAO;IACHxB,KAAKF,MAAMC,SAAUE,KAAKC;IAC1BuB,SAAS3B,MAAMC,SAAUK;GAC7B;GACA,GAAIY,QAAQU,UAAU,EAAEA,SAASV,QAAQU,QAAQ,IAAI,CAAC;EAC1D,CAAA;EAGJ,MAAM,EAAEzB,MAAM0B,UAAUC,SAAS,MAAM,KAAKlC,WAAW6B,SAASR,OAAO,EAAE,GAAIC,QAAQU,UAAU,EAAEA,SAASV,QAAQU,QAAQ,IAAI,CAAC,EAAG,CAAA;EAElI,MAAMzB,OAAkB,CAAA;EACxB,IAAI,EAAE4B,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAK/B,UAAUkC,QAAQhC,KAAAA,GAAQ;IAC/BG,KAAK8B,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMhC,MAAMoB,oBAAoBc,SAAS;KACrCZ,MAAM/B,eAAegC;KACrBpB,MAAMd,iBAAiB;OAClBD,kBAAkB+C,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACA7B,KAAK8B,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACH5B;GACA2B,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAOjC,IAAYJ,OAAqBkB,UAAqC,CAAC,GAAqB;EACrG,MAAMc,SAAS,MAAM,KAAKpC,WAAW0C,YAAYlC,EAAAA;EACjD,IAAI,CAAC4B,UAAWd,QAAQU,WAAWI,OAAOO,aAAarB,QAAQU,SAG3D,MAAM,IAAItC,oBAAAA;EAGd,IAAI,CAAC,KAAKQ,UAAUkC,QAAQhC,KAAAA,GAAQ;GAChC,MAAMA,MAAMoB,oBAAoBC,YAAY,EAAEC,MAAM/B,eAAegC,aAAa,CAAA;GAChF,MAAMvB,MAAMoB,oBAAoBc,SAAS;IACrCZ,MAAM/B,eAAegC;IACrBpB,MAAMd,iBAAiB;MAClBD,kBAAkB+C,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMQ,OAAOpC,IAAYJ,OAAqBkB,UAAqC,CAAC,GAAqB;EACrG,MAAMc,SAAS,MAAM,KAAKpC,WAAW0C,YAAYlC,EAAAA;EACjD,IAAI,CAAC4B,UAAWd,QAAQU,WAAWI,OAAOO,aAAarB,QAAQU,SAC3D,MAAM,IAAItC,oBAAAA;EAGd,IAAI,CAAC,KAAKQ,UAAUkC,QAAQhC,KAAAA,GAAQ;GAChC,MAAMA,MAAMoB,oBAAoBC,YAAY,EAAEC,MAAM/B,eAAekD,eAAe,CAAA;GAClF,MAAMzC,MAAMoB,oBAAoBc,SAAS;IACrCZ,MAAM/B,eAAekD;IACrBtC,MAAMd,iBAAiB;MAClBD,kBAAkB+C,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAE5B,IAAIsC,aAAaV;EACzB,MAAM,KAAKpC,WAAW+C,OAAOX,MAAAA;EAC7BA,OAAO5B,KAAKsC;EAEZ,OAAOV;CACX;CAEA,MAAMY,OAAOC,OAA0C;EACnD,MAAMpC,SAAS,KAAKF,qBAAqBsC,MAAMrC,KAAK;EACpD,IAAIC,OAAOG,WAAW,GAClB;EAGJ,MAAM,KAAKhB,WAAWkD,cAAc;GAChCC,UAAUF,MAAME;GAChBnB,SAASiB,MAAMjB;GACfF,OAAOmB,MAAMnB;GACbsB,QAAQvC;EACZ,CAAA;CACJ;CAEA,MAAMwC,WAAWJ,OAA+C;EAC5D,MAAMpC,SAAS,KAAKF,qBAAqBsC,MAAMrC,KAAK;EACpD,IAAIC,OAAOG,WAAW,GAClB,OAAO;EAGX,MAAMsC,OAAO,MAAM,KAAKtD,WAAWuD,uBAAuBN,MAAME,UAAUF,MAAMnB,KAAK;EACrF,MAAM0B,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAElC,OAAO7C,OAAO8C,OAAO5C,UAAUuC,KAAKM,MAC/BC,QAAQA,IAAIjD,UAAUG,UAClB8C,IAAIC,eAAe,QAAQD,IAAIC,aAAaN,IAAE,CAAA;CAE3D;AACJ"}

package/dist/core/entities/consent/types.d.ts

@@ -0,0 +1,97 @@
+import type { Consent } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+export type ConsentOwner = {
+    sub: string;
+    subKind: string;
+};
+/**
+ * Max length of a single stored scope token — must equal the
+ * `auth_consents.scope` column width (varchar 128). A longer token (only
+ * reachable via a non-standard scope riding the `global` verifier bypass) is
+ * dropped at normalization rather than overflowing the column.
+ */
+export declare const CONSENT_SCOPE_MAX_LENGTH = 128;
+/**
+ * Filter keys a consent list query may target. Shared by the repository's
+ * rapiq `filters.allowed` so service and adapter can never drift.
+ */
+export declare const CONSENT_FILTER_KEYS: readonly ["id", "client_id", "realm_id", "sub", "sub_kind", "scope"];
+export type ConsentFindManyOptions = {
+    /**
+     * Force the result to a single subject (self-service). Applied as a
+     * mandatory WHERE that a rapiq query filter cannot override.
+     */
+    owner?: ConsentOwner;
+    /**
+     * Restrict the result to a single realm (the `/realms/:realmId/consents`
+     * nested mount). Mandatory WHERE, not overridable by a rapiq filter.
+     */
+    realmId?: string;
+};
+export type ConsentServiceReadOptions = {
+    realmId?: string;
+};
+export type ConsentRecordInput = {
+    clientId: string;
+    realmId: string;
+    owner: ConsentOwner;
+    /**
+     * Raw scope representation(s) — normalized to lowercase tokens via
+     * `unwrapOAuth2Scope` before persistence.
+     */
+    scope: string | string[] | null;
+};
+export type ConsentCoveringInput = {
+    clientId: string;
+    owner: ConsentOwner;
+    scope: string | string[] | null;
+};
+export interface IConsentRepository {
+    findMany(query: Record<string, any>, options?: ConsentFindManyOptions): Promise<EntityRepositoryFindManyResult<Consent>>;
+    findOneById(id: string): Promise<Consent | null>;
+    /**
+     * Covering-lookup source — query-cached
+     * (`CachePrefix.CONSENT_COVERING`, 60s), invalidated by the
+     * `ConsentEntitySubscriber` on insert/update/remove.
+     */
+    findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]>;
+    /**
+     * Union/keep: insert one row per missing scope token, never touching
+     * existing rows. Race-safe under the 4-column unique index.
+     */
+    insertMissing(input: {
+        clientId: string;
+        realmId: string;
+        owner: ConsentOwner;
+        scopes: string[];
+    }): Promise<void>;
+    remove(entity: Consent): Promise<void>;
+}
+export interface IConsentService {
+    /**
+     * List consents. An actor without `CONSENT_READ` is scoped to its own
+     * rows (self-service); an actor with `CONSENT_READ` sees every row its
+     * realm reach permits.
+     */
+    getMany(query: Record<string, any>, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<EntityRepositoryFindManyResult<Consent>>;
+    /**
+     * Read a single consent by id. Own rows need no permission.
+     */
+    getOne(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;
+    /**
+     * Revoke (delete) a single consent by id. Own rows need no permission.
+     */
+    delete(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;
+    /**
+     * Flow integration (POST /authorize approval) — no permission checks:
+     * the subject consents to its own grant. Inputs are server-derived
+     * (verifier-stamped client/realm, token-derived subject), never raw
+     * client input.
+     */
+    record(input: ConsentRecordInput): Promise<void>;
+    /**
+     * Strict covering: every requested token has an unexpired row.
+     */
+    isCovering(input: ConsentCoveringInput): Promise<boolean>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/consent/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,MAAM,YAAY,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,sEAOtB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;OAIG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAElF;;;OAGG;IACH,aAAa,CAAC,KAAK,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,YAAY,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAA;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElB,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhJ;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/F;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/F;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D"}

package/dist/core/entities/consent/types.mjs

@@ -0,0 +1,25 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/entities/consent/types.ts
+/**
+* Max length of a single stored scope token — must equal the
+* `auth_consents.scope` column width (varchar 128). A longer token (only
+* reachable via a non-standard scope riding the `global` verifier bypass) is
+* dropped at normalization rather than overflowing the column.
+*/ const CONSENT_SCOPE_MAX_LENGTH = 128;
+/**
+* Filter keys a consent list query may target. Shared by the repository's
+* rapiq `filters.allowed` so service and adapter can never drift.
+*/ const CONSENT_FILTER_KEYS = [
+	"id",
+	"client_id",
+	"realm_id",
+	"sub",
+	"sub_kind",
+	"scope"
+];
+//#endregion
+export { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH };
+
+//# sourceMappingURL=types.mjs.map

package/dist/core/entities/consent/types.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.mjs","names":["CONSENT_SCOPE_MAX_LENGTH","CONSENT_FILTER_KEYS"],"sources":["../../../../src/core/entities/consent/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type ConsentOwner = {\n    sub: string,\n    subKind: string,\n};\n\n/**\n * Max length of a single stored scope token — must equal the\n * `auth_consents.scope` column width (varchar 128). A longer token (only\n * reachable via a non-standard scope riding the `global` verifier bypass) is\n * dropped at normalization rather than overflowing the column.\n */\nexport const CONSENT_SCOPE_MAX_LENGTH = 128;\n\n/**\n * Filter keys a consent list query may target. Shared by the repository's\n * rapiq `filters.allowed` so service and adapter can never drift.\n */\nexport const CONSENT_FILTER_KEYS = [\n    'id',\n    'client_id',\n    'realm_id',\n    'sub',\n    'sub_kind',\n    'scope',\n] as const;\n\nexport type ConsentFindManyOptions = {\n    /**\n     * Force the result to a single subject (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    owner?: ConsentOwner,\n    /**\n     * Restrict the result to a single realm (the `/realms/:realmId/consents`\n     * nested mount). Mandatory WHERE, not overridable by a rapiq filter.\n     */\n    realmId?: string,\n};\n\nexport type ConsentServiceReadOptions = {\n    realmId?: string,\n};\n\nexport type ConsentRecordInput = {\n    clientId: string,\n    realmId: string,\n    owner: ConsentOwner,\n    /**\n     * Raw scope representation(s) — normalized to lowercase tokens via\n     * `unwrapOAuth2Scope` before persistence.\n     */\n    scope: string | string[] | null,\n};\n\nexport type ConsentCoveringInput = {\n    clientId: string,\n    owner: ConsentOwner,\n    scope: string | string[] | null,\n};\n\nexport interface IConsentRepository {\n    findMany(query: Record<string, any>, options?: ConsentFindManyOptions): Promise<EntityRepositoryFindManyResult<Consent>>;\n\n    findOneById(id: string): Promise<Consent | null>;\n\n    /**\n     * Covering-lookup source — query-cached\n     * (`CachePrefix.CONSENT_COVERING`, 60s), invalidated by the\n     * `ConsentEntitySubscriber` on insert/update/remove.\n     */\n    findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]>;\n\n    /**\n     * Union/keep: insert one row per missing scope token, never touching\n     * existing rows. Race-safe under the 4-column unique index.\n     */\n    insertMissing(input: {\n        clientId: string, \n        realmId: string, \n        owner: ConsentOwner, \n        scopes: string[] \n    }): Promise<void>;\n\n    remove(entity: Consent): Promise<void>;\n}\n\nexport interface IConsentService {\n    /**\n     * List consents. An actor without `CONSENT_READ` is scoped to its own\n     * rows (self-service); an actor with `CONSENT_READ` sees every row its\n     * realm reach permits.\n     */\n    getMany(query: Record<string, any>, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<EntityRepositoryFindManyResult<Consent>>;\n\n    /**\n     * Read a single consent by id. Own rows need no permission.\n     */\n    getOne(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;\n\n    /**\n     * Revoke (delete) a single consent by id. Own rows need no permission.\n     */\n    delete(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;\n\n    /**\n     * Flow integration (POST /authorize approval) — no permission checks:\n     * the subject consents to its own grant. Inputs are server-derived\n     * (verifier-stamped client/realm, token-derived subject), never raw\n     * client input.\n     */\n    record(input: ConsentRecordInput): Promise<void>;\n\n    /**\n     * Strict covering: every requested token has an unexpired row.\n     */\n    isCovering(input: ConsentCoveringInput): Promise<boolean>;\n}\n"],"mappings":";;;;;;;;;GAqBA,MAAaA,2BAA2B;;;;GAMxC,MAAaC,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA"}

package/dist/core/entities/event/constants.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Default retention for persisted security events in days (hosted-provider
+ * posture, Okta-parity; raise via eventLogRetentionDays /
+ * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).
+ */
+export declare const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/entities/event/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/constants.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC"}

package/dist/core/entities/event/constants.mjs

@@ -0,0 +1,13 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/entities/event/constants.ts
+/**
+* Default retention for persisted security events in days (hosted-provider
+* posture, Okta-parity; raise via eventLogRetentionDays /
+* EVENT_LOG_RETENTION_DAYS, 0 = keep forever).
+*/ const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;
+//#endregion
+export { EVENT_LOG_RETENTION_DAYS_DEFAULT };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/entities/event/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["EVENT_LOG_RETENTION_DAYS_DEFAULT"],"sources":["../../../../src/core/entities/event/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Default retention for persisted security events in days (hosted-provider\n * posture, Okta-parity; raise via eventLogRetentionDays /\n * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).\n */\nexport const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;\n"],"mappings":";;;;;;;;GAYA,MAAaA,mCAAmC"}

package/dist/core/entities/event/diff.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Secret denylist for entity-diff keys (fail-closed: losing a
+ * "secret_hashed flipped" diff entry is acceptable, leaking a hash is not).
+ * Shared with the sanitizer's `diff` branch so both boundaries agree.
+ */
+export declare const EVENT_DIFF_SECRET_KEY_REGEX: RegExp;
+export declare const EVENT_DIFF_VALUE_MAX_LENGTH = 512;
+export type EntityDiff = Record<string, {
+    next: unknown;
+    previous: unknown;
+}>;
+/**
+ * PII-safe scalar diff between the updated entity and its pre-mutation
+ * snapshot: only keys with scalar values (string/number/boolean/null) on BOTH
+ * sides, skipping timestamp columns (`*_at`) and any key matching the secret
+ * denylist, including only keys whose value actually changed. String values
+ * are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.
+ */
+export declare function buildEntityDiff(next: Record<string, any>, previous: Record<string, any>): EntityDiff;
+//# sourceMappingURL=diff.d.ts.map

package/dist/core/entities/event/diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/diff.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAA6C,CAAC;AAEtF,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAiB9E;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC9B,UAAU,CAmCZ"}

package/dist/core/entities/event/diff.mjs

@@ -0,0 +1,45 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { isEqual } from "smob";
+//#region src/core/entities/event/diff.ts
+/**
+* Secret denylist for entity-diff keys (fail-closed: losing a
+* "secret_hashed flipped" diff entry is acceptable, leaking a hash is not).
+* Shared with the sanitizer's `diff` branch so both boundaries agree.
+*/ const EVENT_DIFF_SECRET_KEY_REGEX = /(password|secret|hash|token|credential)/i;
+const EVENT_DIFF_VALUE_MAX_LENGTH = 512;
+function isScalar(value) {
+	return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function truncateScalar(value) {
+	if (typeof value === "string" && value.length > 512) return value.substring(0, 512);
+	return value;
+}
+/**
+* PII-safe scalar diff between the updated entity and its pre-mutation
+* snapshot: only keys with scalar values (string/number/boolean/null) on BOTH
+* sides, skipping timestamp columns (`*_at`) and any key matching the secret
+* denylist, including only keys whose value actually changed. String values
+* are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.
+*/ function buildEntityDiff(next, previous) {
+	const output = {};
+	const keys = /* @__PURE__ */ new Set([...Object.keys(next), ...Object.keys(previous)]);
+	for (const key of keys) {
+		if (key.endsWith("_at")) continue;
+		if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) continue;
+		const nextValue = next[key];
+		const previousValue = previous[key];
+		if (!isScalar(nextValue) || !isScalar(previousValue)) continue;
+		if (isEqual(nextValue, previousValue)) continue;
+		output[key] = {
+			next: truncateScalar(nextValue),
+			previous: truncateScalar(previousValue)
+		};
+	}
+	return output;
+}
+//#endregion
+export { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDiff };
+
+//# sourceMappingURL=diff.mjs.map

package/dist/core/entities/event/diff.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.mjs","names":["isEqual","EVENT_DIFF_SECRET_KEY_REGEX","EVENT_DIFF_VALUE_MAX_LENGTH","isScalar","value","truncateScalar","length","substring","buildEntityDiff","next","previous","output","keys","Set","Object","key","endsWith","test","nextValue","previousValue"],"sources":["../../../../src/core/entities/event/diff.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isEqual } from 'smob';\n\n/**\n * Secret denylist for entity-diff keys (fail-closed: losing a\n * \"secret_hashed flipped\" diff entry is acceptable, leaking a hash is not).\n * Shared with the sanitizer's `diff` branch so both boundaries agree.\n */\nexport const EVENT_DIFF_SECRET_KEY_REGEX = /(password|secret|hash|token|credential)/i;\n\nexport const EVENT_DIFF_VALUE_MAX_LENGTH = 512;\n\nexport type EntityDiff = Record<string, { next: unknown, previous: unknown }>;\n\nfunction isScalar(value: unknown): value is string | number | boolean | null {\n    return value === null ||\n        typeof value === 'string' ||\n        typeof value === 'number' ||\n        typeof value === 'boolean';\n}\n\nfunction truncateScalar(value: string | number | boolean | null): string | number | boolean | null {\n    if (typeof value === 'string' && value.length > EVENT_DIFF_VALUE_MAX_LENGTH) {\n        return value.substring(0, EVENT_DIFF_VALUE_MAX_LENGTH);\n    }\n\n    return value;\n}\n\n/**\n * PII-safe scalar diff between the updated entity and its pre-mutation\n * snapshot: only keys with scalar values (string/number/boolean/null) on BOTH\n * sides, skipping timestamp columns (`*_at`) and any key matching the secret\n * denylist, including only keys whose value actually changed. String values\n * are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.\n */\nexport function buildEntityDiff(\n    next: Record<string, any>,\n    previous: Record<string, any>,\n): EntityDiff {\n    const output: EntityDiff = {};\n\n    const keys = new Set([\n        ...Object.keys(next),\n        ...Object.keys(previous),\n    ]);\n\n    for (const key of keys) {\n        if (key.endsWith('_at')) {\n            continue;\n        }\n\n        if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n            continue;\n        }\n\n        const nextValue = next[key];\n        const previousValue = previous[key];\n\n        if (!isScalar(nextValue) || !isScalar(previousValue)) {\n            continue;\n        }\n\n        if (isEqual(nextValue, previousValue)) {\n            continue;\n        }\n\n        output[key] = {\n            next: truncateScalar(nextValue),\n            previous: truncateScalar(previousValue),\n        };\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;;;;GAcA,MAAaC,8BAA8B;AAE3C,MAAaC,8BAA8B;AAI3C,SAASC,SAASC,OAAc;CAC5B,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,eAAeD,OAAuC;CAC3D,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAAAA,KACnC,OAAOF,MAAMG,UAAU,GAAA,GAAGL;CAG9B,OAAOE;AACX;;;;;;;GASA,SAAgBI,gBACZC,MACAC,UAA6B;CAE7B,MAAMC,SAAqB,CAAC;CAE5B,MAAMC,uBAAO,IAAIC,IAAI,CAAA,GACdC,OAAOF,KAAKH,IAAAA,GAAAA,GACZK,OAAOF,KAAKF,QAAAA,CAAAA,CAClB;CAED,KAAK,MAAMK,OAAOH,MAAM;EACpB,IAAIG,IAAIC,SAAS,KAAA,GACb;EAGJ,IAAIf,4BAA4BgB,KAAKF,GAAAA,GACjC;EAGJ,MAAMG,YAAYT,KAAKM;EACvB,MAAMI,gBAAgBT,SAASK;EAE/B,IAAI,CAACZ,SAASe,SAAAA,KAAc,CAACf,SAASgB,aAAAA,GAClC;EAGJ,IAAInB,QAAQkB,WAAWC,aAAAA,GACnB;EAGJR,OAAOI,OAAO;GACVN,MAAMJ,eAAea,SAAAA;GACrBR,UAAUL,eAAec,aAAAA;EAC7B;CACJ;CAEA,OAAOR;AACX"}

package/dist/core/entities/event/entity-event-handler.d.ts

@@ -0,0 +1,19 @@
+import type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';
+import type { EntityEventHandlerOptions, EventRequestContext, IEventService } from './types.ts';
+export type EntityEventHandlerContext = {
+    eventService: IEventService;
+    requestContext?: () => EventRequestContext | undefined;
+    options?: EntityEventHandlerOptions;
+};
+/**
+ * Bridges every entity create/update/delete published on the
+ * DomainEventPublisher bus into the auth_events audit table (scope `entity`).
+ */
+export declare class EntityEventHandler implements IDomainEventHandler {
+    protected eventService: IEventService;
+    protected requestContext?: () => EventRequestContext | undefined;
+    protected options: EntityEventHandlerOptions;
+    constructor(ctx: EntityEventHandlerContext);
+    handle(ctx: DomainEventPublishContext): Promise<void>;
+}
+//# sourceMappingURL=entity-event-handler.d.ts.map

package/dist/core/entities/event/entity-event-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-event-handler.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,KAAK,EACR,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,YAAY,EAAE,aAAa,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AA0CF;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAG,MAAM,mBAAmB,GAAG,SAAS,CAAC;IAElE,SAAS,CAAC,OAAO,EAAG,yBAAyB,CAAC;gBAElC,GAAG,EAAE,yBAAyB;IAMpC,MAAM,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;CAqD9D"}