@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/core/identity/password-recovery/disabled.mjs

@@ -1,10 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { BadRequestError, ErrorCode, markInstanceof } from "@authup/errors";
+import { ErrorCode, ValidationError, markInstanceof } from "@authup/errors";
 //#region src/core/identity/password-recovery/disabled.ts
 const PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE = Symbol.for("@authup/server-core/PasswordRecoveryDisabledError");
-var PasswordRecoveryDisabledError = class extends BadRequestError {
+var PasswordRecoveryDisabledError = class extends ValidationError {
 	constructor() {
 		super({
 			code: ErrorCode.PASSWORD_RECOVERY_DISABLED,

package/dist/core/identity/password-recovery/disabled.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"disabled.mjs","names":["BadRequestError","ErrorCode","markInstanceof","PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE","Symbol","for","PasswordRecoveryDisabledError","code","PASSWORD_RECOVERY_DISABLED","message"],"sources":["../../../../src/core/identity/password-recovery/disabled.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, ErrorCode, markInstanceof } from '@authup/errors';\n\nexport const PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE = Symbol.for('@authup/server-core/PasswordRecoveryDisabledError');\n\nexport class PasswordRecoveryDisabledError extends BadRequestError {\n    constructor() {\n        super({\n            code: ErrorCode.PASSWORD_RECOVERY_DISABLED,\n            message: 'Password recovery is not enabled.',\n        });\n        markInstanceof(this, PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaG,4CAA4CC,OAAOC,IAAI,mDAAA;AAEpE,IAAaC,gCAAb,cAAmDN,gBAAAA;CAC/C,cAAc;EACV,MAAM;GACFO,MAAMN,UAAUO;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,yCAAAA;CACzB;AACJ"}
+{"version":3,"file":"disabled.mjs","names":["ErrorCode","ValidationError","markInstanceof","PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE","Symbol","for","PasswordRecoveryDisabledError","code","PASSWORD_RECOVERY_DISABLED","message"],"sources":["../../../../src/core/identity/password-recovery/disabled.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode, ValidationError, markInstanceof } from '@authup/errors';\n\nexport const PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE = Symbol.for('@authup/server-core/PasswordRecoveryDisabledError');\n\nexport class PasswordRecoveryDisabledError extends ValidationError {\n    constructor() {\n        super({\n            code: ErrorCode.PASSWORD_RECOVERY_DISABLED,\n            message: 'Password recovery is not enabled.',\n        });\n        markInstanceof(this, PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaG,4CAA4CC,OAAOC,IAAI,mDAAA;AAEpE,IAAaC,gCAAb,cAAmDL,gBAAAA;CAC/C,cAAc;EACV,MAAM;GACFM,MAAMP,UAAUQ;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,yCAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/email-verification-required.d.ts

@@ -1,6 +1,6 @@
-import { BadRequestError } from '@authup/errors';
+import { ValidationError } from '@authup/errors';
 export declare const EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE: unique symbol;
-export declare class EmailVerificationRequiredError extends BadRequestError {
+export declare class EmailVerificationRequiredError extends ValidationError {
     constructor(message?: string);
 }
 //# sourceMappingURL=email-verification-required.d.ts.map

package/dist/core/identity/password-recovery/email-verification-required.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-verification-required.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/email-verification-required.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAA6B,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,0CAA0C,eAAmE,CAAC;AAE3H,qBAAa,8BAA+B,SAAQ,eAAe;gBACnD,OAAO,GAAE,MAA0C;CAOlE"}
+{"version":3,"file":"email-verification-required.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/email-verification-required.ts"],"names":[],"mappings":"AAOA,OAAO,EAAa,eAAe,EAAkB,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,0CAA0C,eAAmE,CAAC;AAE3H,qBAAa,8BAA+B,SAAQ,eAAe;gBACnD,OAAO,GAAE,MAA0C;CAOlE"}

package/dist/core/identity/password-recovery/email-verification-required.mjs

@@ -1,10 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { BadRequestError, ErrorCode, markInstanceof } from "@authup/errors";
+import { ErrorCode, ValidationError, markInstanceof } from "@authup/errors";
 //#region src/core/identity/password-recovery/email-verification-required.ts
 const EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE = Symbol.for("@authup/server-core/EmailVerificationRequiredError");
-var EmailVerificationRequiredError = class extends BadRequestError {
+var EmailVerificationRequiredError = class extends ValidationError {
 	constructor(message = "Email verification is required.") {
 		super({
 			code: ErrorCode.EMAIL_VERIFICATION_REQUIRED,

package/dist/core/identity/password-recovery/email-verification-required.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"email-verification-required.mjs","names":["BadRequestError","ErrorCode","markInstanceof","EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE","Symbol","for","EmailVerificationRequiredError","message","code","EMAIL_VERIFICATION_REQUIRED"],"sources":["../../../../src/core/identity/password-recovery/email-verification-required.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, ErrorCode, markInstanceof } from '@authup/errors';\n\nexport const EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE = Symbol.for('@authup/server-core/EmailVerificationRequiredError');\n\nexport class EmailVerificationRequiredError extends BadRequestError {\n    constructor(message: string = 'Email verification is required.') {\n        super({\n            code: ErrorCode.EMAIL_VERIFICATION_REQUIRED,\n            message,\n        });\n        markInstanceof(this, EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaG,6CAA6CC,OAAOC,IAAI,oDAAA;AAErE,IAAaC,iCAAb,cAAoDN,gBAAAA;CAChD,YAAYO,UAAkB,mCAAmC;EAC7D,MAAM;GACFC,MAAMP,UAAUQ;GAChBF;EACJ,CAAA;EACAL,eAAe,MAAMC,0CAAAA;CACzB;AACJ"}
+{"version":3,"file":"email-verification-required.mjs","names":["ErrorCode","ValidationError","markInstanceof","EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE","Symbol","for","EmailVerificationRequiredError","message","code","EMAIL_VERIFICATION_REQUIRED"],"sources":["../../../../src/core/identity/password-recovery/email-verification-required.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode, ValidationError, markInstanceof } from '@authup/errors';\n\nexport const EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE = Symbol.for('@authup/server-core/EmailVerificationRequiredError');\n\nexport class EmailVerificationRequiredError extends ValidationError {\n    constructor(message: string = 'Email verification is required.') {\n        super({\n            code: ErrorCode.EMAIL_VERIFICATION_REQUIRED,\n            message,\n        });\n        markInstanceof(this, EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaG,6CAA6CC,OAAOC,IAAI,oDAAA;AAErE,IAAaC,iCAAb,cAAoDL,gBAAAA;CAChD,YAAYM,UAAkB,mCAAmC;EAC7D,MAAM;GACFC,MAAMR,UAAUS;GAChBF;EACJ,CAAA;EACAL,eAAe,MAAMC,0CAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/service.d.ts

@@ -1,6 +1,6 @@
 import type { IPasswordRecoveryService, PasswordForgotResult, PasswordRecoveryServiceContext, PasswordRecoveryServiceOptions, PasswordResetResult } from './types.ts';
 import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
-import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';
 import type { IdentityWorkflowContext } from '../types.ts';
 export declare class PasswordRecoveryService implements IPasswordRecoveryService {
     protected options: PasswordRecoveryServiceOptions;
@@ -8,6 +8,7 @@ export declare class PasswordRecoveryService implements IPasswordRecoveryService
     protected realmRepository: IRealmRepository;
     protected mailClient: IMailClient;
     protected mailTemplateRenderer: IMailTemplateRenderer;
+    protected eventService?: IEventService;
     constructor(ctx: PasswordRecoveryServiceContext);
     forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult>;
     resetPassword(data: Record<string, any>): Promise<PasswordResetResult>;

package/dist/core/identity/password-recovery/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/service.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,mBAAmB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAG3D,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,OAAO,EAAE,8BAA8B,CAAC;IAElD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;gBAE1C,GAAG,EAAE,8BAA8B;IAQzC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAwE3G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;YA0C9D,0BAA0B;YAgC1B,yBAAyB;CAuC1C"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/service.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,mBAAmB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAG3D,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,OAAO,EAAE,8BAA8B,CAAC;IAElD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAEtD,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;gBAE3B,GAAG,EAAE,8BAA8B;IASzC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmF3G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;YAqD9D,0BAA0B;YAgC1B,yBAAyB;CA2C1C"}

package/dist/core/identity/password-recovery/service.mjs

@@ -8,11 +8,12 @@ import "./constants.mjs";
 import { PasswordRecoveryDisabledError } from "./disabled.mjs";
 import { EmailVerificationRequiredError } from "./email-verification-required.mjs";
 import { ResetTokenExpiredError } from "./token-expired.mjs";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { EventName, EventRefType, EventScope, IdentityType, USER_PASSWORD_MAX_LENGTH, USER_PASSWORD_MIN_LENGTH } from "@authup/core-kit";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
+import { randomBytes } from "node:crypto";
 import { Container } from "validup";
 import { createValidator } from "@validup/zod";
 import { z } from "zod";
-import { randomBytes } from "node:crypto";
 //#region src/core/identity/password-recovery/service.ts
 var PasswordRecoveryService = class {
 	options;
@@ -20,12 +21,14 @@ var PasswordRecoveryService = class {
 	realmRepository;
 	mailClient;
 	mailTemplateRenderer;
+	eventService;
 	constructor(ctx) {
 		this.options = ctx.options;
 		this.repository = ctx.repository;
 		this.realmRepository = ctx.realmRepository;
 		this.mailClient = ctx.mailClient;
 		this.mailTemplateRenderer = ctx.mailTemplateRenderer;
+		this.eventService = ctx.eventService;
 	}
 	async forgotPassword(data, context) {
 		if (!this.options.passwordRecoveryEnabled) throw new PasswordRecoveryDisabledError();
@@ -65,8 +68,18 @@ var PasswordRecoveryService = class {
 				reset_expires: null
 			});
 			await this.repository.save(merged);
-			throw new BadRequestError("Password recovery failed. Could not send reset email.");
+			throw new ValidationError("Password recovery failed. Could not send reset email.");
 		}
+		await this.eventService?.record({
+			scope: EventScope.IDENTITY,
+			name: EventName.PASSWORD_RESET_REQUESTED,
+			refType: EventRefType.USER,
+			refId: merged.id,
+			actorType: IdentityType.USER,
+			actorId: merged.id,
+			actorName: merged.name,
+			realmId: merged.realm_id
+		});
 		return { reset_expires: merged.reset_expires };
 	}
 	async resetPassword(data) {
@@ -91,6 +104,16 @@ var PasswordRecoveryService = class {
 			password: hashedPassword
 		});
 		await this.repository.save(merged);
+		await this.eventService?.record({
+			scope: EventScope.IDENTITY,
+			name: EventName.PASSWORD_RESET_COMPLETED,
+			refType: EventRefType.USER,
+			refId: merged.id,
+			actorType: IdentityType.USER,
+			actorId: merged.id,
+			actorName: merged.name,
+			realmId: merged.realm_id
+		});
 		return { reset_at: merged.reset_at };
 	}
 	async runForgotPasswordValidator(data) {
@@ -110,7 +133,7 @@ var PasswordRecoveryService = class {
 		validator.mount(oneOfContainer);
 		validator.mount("realm_id", { optional: true }, createValidator(z.uuid().nullable()));
 		validator.mount("token", createValidator(z.string().min(3).max(256)));
-		validator.mount("password", createValidator(z.string().min(5).max(512)));
+		validator.mount("password", createValidator(z.string().min(this.options.passwordMinLength ?? USER_PASSWORD_MIN_LENGTH).max(USER_PASSWORD_MAX_LENGTH)));
 		return validator.run(data);
 	}
 };

package/dist/core/identity/password-recovery/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BadRequestError","EntityNotFoundError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidator","randomBytes","Container","z","UserCredentialsService","MailTemplateName","PASSWORD_RESET_EXPIRES_IN_MINUTES","PasswordRecoveryService","options","repository","realmRepository","mailClient","mailTemplateRenderer","ctx","forgotPassword","data","context","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realm_id","where","name","email","id","entity","findOneByWithEmail","merged","merge","reset_expires","Date","now","toISOString","reset_hash","toString","save","resetUrl","publicUrl","replace","encodeURIComponent","undefined","mail","render","template","PASSWORD_RESET","params","code","url","expiresInMinutes","locale","send","to","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","reset_at","validator","oneOfContainer","oneOf","mount","string","trim","toLowerCase","regex","message","min","optional","uuid","nullable","run","max"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidator } from '@validup/zod';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IPasswordRecoveryService,\n    PasswordForgotResult,\n    PasswordRecoveryServiceContext,\n    PasswordRecoveryServiceOptions,\n    PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\nimport { PASSWORD_RESET_EXPIRES_IN_MINUTES } from './constants.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n    protected options: PasswordRecoveryServiceOptions;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    constructor(ctx: PasswordRecoveryServiceContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n    }\n\n    async forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        if (!this.options.emailVerificationEnabled) {\n            throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n        }\n\n        const validated = await this.runForgotPasswordValidator(data);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneByWithEmail(where);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            reset_expires: new Date(\n                Date.now() + (1000 * 60 * PASSWORD_RESET_EXPIRES_IN_MINUTES),\n            ).toISOString(),\n            reset_hash: randomBytes(32).toString('hex'),\n        });\n\n        await this.repository.save(merged);\n\n        try {\n            // realm_id MUST ride the link: resetPassword resolves the realm\n            // from the request and filters the lookup by it, so a realm-less\n            // link resolves to the master realm and never matches a\n            // non-master user.\n            const resetUrl = this.options.publicUrl ?\n                `${this.options.publicUrl.replace(/\\/+$/, '')}/password-reset` +\n                `?token=${encodeURIComponent(merged.reset_hash!)}` +\n                `&realm_id=${encodeURIComponent(entity.realm_id)}` :\n                undefined;\n\n            const mail = await this.mailTemplateRenderer.render({\n                template: MailTemplateName.PASSWORD_RESET,\n                params: {\n                    code: merged.reset_hash!,\n                    url: resetUrl,\n                    expiresInMinutes: PASSWORD_RESET_EXPIRES_IN_MINUTES,\n                },\n                locale: context?.locale,\n            });\n\n            await this.mailClient.send({\n                to: entity.email,\n                ...mail,\n            });\n        } catch {\n            this.repository.merge(merged, {\n                reset_hash: null,\n                reset_expires: null,\n            });\n            await this.repository.save(merged);\n\n            throw new BadRequestError('Password recovery failed. Could not send reset email.');\n        }\n\n        return { reset_expires: merged.reset_expires! };\n    }\n\n    async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        const validated = await this.runResetPasswordValidator(data);\n\n        await this.repository.validateJoinColumns(validated);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            reset_hash: validated.token,\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneBy(where);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!entity.reset_expires || new Date(entity.reset_expires) < new Date()) {\n            throw new ResetTokenExpiredError();\n        }\n\n        const credentialsService = new UserCredentialsService();\n        const hashedPassword = await credentialsService.protect(validated.password);\n\n        const merged = this.repository.merge(entity, {\n            reset_at: new Date().toISOString(),\n            reset_hash: null,\n            reset_expires: null,\n            password: hashedPassword,\n        });\n\n        await this.repository.save(merged);\n\n        return { reset_at: merged.reset_at! };\n    }\n\n    private async runForgotPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        return validator.run(data);\n    }\n\n    private async runResetPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        validator.mount(\n            'token',\n            createValidator(z.string().min(3).max(256)),\n        );\n\n        validator.mount(\n            'password',\n            createValidator(z.string().min(5).max(512)),\n        );\n\n        return validator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6BA,IAAaY,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKL,UAAUK,IAAIL;EACnB,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,uBAAuBC,IAAID;CACpC;CAEA,MAAME,eAAeC,MAA2BC,SAAkE;EAC9G,IAAI,CAAC,KAAKR,QAAQS,yBACd,MAAM,IAAIpB,8BAAAA;EAGd,IAAI,CAAC,KAAKW,QAAQU,0BACd,MAAM,IAAIpB,+BAA+B,sEAAA;EAG7C,MAAMqB,YAAY,MAAM,KAAKC,2BAA2BL,IAAAA;EAExD,MAAMM,QAAQ,MAAM,KAAKX,gBAAgBY,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKnB,WAAWoB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkC,SAAS,KAAKrB,WAAWsB,MAAMH,QAAQ;GACzCI,eAAe,IAAIC,KACfA,KAAKC,IAAG,IAAM,MAAO,KAAA,EAAK5B,CAAAA,CAC5B6B,YAAW;GACbC,YAAYnC,YAAY,EAAA,CAAA,CAAIoC,SAAS,KAAA;EACzC,CAAA;EAEA,MAAM,KAAK5B,WAAW6B,KAAKR,MAAAA;EAE3B,IAAI;GAKA,MAAMS,WAAW,KAAK/B,QAAQgC,YAC1B,GAAG,KAAKhC,QAAQgC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,wBACpCC,mBAAmBZ,OAAOM,UAAU,EAAA,YACjCM,mBAAmBd,OAAOL,QAAQ,MAC/CoB,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKhC,qBAAqBiC,OAAO;IAChDC,UAAUzC,iBAAiB0C;IAC3BC,QAAQ;KACJC,MAAMnB,OAAOM;KACbc,KAAKX;KACLY,kBAAAA;IACJ;IACAC,QAAQpC,SAASoC;GACrB,CAAA;GAEA,MAAM,KAAKzC,WAAW0C,KAAK;IACvBC,IAAI1B,OAAOF;IACX,GAAGkB;GACP,CAAA;EACJ,QAAQ;GACJ,KAAKnC,WAAWsB,MAAMD,QAAQ;IAC1BM,YAAY;IACZJ,eAAe;GACnB,CAAA;GACA,MAAM,KAAKvB,WAAW6B,KAAKR,MAAAA;GAE3B,MAAM,IAAInC,gBAAgB,uDAAA;EAC9B;EAEA,OAAO,EAAEqC,eAAeF,OAAOE,cAAe;CAClD;CAEA,MAAMuB,cAAcxC,MAAyD;EACzE,IAAI,CAAC,KAAKP,QAAQS,yBACd,MAAM,IAAIpB,8BAAAA;EAGd,MAAMsB,YAAY,MAAM,KAAKqC,0BAA0BzC,IAAAA;EAEvD,MAAM,KAAKN,WAAWgD,oBAAoBtC,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKX,gBAAgBY,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,YAAYjB,UAAUuC;GACtBnC,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKnB,WAAWkD,UAAUnC,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAACgC,OAAOI,iBAAiB,IAAIC,KAAKL,OAAOI,aAAa,oBAAI,IAAIC,KAAAA,GAC9D,MAAM,IAAIlC,uBAAAA;EAId,MAAM8D,iBAAiB,MAAMD,IADExD,uBACFwD,CAAAA,CAAmBE,QAAQ3C,UAAU4C,QAAQ;EAE1E,MAAMjC,SAAS,KAAKrB,WAAWsB,MAAMH,QAAQ;GACzCoC,2BAAU,IAAI/B,KAAAA,EAAAA,CAAOE,YAAW;GAChCC,YAAY;GACZJ,eAAe;GACf+B,UAAUF;EACd,CAAA;EAEA,MAAM,KAAKpD,WAAW6B,KAAKR,MAAAA;EAE3B,OAAO,EAAEkC,UAAUlC,OAAOkC,SAAU;CACxC;CAEA,MAAc5C,2BAA2BL,MAA2B;EAChE,MAAMkD,YAAY,IAAI/D,UAAe,CAAC,CAAA;EAEtC,MAAMgE,iBAAiB,IAAIhE,UAAU,EAAEiE,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MACX,SACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACX7C,MAAK,CAAA,CACL8C,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAItEP,eAAeE,MACX,QACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3E,gBAAgBG,EAAEyE,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrC,OAAOZ,UAAUa,IAAI/D,IAAAA;CACzB;CAEA,MAAcyC,0BAA0BzC,MAA2B;EAC/D,MAAMkD,YAAY,IAAI/D,UAAe,CAAC,CAAA;EAEtC,MAAMgE,iBAAiB,IAAIhE,UAAU,EAAEiE,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACX7C,MAAK,CAAA,CACL8C,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAGtEP,eAAeE,MACX,QACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3E,gBAAgBG,EAAEyE,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrCZ,UAAUG,MACN,SACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1Cd,UAAUG,MACN,YACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1C,OAAOd,UAAUa,IAAI/D,IAAAA;CACzB;AACJ"}
+{"version":3,"file":"service.mjs","names":["EventName","EventRefType","EventScope","IdentityType","USER_PASSWORD_MAX_LENGTH","USER_PASSWORD_MIN_LENGTH","EntityNotFoundError","ValidationError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidator","randomBytes","Container","z","UserCredentialsService","MailTemplateName","PASSWORD_RESET_EXPIRES_IN_MINUTES","PasswordRecoveryService","options","repository","realmRepository","mailClient","mailTemplateRenderer","eventService","ctx","forgotPassword","data","context","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realm_id","where","name","email","id","entity","findOneByWithEmail","merged","merge","reset_expires","Date","now","toISOString","reset_hash","toString","save","resetUrl","publicUrl","replace","encodeURIComponent","undefined","mail","render","template","PASSWORD_RESET","params","code","url","expiresInMinutes","locale","send","to","record","scope","IDENTITY","PASSWORD_RESET_REQUESTED","refType","USER","refId","actorType","actorId","actorName","realmId","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","reset_at","PASSWORD_RESET_COMPLETED","validator","oneOfContainer","oneOf","mount","string","trim","toLowerCase","regex","message","min","optional","uuid","nullable","run","max","passwordMinLength"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    USER_PASSWORD_MAX_LENGTH,\n    USER_PASSWORD_MIN_LENGTH,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidator } from '@validup/zod';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IPasswordRecoveryService,\n    PasswordForgotResult,\n    PasswordRecoveryServiceContext,\n    PasswordRecoveryServiceOptions,\n    PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\nimport { PASSWORD_RESET_EXPIRES_IN_MINUTES } from './constants.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n    protected options: PasswordRecoveryServiceOptions;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected eventService?: IEventService;\n\n    constructor(ctx: PasswordRecoveryServiceContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.eventService = ctx.eventService;\n    }\n\n    async forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        if (!this.options.emailVerificationEnabled) {\n            throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n        }\n\n        const validated = await this.runForgotPasswordValidator(data);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneByWithEmail(where);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            reset_expires: new Date(\n                Date.now() + (1000 * 60 * PASSWORD_RESET_EXPIRES_IN_MINUTES),\n            ).toISOString(),\n            reset_hash: randomBytes(32).toString('hex'),\n        });\n\n        await this.repository.save(merged);\n\n        try {\n            // realm_id MUST ride the link: resetPassword resolves the realm\n            // from the request and filters the lookup by it, so a realm-less\n            // link resolves to the master realm and never matches a\n            // non-master user.\n            const resetUrl = this.options.publicUrl ?\n                `${this.options.publicUrl.replace(/\\/+$/, '')}/password-reset` +\n                `?token=${encodeURIComponent(merged.reset_hash!)}` +\n                `&realm_id=${encodeURIComponent(entity.realm_id)}` :\n                undefined;\n\n            const mail = await this.mailTemplateRenderer.render({\n                template: MailTemplateName.PASSWORD_RESET,\n                params: {\n                    code: merged.reset_hash!,\n                    url: resetUrl,\n                    expiresInMinutes: PASSWORD_RESET_EXPIRES_IN_MINUTES,\n                },\n                locale: context?.locale,\n            });\n\n            await this.mailClient.send({\n                to: entity.email,\n                ...mail,\n            });\n        } catch {\n            this.repository.merge(merged, {\n                reset_hash: null,\n                reset_expires: null,\n            });\n            await this.repository.save(merged);\n\n            throw new ValidationError('Password recovery failed. Could not send reset email.');\n        }\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.PASSWORD_RESET_REQUESTED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realm_id,\n        });\n\n        return { reset_expires: merged.reset_expires! };\n    }\n\n    async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        const validated = await this.runResetPasswordValidator(data);\n\n        await this.repository.validateJoinColumns(validated);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            reset_hash: validated.token,\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneBy(where);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!entity.reset_expires || new Date(entity.reset_expires) < new Date()) {\n            throw new ResetTokenExpiredError();\n        }\n\n        const credentialsService = new UserCredentialsService();\n        const hashedPassword = await credentialsService.protect(validated.password);\n\n        const merged = this.repository.merge(entity, {\n            reset_at: new Date().toISOString(),\n            reset_hash: null,\n            reset_expires: null,\n            password: hashedPassword,\n        });\n\n        await this.repository.save(merged);\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.PASSWORD_RESET_COMPLETED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realm_id,\n        });\n\n        return { reset_at: merged.reset_at! };\n    }\n\n    private async runForgotPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        return validator.run(data);\n    }\n\n    private async runResetPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        validator.mount(\n            'token',\n            createValidator(z.string().min(3).max(256)),\n        );\n\n        validator.mount(\n            'password',\n            createValidator(\n                z.string()\n                    .min(this.options.passwordMinLength ?? USER_PASSWORD_MIN_LENGTH)\n                    .max(USER_PASSWORD_MAX_LENGTH),\n            ),\n        );\n\n        return validator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAqCA,IAAakB,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,UAAUM,IAAIN;EACnB,KAAKC,aAAaK,IAAIL;EACtB,KAAKC,kBAAkBI,IAAIJ;EAC3B,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,uBAAuBE,IAAIF;EAChC,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,eAAeC,MAA2BC,SAAkE;EAC9G,IAAI,CAAC,KAAKT,QAAQU,yBACd,MAAM,IAAIrB,8BAAAA;EAGd,IAAI,CAAC,KAAKW,QAAQW,0BACd,MAAM,IAAIrB,+BAA+B,sEAAA;EAG7C,MAAMsB,YAAY,MAAM,KAAKC,2BAA2BL,IAAAA;EAExD,MAAMM,QAAQ,MAAM,KAAKZ,gBAAgBa,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKpB,WAAWqB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAIlC,oBAAAA;EAGd,MAAMoC,SAAS,KAAKtB,WAAWuB,MAAMH,QAAQ;GACzCI,eAAe,IAAIC,KACfA,KAAKC,IAAG,IAAM,MAAO,KAAA,EAAK7B,CAAAA,CAC5B8B,YAAW;GACbC,YAAYpC,YAAY,EAAA,CAAA,CAAIqC,SAAS,KAAA;EACzC,CAAA;EAEA,MAAM,KAAK7B,WAAW8B,KAAKR,MAAAA;EAE3B,IAAI;GAKA,MAAMS,WAAW,KAAKhC,QAAQiC,YAC1B,GAAG,KAAKjC,QAAQiC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,wBACpCC,mBAAmBZ,OAAOM,UAAU,EAAA,YACjCM,mBAAmBd,OAAOL,QAAQ,MAC/CoB,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKjC,qBAAqBkC,OAAO;IAChDC,UAAU1C,iBAAiB2C;IAC3BC,QAAQ;KACJC,MAAMnB,OAAOM;KACbc,KAAKX;KACLY,kBAAAA;IACJ;IACAC,QAAQpC,SAASoC;GACrB,CAAA;GAEA,MAAM,KAAK1C,WAAW2C,KAAK;IACvBC,IAAI1B,OAAOF;IACX,GAAGkB;GACP,CAAA;EACJ,QAAQ;GACJ,KAAKpC,WAAWuB,MAAMD,QAAQ;IAC1BM,YAAY;IACZJ,eAAe;GACnB,CAAA;GACA,MAAM,KAAKxB,WAAW8B,KAAKR,MAAAA;GAE3B,MAAM,IAAInC,gBAAgB,uDAAA;EAC9B;EAEA,MAAM,KAAKiB,cAAc2C,OAAO;GAC5BC,OAAOlE,WAAWmE;GAClBhC,MAAMrC,UAAUsE;GAChBC,SAAStE,aAAauE;GACtBC,OAAO/B,OAAOH;GACdmC,WAAWvE,aAAaqE;GACxBG,SAASjC,OAAOH;GAChBqC,WAAWlC,OAAOL;GAClBwC,SAASnC,OAAOP;EACpB,CAAA;EAEA,OAAO,EAAES,eAAeF,OAAOE,cAAe;CAClD;CAEA,MAAMkC,cAAcnD,MAAyD;EACzE,IAAI,CAAC,KAAKR,QAAQU,yBACd,MAAM,IAAIrB,8BAAAA;EAGd,MAAMuB,YAAY,MAAM,KAAKgD,0BAA0BpD,IAAAA;EAEvD,MAAM,KAAKP,WAAW4D,oBAAoBjD,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKZ,gBAAgBa,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,YAAYjB,UAAUkD;GACtB9C,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKpB,WAAW8D,UAAU9C,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAIlC,oBAAAA;EAGd,IAAI,CAACkC,OAAOI,iBAAiB,IAAIC,KAAKL,OAAOI,aAAa,oBAAI,IAAIC,KAAAA,GAC9D,MAAM,IAAInC,uBAAAA;EAId,MAAM0E,iBAAiB,MAAMD,IADEpE,uBACFoE,CAAAA,CAAmBE,QAAQtD,UAAUuD,QAAQ;EAE1E,MAAM5C,SAAS,KAAKtB,WAAWuB,MAAMH,QAAQ;GACzC+C,2BAAU,IAAI1C,KAAAA,EAAAA,CAAOE,YAAW;GAChCC,YAAY;GACZJ,eAAe;GACf0C,UAAUF;EACd,CAAA;EAEA,MAAM,KAAKhE,WAAW8B,KAAKR,MAAAA;EAE3B,MAAM,KAAKlB,cAAc2C,OAAO;GAC5BC,OAAOlE,WAAWmE;GAClBhC,MAAMrC,UAAUwF;GAChBjB,SAAStE,aAAauE;GACtBC,OAAO/B,OAAOH;GACdmC,WAAWvE,aAAaqE;GACxBG,SAASjC,OAAOH;GAChBqC,WAAWlC,OAAOL;GAClBwC,SAASnC,OAAOP;EACpB,CAAA;EAEA,OAAO,EAAEoD,UAAU7C,OAAO6C,SAAU;CACxC;CAEA,MAAcvD,2BAA2BL,MAA2B;EAChE,MAAM8D,YAAY,IAAI5E,UAAe,CAAC,CAAA;EAEtC,MAAM6E,iBAAiB,IAAI7E,UAAU,EAAE8E,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MACX,SACAjF,gBACIG,EAAE+E,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXzD,MAAK,CAAA,CACL0D,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAItEP,eAAeE,MACX,QACAjF,gBAAgBG,EAAE+E,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjBxF,gBAAgBG,EAAEsF,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrC,OAAOZ,UAAUa,IAAI3E,IAAAA;CACzB;CAEA,MAAcoD,0BAA0BpD,MAA2B;EAC/D,MAAM8D,YAAY,IAAI5E,UAAe,CAAC,CAAA;EAEtC,MAAM6E,iBAAiB,IAAI7E,UAAU,EAAE8E,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACAjF,gBACIG,EAAE+E,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXzD,MAAK,CAAA,CACL0D,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAGtEP,eAAeE,MACX,QACAjF,gBAAgBG,EAAE+E,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjBxF,gBAAgBG,EAAEsF,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrCZ,UAAUG,MACN,SACAjF,gBAAgBG,EAAE+E,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1Cd,UAAUG,MACN,YACAjF,gBACIG,EAAE+E,OAAM,CAAA,CACHK,IAAI,KAAK/E,QAAQqF,qBAAqBnG,wBAAAA,CAAAA,CACtCkG,IAAInG,wBAAAA,CAAAA,CAAAA;EAIjB,OAAOqF,UAAUa,IAAI3E,IAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/token-expired.d.ts

@@ -1,6 +1,6 @@
-import { BadRequestError } from '@authup/errors';
+import { ValidationError } from '@authup/errors';
 export declare const RESET_TOKEN_EXPIRED_ERROR_INSTANCE: unique symbol;
-export declare class ResetTokenExpiredError extends BadRequestError {
+export declare class ResetTokenExpiredError extends ValidationError {
     constructor();
 }
 //# sourceMappingURL=token-expired.d.ts.map

package/dist/core/identity/password-recovery/token-expired.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-expired.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/token-expired.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAA6B,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,kCAAkC,eAA2D,CAAC;AAE3G,qBAAa,sBAAuB,SAAQ,eAAe;;CAQ1D"}
+{"version":3,"file":"token-expired.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/token-expired.ts"],"names":[],"mappings":"AAOA,OAAO,EAAa,eAAe,EAAkB,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,kCAAkC,eAA2D,CAAC;AAE3G,qBAAa,sBAAuB,SAAQ,eAAe;;CAQ1D"}

package/dist/core/identity/password-recovery/token-expired.mjs

@@ -1,10 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { BadRequestError, ErrorCode, markInstanceof } from "@authup/errors";
+import { ErrorCode, ValidationError, markInstanceof } from "@authup/errors";
 //#region src/core/identity/password-recovery/token-expired.ts
 const RESET_TOKEN_EXPIRED_ERROR_INSTANCE = Symbol.for("@authup/server-core/ResetTokenExpiredError");
-var ResetTokenExpiredError = class extends BadRequestError {
+var ResetTokenExpiredError = class extends ValidationError {
 	constructor() {
 		super({
 			code: ErrorCode.RESET_TOKEN_EXPIRED,

package/dist/core/identity/password-recovery/token-expired.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"token-expired.mjs","names":["BadRequestError","ErrorCode","markInstanceof","RESET_TOKEN_EXPIRED_ERROR_INSTANCE","Symbol","for","ResetTokenExpiredError","code","RESET_TOKEN_EXPIRED","message"],"sources":["../../../../src/core/identity/password-recovery/token-expired.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, ErrorCode, markInstanceof } from '@authup/errors';\n\nexport const RESET_TOKEN_EXPIRED_ERROR_INSTANCE = Symbol.for('@authup/server-core/ResetTokenExpiredError');\n\nexport class ResetTokenExpiredError extends BadRequestError {\n    constructor() {\n        super({\n            code: ErrorCode.RESET_TOKEN_EXPIRED,\n            message: 'Reset token has expired.',\n        });\n        markInstanceof(this, RESET_TOKEN_EXPIRED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaG,qCAAqCC,OAAOC,IAAI,4CAAA;AAE7D,IAAaC,yBAAb,cAA4CN,gBAAAA;CACxC,cAAc;EACV,MAAM;GACFO,MAAMN,UAAUO;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,kCAAAA;CACzB;AACJ"}
+{"version":3,"file":"token-expired.mjs","names":["ErrorCode","ValidationError","markInstanceof","RESET_TOKEN_EXPIRED_ERROR_INSTANCE","Symbol","for","ResetTokenExpiredError","code","RESET_TOKEN_EXPIRED","message"],"sources":["../../../../src/core/identity/password-recovery/token-expired.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode, ValidationError, markInstanceof } from '@authup/errors';\n\nexport const RESET_TOKEN_EXPIRED_ERROR_INSTANCE = Symbol.for('@authup/server-core/ResetTokenExpiredError');\n\nexport class ResetTokenExpiredError extends ValidationError {\n    constructor() {\n        super({\n            code: ErrorCode.RESET_TOKEN_EXPIRED,\n            message: 'Reset token has expired.',\n        });\n        markInstanceof(this, RESET_TOKEN_EXPIRED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaG,qCAAqCC,OAAOC,IAAI,4CAAA;AAE7D,IAAaC,yBAAb,cAA4CL,gBAAAA;CACxC,cAAc;EACV,MAAM;GACFM,MAAMP,UAAUQ;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,kCAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/types.d.ts

@@ -1,10 +1,11 @@
 import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
-import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';
 import type { IdentityWorkflowContext } from '../types.ts';
 export type PasswordRecoveryServiceOptions = {
     passwordRecoveryEnabled?: boolean;
     emailVerificationEnabled?: boolean;
     publicUrl?: string;
+    passwordMinLength?: number;
 };
 export type PasswordRecoveryServiceContext = {
     options: PasswordRecoveryServiceOptions;
@@ -12,6 +13,7 @@ export type PasswordRecoveryServiceContext = {
     mailTemplateRenderer: IMailTemplateRenderer;
     repository: IUserRepository;
     realmRepository: IRealmRepository;
+    eventService?: IEventService;
 };
 export type PasswordForgotResult = {
     reset_expires: string;

package/dist/core/identity/password-recovery/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,8BAA8B,GAAG;IACzC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,8BAA8B,GAAG;IACzC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;IAClC,YAAY,CAAC,EAAE,aAAa,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1E"}

package/dist/core/identity/permission/checker/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/permission/checker/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EACR,yBAAyB,EACzB,+BAA+B,EAClC,MAAM,YAAY,CAAC;AAEpB,qBAAa,wBAAyB,YAAW,yBAAyB;IACtE,SAAS,CAAC,GAAG,EAAE,+BAA+B,CAAC;gBAEnC,GAAG,EAAE,+BAA+B;IAI1C,KAAK,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAiDV,SAAS,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ3B"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/permission/checker/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EACR,yBAAyB,EACzB,+BAA+B,EAClC,MAAM,YAAY,CAAC;AAEpB,qBAAa,wBAAyB,YAAW,yBAAyB;IACtE,SAAS,CAAC,GAAG,EAAE,+BAA+B,CAAC;gBAEnC,GAAG,EAAE,+BAA+B;IAI1C,KAAK,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAqDV,SAAS,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ3B"}

package/dist/core/identity/permission/checker/service.mjs

@@ -16,11 +16,12 @@ var PermissionCheckerService = class {
 		let criteria;
 		if (isUUID(idOrName)) criteria = { id: idOrName };
 		else {
-			const realmEntity = await this.ctx.realmRepository.resolve(realm);
-			criteria = {
-				name: idOrName,
-				...realmEntity ? { realm_id: realmEntity.id } : {}
-			};
+			criteria = { name: idOrName };
+			if (realm) {
+				const realmId = await this.ctx.realmRepository.resolveId(realm);
+				if (!realmId) throw new EntityNotFoundError();
+				criteria.realm_id = realmId;
+			}
 		}
 		const entity = await this.ctx.repository.findOneBy(criteria);
 		if (!entity) throw new EntityNotFoundError();

package/dist/core/identity/permission/checker/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionEvaluator","definePolicyData","hasOwnProperty","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PermissionCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","realmEntity","realmRepository","resolve","name","realm_id","entity","repository","findOneBy","input","IDENTITY","identity","attributes","ATTRIBUTES","REALM_MATCH","evaluationContext","evaluator","provider","permissionProvider","policyEngine","identityPermissionProvider","has","evaluate","preEvaluate","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/permission/checker/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PermissionEvaluationContext } from '@authup/access';\nimport { BuiltInPolicyType, PermissionEvaluator, definePolicyData } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { hasOwnProperty, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../identity-policy-data.ts';\nimport type {\n    IPermissionCheckerService,\n    PermissionCheckerServiceContext,\n} from './types.ts';\n\nexport class PermissionCheckerService implements IPermissionCheckerService {\n    protected ctx: PermissionCheckerServiceContext;\n\n    constructor(ctx: PermissionCheckerServiceContext) {\n        this.ctx = ctx;\n    }\n\n    async check(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<void> {\n        let criteria: Record<string, any>;\n        if (isUUID(idOrName)) {\n            criteria = { id: idOrName };\n        } else {\n            const realmEntity = await this.ctx.realmRepository.resolve(realm);\n            criteria = {\n                name: idOrName,\n                ...(realmEntity ? { realm_id: realmEntity.id } : {}),\n            };\n        }\n\n        const entity = await this.ctx.repository.findOneBy(criteria);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const input = { ...data };\n        if (typeof input[BuiltInPolicyType.IDENTITY] === 'undefined') {\n            input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n        }\n        // Surface the resource realm to the realm_scope reach factor (realm-match scope mode).\n        // Only when the body carries an ATTRIBUTES realm — so a realm-less check still rides\n        // the preEvaluate path below and neutral-passes.\n        const attributes = input[BuiltInPolicyType.ATTRIBUTES] as Record<string, any> | undefined;\n        if (attributes && hasOwnProperty(attributes, 'realm_id')) {\n            input[BuiltInPolicyType.REALM_MATCH] = attributes.realm_id ?? null;\n        }\n\n        const evaluationContext: PermissionEvaluationContext = {\n            name: entity.name,\n            data: definePolicyData(input),\n        };\n\n        const evaluator = new PermissionEvaluator({\n            provider: this.ctx.permissionProvider,\n            policyEngine: new PolicyEngine(this.ctx.identityPermissionProvider),\n        });\n\n        if (\n            evaluationContext.data &&\n            evaluationContext.data.has(BuiltInPolicyType.ATTRIBUTES)\n        ) {\n            await evaluator.evaluate(evaluationContext);\n        } else {\n            await evaluator.preEvaluate(evaluationContext);\n        }\n    }\n\n    async safeCheck(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Result<null>> {\n        try {\n            await this.check(idOrName, data, actor, realm);\n            return { success: true, data: null };\n        } catch (e) {\n            return { success: false, error: normalizeError(e) };\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaS,2BAAb,MAAaA;CACCC;CAEV,YAAYA,KAAsC;EAC9C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACH,MAAMM,cAAc,MAAM,KAAKR,IAAIS,gBAAgBC,QAAQL,KAAAA;GAC3DC,WAAW;IACPK,MAAMT;IACN,GAAIM,cAAc,EAAEI,UAAUJ,YAAYD,GAAG,IAAI,CAAC;GACtD;EACJ;EAEA,MAAMM,SAAS,MAAM,KAAKb,IAAIc,WAAWC,UAAUT,QAAAA;EACnD,IAAI,CAACO,QACD,MAAM,IAAIlB,oBAAAA;EAGd,MAAMqB,QAAQ,EAAE,GAAGb,KAAK;EACxB,IAAI,OAAOa,MAAM1B,kBAAkB2B,cAAc,aAC7CD,MAAM1B,kBAAkB2B,YAAYnB,qBAAqBM,MAAMc,QAAQ;EAK3E,MAAMC,aAAaH,MAAM1B,kBAAkB8B;EAC3C,IAAID,cAAc1B,eAAe0B,YAAY,UAAA,GACzCH,MAAM1B,kBAAkB+B,eAAeF,WAAWP,YAAY;EAGlE,MAAMU,oBAAiD;GACnDX,MAAME,OAAOF;GACbR,MAAMX,iBAAiBwB,KAAAA;EAC3B;EAEA,MAAMO,YAAY,IAAIhC,oBAAoB;GACtCiC,UAAU,KAAKxB,IAAIyB;GACnBC,cAAc,IAAI7B,eAAa,KAAKG,IAAI2B,0BAA0B;EACtE,CAAA;EAEA,IACIL,kBAAkBnB,QAClBmB,kBAAkBnB,KAAKyB,IAAItC,kBAAkB8B,UAAU,GAEvD,MAAMG,UAAUM,SAASP,iBAAAA;OAEzB,MAAMC,UAAUO,YAAYR,iBAAAA;CAEpC;CAEA,MAAMS,UACF7B,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAE2B,SAAS;IAAM7B,MAAM;GAAK;EACvC,SAAS8B,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAOtC,eAAeqC,CAAAA;GAAG;EACtD;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionEvaluator","definePolicyData","hasOwnProperty","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PermissionCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","name","realmId","realmRepository","resolveId","realm_id","entity","repository","findOneBy","input","IDENTITY","identity","attributes","ATTRIBUTES","REALM_MATCH","evaluationContext","evaluator","provider","permissionProvider","policyEngine","identityPermissionProvider","has","evaluate","preEvaluate","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/permission/checker/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PermissionEvaluationContext } from '@authup/access';\nimport { BuiltInPolicyType, PermissionEvaluator, definePolicyData } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { hasOwnProperty, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../identity-policy-data.ts';\nimport type {\n    IPermissionCheckerService,\n    PermissionCheckerServiceContext,\n} from './types.ts';\n\nexport class PermissionCheckerService implements IPermissionCheckerService {\n    protected ctx: PermissionCheckerServiceContext;\n\n    constructor(ctx: PermissionCheckerServiceContext) {\n        this.ctx = ctx;\n    }\n\n    async check(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<void> {\n        let criteria: Record<string, any>;\n        if (isUUID(idOrName)) {\n            criteria = { id: idOrName };\n        } else {\n            criteria = { name: idOrName };\n\n            if (realm) {\n                const realmId = await this.ctx.realmRepository.resolveId(realm);\n                if (!realmId) {\n                    throw new EntityNotFoundError();\n                }\n                criteria.realm_id = realmId;\n            }\n        }\n\n        const entity = await this.ctx.repository.findOneBy(criteria);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const input = { ...data };\n        if (typeof input[BuiltInPolicyType.IDENTITY] === 'undefined') {\n            input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n        }\n        // Surface the resource realm to the realm_scope reach factor (realm-match scope mode).\n        // Only when the body carries an ATTRIBUTES realm — so a realm-less check still rides\n        // the preEvaluate path below and neutral-passes.\n        const attributes = input[BuiltInPolicyType.ATTRIBUTES] as Record<string, any> | undefined;\n        if (attributes && hasOwnProperty(attributes, 'realm_id')) {\n            input[BuiltInPolicyType.REALM_MATCH] = attributes.realm_id ?? null;\n        }\n\n        const evaluationContext: PermissionEvaluationContext = {\n            name: entity.name,\n            data: definePolicyData(input),\n        };\n\n        const evaluator = new PermissionEvaluator({\n            provider: this.ctx.permissionProvider,\n            policyEngine: new PolicyEngine(this.ctx.identityPermissionProvider),\n        });\n\n        if (\n            evaluationContext.data &&\n            evaluationContext.data.has(BuiltInPolicyType.ATTRIBUTES)\n        ) {\n            await evaluator.evaluate(evaluationContext);\n        } else {\n            await evaluator.preEvaluate(evaluationContext);\n        }\n    }\n\n    async safeCheck(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Result<null>> {\n        try {\n            await this.check(idOrName, data, actor, realm);\n            return { success: true, data: null };\n        } catch (e) {\n            return { success: false, error: normalizeError(e) };\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaS,2BAAb,MAAaA;CACCC;CAEV,YAAYA,KAAsC;EAC9C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACHI,WAAW,EAAEE,MAAMN,SAAS;GAE5B,IAAIG,OAAO;IACP,MAAMI,UAAU,MAAM,KAAKT,IAAIU,gBAAgBC,UAAUN,KAAAA;IACzD,IAAI,CAACI,SACD,MAAM,IAAId,oBAAAA;IAEdW,SAASM,WAAWH;GACxB;EACJ;EAEA,MAAMI,SAAS,MAAM,KAAKb,IAAIc,WAAWC,UAAUT,QAAAA;EACnD,IAAI,CAACO,QACD,MAAM,IAAIlB,oBAAAA;EAGd,MAAMqB,QAAQ,EAAE,GAAGb,KAAK;EACxB,IAAI,OAAOa,MAAM1B,kBAAkB2B,cAAc,aAC7CD,MAAM1B,kBAAkB2B,YAAYnB,qBAAqBM,MAAMc,QAAQ;EAK3E,MAAMC,aAAaH,MAAM1B,kBAAkB8B;EAC3C,IAAID,cAAc1B,eAAe0B,YAAY,UAAA,GACzCH,MAAM1B,kBAAkB+B,eAAeF,WAAWP,YAAY;EAGlE,MAAMU,oBAAiD;GACnDd,MAAMK,OAAOL;GACbL,MAAMX,iBAAiBwB,KAAAA;EAC3B;EAEA,MAAMO,YAAY,IAAIhC,oBAAoB;GACtCiC,UAAU,KAAKxB,IAAIyB;GACnBC,cAAc,IAAI7B,eAAa,KAAKG,IAAI2B,0BAA0B;EACtE,CAAA;EAEA,IACIL,kBAAkBnB,QAClBmB,kBAAkBnB,KAAKyB,IAAItC,kBAAkB8B,UAAU,GAEvD,MAAMG,UAAUM,SAASP,iBAAAA;OAEzB,MAAMC,UAAUO,YAAYR,iBAAAA;CAEpC;CAEA,MAAMS,UACF7B,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAE2B,SAAS;IAAM7B,MAAM;GAAK;EACvC,SAAS8B,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAOtC,eAAeqC,CAAAA;GAAG;EACtD;CACJ;AACJ"}

package/dist/core/identity/permission/index.d.ts

@@ -1,4 +1,5 @@
 export * from './checker/index.ts';
+export * from './identity-policy-data.ts';
 export * from './junction-grant.ts';
 export * from './module.ts';
 export * from './types.ts';

package/dist/core/identity/permission/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/permission/index.mjs

@@ -2,7 +2,8 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { applyJunctionCreateGrant, buildJunctionUpdateData } from "./junction-grant.mjs";
+import { toIdentityPolicyData } from "./identity-policy-data.mjs";
 import { PermissionCheckerService } from "./checker/service.mjs";
 import "./checker/index.mjs";
 import { IdentityPermissionProvider } from "./module.mjs";
-export { IdentityPermissionProvider, PermissionCheckerService, applyJunctionCreateGrant, buildJunctionUpdateData };
+export { IdentityPermissionProvider, PermissionCheckerService, applyJunctionCreateGrant, buildJunctionUpdateData, toIdentityPolicyData };

package/dist/core/identity/policy/checker/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/policy/checker/service.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EACR,qBAAqB,EACrB,2BAA2B,EAC9B,MAAM,YAAY,CAAC;AAEpB,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,GAAG,EAAE,2BAA2B,CAAC;gBAE/B,GAAG,EAAE,2BAA2B;IAItC,KAAK,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAgCV,SAAS,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ3B"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../src/core/identity/policy/checker/service.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EACR,qBAAqB,EACrB,2BAA2B,EAC9B,MAAM,YAAY,CAAC;AAEpB,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,GAAG,EAAE,2BAA2B,CAAC;gBAE/B,GAAG,EAAE,2BAA2B;IAItC,KAAK,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAoCV,SAAS,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ3B"}

package/dist/core/identity/policy/checker/service.mjs

@@ -16,17 +16,18 @@ var PolicyCheckerService = class {
 		let criteria;
 		if (isUUID(idOrName)) criteria = { id: idOrName };
 		else {
-			const realmEntity = await this.ctx.realmRepository.resolve(realm);
-			criteria = {
-				name: idOrName,
-				...realmEntity ? { realm_id: realmEntity.id } : {}
-			};
+			criteria = { name: idOrName };
+			if (realm) {
+				const realmId = await this.ctx.realmRepository.resolveId(realm);
+				if (!realmId) throw new EntityNotFoundError();
+				criteria.realm_id = realmId;
+			}
 		}
 		const entity = await this.ctx.repository.findOneBy(criteria);
 		if (!entity) throw new EntityNotFoundError();
 		const input = { ...data };
 		if (!input[BuiltInPolicyType.IDENTITY] && input[BuiltInPolicyType.IDENTITY] !== null) input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);
-		await new PolicyEngine$1(this.ctx.identityPermissionProvider).evaluate(entity, definePolicyEvaluationContext({ data: new PolicyData(input) }));
+		await new PolicyEngine$1(this.ctx.identityPermissionProvider).evaluateOrFail(entity, definePolicyEvaluationContext({ data: new PolicyData(input) }));
 	}
 	async safeCheck(idOrName, data, actor, realm) {
 		try {

package/dist/core/identity/policy/checker/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","definePolicyEvaluationContext","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PolicyCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","realmEntity","realmRepository","resolve","name","realm_id","entity","repository","findOneBy","input","IDENTITY","identity","engine","identityPermissionProvider","evaluate","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/policy/checker/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData, definePolicyEvaluationContext } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../../permission/identity-policy-data.ts';\nimport type {\n    IPolicyCheckerService,\n    PolicyCheckerServiceContext,\n} from './types.ts';\n\nexport class PolicyCheckerService implements IPolicyCheckerService {\n    protected ctx: PolicyCheckerServiceContext;\n\n    constructor(ctx: PolicyCheckerServiceContext) {\n        this.ctx = ctx;\n    }\n\n    async check(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<void> {\n        let criteria: Record<string, any>;\n        if (isUUID(idOrName)) {\n            criteria = { id: idOrName };\n        } else {\n            const realmEntity = await this.ctx.realmRepository.resolve(realm);\n            criteria = {\n                name: idOrName,\n                ...(realmEntity ? { realm_id: realmEntity.id } : {}),\n            };\n        }\n\n        const entity = await this.ctx.repository.findOneBy(criteria);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const input = { ...data };\n        if (\n            !input[BuiltInPolicyType.IDENTITY] &&\n            input[BuiltInPolicyType.IDENTITY] !== null\n        ) {\n            input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n        }\n\n        const engine = new PolicyEngine(this.ctx.identityPermissionProvider);\n        await engine.evaluate(\n            entity,\n            definePolicyEvaluationContext({ data: new PolicyData(input) }),\n        );\n    }\n\n    async safeCheck(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Result<null>> {\n        try {\n            await this.check(idOrName, data, actor, realm);\n            return { success: true, data: null };\n        } catch (e) {\n            return { success: false, error: normalizeError(e) };\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaQ,uBAAb,MAAaA;CACCC;CAEV,YAAYA,KAAkC;EAC1C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACH,MAAMM,cAAc,MAAM,KAAKR,IAAIS,gBAAgBC,QAAQL,KAAAA;GAC3DC,WAAW;IACPK,MAAMT;IACN,GAAIM,cAAc,EAAEI,UAAUJ,YAAYD,GAAG,IAAI,CAAC;GACtD;EACJ;EAEA,MAAMM,SAAS,MAAM,KAAKb,IAAIc,WAAWC,UAAUT,QAAAA;EACnD,IAAI,CAACO,QACD,MAAM,IAAIlB,oBAAAA;EAGd,MAAMqB,QAAQ,EAAE,GAAGb,KAAK;EACxB,IACI,CAACa,MAAMzB,kBAAkB0B,aACzBD,MAAMzB,kBAAkB0B,cAAc,MAEtCD,MAAMzB,kBAAkB0B,YAAYnB,qBAAqBM,MAAMc,QAAQ;EAI3E,MAAMC,IADatB,eAAa,KAAKG,IAAIoB,0BACnCD,CAAAA,CAAOE,SACTR,QACApB,8BAA8B,EAAEU,MAAM,IAAIX,WAAWwB,KAAAA,EAAO,CAAA,CAAA;CAEpE;CAEA,MAAMM,UACFpB,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAEkB,SAAS;IAAMpB,MAAM;GAAK;EACvC,SAASqB,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAO7B,eAAe4B,CAAAA;GAAG;EACtD;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","definePolicyEvaluationContext","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PolicyCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","name","realmId","realmRepository","resolveId","realm_id","entity","repository","findOneBy","input","IDENTITY","identity","engine","identityPermissionProvider","evaluateOrFail","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/policy/checker/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData, definePolicyEvaluationContext } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../../permission/identity-policy-data.ts';\nimport type {\n    IPolicyCheckerService,\n    PolicyCheckerServiceContext,\n} from './types.ts';\n\nexport class PolicyCheckerService implements IPolicyCheckerService {\n    protected ctx: PolicyCheckerServiceContext;\n\n    constructor(ctx: PolicyCheckerServiceContext) {\n        this.ctx = ctx;\n    }\n\n    async check(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<void> {\n        let criteria: Record<string, any>;\n        if (isUUID(idOrName)) {\n            criteria = { id: idOrName };\n        } else {\n            criteria = { name: idOrName };\n\n            if (realm) {\n                const realmId = await this.ctx.realmRepository.resolveId(realm);\n                if (!realmId) {\n                    throw new EntityNotFoundError();\n                }\n                criteria.realm_id = realmId;\n            }\n        }\n\n        const entity = await this.ctx.repository.findOneBy(criteria);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const input = { ...data };\n        if (\n            !input[BuiltInPolicyType.IDENTITY] &&\n            input[BuiltInPolicyType.IDENTITY] !== null\n        ) {\n            input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n        }\n\n        const engine = new PolicyEngine(this.ctx.identityPermissionProvider);\n        await engine.evaluateOrFail(\n            entity,\n            definePolicyEvaluationContext({ data: new PolicyData(input) }),\n        );\n    }\n\n    async safeCheck(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Result<null>> {\n        try {\n            await this.check(idOrName, data, actor, realm);\n            return { success: true, data: null };\n        } catch (e) {\n            return { success: false, error: normalizeError(e) };\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaQ,uBAAb,MAAaA;CACCC;CAEV,YAAYA,KAAkC;EAC1C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACHI,WAAW,EAAEE,MAAMN,SAAS;GAE5B,IAAIG,OAAO;IACP,MAAMI,UAAU,MAAM,KAAKT,IAAIU,gBAAgBC,UAAUN,KAAAA;IACzD,IAAI,CAACI,SACD,MAAM,IAAId,oBAAAA;IAEdW,SAASM,WAAWH;GACxB;EACJ;EAEA,MAAMI,SAAS,MAAM,KAAKb,IAAIc,WAAWC,UAAUT,QAAAA;EACnD,IAAI,CAACO,QACD,MAAM,IAAIlB,oBAAAA;EAGd,MAAMqB,QAAQ,EAAE,GAAGb,KAAK;EACxB,IACI,CAACa,MAAMzB,kBAAkB0B,aACzBD,MAAMzB,kBAAkB0B,cAAc,MAEtCD,MAAMzB,kBAAkB0B,YAAYnB,qBAAqBM,MAAMc,QAAQ;EAI3E,MAAMC,IADatB,eAAa,KAAKG,IAAIoB,0BACnCD,CAAAA,CAAOE,eACTR,QACApB,8BAA8B,EAAEU,MAAM,IAAIX,WAAWwB,KAAAA,EAAO,CAAA,CAAA;CAEpE;CAEA,MAAMM,UACFpB,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAEkB,SAAS;IAAMpB,MAAM;GAAK;EACvC,SAASqB,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAO7B,eAAe4B,CAAAA;GAAG;EACtD;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/presets/facebook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"facebook.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/authentication/presets/facebook.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE5E,qBAAa,qCAAsC,SAAQ,mCAAmC;gBAC9E,GAAG,EAAE,0CAA0C;cAS3C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CA6BpH"}
+{"version":3,"file":"facebook.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/authentication/presets/facebook.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE5E,qBAAa,qCAAsC,SAAQ,mCAAmC;gBAC9E,GAAG,EAAE,0CAA0C;cAS3C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CA6BpH"}

package/dist/core/identity/provider/authentication/presets/facebook.mjs

@@ -4,10 +4,11 @@ import.meta.url;
 import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
 import "../protocols/index.mjs";
 import { extractTokenPayload } from "@authup/server-kit";
+import { mergeOAuth2Scopes } from "@authup/specs";
 //#region src/core/identity/provider/authentication/presets/facebook.ts
 var IdentityProviderFacebookAuthenticator = class extends IdentityProviderOAuth2Authenticator {
 	constructor(ctx) {
-		ctx.provider.scope = "email";
+		ctx.provider.scope = mergeOAuth2Scopes("email", ctx.provider.scope);
 		ctx.provider.authorize_url = "https://graph.facebook.com/oauth/authorize";
 		ctx.provider.token_url = "https://graph.facebook.com/oauth/access_token";
 		ctx.provider.user_info_url = "https://graph.facebook.com/me?fields=id,name,email,first_name,last_name";

package/dist/core/identity/provider/authentication/presets/facebook.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"facebook.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderFacebookAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","username","email","first_name","last_name","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/facebook.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderFacebookAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'email';\n        ctx.provider.authorize_url = 'https://graph.facebook.com/oauth/authorize';\n        ctx.provider.token_url = 'https://graph.facebook.com/oauth/access_token';\n        ctx.provider.user_info_url = 'https://graph.facebook.com/me?fields=id,name,email,first_name,last_name';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.id,\n            attributeCandidates: {\n                name: [\n                    userInfo.username,\n                    userInfo.id,\n                ],\n                email: [\n                    userInfo.email,\n                ],\n                first_name: [\n                    userInfo.first_name,\n                ],\n                last_name: [\n                    userInfo.last_name,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;AAaA,IAAaE,wCAAb,cAA2DD,oCAAAA;CACvD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQ;EACrBF,IAAIC,SAASE,gBAAgB;EAC7BH,IAAIC,SAASG,YAAY;EACzBJ,IAAIC,SAASI,gBAAgB;EAE7B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB;IACjBC,MAAM,CACFT,SAASU,UACTV,SAASO,EAAAA;IAEbI,OAAO,CACHX,SAASW,KAAAA;IAEbC,YAAY,CACRZ,SAASY,UAAAA;IAEbC,WAAW,CACPb,SAASa,SAAAA;GAEjB;GACAC,MAAMR;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}
+{"version":3,"file":"facebook.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderFacebookAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","username","email","first_name","last_name","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/facebook.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderFacebookAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = mergeOAuth2Scopes('email', ctx.provider.scope);\n        ctx.provider.authorize_url = 'https://graph.facebook.com/oauth/authorize';\n        ctx.provider.token_url = 'https://graph.facebook.com/oauth/access_token';\n        ctx.provider.user_info_url = 'https://graph.facebook.com/me?fields=id,name,email,first_name,last_name';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.id,\n            attributeCandidates: {\n                name: [\n                    userInfo.username,\n                    userInfo.id,\n                ],\n                email: [\n                    userInfo.email,\n                ],\n                first_name: [\n                    userInfo.first_name,\n                ],\n                last_name: [\n                    userInfo.last_name,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaG,wCAAb,cAA2DD,oCAAAA;CACvD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQL,kBAAkB,SAASG,IAAIC,SAASC,KAAK;EAClEF,IAAIC,SAASE,gBAAgB;EAC7BH,IAAIC,SAASG,YAAY;EACzBJ,IAAIC,SAASI,gBAAgB;EAE7B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUlB,oBAAoBW,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB;IACjBC,MAAM,CACFT,SAASU,UACTV,SAASO,EAAAA;IAEbI,OAAO,CACHX,SAASW,KAAAA;IAEbC,YAAY,CACRZ,SAASY,UAAAA;IAEbC,WAAW,CACPb,SAASa,SAAAA;GAEjB;GACAC,MAAMR;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/presets/github.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/authentication/presets/github.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE5E,qBAAa,mCAAoC,SAAQ,mCAAmC;gBAC5E,GAAG,EAAE,0CAA0C;cAS3C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAwBpH"}
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/authentication/presets/github.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE5E,qBAAa,mCAAoC,SAAQ,mCAAmC;gBAC5E,GAAG,EAAE,0CAA0C;cAS3C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAwBpH"}

package/dist/core/identity/provider/authentication/presets/github.mjs

@@ -4,10 +4,11 @@ import.meta.url;
 import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
 import "../protocols/index.mjs";
 import { extractTokenPayload } from "@authup/server-kit";
+import { mergeOAuth2Scopes } from "@authup/specs";
 //#region src/core/identity/provider/authentication/presets/github.ts
 var IdentityProviderGithubAuthenticator = class extends IdentityProviderOAuth2Authenticator {
 	constructor(ctx) {
-		ctx.provider.scope = "user:email";
+		ctx.provider.scope = mergeOAuth2Scopes("user:email", ctx.provider.scope);
 		ctx.provider.authorize_url = "https://github.com/login/oauth/authorize";
 		ctx.provider.token_url = "https://github.com/login/oauth/access_token";
 		ctx.provider.user_info_url = "https://api.github.com/user";

package/dist/core/identity/provider/authentication/presets/github.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"github.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderGithubAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","login","email","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/github.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderGithubAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'user:email';\n        ctx.provider.authorize_url = 'https://github.com/login/oauth/authorize';\n        ctx.provider.token_url = 'https://github.com/login/oauth/access_token';\n        ctx.provider.user_info_url = 'https://api.github.com/user';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.id,\n            attributeCandidates: {\n                name: [\n                    userInfo.login,\n                    userInfo.name,\n                    userInfo.id,\n                ],\n                email: [\n                    userInfo.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;AAaA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQ;EACrBF,IAAIC,SAASE,gBAAgB;EAC7BH,IAAIC,SAASG,YAAY;EACzBJ,IAAIC,SAASI,gBAAgB;EAE7B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB;IACjBC,MAAM;KACFT,SAASU;KACTV,SAASS;KACTT,SAASO;;IAEbI,OAAO,CACHX,SAASW,KAAAA;GAEjB;GACAC,MAAMN;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}
+{"version":3,"file":"github.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderGithubAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","login","email","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/github.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderGithubAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = mergeOAuth2Scopes('user:email', ctx.provider.scope);\n        ctx.provider.authorize_url = 'https://github.com/login/oauth/authorize';\n        ctx.provider.token_url = 'https://github.com/login/oauth/access_token';\n        ctx.provider.user_info_url = 'https://api.github.com/user';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.id,\n            attributeCandidates: {\n                name: [\n                    userInfo.login,\n                    userInfo.name,\n                    userInfo.id,\n                ],\n                email: [\n                    userInfo.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaG,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQL,kBAAkB,cAAcG,IAAIC,SAASC,KAAK;EACvEF,IAAIC,SAASE,gBAAgB;EAC7BH,IAAIC,SAASG,YAAY;EACzBJ,IAAIC,SAASI,gBAAgB;EAE7B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUlB,oBAAoBW,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB;IACjBC,MAAM;KACFT,SAASU;KACTV,SAASS;KACTT,SAASO;;IAEbI,OAAO,CACHX,SAASW,KAAAA;GAEjB;GACAC,MAAMN;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/presets/google.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/authentication/presets/google.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE5E,qBAAa,mCAAoC,SAAQ,mCAAmC;gBAC5E,GAAG,EAAE,0CAA0C;cAS3C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAkCpH"}
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/authentication/presets/google.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE5E,qBAAa,mCAAoC,SAAQ,mCAAmC;gBAC5E,GAAG,EAAE,0CAA0C;cAS3C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAkCpH"}

package/dist/core/identity/provider/authentication/presets/google.mjs

@@ -4,10 +4,11 @@ import.meta.url;
 import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
 import "../protocols/index.mjs";
 import { extractTokenPayload } from "@authup/server-kit";
+import { mergeOAuth2Scopes } from "@authup/specs";
 //#region src/core/identity/provider/authentication/presets/google.ts
 var IdentityProviderGoogleAuthenticator = class extends IdentityProviderOAuth2Authenticator {
 	constructor(ctx) {
-		ctx.provider.scope = "openid profile email";
+		ctx.provider.scope = mergeOAuth2Scopes("openid profile email", ctx.provider.scope);
 		ctx.provider.authorize_url = "https://accounts.google.com/o/oauth2/v2/auth";
 		ctx.provider.token_url = "https://oauth2.googleapis.com/token";
 		ctx.provider.user_info_url = "https://openidconnect.googleapis.com/v1/userinfo";

package/dist/core/identity/provider/authentication/presets/google.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"google.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderGoogleAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","payload","access_token","attributeCandidates","id_token","idTokenPayload","name","email","first_name","given_name","last_name","family_name","id","sub","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/google.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderGoogleAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'openid profile email';\n        ctx.provider.authorize_url = 'https://accounts.google.com/o/oauth2/v2/auth';\n        ctx.provider.token_url = 'https://oauth2.googleapis.com/token';\n        ctx.provider.user_info_url = 'https://openidconnect.googleapis.com/v1/userinfo';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        const attributeCandidates : Record<keyof User, unknown[]> = {};\n\n        /**\n         * @see https://developers.google.com/identity/openid-connect/openid-connect?hl=de#server-flow\n         */\n        if (input.id_token) {\n            const idTokenPayload = extractTokenPayload(input.id_token) as OpenIDTokenPayload;\n\n            attributeCandidates.name = [\n                idTokenPayload.name,\n            ];\n\n            attributeCandidates.email = [\n                idTokenPayload.email,\n            ];\n\n            attributeCandidates.first_name = [\n                idTokenPayload.given_name,\n            ];\n            attributeCandidates.last_name = [\n                idTokenPayload.family_name,\n            ];\n        }\n\n        return {\n            id: payload.sub!,\n            attributeCandidates,\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;AAeA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQ;EACrBF,IAAIC,SAASE,gBAAgB;EAC7BH,IAAIC,SAASG,YAAY;EACzBJ,IAAIC,SAASI,gBAAgB;EAE7B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,UAAUX,oBAAoBU,MAAME,YAAY;EAEtD,MAAMC,sBAAsD,CAAC;;;KAK7D,IAAIH,MAAMI,UAAU;GAChB,MAAMC,iBAAiBf,oBAAoBU,MAAMI,QAAQ;GAEzDD,oBAAoBG,OAAO,CACvBD,eAAeC,IAAAA;GAGnBH,oBAAoBI,QAAQ,CACxBF,eAAeE,KAAAA;GAGnBJ,oBAAoBK,aAAa,CAC7BH,eAAeI,UAAAA;GAEnBN,oBAAoBO,YAAY,CAC5BL,eAAeM,WAAAA;EAEvB;EAEA,OAAO;GACHC,IAAIX,QAAQY;GACZV;GACAW,MAAMb;GACNP,UAAU,KAAKA;EACnB;CACJ;AACJ"}
+{"version":3,"file":"google.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderGoogleAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","payload","access_token","attributeCandidates","id_token","idTokenPayload","name","email","first_name","given_name","last_name","family_name","id","sub","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/google.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderGoogleAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = mergeOAuth2Scopes('openid profile email', ctx.provider.scope);\n        ctx.provider.authorize_url = 'https://accounts.google.com/o/oauth2/v2/auth';\n        ctx.provider.token_url = 'https://oauth2.googleapis.com/token';\n        ctx.provider.user_info_url = 'https://openidconnect.googleapis.com/v1/userinfo';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        const attributeCandidates : Record<keyof User, unknown[]> = {};\n\n        /**\n         * @see https://developers.google.com/identity/openid-connect/openid-connect?hl=de#server-flow\n         */\n        if (input.id_token) {\n            const idTokenPayload = extractTokenPayload(input.id_token) as OpenIDTokenPayload;\n\n            attributeCandidates.name = [\n                idTokenPayload.name,\n            ];\n\n            attributeCandidates.email = [\n                idTokenPayload.email,\n            ];\n\n            attributeCandidates.first_name = [\n                idTokenPayload.given_name,\n            ];\n            attributeCandidates.last_name = [\n                idTokenPayload.family_name,\n            ];\n        }\n\n        return {\n            id: payload.sub!,\n            attributeCandidates,\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAgBA,IAAaG,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQL,kBAAkB,wBAAwBG,IAAIC,SAASC,KAAK;EACjFF,IAAIC,SAASE,gBAAgB;EAC7BH,IAAIC,SAASG,YAAY;EACzBJ,IAAIC,SAASI,gBAAgB;EAE7B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,UAAUZ,oBAAoBW,MAAME,YAAY;EAEtD,MAAMC,sBAAsD,CAAC;;;KAK7D,IAAIH,MAAMI,UAAU;GAChB,MAAMC,iBAAiBhB,oBAAoBW,MAAMI,QAAQ;GAEzDD,oBAAoBG,OAAO,CACvBD,eAAeC,IAAAA;GAGnBH,oBAAoBI,QAAQ,CACxBF,eAAeE,KAAAA;GAGnBJ,oBAAoBK,aAAa,CAC7BH,eAAeI,UAAAA;GAEnBN,oBAAoBO,YAAY,CAC5BL,eAAeM,WAAAA;EAEvB;EAEA,OAAO;GACHC,IAAIX,QAAQY;GACZV;GACAW,MAAMb;GACNP,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/presets/instagram.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instagram.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/authentication/presets/instagram.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE5E,qBAAa,sCAAuC,SAAQ,mCAAmC;gBAC/E,GAAG,EAAE,0CAA0C;cAS3C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAoBpH"}
+{"version":3,"file":"instagram.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/authentication/presets/instagram.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE5E,qBAAa,sCAAuC,SAAQ,mCAAmC;gBAC/E,GAAG,EAAE,0CAA0C;cAS3C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAoBpH"}