@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/core/entities/session/service.d.ts

@@ -0,0 +1,27 @@
+import type { Session } from '@authup/core-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { ISessionRepository } from '../../authentication/index.ts';
+import type { ISessionService, SessionDeleteManyOptions, SessionDeleteManyResult } from './types.ts';
+export type SessionServiceContext = {
+    repository: ISessionRepository;
+};
+export declare class SessionService extends AbstractEntityService implements ISessionService {
+    protected repository: ISessionRepository;
+    constructor(ctx: SessionServiceContext);
+    protected isOwnedBy(session: Session, actor: ActorContext): boolean;
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<Session>>;
+    getOne(id: string, actor: ActorContext): Promise<Session>;
+    delete(id: string, actor: ActorContext): Promise<Session>;
+    deleteMany(actor: ActorContext, options?: SessionDeleteManyOptions): Promise<SessionDeleteManyResult>;
+    /**
+     * True when the query carries at least one recognized target filter — the
+     * discriminator between the admin bulk-revoke path and self-service. An
+     * unrecognized / empty filter falls through to self-service (fail-safe: a
+     * typo can never trigger an unconstrained mass delete).
+     */
+    protected hasTargetFilter(query?: Record<string, any>): boolean;
+    protected deleteManyForSelf(actor: ActorContext, currentSessionId?: string): Promise<SessionDeleteManyResult>;
+    protected deleteManyByQuery(actor: ActorContext, query: Record<string, any>): Promise<SessionDeleteManyResult>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/session/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/service.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAExE,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAErG,MAAM,MAAM,qBAAqB,GAAG;IAChC,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,qBAAa,cAAe,SAAQ,qBAAsB,YAAW,eAAe;IAChF,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAE7B,GAAG,EAAE,qBAAqB;IAKtC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAM7D,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAuD7C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBzD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBzD,UAAU,CACZ,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,wBAA6B,GACvC,OAAO,CAAC,uBAAuB,CAAC;IAYnC;;;;;OAKG;IACH,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;cAY/C,iBAAiB,CAC7B,KAAK,EAAE,YAAY,EACnB,gBAAgB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,uBAAuB,CAAC;cAkBnB,iBAAiB,CAC7B,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,uBAAuB,CAAC;CAgCtC"}

package/dist/core/entities/session/service.mjs

@@ -0,0 +1,154 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SESSION_FILTER_KEYS } from "../../authentication/session/types.mjs";
+import "../../authentication/index.mjs";
+import { isObject } from "@authup/kit";
+import { PermissionName } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { AuthupError, EntityNotFoundError, ErrorCode } from "@authup/errors";
+//#region src/core/entities/session/service.ts
+var SessionService = class extends AbstractEntityService {
+	repository;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+	}
+	isOwnedBy(session, actor) {
+		return !!actor.identity && session.sub === actor.identity.data.id && session.sub_kind === actor.identity.type;
+	}
+	async getMany(query, actor) {
+		let canReadAll = true;
+		try {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });
+		} catch (e) {
+			if (!actor.identity) throw e;
+			canReadAll = false;
+		}
+		if (!canReadAll) return this.repository.findMany(query, { owner: {
+			sub: actor.identity.data.id,
+			subKind: actor.identity.type
+		} });
+		const { data: entities, meta } = await this.repository.findMany(query);
+		const data = [];
+		let { total } = meta;
+		for (const entity of entities) {
+			if (this.isOwnedBy(entity, actor)) {
+				data.push(entity);
+				continue;
+			}
+			try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.SESSION_READ,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: entity,
+						...this.resourceRealmMatch(entity)
+					})
+				});
+				data.push(entity);
+			} catch {
+				total -= 1;
+			}
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(id, actor) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.SESSION_READ,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		return entity;
+	}
+	async delete(id, actor) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.SESSION_DELETE,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+	async deleteMany(actor, options = {}) {
+		if (!actor.identity) throw new AuthupError({
+			code: ErrorCode.IDENTITY_UNAUTHORIZED,
+			message: "Authentication required."
+		});
+		if (this.hasTargetFilter(options.query)) return this.deleteManyByQuery(actor, options.query);
+		return this.deleteManyForSelf(actor, options.currentSessionId);
+	}
+	/**
+	* True when the query carries at least one recognized target filter — the
+	* discriminator between the admin bulk-revoke path and self-service. An
+	* unrecognized / empty filter falls through to self-service (fail-safe: a
+	* typo can never trigger an unconstrained mass delete).
+	*/ hasTargetFilter(query) {
+		const filter = query?.filter;
+		if (!isObject(filter)) return false;
+		return SESSION_FILTER_KEYS.some((key) => {
+			const value = filter[key];
+			return typeof value !== "undefined" && value !== "";
+		});
+	}
+	async deleteManyForSelf(actor, currentSessionId) {
+		const sessions = await this.repository.findAllByOwner({
+			sub: actor.identity.data.id,
+			subKind: actor.identity.type
+		});
+		let count = 0;
+		for (const session of sessions) {
+			if (currentSessionId && session.id === currentSessionId) continue;
+			await this.repository.remove(session);
+			count += 1;
+		}
+		return { count };
+	}
+	async deleteManyByQuery(actor, query) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });
+		const sessions = await this.repository.findAllByQuery(query);
+		let count = 0;
+		for (const session of sessions) {
+			if (!this.isOwnedBy(session, actor)) try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.SESSION_DELETE,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: session,
+						...this.resourceRealmMatch(session)
+					})
+				});
+			} catch {
+				continue;
+			}
+			await this.repository.remove(session);
+			count += 1;
+		}
+		return { count };
+	}
+};
+//#endregion
+export { SessionService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/session/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","AuthupError","EntityNotFoundError","ErrorCode","isObject","PermissionName","AbstractEntityService","SESSION_FILTER_KEYS","SessionService","repository","ctx","isOwnedBy","session","actor","identity","sub","data","id","sub_kind","type","getMany","query","canReadAll","permissionEvaluator","preEvaluate","name","SESSION_READ","e","findMany","owner","subKind","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","delete","SESSION_DELETE","entityId","remove","deleteMany","options","code","IDENTITY_UNAUTHORIZED","message","hasTargetFilter","deleteManyByQuery","deleteManyForSelf","currentSessionId","filter","some","key","value","sessions","findAllByOwner","count","findAllByQuery"],"sources":["../../../../src/core/entities/session/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { AuthupError, EntityNotFoundError, ErrorCode } from '@authup/errors';\nimport { isObject } from '@authup/kit';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Session } from '@authup/core-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { ISessionRepository } from '../../authentication/index.ts';\nimport { SESSION_FILTER_KEYS } from '../../authentication/index.ts';\nimport type { ISessionService, SessionDeleteManyOptions, SessionDeleteManyResult } from './types.ts';\n\nexport type SessionServiceContext = {\n    repository: ISessionRepository,\n};\n\nexport class SessionService extends AbstractEntityService implements ISessionService {\n    protected repository: ISessionRepository;\n\n    constructor(ctx: SessionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n    }\n\n    protected isOwnedBy(session: Session, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            session.sub === actor.identity.data.id &&\n            session.sub_kind === actor.identity.type;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own sessions\n            return this.repository.findMany(query, {\n                owner: {\n                    sub: actor.identity!.data.id,\n                    subKind: actor.identity!.type,\n                },\n            });\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(query);\n\n        const data: Session[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.SESSION_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext): Promise<Session> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SESSION_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n\n    async delete(id: string, actor: ActorContext): Promise<Session> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SESSION_DELETE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    async deleteMany(\n        actor: ActorContext,\n        options: SessionDeleteManyOptions = {},\n    ): Promise<SessionDeleteManyResult> {\n        if (!actor.identity) {\n            throw new AuthupError({ code: ErrorCode.IDENTITY_UNAUTHORIZED, message: 'Authentication required.' });\n        }\n\n        if (this.hasTargetFilter(options.query)) {\n            return this.deleteManyByQuery(actor, options.query!);\n        }\n\n        return this.deleteManyForSelf(actor, options.currentSessionId);\n    }\n\n    /**\n     * True when the query carries at least one recognized target filter — the\n     * discriminator between the admin bulk-revoke path and self-service. An\n     * unrecognized / empty filter falls through to self-service (fail-safe: a\n     * typo can never trigger an unconstrained mass delete).\n     */\n    protected hasTargetFilter(query?: Record<string, any>): boolean {\n        const filter = query?.filter;\n        if (!isObject(filter)) {\n            return false;\n        }\n\n        return SESSION_FILTER_KEYS.some((key) => {\n            const value = filter[key];\n            return typeof value !== 'undefined' && value !== '';\n        });\n    }\n\n    protected async deleteManyForSelf(\n        actor: ActorContext,\n        currentSessionId?: string,\n    ): Promise<SessionDeleteManyResult> {\n        const sessions = await this.repository.findAllByOwner({\n            sub: actor.identity!.data.id,\n            subKind: actor.identity!.type,\n        });\n\n        let count = 0;\n        for (const session of sessions) {\n            if (currentSessionId && session.id === currentSessionId) {\n                continue;\n            }\n            await this.repository.remove(session);\n            count += 1;\n        }\n\n        return { count };\n    }\n\n    protected async deleteManyByQuery(\n        actor: ActorContext,\n        query: Record<string, any>,\n    ): Promise<SessionDeleteManyResult> {\n        // Gate: an actor without SESSION_DELETE cannot force-logout anyone → 403.\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n\n        const sessions = await this.repository.findAllByQuery(query);\n\n        let count = 0;\n        for (const session of sessions) {\n            // Own sessions are always deletable by the actor (mirrors getMany).\n            // Otherwise per-session realm-match: a realm_admin only reaches\n            // sessions in its realm — cross-realm rows are skipped, not failed,\n            // so filter breadth cannot escalate beyond the actor's reach.\n            if (!this.isOwnedBy(session, actor)) {\n                try {\n                    await actor.permissionEvaluator.evaluate({\n                        name: PermissionName.SESSION_DELETE,\n                        data: definePolicyData({\n                            [BuiltInPolicyType.ATTRIBUTES]: session,\n                            ...this.resourceRealmMatch(session),\n                        }),\n                    });\n                } catch {\n                    continue;\n                }\n            }\n\n            await this.repository.remove(session);\n            count += 1;\n        }\n\n        return { count };\n    }\n}\n"],"mappings":";;;;;;;;;;;AAsBA,IAAaS,iBAAb,cAAoCF,sBAAAA;CACtBG;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,aAAaL,MAAMC,SAASK;CAC5C;CAEA,MAAMC,QACFC,OACAR,OACgD;EAChD,IAAIS,aAAa;EACjB,IAAI;GACA,MAAMT,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqB,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAACd,MAAMC,UACP,MAAMa;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKb,WAAWmB,SAASP,OAAO,EACnCQ,OAAO;GACHd,KAAKF,MAAMC,SAAUE,KAAKC;GAC1Ba,SAASjB,MAAMC,SAAUK;EAC7B,EACJ,CAAA;EAGJ,MAAM,EAAEH,MAAMe,UAAUC,SAAS,MAAM,KAAKvB,WAAWmB,SAASP,KAAAA;EAEhE,MAAML,OAAkB,CAAA;EACxB,IAAI,EAAEiB,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAKpB,UAAUuB,QAAQrB,KAAAA,GAAQ;IAC/BG,KAAKmB,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMrB,MAAMU,oBAAoBa,SAAS;KACrCX,MAAMpB,eAAeqB;KACrBV,MAAMhB,iBAAiB;OAClBD,kBAAkBsC,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAlB,KAAKmB,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHjB;GACAgB,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAOtB,IAAYJ,OAAuC;EAC5D,MAAMqB,SAAS,MAAM,KAAKzB,WAAW+B,YAAYvB,EAAAA;EACjD,IAAI,CAACiB,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAAC,KAAKS,UAAUuB,QAAQrB,KAAAA,GAAQ;GAChC,MAAMA,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqB,aAAa,CAAA;GAChF,MAAMb,MAAMU,oBAAoBa,SAAS;IACrCX,MAAMpB,eAAeqB;IACrBV,MAAMhB,iBAAiB;MAClBD,kBAAkBsC,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMO,OAAOxB,IAAYJ,OAAuC;EAC5D,MAAMqB,SAAS,MAAM,KAAKzB,WAAW+B,YAAYvB,EAAAA;EACjD,IAAI,CAACiB,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAAC,KAAKS,UAAUuB,QAAQrB,KAAAA,GAAQ;GAChC,MAAMA,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqC,eAAe,CAAA;GAClF,MAAM7B,MAAMU,oBAAoBa,SAAS;IACrCX,MAAMpB,eAAeqC;IACrB1B,MAAMhB,iBAAiB;MAClBD,kBAAkBsC,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAEjB,IAAI0B,aAAaT;EACzB,MAAM,KAAKzB,WAAWmC,OAAOV,MAAAA;EAC7BA,OAAOjB,KAAK0B;EAEZ,OAAOT;CACX;CAEA,MAAMW,WACFhC,OACAiC,UAAoC,CAAC,GACL;EAChC,IAAI,CAACjC,MAAMC,UACP,MAAM,IAAIb,YAAY;GAAE8C,MAAM5C,UAAU6C;GAAuBC,SAAS;EAA2B,CAAA;EAGvG,IAAI,KAAKC,gBAAgBJ,QAAQzB,KAAK,GAClC,OAAO,KAAK8B,kBAAkBtC,OAAOiC,QAAQzB,KAAK;EAGtD,OAAO,KAAK+B,kBAAkBvC,OAAOiC,QAAQO,gBAAgB;CACjE;;;;;;IAQA,gBAA0BhC,OAAsC;EAC5D,MAAMiC,SAASjC,OAAOiC;EACtB,IAAI,CAAClD,SAASkD,MAAAA,GACV,OAAO;EAGX,OAAO/C,oBAAoBgD,MAAMC,QAAAA;GAC7B,MAAMC,QAAQH,OAAOE;GACrB,OAAO,OAAOC,UAAU,eAAeA,UAAU;EACrD,CAAA;CACJ;CAEA,MAAgBL,kBACZvC,OACAwC,kBACgC;EAChC,MAAMK,WAAW,MAAM,KAAKjD,WAAWkD,eAAe;GAClD5C,KAAKF,MAAMC,SAAUE,KAAKC;GAC1Ba,SAASjB,MAAMC,SAAUK;EAC7B,CAAA;EAEA,IAAIyC,QAAQ;EACZ,KAAK,MAAMhD,WAAW8C,UAAU;GAC5B,IAAIL,oBAAoBzC,QAAQK,OAAOoC,kBACnC;GAEJ,MAAM,KAAK5C,WAAWmC,OAAOhC,OAAAA;GAC7BgD,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;CAEA,MAAgBT,kBACZtC,OACAQ,OACgC;EAEhC,MAAMR,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqC,eAAe,CAAA;EAElF,MAAMgB,WAAW,MAAM,KAAKjD,WAAWoD,eAAexC,KAAAA;EAEtD,IAAIuC,QAAQ;EACZ,KAAK,MAAMhD,WAAW8C,UAAU;GAK5B,IAAI,CAAC,KAAK/C,UAAUC,SAASC,KAAAA,GACzB,IAAI;IACA,MAAMA,MAAMU,oBAAoBa,SAAS;KACrCX,MAAMpB,eAAeqC;KACrB1B,MAAMhB,iBAAiB;OAClBD,kBAAkBsC,aAAazB;MAChC,GAAG,KAAK0B,mBAAmB1B,OAAAA;KAC/B,CAAA;IACJ,CAAA;GACJ,QAAQ;IACJ;GACJ;GAGJ,MAAM,KAAKH,WAAWmC,OAAOhC,OAAAA;GAC7BgD,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;AACJ"}

package/dist/core/entities/session/types.d.ts

@@ -0,0 +1,48 @@
+import type { Session } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+export type SessionDeleteManyResult = {
+    count: number;
+};
+export type SessionDeleteManyOptions = {
+    /**
+     * The parsed request query. When it carries a recognized target filter
+     * (`SESSION_FILTER_KEYS`, e.g. `filter[user_id]`) the call is an admin
+     * bulk revoke; otherwise it is the self-service path.
+     */
+    query?: Record<string, any>;
+    /**
+     * The caller's current session id (from the bearer). Preserved on the
+     * self-service path so "log out my other devices" keeps this device.
+     */
+    currentSessionId?: string;
+};
+export interface ISessionService {
+    /**
+     * List sessions. An actor without `SESSION_READ` is scoped to its own
+     * sessions (self-service); an actor with `SESSION_READ` sees every session
+     * its realm reach permits.
+     */
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<Session>>;
+    /**
+     * Read a single session by id. Own sessions need no permission.
+     */
+    getOne(id: string, actor: ActorContext): Promise<Session>;
+    /**
+     * Revoke (delete) a single session by id. Own sessions need no permission.
+     */
+    delete(id: string, actor: ActorContext): Promise<Session>;
+    /**
+     * Bulk revoke.
+     *
+     * - **No recognized target filter** → self-service: revoke every session of
+     *   the actor except the current one ("log out my other devices"). No
+     *   permission required.
+     * - **A recognized target filter** (`SESSION_FILTER_KEYS`, e.g.
+     *   `filter[user_id]`, `filter[realm_id]`) → admin "force-logout": revoke
+     *   every matching session. Requires `SESSION_DELETE`, and each session is
+     *   additionally realm-matched (drop-unauthorized), so a `realm_admin` only
+     *   revokes sessions in its reach and filter breadth cannot escalate.
+     */
+    deleteMany(actor: ActorContext, options?: SessionDeleteManyOptions): Promise<SessionDeleteManyResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/session/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,MAAM,uBAAuB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3G;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1D;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1D;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACzG"}

package/dist/core/entities/session/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/entities/trust-anchor/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/trust-anchor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/entities/trust-anchor/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { TrustAnchorService } from "./service.mjs";
+export { TrustAnchorService };

package/dist/core/entities/trust-anchor/service.d.ts

@@ -0,0 +1,33 @@
+import type { TrustAnchor } from '@authup/core-kit';
+import { EventName, TrustAnchorValidator } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { EventRequestContext, IEventService } from '../event/index.ts';
+import type { ITrustAnchorRepository, ITrustAnchorService } from './types.ts';
+export type TrustAnchorServiceContext = {
+    repository: ITrustAnchorRepository;
+    eventService?: IEventService;
+    requestContext?: () => EventRequestContext | undefined;
+};
+export declare class TrustAnchorService extends AbstractEntityService implements ITrustAnchorService {
+    protected repository: ITrustAnchorRepository;
+    protected validator: TrustAnchorValidator;
+    protected eventService?: IEventService;
+    protected requestContext?: () => EventRequestContext | undefined;
+    constructor(ctx: TrustAnchorServiceContext);
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<TrustAnchor>>;
+    getOne(idOrName: string, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<TrustAnchor>;
+    update(idOrName: string, data: Record<string, any>, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;
+    delete(id: string, actor: ActorContext): Promise<TrustAnchor>;
+    /**
+     * Metadata-only audit trail for trust-anchor lifecycle operations
+     * (issue #3269) — trust anchors have no entity subscriber, so the
+     * security-relevant mutations (an enabled CA anchor turns on mTLS client
+     * auth for a realm) are recorded explicitly. The payload never carries
+     * certificate bytes.
+     */
+    protected recordEvent(name: `${EventName}`, entity: TrustAnchor, actor: ActorContext, data?: Record<string, any>): Promise<void>;
+    protected pickAuditFields(entity: TrustAnchor): Record<string, any>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/trust-anchor/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/service.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAEH,SAAS,EAGT,oBAAoB,EACvB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,MAAM,yBAAyB,GAAG;IACpC,UAAU,EAAE,sBAAsB,CAAC;IACnC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;CAC1D,CAAC;AAQF,qBAAa,kBAAmB,SAAQ,qBAAsB,YAAW,mBAAmB;IACxF,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;IAE1C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;gBAErD,GAAG,EAAE,yBAAyB;IAQpC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAgCjD,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAmBjB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IA6CjB,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAuCjB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IA2BvB;;;;;;OAMG;cACa,WAAW,CACvB,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,YAAY,EACnB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IA0BhB,SAAS,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;CAMtE"}

package/dist/core/entities/trust-anchor/service.mjs

@@ -0,0 +1,175 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildEntityDiff } from "../event/diff.mjs";
+import "../event/index.mjs";
+import { parseCertificateChain } from "../../key/certificate.mjs";
+import "../../key/index.mjs";
+import { ValidatorGroup } from "@authup/kit";
+import { EntityType, EventName, EventScope, PermissionName, TrustAnchorValidator } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
+//#region src/core/entities/trust-anchor/service.ts
+const PERMISSION_NAMES = [
+	PermissionName.KEY_READ,
+	PermissionName.KEY_UPDATE,
+	PermissionName.KEY_DELETE
+];
+var TrustAnchorService = class extends AbstractEntityService {
+	repository;
+	validator;
+	eventService;
+	requestContext;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.validator = new TrustAnchorValidator();
+		this.eventService = ctx.eventService;
+		this.requestContext = ctx.requestContext;
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });
+		const { data: entities, meta } = await this.repository.findMany(query);
+		const data = [];
+		let { total } = meta;
+		for (const entity of entities) try {
+			await actor.permissionEvaluator.evaluateOneOf({
+				name: PERMISSION_NAMES,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+			data.push(entity);
+		} catch {
+			total -= 1;
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(idOrName, actor, realmId) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });
+		const entity = await this.repository.findOneByIdOrName(idOrName, realmId);
+		if (!entity) throw new EntityNotFoundError();
+		await actor.permissionEvaluator.evaluateOneOf({
+			name: PERMISSION_NAMES,
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
+		});
+		return entity;
+	}
+	async create(data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		if (!validated.realm_id && actor.identity) {
+			const actorRealmId = this.getActorRealmId(actor);
+			if (actorRealmId) validated.realm_id = actorRealmId;
+		}
+		if (!validated.realm_id) throw new ValidationError("A realm must be specified.");
+		await this.repository.validateJoinColumns(validated);
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.KEY_CREATE,
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: validated,
+				...this.resourceRealmMatch(validated)
+			})
+		});
+		await this.repository.checkUniqueness(validated);
+		const chain = parseCertificateChain(validated.certificate);
+		if (!chain[0] || !chain[0].ca) throw new ValidationError("A trust anchor must contain a CA certificate.");
+		if (typeof validated.enabled !== "boolean") validated.enabled = true;
+		let entity = this.repository.create(validated);
+		entity = await this.repository.save(entity);
+		await this.recordEvent(EventName.CREATED, entity, actor);
+		return entity;
+	}
+	async update(idOrName, data, actor, realmId) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });
+		let entity = await this.repository.findOneByIdOrName(idOrName, realmId);
+		if (!entity) throw new EntityNotFoundError();
+		const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.KEY_UPDATE,
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: {
+					...entity,
+					...validated
+				},
+				...this.resourceRealmMatch(entity)
+			})
+		});
+		if (validated.name && validated.name !== entity.name) await this.repository.checkUniqueness({
+			name: validated.name,
+			realm_id: entity.realm_id
+		}, entity);
+		const previous = this.pickAuditFields(entity);
+		entity = this.repository.merge(entity, validated);
+		entity = await this.repository.save(entity);
+		const diff = buildEntityDiff(this.pickAuditFields(entity), previous);
+		await this.recordEvent(EventName.UPDATED, entity, actor, { ...Object.keys(diff).length > 0 ? { diff } : {} });
+		return entity;
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new EntityNotFoundError();
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.KEY_DELETE,
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
+		});
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		await this.recordEvent(EventName.DELETED, entity, actor);
+		return entity;
+	}
+	/**
+	* Metadata-only audit trail for trust-anchor lifecycle operations
+	* (issue #3269) — trust anchors have no entity subscriber, so the
+	* security-relevant mutations (an enabled CA anchor turns on mTLS client
+	* auth for a realm) are recorded explicitly. The payload never carries
+	* certificate bytes.
+	*/ async recordEvent(name, entity, actor, data = {}) {
+		const requestContext = this.requestContext ? this.requestContext() : void 0;
+		await this.eventService?.record({
+			scope: EventScope.ENTITY,
+			name,
+			refType: EntityType.TRUST_ANCHOR,
+			refId: entity.id,
+			realmId: entity.realm_id ?? null,
+			actorType: actor.identity?.type ?? null,
+			actorId: actor.identity?.data.id ?? null,
+			actorName: actor.identity?.data.name ?? null,
+			requestPath: requestContext?.requestPath ?? null,
+			requestMethod: requestContext?.requestMethod ?? null,
+			requestIpAddress: requestContext?.requestIpAddress ?? null,
+			requestUserAgent: requestContext?.requestUserAgent ?? null,
+			data: {
+				name: entity.name,
+				enabled: entity.enabled,
+				...data
+			}
+		});
+	}
+	pickAuditFields(entity) {
+		return {
+			name: entity.name,
+			enabled: entity.enabled
+		};
+	}
+};
+//#endregion
+export { TrustAnchorService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/trust-anchor/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityType","EventName","EventScope","PermissionName","TrustAnchorValidator","EntityNotFoundError","ValidationError","ValidatorGroup","AbstractEntityService","buildEntityDiff","parseCertificateChain","PERMISSION_NAMES","KEY_READ","KEY_UPDATE","KEY_DELETE","TrustAnchorService","repository","validator","eventService","requestContext","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","data","entities","meta","findMany","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","realmId","findOneByIdOrName","create","preEvaluate","KEY_CREATE","validated","run","group","CREATE","realm_id","identity","actorRealmId","getActorRealmId","validateJoinColumns","evaluate","checkUniqueness","chain","certificate","ca","enabled","save","recordEvent","CREATED","update","UPDATE","previous","pickAuditFields","merge","diff","UPDATED","Object","keys","length","delete","id","findOneBy","entityId","remove","DELETED","undefined","record","scope","ENTITY","refType","TRUST_ANCHOR","refId","actorType","type","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent"],"sources":["../../../../src/core/entities/trust-anchor/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport {\n    EntityType,\n    EventName,\n    EventScope,\n    PermissionName,\n    TrustAnchorValidator,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { buildEntityDiff } from '../event/index.ts';\nimport type { EventRequestContext, IEventService } from '../event/index.ts';\nimport { parseCertificateChain } from '../../key/index.ts';\nimport type { ITrustAnchorRepository, ITrustAnchorService } from './types.ts';\n\nexport type TrustAnchorServiceContext = {\n    repository: ITrustAnchorRepository,\n    eventService?: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n};\n\nconst PERMISSION_NAMES = [\n    PermissionName.KEY_READ,\n    PermissionName.KEY_UPDATE,\n    PermissionName.KEY_DELETE,\n];\n\nexport class TrustAnchorService extends AbstractEntityService implements ITrustAnchorService {\n    protected repository: ITrustAnchorRepository;\n\n    protected validator: TrustAnchorValidator;\n\n    protected eventService?: IEventService;\n\n    protected requestContext?: () => EventRequestContext | undefined;\n\n    constructor(ctx: TrustAnchorServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new TrustAnchorValidator();\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<TrustAnchor>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        const { data: entities, meta } = await this.repository.findMany(query);\n\n        const data: TrustAnchor[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: PERMISSION_NAMES,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluateOneOf({\n            name: PERMISSION_NAMES,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        if (!validated.realm_id && actor.identity) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realm_id = actorRealmId;\n            }\n        }\n\n        if (!validated.realm_id) {\n            throw new ValidationError('A realm must be specified.');\n        }\n\n        await this.repository.validateJoinColumns(validated);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: validated,\n                ...this.resourceRealmMatch(validated),\n            }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        const chain = parseCertificateChain(validated.certificate as string);\n        if (!chain[0] || !chain[0].ca) {\n            throw new ValidationError('A trust anchor must contain a CA certificate.');\n        }\n\n        if (typeof validated.enabled !== 'boolean') {\n            validated.enabled = true;\n        }\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        await this.recordEvent(EventName.CREATED, entity, actor);\n\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });\n\n        let entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: {\n                    ...entity,\n                    ...validated,\n                },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        if (validated.name && validated.name !== entity.name) {\n            await this.repository.checkUniqueness({\n                name: validated.name,\n                realm_id: entity.realm_id,\n            }, entity);\n        }\n\n        const previous = this.pickAuditFields(entity);\n\n        entity = this.repository.merge(entity, validated);\n        entity = await this.repository.save(entity);\n\n        const diff = buildEntityDiff(this.pickAuditFields(entity), previous);\n        await this.recordEvent(EventName.UPDATED, entity, actor, { ...(Object.keys(diff).length > 0 ? { diff } : {}) });\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        await this.recordEvent(EventName.DELETED, entity, actor);\n\n        return entity;\n    }\n\n    // ------------------------------------------------------------------\n\n    /**\n     * Metadata-only audit trail for trust-anchor lifecycle operations\n     * (issue #3269) — trust anchors have no entity subscriber, so the\n     * security-relevant mutations (an enabled CA anchor turns on mTLS client\n     * auth for a realm) are recorded explicitly. The payload never carries\n     * certificate bytes.\n     */\n    protected async recordEvent(\n        name: `${EventName}`,\n        entity: TrustAnchor,\n        actor: ActorContext,\n        data: Record<string, any> = {},\n    ): Promise<void> {\n        const requestContext = this.requestContext ?\n            this.requestContext() :\n            undefined;\n\n        await this.eventService?.record({\n            scope: EventScope.ENTITY,\n            name,\n            refType: EntityType.TRUST_ANCHOR,\n            refId: entity.id,\n            realmId: entity.realm_id ?? null,\n            actorType: actor.identity?.type ?? null,\n            actorId: actor.identity?.data.id ?? null,\n            actorName: actor.identity?.data.name ?? null,\n            requestPath: requestContext?.requestPath ?? null,\n            requestMethod: requestContext?.requestMethod ?? null,\n            requestIpAddress: requestContext?.requestIpAddress ?? null,\n            requestUserAgent: requestContext?.requestUserAgent ?? null,\n            data: {\n                name: entity.name,\n                enabled: entity.enabled,\n                ...data,\n            },\n        });\n    }\n\n    protected pickAuditFields(entity: TrustAnchor): Record<string, any> {\n        return {\n            name: entity.name,\n            enabled: entity.enabled,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AA+BA,MAAMa,mBAAmB;CACrBR,eAAeS;CACfT,eAAeU;CACfV,eAAeW;;AAGnB,IAAaC,qBAAb,cAAwCP,sBAAAA;CAC1BQ;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,YAAY,IAAIb,qBAAAA;EACrB,KAAKc,eAAeE,IAAIF;EACxB,KAAKC,iBAAiBC,IAAID;CAC9B;CAEA,MAAME,QACFC,OACAC,OACoD;EACpD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMf,iBAAiB,CAAA;EAE1E,MAAM,EAAEgB,MAAMC,UAAUC,SAAS,MAAM,KAAKb,WAAWc,SAASR,KAAAA;EAEhE,MAAMK,OAAsB,CAAA;EAC5B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UACjB,IAAI;GACA,MAAML,MAAMC,oBAAoBS,cAAc;IAC1CP,MAAMf;IACNgB,MAAM5B,iBAAiB;MAClBD,kBAAkBoC,aAAaF;KAChC,GAAG,KAAKG,mBAAmBH,MAAAA;IAC/B,CAAA;GACJ,CAAA;GACAL,KAAKS,KAAKJ,MAAAA;EACd,QAAQ;GACJD,SAAS;EACb;EAGJ,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,UACAf,OACAgB,SACoB;EACpB,MAAMhB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMf,iBAAiB,CAAA;EAE1E,MAAMqB,SAAS,MAAM,KAAKhB,WAAWwB,kBAAkBF,UAAUC,OAAAA;EACjE,IAAI,CAACP,QACD,MAAM,IAAI3B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBS,cAAc;GAC1CP,MAAMf;GACNgB,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMS,OACFd,MACAJ,OACoB;EACpB,MAAMA,MAAMC,oBAAoBkB,YAAY,EAAEhB,MAAMvB,eAAewC,WAAW,CAAA;EAE9E,MAAMC,YAAY,MAAM,KAAK3B,UAAU4B,IAAIlB,MAAM,EAAEmB,OAAOvC,eAAewC,OAAO,CAAA;EAEhF,IAAI,CAACH,UAAUI,YAAYzB,MAAM0B,UAAU;GACvC,MAAMC,eAAe,KAAKC,gBAAgB5B,KAAAA;GAC1C,IAAI2B,cACAN,UAAUI,WAAWE;EAE7B;EAEA,IAAI,CAACN,UAAUI,UACX,MAAM,IAAI1C,gBAAgB,4BAAA;EAG9B,MAAM,KAAKU,WAAWoC,oBAAoBR,SAAAA;EAE1C,MAAMrB,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMvB,eAAewC;GACrBhB,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAaU;IAChC,GAAG,KAAKT,mBAAmBS,SAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAK5B,WAAWsC,gBAAgBV,SAAAA;EAEtC,MAAMW,QAAQ7C,sBAAsBkC,UAAUY,WAAW;EACzD,IAAI,CAACD,MAAM,MAAM,CAACA,MAAM,EAAE,CAACE,IACvB,MAAM,IAAInD,gBAAgB,+CAAA;EAG9B,IAAI,OAAOsC,UAAUc,YAAY,WAC7Bd,UAAUc,UAAU;EAGxB,IAAI1B,SAAS,KAAKhB,WAAWyB,OAAOG,SAAAA;EACpCZ,SAAS,MAAM,KAAKhB,WAAW2C,KAAK3B,MAAAA;EAEpC,MAAM,KAAK4B,YAAY3D,UAAU4D,SAAS7B,QAAQT,KAAAA;EAElD,OAAOS;CACX;CAEA,MAAM8B,OACFxB,UACAX,MACAJ,OACAgB,SACoB;EACpB,MAAMhB,MAAMC,oBAAoBkB,YAAY,EAAEhB,MAAMvB,eAAeU,WAAW,CAAA;EAE9E,IAAImB,SAAS,MAAM,KAAKhB,WAAWwB,kBAAkBF,UAAUC,OAAAA;EAC/D,IAAI,CAACP,QACD,MAAM,IAAI3B,oBAAAA;EAGd,MAAMuC,YAAY,MAAM,KAAK3B,UAAU4B,IAAIlB,MAAM,EAAEmB,OAAOvC,eAAewD,OAAO,CAAA;EAEhF,MAAMxC,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMvB,eAAeU;GACrBc,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAa;KAC5B,GAAGF;KACH,GAAGY;IACP;IACA,GAAG,KAAKT,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIY,UAAUlB,QAAQkB,UAAUlB,SAASM,OAAON,MAC5C,MAAM,KAAKV,WAAWsC,gBAAgB;GAClC5B,MAAMkB,UAAUlB;GAChBsB,UAAUhB,OAAOgB;EACrB,GAAGhB,MAAAA;EAGP,MAAMgC,WAAW,KAAKC,gBAAgBjC,MAAAA;EAEtCA,SAAS,KAAKhB,WAAWkD,MAAMlC,QAAQY,SAAAA;EACvCZ,SAAS,MAAM,KAAKhB,WAAW2C,KAAK3B,MAAAA;EAEpC,MAAMmC,OAAO1D,gBAAgB,KAAKwD,gBAAgBjC,MAAAA,GAASgC,QAAAA;EAC3D,MAAM,KAAKJ,YAAY3D,UAAUmE,SAASpC,QAAQT,OAAO,EAAE,GAAI8C,OAAOC,KAAKH,IAAAA,CAAAA,CAAMI,SAAS,IAAI,EAAEJ,KAAK,IAAI,CAAC,EAAG,CAAA;EAE7G,OAAOnC;CACX;CAEA,MAAMwC,OACFC,IACAlD,OACoB;EACpB,MAAMA,MAAMC,oBAAoBkB,YAAY,EAAEhB,MAAMvB,eAAeW,WAAW,CAAA;EAE9E,MAAMkB,SAAS,MAAM,KAAKhB,WAAW0D,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACzC,QACD,MAAM,IAAI3B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMvB,eAAeW;GACrBa,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,EAAEyC,IAAIE,aAAa3C;EACzB,MAAM,KAAKhB,WAAW4D,OAAO5C,MAAAA;EAC7BA,OAAOyC,KAAKE;EAEZ,MAAM,KAAKf,YAAY3D,UAAU4E,SAAS7C,QAAQT,KAAAA;EAElD,OAAOS;CACX;;;;;;;IAWA,MAAgB4B,YACZlC,MACAM,QACAT,OACAI,OAA4B,CAAC,GAChB;EACb,MAAMR,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnB2D,KAAAA;EAEJ,MAAM,KAAK5D,cAAc6D,OAAO;GAC5BC,OAAO9E,WAAW+E;GAClBvD;GACAwD,SAASlF,WAAWmF;GACpBC,OAAOpD,OAAOyC;GACdlC,SAASP,OAAOgB,YAAY;GAC5BqC,WAAW9D,MAAM0B,UAAUqC,QAAQ;GACnCC,SAAShE,MAAM0B,UAAUtB,KAAK8C,MAAM;GACpCe,WAAWjE,MAAM0B,UAAUtB,KAAKD,QAAQ;GACxC+D,aAAatE,gBAAgBsE,eAAe;GAC5CC,eAAevE,gBAAgBuE,iBAAiB;GAChDC,kBAAkBxE,gBAAgBwE,oBAAoB;GACtDC,kBAAkBzE,gBAAgByE,oBAAoB;GACtDjE,MAAM;IACFD,MAAMM,OAAON;IACbgC,SAAS1B,OAAO0B;IAChB,GAAG/B;GACP;EACJ,CAAA;CACJ;CAEUsC,gBAAgBjC,QAA0C;EAChE,OAAO;GACHN,MAAMM,OAAON;GACbgC,SAAS1B,OAAO0B;EACpB;CACJ;AACJ"}

package/dist/core/entities/trust-anchor/types.d.ts

@@ -0,0 +1,14 @@
+import type { TrustAnchor } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
+export interface ITrustAnchorRepository extends IEntityRepository<TrustAnchor> {
+    checkUniqueness(data: Partial<TrustAnchor>, existing?: TrustAnchor): Promise<void>;
+    findOneByIdOrName(idOrName: string, realm?: string): Promise<TrustAnchor | null>;
+}
+export interface ITrustAnchorService {
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<TrustAnchor>>;
+    getOne(idOrName: string, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<TrustAnchor>;
+    update(idOrName: string, data: Record<string, any>, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;
+    delete(id: string, actor: ActorContext): Promise<TrustAnchor>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/trust-anchor/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE1G,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB,CAAC,WAAW,CAAC;IAC1E,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnF,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,mBAAmB;IAChC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/G,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjE"}

package/dist/core/entities/trust-anchor/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/entities/user/service.d.ts

@@ -7,6 +7,7 @@ import type { IUserRepository, IUserService } from './types.ts';
 export type UserServiceContext = {
     repository: IUserRepository;
     realmRepository: IRealmRepository;
+    passwordMinLength?: number;
 };
 export declare class UserService extends AbstractEntityService implements IUserService {
     protected repository: IUserRepository;

package/dist/core/entities/user/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAEH,aAAa,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,WAAY,SAAQ,qBAAsB,YAAW,YAAY;IAC1E,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;gBAEvB,GAAG,EAAE,kBAAkB;IAO7B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAoD1C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IAsCV,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAsII,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;CA2BnB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAEH,aAAa,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,qBAAa,WAAY,SAAQ,qBAAsB,YAAW,YAAY;IAC1E,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;gBAEvB,GAAG,EAAE,kBAAkB;IAO7B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAoD1C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IAsCV,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAsII,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;CA2BnB"}

package/dist/core/entities/user/service.mjs

@@ -6,7 +6,7 @@ import { ValidatorGroup, isUUID } from "@authup/kit";
 import { PermissionName, UserValidator } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
 //#region src/core/entities/user/service.ts
 var UserService = class extends AbstractEntityService {
 	repository;
@@ -16,7 +16,7 @@ var UserService = class extends AbstractEntityService {
 		super();
 		this.repository = ctx.repository;
 		this.realmRepository = ctx.realmRepository;
-		this.validator = new UserValidator();
+		this.validator = new UserValidator({ passwordMinLength: ctx.passwordMinLength });
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -170,7 +170,7 @@ var UserService = class extends AbstractEntityService {
 	}
 	async delete(id, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });
-		if (actor.identity && actor.identity.type === "user" && actor.identity.data.id === id) throw new BadRequestError("The own user can not be deleted.");
+		if (actor.identity && actor.identity.type === "user" && actor.identity.data.id === id) throw new ValidationError("The own user can not be deleted.");
 		const entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
 		await actor.permissionEvaluator.evaluate({