@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/core/identity/provider/authentication/presets/instagram.mjs

@@ -4,10 +4,11 @@ import.meta.url;
 import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
 import "../protocols/index.mjs";
 import { extractTokenPayload } from "@authup/server-kit";
+import { mergeOAuth2Scopes } from "@authup/specs";
 //#region src/core/identity/provider/authentication/presets/instagram.ts
 var IdentityProviderInstagramAuthenticator = class extends IdentityProviderOAuth2Authenticator {
 	constructor(ctx) {
-		ctx.provider.scope = "user_profile";
+		ctx.provider.scope = mergeOAuth2Scopes("user_profile", ctx.provider.scope);
 		ctx.provider.authorize_url = "https://api.instagram.com/oauth/authorize";
 		ctx.provider.token_url = "https://api.instagram.com/oauth/access_token";
 		ctx.provider.user_info_url = "https://graph.instagram.com/me?fields=id,username";

package/dist/core/identity/provider/authentication/presets/instagram.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"instagram.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderInstagramAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","username","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/instagram.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderInstagramAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'user_profile';\n        ctx.provider.authorize_url = 'https://api.instagram.com/oauth/authorize';\n        ctx.provider.token_url = 'https://api.instagram.com/oauth/access_token';\n        ctx.provider.user_info_url = 'https://graph.instagram.com/me?fields=id,username';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.id,\n            attributeCandidates: {\n                name: [\n                    userInfo.username,\n                    userInfo.id,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;AAaA,IAAaE,yCAAb,cAA4DD,oCAAAA;CACxD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQ;EACrBF,IAAIC,SAASE,gBAAgB;EAC7BH,IAAIC,SAASG,YAAY;EACzBJ,IAAIC,SAASI,gBAAgB;EAE7B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB,EACjBC,MAAM,CACFT,SAASU,UACTV,SAASO,EAAAA,EAEjB;GACAI,MAAML;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}
+{"version":3,"file":"instagram.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderInstagramAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","username","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/instagram.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderInstagramAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = mergeOAuth2Scopes('user_profile', ctx.provider.scope);\n        ctx.provider.authorize_url = 'https://api.instagram.com/oauth/authorize';\n        ctx.provider.token_url = 'https://api.instagram.com/oauth/access_token';\n        ctx.provider.user_info_url = 'https://graph.instagram.com/me?fields=id,username';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.id,\n            attributeCandidates: {\n                name: [\n                    userInfo.username,\n                    userInfo.id,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaG,yCAAb,cAA4DD,oCAAAA;CACxD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQL,kBAAkB,gBAAgBG,IAAIC,SAASC,KAAK;EACzEF,IAAIC,SAASE,gBAAgB;EAC7BH,IAAIC,SAASG,YAAY;EACzBJ,IAAIC,SAASI,gBAAgB;EAE7B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUlB,oBAAoBW,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB,EACjBC,MAAM,CACFT,SAASU,UACTV,SAASO,EAAAA,EAEjB;GACAI,MAAML;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/presets/paypal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paypal.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/authentication/presets/paypal.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE5E,qBAAa,mCAAoC,SAAQ,mCAAmC;gBAC5E,GAAG,EAAE,0CAA0C;cAS3C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAuBpH"}
+{"version":3,"file":"paypal.d.ts","sourceRoot":"","sources":["../../../../../../src/core/identity/provider/authentication/presets/paypal.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE5E,qBAAa,mCAAoC,SAAQ,mCAAmC;gBAC5E,GAAG,EAAE,0CAA0C;cAS3C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAuBpH"}

package/dist/core/identity/provider/authentication/presets/paypal.mjs

@@ -4,10 +4,11 @@ import.meta.url;
 import { IdentityProviderOAuth2Authenticator } from "../protocols/oauth2/module.mjs";
 import "../protocols/index.mjs";
 import { extractTokenPayload } from "@authup/server-kit";
+import { mergeOAuth2Scopes } from "@authup/specs";
 //#region src/core/identity/provider/authentication/presets/paypal.ts
 var IdentityProviderPaypalAuthenticator = class extends IdentityProviderOAuth2Authenticator {
 	constructor(ctx) {
-		ctx.provider.scope = "openid profile email";
+		ctx.provider.scope = mergeOAuth2Scopes("openid profile email", ctx.provider.scope);
 		ctx.provider.authorize_url = "https://www.paypal.com/signin/authorize";
 		ctx.provider.token_url = "https://api.paypal.com/v1/identity/openidconnect/tokenservice";
 		ctx.provider.user_info_url = "https://api.paypal.com/v1/oauth2/token/userinfo?schema=openid";

package/dist/core/identity/provider/authentication/presets/paypal.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"paypal.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderPaypalAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","user_id","attributeCandidates","name","email","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/paypal.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderPaypalAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = 'openid profile email';\n        ctx.provider.authorize_url = 'https://www.paypal.com/signin/authorize';\n        ctx.provider.token_url = 'https://api.paypal.com/v1/identity/openidconnect/tokenservice';\n        ctx.provider.user_info_url = 'https://api.paypal.com/v1/oauth2/token/userinfo?schema=openid';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.user_id,\n            attributeCandidates: {\n                name: [\n                    userInfo.name,\n                    userInfo.user_id,\n                ],\n                email: [\n                    userInfo.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;AAaA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQ;EACrBF,IAAIC,SAASE,gBAAgB;EAC7BH,IAAIC,SAASG,YAAY;EACzBJ,IAAIC,SAASI,gBAAgB;EAE7B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUjB,oBAAoBU,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASQ;GACbC,qBAAqB;IACjBC,MAAM,CACFV,SAASU,MACTV,SAASQ,OAAAA;IAEbG,OAAO,CACHX,SAASW,KAAAA;GAEjB;GACAC,MAAMN;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}
+{"version":3,"file":"paypal.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderPaypalAuthenticator","ctx","provider","scope","authorize_url","token_url","user_info_url","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","user_id","attributeCandidates","name","email","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/paypal.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderPaypalAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        ctx.provider.scope = mergeOAuth2Scopes('openid profile email', ctx.provider.scope);\n        ctx.provider.authorize_url = 'https://www.paypal.com/signin/authorize';\n        ctx.provider.token_url = 'https://api.paypal.com/v1/identity/openidconnect/tokenservice';\n        ctx.provider.user_info_url = 'https://api.paypal.com/v1/oauth2/token/userinfo?schema=openid';\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const userInfo = await this.client.userInfo.get({\n            type: 'Bearer',\n            token: input.access_token,\n        });\n\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: userInfo.user_id,\n            attributeCandidates: {\n                name: [\n                    userInfo.name,\n                    userInfo.user_id,\n                ],\n                email: [\n                    userInfo.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaG,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQL,kBAAkB,wBAAwBG,IAAIC,SAASC,KAAK;EACjFF,IAAIC,SAASE,gBAAgB;EAC7BH,IAAIC,SAASG,YAAY;EACzBJ,IAAIC,SAASI,gBAAgB;EAE7B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUlB,oBAAoBW,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASQ;GACbC,qBAAqB;IACjBC,MAAM,CACFV,SAASU,MACTV,SAASQ,OAAAA;IAEbG,OAAO,CACHX,SAASW,KAAAA;GAEjB;GACAC,MAAMN;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/protocols/oauth2/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EACR,oBAAoB,EACpB,0CAA0C,EAC1C,0CAA0C,EAC1C,mCAAmC,EACtC,MAAM,YAAY,CAAC;AAEpB,qBAAa,mCAAoC,YAAW,oBAAoB,CAAC,IAAI,CAAC;IAClF,SAAS,CAAC,MAAM,EAAG,YAAY,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAG,0CAA0C,CAAC;IAE/D,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,QAAQ,EAAG,sBAAsB,GAAG,sBAAsB,CAAC;gBAIzD,GAAG,EAAE,0CAA0C;IAoB3D,gBAAgB,CAAC,UAAU,GAAE,OAAO,CAAC,mBAAmB,CAAM,GAAI,MAAM;IAMlE,YAAY,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxE,gBAAgB,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;cAiB1E,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,wBAAwB,CAAC;CAiBrH"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EACR,oBAAoB,EACpB,0CAA0C,EAC1C,0CAA0C,EAC1C,mCAAmC,EACtC,MAAM,YAAY,CAAC;AAEpB,qBAAa,mCAAoC,YAAW,oBAAoB,CAAC,IAAI,CAAC;IAClF,SAAS,CAAC,MAAM,EAAG,YAAY,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAG,0CAA0C,CAAC;IAE/D,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,QAAQ,EAAG,sBAAsB,GAAG,sBAAsB,CAAC;gBAIzD,GAAG,EAAE,0CAA0C;IAoB3D,gBAAgB,CAAC,UAAU,GAAE,OAAO,CAAC,mBAAmB,CAAM,GAAI,MAAM;IAYlE,YAAY,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxE,gBAAgB,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;cAiB1E,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,wBAAwB,CAAC;CAiBrH"}

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs

@@ -3,6 +3,7 @@ import "node:url";
 import.meta.url;
 import { buildIdentityProviderAuthorizeCallbackPath } from "@authup/core-kit";
 import { extractTokenPayload } from "@authup/server-kit";
+import { ValidationError } from "@authup/errors";
 import { OAuth2Client } from "@hapic/oauth2";
 //#region src/core/identity/provider/authentication/protocols/oauth2/module.ts
 var IdentityProviderOAuth2Authenticator = class {
@@ -18,14 +19,18 @@ var IdentityProviderOAuth2Authenticator = class {
 			clientId: ctx.provider.client_id,
 			clientSecret: ctx.provider.client_secret,
 			redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,
-			scope: ctx.provider.scope,
+			scope: ctx.provider.scope || void 0,
 			authorizationEndpoint: ctx.provider.authorize_url,
 			tokenEndpoint: ctx.provider.token_url,
 			userinfoEndpoint: ctx.provider.user_info_url || void 0
 		} });
 	}
 	buildRedirectURL(parameters = {}) {
-		return this.client.authorize.buildURL(parameters);
+		try {
+			return this.client.authorize.buildURL(parameters);
+		} catch {
+			throw new ValidationError("The identity provider is misconfigured and has an invalid or missing authorize URL.");
+		}
 	}
 	async authenticate(params) {
 		const token = await this.client.token.createWithAuthorizationCode(params);

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["buildIdentityProviderAuthorizeCallbackPath","extractTokenPayload","OAuth2Client","IdentityProviderOAuth2Authenticator","client","options","accountManager","provider","ctx","clientId","client_id","clientSecret","client_secret","redirectUri","baseURL","id","scope","authorizationEndpoint","authorize_url","tokenEndpoint","token_url","userinfoEndpoint","user_info_url","undefined","buildRedirectURL","parameters","authorize","buildURL","authenticate","params","token","createWithAuthorizationCode","identity","buildIdentityWithTokenGrantResponse","account","save","user","safeAuthenticate","data","success","e","error","input","payload","access_token","sub","attributeCandidates","name","email"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';\nimport { buildIdentityProviderAuthorizeCallbackPath } from '@authup/core-kit';\nimport type { Result } from '@authup/kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';\nimport { OAuth2Client } from '@hapic/oauth2';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type {\n    IOAuth2Authenticator,\n    IdentityProviderOAuth2AuthenticatorContext,\n    IdentityProviderOAuth2AuthenticatorOptions,\n    OAuth2AuthorizationCodeGrantPayload,\n} from './types.ts';\n\nexport class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {\n    protected client : OAuth2Client;\n\n    protected options : IdentityProviderOAuth2AuthenticatorOptions;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected provider : OAuth2IdentityProvider | OpenIDIdentityProvider;\n\n    //----------------------------------------------------------------------\n\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n\n        this.client = new OAuth2Client({\n            options: {\n                clientId: ctx.provider.client_id,\n                clientSecret: ctx.provider.client_secret,\n                redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,\n                scope: ctx.provider.scope,\n                authorizationEndpoint: ctx.provider.authorize_url,\n                tokenEndpoint: ctx.provider.token_url,\n                userinfoEndpoint: ctx.provider.user_info_url || undefined,\n            },\n        });\n    }\n\n    //----------------------------------------------------------------------\n\n    buildRedirectURL(parameters: Partial<AuthorizeParameters> = {}) : string {\n        return this.client.authorize.buildURL(parameters);\n    }\n\n    //----------------------------------------------------------------------\n\n    async authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User> {\n        const token = await this.client.token.createWithAuthorizationCode(params);\n\n        const identity = await this.buildIdentityWithTokenGrantResponse(token);\n        if (this.options.clientId) {\n            identity.clientId = this.options.clientId;\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    async safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>> {\n        try {\n            const data = await this.authenticate(params);\n            return {\n                success: true,\n                data, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse) : Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;AAsBA,IAAaG,sCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiD;EACzD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,WAAWC,IAAID;EAEpB,KAAKH,SAAS,IAAIF,aAAa,EAC3BG,SAAS;GACLI,UAAUD,IAAID,SAASG;GACvBC,cAAcH,IAAID,SAASK;GAC3BC,aAAa,GAAGL,IAAIH,QAAQS,UAAUd,2CAA2CQ,IAAID,SAASQ,EAAE;GAChGC,OAAOR,IAAID,SAASS;GACpBC,uBAAuBT,IAAID,SAASW;GACpCC,eAAeX,IAAID,SAASa;GAC5BC,kBAAkBb,IAAID,SAASe,iBAAiBC,KAAAA;EACpD,EACJ,CAAA;CACJ;CAIAC,iBAAiBC,aAA2C,CAAC,GAAY;EACrE,OAAO,KAAKrB,OAAOsB,UAAUC,SAASF,UAAAA;CAC1C;CAIA,MAAMG,aAAaC,QAA4D;EAC3E,MAAMC,QAAQ,MAAM,KAAK1B,OAAO0B,MAAMC,4BAA4BF,MAAAA;EAElE,MAAMG,WAAW,MAAM,KAAKC,oCAAoCH,KAAAA;EAChE,IAAI,KAAKzB,QAAQI,UACbuB,SAASvB,WAAW,KAAKJ,QAAQI;EAKrC,QAAOyB,MAFe,KAAK5B,eAAe6B,KAAKH,QAAAA,EAAAA,CAEhCI;CACnB;CAEA,MAAMC,iBAAiBR,QAAoE;EACvF,IAAI;GAEA,OAAO;IACHU,SAAS;IACTD,MAAAA,MAHe,KAAKV,aAAaC,MAAAA;GAIrC;EACJ,SAASW,GAAG;GACR,OAAO;IACHD,SAAS;IACTE,OAAOD;GACX;EACJ;CACJ;CAIA,MAAgBP,oCAAoCS,OAA+D;EAC/G,MAAMC,UAAU1C,oBAAoByC,MAAME,YAAY;EAEtD,OAAO;GACH7B,IAAI4B,QAAQE;GACZC,qBAAqB;IACjBC,MAAM,CACFJ,QAAQE,GAAAA;IAEZG,OAAO,CACHL,QAAQK,KAAAA;GAEhB;GACAV,MAAMK;GACNpC,UAAU,KAAKA;EACnB;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["buildIdentityProviderAuthorizeCallbackPath","ValidationError","extractTokenPayload","OAuth2Client","IdentityProviderOAuth2Authenticator","client","options","accountManager","provider","ctx","clientId","client_id","clientSecret","client_secret","redirectUri","baseURL","id","scope","undefined","authorizationEndpoint","authorize_url","tokenEndpoint","token_url","userinfoEndpoint","user_info_url","buildRedirectURL","parameters","authorize","buildURL","authenticate","params","token","createWithAuthorizationCode","identity","buildIdentityWithTokenGrantResponse","account","save","user","safeAuthenticate","data","success","e","error","input","payload","access_token","sub","attributeCandidates","name","email"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';\nimport { buildIdentityProviderAuthorizeCallbackPath } from '@authup/core-kit';\nimport { ValidationError } from '@authup/errors';\nimport type { Result } from '@authup/kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';\nimport { OAuth2Client } from '@hapic/oauth2';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type {\n    IOAuth2Authenticator,\n    IdentityProviderOAuth2AuthenticatorContext,\n    IdentityProviderOAuth2AuthenticatorOptions,\n    OAuth2AuthorizationCodeGrantPayload,\n} from './types.ts';\n\nexport class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {\n    protected client : OAuth2Client;\n\n    protected options : IdentityProviderOAuth2AuthenticatorOptions;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected provider : OAuth2IdentityProvider | OpenIDIdentityProvider;\n\n    //----------------------------------------------------------------------\n\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n\n        this.client = new OAuth2Client({\n            options: {\n                clientId: ctx.provider.client_id,\n                clientSecret: ctx.provider.client_secret,\n                redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,\n                scope: ctx.provider.scope || undefined,\n                authorizationEndpoint: ctx.provider.authorize_url,\n                tokenEndpoint: ctx.provider.token_url,\n                userinfoEndpoint: ctx.provider.user_info_url || undefined,\n            },\n        });\n    }\n\n    //----------------------------------------------------------------------\n\n    buildRedirectURL(parameters: Partial<AuthorizeParameters> = {}) : string {\n        try {\n            return this.client.authorize.buildURL(parameters);\n        } catch {\n            throw new ValidationError(\n                'The identity provider is misconfigured and has an invalid or missing authorize URL.',\n            );\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    async authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User> {\n        const token = await this.client.token.createWithAuthorizationCode(params);\n\n        const identity = await this.buildIdentityWithTokenGrantResponse(token);\n        if (this.options.clientId) {\n            identity.clientId = this.options.clientId;\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    async safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>> {\n        try {\n            const data = await this.authenticate(params);\n            return {\n                success: true,\n                data, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse) : Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAuBA,IAAaI,sCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiD;EACzD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,WAAWC,IAAID;EAEpB,KAAKH,SAAS,IAAIF,aAAa,EAC3BG,SAAS;GACLI,UAAUD,IAAID,SAASG;GACvBC,cAAcH,IAAID,SAASK;GAC3BC,aAAa,GAAGL,IAAIH,QAAQS,UAAUf,2CAA2CS,IAAID,SAASQ,EAAE;GAChGC,OAAOR,IAAID,SAASS,SAASC,KAAAA;GAC7BC,uBAAuBV,IAAID,SAASY;GACpCC,eAAeZ,IAAID,SAASc;GAC5BC,kBAAkBd,IAAID,SAASgB,iBAAiBN,KAAAA;EACpD,EACJ,CAAA;CACJ;CAIAO,iBAAiBC,aAA2C,CAAC,GAAY;EACrE,IAAI;GACA,OAAO,KAAKrB,OAAOsB,UAAUC,SAASF,UAAAA;EAC1C,QAAQ;GACJ,MAAM,IAAIzB,gBACN,qFAAA;EAER;CACJ;CAIA,MAAM4B,aAAaC,QAA4D;EAC3E,MAAMC,QAAQ,MAAM,KAAK1B,OAAO0B,MAAMC,4BAA4BF,MAAAA;EAElE,MAAMG,WAAW,MAAM,KAAKC,oCAAoCH,KAAAA;EAChE,IAAI,KAAKzB,QAAQI,UACbuB,SAASvB,WAAW,KAAKJ,QAAQI;EAKrC,QAAOyB,MAFe,KAAK5B,eAAe6B,KAAKH,QAAAA,EAAAA,CAEhCI;CACnB;CAEA,MAAMC,iBAAiBR,QAAoE;EACvF,IAAI;GAEA,OAAO;IACHU,SAAS;IACTD,MAAAA,MAHe,KAAKV,aAAaC,MAAAA;GAIrC;EACJ,SAASW,GAAG;GACR,OAAO;IACHD,SAAS;IACTE,OAAOD;GACX;EACJ;CACJ;CAIA,MAAgBP,oCAAoCS,OAA+D;EAC/G,MAAMC,UAAU1C,oBAAoByC,MAAME,YAAY;EAEtD,OAAO;GACH7B,IAAI4B,QAAQE;GACZC,qBAAqB;IACjBC,MAAM,CACFJ,QAAQE,GAAAA;IAEZG,OAAO,CACHL,QAAQK,KAAAA;GAEhB;GACAV,MAAMK;GACNpC,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/protocols/open-id/module.d.ts

@@ -1,7 +1,9 @@
 import type { TokenGrantResponse } from '@hapic/oauth2';
 import type { IdentityProviderIdentity } from '../../../types.ts';
+import type { IdentityProviderOAuth2AuthenticatorContext } from '../oauth2/index.ts';
 import { IdentityProviderOAuth2Authenticator } from '../oauth2/index.ts';
 export declare class IdentityProviderOpenIDAuthenticator extends IdentityProviderOAuth2Authenticator {
+    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext);
     protected buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/identity/provider/authentication/protocols/open-id/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/open-id/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,mCAAmC,EAAE,MAAM,oBAAoB,CAAC;AAEzE,qBAAa,mCAAoC,SAAQ,mCAAmC;cACxE,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAmBpH"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/core/identity/provider/authentication/protocols/open-id/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,mCAAmC,EAAE,MAAM,oBAAoB,CAAC;AAEzE,qBAAa,mCAAoC,SAAQ,mCAAmC;gBAC5E,GAAG,EAAE,0CAA0C;cAU3C,mCAAmC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAmBpH"}

package/dist/core/identity/provider/authentication/protocols/open-id/module.mjs

@@ -4,8 +4,13 @@ import.meta.url;
 import { IdentityProviderOAuth2Authenticator } from "../oauth2/module.mjs";
 import "../oauth2/index.mjs";
 import { extractTokenPayload } from "@authup/server-kit";
+import { mergeOAuth2Scopes } from "@authup/specs";
 //#region src/core/identity/provider/authentication/protocols/open-id/module.ts
 var IdentityProviderOpenIDAuthenticator = class extends IdentityProviderOAuth2Authenticator {
+	constructor(ctx) {
+		ctx.provider.scope = mergeOAuth2Scopes("openid", ctx.provider.scope || "openid profile email");
+		super(ctx);
+	}
 	async buildIdentityWithTokenGrantResponse(input) {
 		const payload = extractTokenPayload(input.access_token);
 		return {

package/dist/core/identity/provider/authentication/protocols/open-id/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["extractTokenPayload","IdentityProviderOAuth2Authenticator","IdentityProviderOpenIDAuthenticator","buildIdentityWithTokenGrantResponse","input","payload","access_token","id","sub","attributeCandidates","name","preferred_username","nickname","email","data","provider"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../oauth2/index.ts';\n\nexport class IdentityProviderOpenIDAuthenticator extends IdentityProviderOAuth2Authenticator {\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.preferred_username,\n                    payload.nickname,\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;AAYA,IAAaE,sCAAb,cAAyDD,oCAAAA;CACrD,MAAgBE,oCAAoCC,OAA8D;EAC9G,MAAMC,UAAUL,oBAAoBI,MAAME,YAAY;EAEtD,OAAO;GACHC,IAAIF,QAAQG;GACZC,qBAAqB;IACjBC,MAAM;KACFL,QAAQM;KACRN,QAAQO;KACRP,QAAQG;;IAEZK,OAAO,CACHR,QAAQQ,KAAAA;GAEhB;GACAC,MAAMT;GACNU,UAAU,KAAKA;EACnB;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderOpenIDAuthenticator","ctx","provider","scope","buildIdentityWithTokenGrantResponse","input","payload","access_token","id","sub","attributeCandidates","name","preferred_username","nickname","email","data"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../oauth2/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../oauth2/index.ts';\n\nexport class IdentityProviderOpenIDAuthenticator extends IdentityProviderOAuth2Authenticator {\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        // OIDC requires the openid scope (Core §3.1.2.1)\n        ctx.provider.scope = mergeOAuth2Scopes(\n            'openid',\n            ctx.provider.scope || 'openid profile email',\n        );\n\n        super(ctx);\n    }\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.preferred_username,\n                    payload.nickname,\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaG,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EAEzDA,IAAIC,SAASC,QAAQL,kBACjB,UACAG,IAAIC,SAASC,SAAS,sBAAA;EAG1B,MAAMF,GAAAA;CACV;CAEA,MAAgBG,oCAAoCC,OAA8D;EAC9G,MAAMC,UAAUT,oBAAoBQ,MAAME,YAAY;EAEtD,OAAO;GACHC,IAAIF,QAAQG;GACZC,qBAAqB;IACjBC,MAAM;KACFL,QAAQM;KACRN,QAAQO;KACRP,QAAQG;;IAEZK,OAAO,CACHR,QAAQQ,KAAAA;GAEhB;GACAC,MAAMT;GACNJ,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/registration/error.d.ts

@@ -1,6 +1,6 @@
-import { BadRequestError } from '@authup/errors';
+import { ValidationError } from '@authup/errors';
 export declare const REGISTRATION_DISABLED_ERROR_INSTANCE: unique symbol;
-export declare class RegistrationDisabledError extends BadRequestError {
+export declare class RegistrationDisabledError extends ValidationError {
     constructor();
 }
 //# sourceMappingURL=error.d.ts.map

package/dist/core/identity/registration/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/error.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAA6B,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,oCAAoC,eAA8D,CAAC;AAEhH,qBAAa,yBAA0B,SAAQ,eAAe;;CAQ7D"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/error.ts"],"names":[],"mappings":"AAOA,OAAO,EAAa,eAAe,EAAkB,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,oCAAoC,eAA8D,CAAC;AAEhH,qBAAa,yBAA0B,SAAQ,eAAe;;CAQ7D"}

package/dist/core/identity/registration/error.mjs

@@ -1,10 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { BadRequestError, ErrorCode, markInstanceof } from "@authup/errors";
+import { ErrorCode, ValidationError, markInstanceof } from "@authup/errors";
 //#region src/core/identity/registration/error.ts
 const REGISTRATION_DISABLED_ERROR_INSTANCE = Symbol.for("@authup/server-core/RegistrationDisabledError");
-var RegistrationDisabledError = class extends BadRequestError {
+var RegistrationDisabledError = class extends ValidationError {
 	constructor() {
 		super({
 			code: ErrorCode.REGISTRATION_DISABLED,

package/dist/core/identity/registration/error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error.mjs","names":["BadRequestError","ErrorCode","markInstanceof","REGISTRATION_DISABLED_ERROR_INSTANCE","Symbol","for","RegistrationDisabledError","code","REGISTRATION_DISABLED","message"],"sources":["../../../../src/core/identity/registration/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, ErrorCode, markInstanceof } from '@authup/errors';\n\nexport const REGISTRATION_DISABLED_ERROR_INSTANCE = Symbol.for('@authup/server-core/RegistrationDisabledError');\n\nexport class RegistrationDisabledError extends BadRequestError {\n    constructor() {\n        super({\n            code: ErrorCode.REGISTRATION_DISABLED,\n            message: 'User registration is not enabled.',\n        });\n        markInstanceof(this, REGISTRATION_DISABLED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaG,uCAAuCC,OAAOC,IAAI,+CAAA;AAE/D,IAAaC,4BAAb,cAA+CN,gBAAAA;CAC3C,cAAc;EACV,MAAM;GACFO,MAAMN,UAAUO;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,oCAAAA;CACzB;AACJ"}
+{"version":3,"file":"error.mjs","names":["ErrorCode","ValidationError","markInstanceof","REGISTRATION_DISABLED_ERROR_INSTANCE","Symbol","for","RegistrationDisabledError","code","REGISTRATION_DISABLED","message"],"sources":["../../../../src/core/identity/registration/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode, ValidationError, markInstanceof } from '@authup/errors';\n\nexport const REGISTRATION_DISABLED_ERROR_INSTANCE = Symbol.for('@authup/server-core/RegistrationDisabledError');\n\nexport class RegistrationDisabledError extends ValidationError {\n    constructor() {\n        super({\n            code: ErrorCode.REGISTRATION_DISABLED,\n            message: 'User registration is not enabled.',\n        });\n        markInstanceof(this, REGISTRATION_DISABLED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaG,uCAAuCC,OAAOC,IAAI,+CAAA;AAE/D,IAAaC,4BAAb,cAA+CL,gBAAAA;CAC3C,cAAc;EACV,MAAM;GACFM,MAAMP,UAAUQ;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,oCAAAA;CACzB;AACJ"}

package/dist/core/identity/registration/service.d.ts

@@ -1,6 +1,6 @@
 import type { IRegistrationService, RegistrationResult, RegistrationServiceContext, RegistrationServiceOptions } from './types.ts';
 import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
-import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';
 import type { IdentityWorkflowContext } from '../types.ts';
 export declare class RegistrationService implements IRegistrationService {
     protected options: RegistrationServiceOptions;
@@ -8,6 +8,7 @@ export declare class RegistrationService implements IRegistrationService {
     protected mailTemplateRenderer: IMailTemplateRenderer;
     protected repository: IUserRepository;
     protected realmRepository: IRealmRepository;
+    protected eventService?: IEventService;
     constructor(ctx: RegistrationServiceContext);
     register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult>;
     activate(data: {

package/dist/core/identity/registration/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/service.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAEtD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,0BAA0B;IAQrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAsDnG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAczD"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/service.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAEtD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;gBAE3B,GAAG,EAAE,0BAA0B;IASrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoEnG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAyBzD"}

package/dist/core/identity/registration/service.mjs

@@ -6,10 +6,10 @@ import { MailTemplateName } from "../../mail/template/types.mjs";
 import "../../mail/index.mjs";
 import { RegistrationDisabledError } from "./error.mjs";
 import { createNanoID } from "@authup/kit";
-import { UserValidator } from "@authup/core-kit";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
-import { Container } from "validup";
+import { EventName, EventRefType, EventScope, IdentityType, UserValidator } from "@authup/core-kit";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
 import { randomBytes } from "node:crypto";
+import { Container } from "validup";
 //#region src/core/identity/registration/service.ts
 var RegistrationService = class {
 	options;
@@ -17,22 +17,27 @@ var RegistrationService = class {
 	mailTemplateRenderer;
 	repository;
 	realmRepository;
+	eventService;
 	constructor(ctx) {
 		this.options = ctx.options;
 		this.mailClient = ctx.mailClient;
 		this.mailTemplateRenderer = ctx.mailTemplateRenderer;
 		this.repository = ctx.repository;
 		this.realmRepository = ctx.realmRepository;
+		this.eventService = ctx.eventService;
 	}
 	async register(data, context) {
 		if (!this.options.registrationEnabled) throw new RegistrationDisabledError();
 		const validator = new Container({});
-		validator.mount(new UserValidator({ pathsToInclude: [
-			"email",
-			"name",
-			"password",
-			"realm_id"
-		] }));
+		validator.mount(new UserValidator({
+			pathsToInclude: [
+				"email",
+				"name",
+				"password",
+				"realm_id"
+			],
+			passwordMinLength: this.options.passwordMinLength
+		}));
 		const validated = await validator.run(data, { group: "create" });
 		await this.repository.validateJoinColumns(validated);
 		if (this.options.emailVerificationEnabled) {
@@ -61,8 +66,18 @@ var RegistrationService = class {
 			});
 		} catch {
 			await this.repository.remove(entity);
-			throw new BadRequestError("Registration failed. Could not send activation email.");
+			throw new ValidationError("Registration failed. Could not send activation email.");
 		}
+		await this.eventService?.record({
+			scope: EventScope.IDENTITY,
+			name: EventName.REGISTER,
+			refType: EventRefType.USER,
+			refId: entity.id,
+			actorType: IdentityType.USER,
+			actorId: entity.id,
+			actorName: entity.name,
+			realmId: entity.realm_id
+		});
 		return { active: entity.active };
 	}
 	async activate(data) {
@@ -73,6 +88,16 @@ var RegistrationService = class {
 			activate_hash: null
 		});
 		await this.repository.save(merged);
+		await this.eventService?.record({
+			scope: EventScope.IDENTITY,
+			name: EventName.ACCOUNT_ACTIVATED,
+			refType: EventRefType.USER,
+			refId: merged.id,
+			actorType: IdentityType.USER,
+			actorId: merged.id,
+			actorName: merged.name,
+			realmId: merged.realm_id
+		});
 	}
 };
 //#endregion

package/dist/core/identity/registration/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["UserValidator","createNanoID","BadRequestError","EntityNotFoundError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","MailTemplateName","RegistrationService","options","mailClient","mailTemplateRenderer","repository","realmRepository","ctx","register","data","context","registrationEnabled","validator","mount","pathsToInclude","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","activateUrl","publicUrl","replace","undefined","mail","render","template","REGISTRATION_ACTIVATION","params","code","url","locale","send","to","email","remove","activate","findOneBy","token","merged","merge"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserValidator } from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({ pathsToInclude: ['email', 'name', 'password', 'realm_id'] }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                const activateUrl = this.options.publicUrl ?\n                    `${this.options.publicUrl.replace(/\\/+$/, '')}/activate?token=${entity.activate_hash}` :\n                    undefined;\n\n                const mail = await this.mailTemplateRenderer.render({\n                    template: MailTemplateName.REGISTRATION_ACTIVATION,\n                    params: { code: entity.activate_hash!, url: activateUrl },\n                    locale: context?.locale,\n                });\n\n                await this.mailClient.send({\n                    to: entity.email,\n                    ...mail,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new BadRequestError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAyBA,IAAaS,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKL,UAAUK,IAAIL;EACnB,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,SAASC,MAA2BC,SAAgE;EACtG,IAAI,CAAC,KAAKR,QAAQS,qBACd,MAAM,IAAIf,0BAAAA;EAGd,MAAMgB,YAAY,IAAId,UAAU,CAAC,CAAA;EACjCc,UAAUC,MAAM,IAAIrB,cAAc,EAAEsB,gBAAgB;GAAC;GAAS;GAAQ;GAAY;IAAY,CAAA,CAAA;EAC9F,MAAMC,YAAY,MAAMH,UAAUI,IAAIP,MAAM,EAAEQ,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKZ,WAAWa,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKb,QAAQiB,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,gBAAgBxB,YAAY,EAAA,CAAA,CAAIyB,SAAS,KAAA;EACvD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKlB,WAAWmB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAI1B,uBAAAA;EAC/BwB,OAAOG,WAAWH,OAAOG,YAAYjC,aAAa,EAAA;EAClD8B,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,YAAWF,MADE,KAAKtB,gBAAgBuB,QAAQN,OAAOO,UAAU,IAAA,EAAA,CAC1CC;EAExB,MAAM,KAAK1B,WAAW2B,KAAKT,MAAAA;EAE3B,IAAI,KAAKrB,QAAQiB,0BACb,IAAI;GACA,MAAMc,cAAc,KAAK/B,QAAQgC,YAC7B,GAAG,KAAKhC,QAAQgC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,kBAAkBZ,OAAOF,kBACvEe,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKjC,qBAAqBkC,OAAO;IAChDC,UAAUvC,iBAAiBwC;IAC3BC,QAAQ;KAAEC,MAAMnB,OAAOF;KAAgBsB,KAAKV;IAAY;IACxDW,QAAQlC,SAASkC;GACrB,CAAA;GAEA,MAAM,KAAKzC,WAAW0C,KAAK;IACvBC,IAAIvB,OAAOwB;IACX,GAAGV;GACP,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKhC,WAAW2C,OAAOzB,MAAAA;GAC7B,MAAM,IAAI7B,gBAAgB,uDAAA;EAC9B;EAGJ,OAAO,EAAE0B,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAM6B,SAASxC,MAAwC;EACnD,MAAMc,SAAS,MAAM,KAAKlB,WAAW6C,UAAU,EAAE7B,eAAeZ,KAAK0C,MAAM,CAAA;EAE3E,IAAI,CAAC5B,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMyD,SAAS,KAAK/C,WAAWgD,MAAM9B,QAAQ;GACzCH,QAAQ;GACRC,eAAe;EACnB,CAAA;EAEA,MAAM,KAAKhB,WAAW2B,KAAKoB,MAAAA;CAC/B;AACJ"}
+{"version":3,"file":"service.mjs","names":["EventName","EventRefType","EventScope","IdentityType","UserValidator","createNanoID","EntityNotFoundError","ValidationError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","MailTemplateName","RegistrationService","options","mailClient","mailTemplateRenderer","repository","realmRepository","eventService","ctx","register","data","context","registrationEnabled","validator","mount","pathsToInclude","passwordMinLength","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","activateUrl","publicUrl","replace","undefined","mail","render","template","REGISTRATION_ACTIVATION","params","code","url","locale","send","to","email","remove","record","scope","IDENTITY","name","REGISTER","refType","USER","refId","actorType","actorId","actorName","realmId","activate","findOneBy","token","merged","merge","ACCOUNT_ACTIVATED"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    UserValidator,\n} from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected eventService?: IEventService;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.eventService = ctx.eventService;\n    }\n\n    async register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({\n            pathsToInclude: ['email', 'name', 'password', 'realm_id'],\n            passwordMinLength: this.options.passwordMinLength,\n        }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                const activateUrl = this.options.publicUrl ?\n                    `${this.options.publicUrl.replace(/\\/+$/, '')}/activate?token=${entity.activate_hash}` :\n                    undefined;\n\n                const mail = await this.mailTemplateRenderer.render({\n                    template: MailTemplateName.REGISTRATION_ACTIVATION,\n                    params: { code: entity.activate_hash!, url: activateUrl },\n                    locale: context?.locale,\n                });\n\n                await this.mailClient.send({\n                    to: entity.email,\n                    ...mail,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new ValidationError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.REGISTER,\n            refType: EventRefType.USER,\n            refId: entity.id,\n            actorType: IdentityType.USER,\n            actorId: entity.id,\n            actorName: entity.name,\n            realmId: entity.realm_id,\n        });\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.ACCOUNT_ACTIVATED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realm_id,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AA+BA,IAAaa,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKN,UAAUM,IAAIN;EACnB,KAAKC,aAAaK,IAAIL;EACtB,KAAKC,uBAAuBI,IAAIJ;EAChC,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,SAASC,MAA2BC,SAAgE;EACtG,IAAI,CAAC,KAAKT,QAAQU,qBACd,MAAM,IAAIhB,0BAAAA;EAGd,MAAMiB,YAAY,IAAIf,UAAU,CAAC,CAAA;EACjCe,UAAUC,MAAM,IAAItB,cAAc;GAC9BuB,gBAAgB;IAAC;IAAS;IAAQ;IAAY;;GAC9CC,mBAAmB,KAAKd,QAAQc;EACpC,CAAA,CAAA;EACA,MAAMC,YAAY,MAAMJ,UAAUK,IAAIR,MAAM,EAAES,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKd,WAAWe,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKf,QAAQmB,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,gBAAgB1B,YAAY,EAAA,CAAA,CAAI2B,SAAS,KAAA;EACvD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKpB,WAAWqB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAI5B,uBAAAA;EAC/B0B,OAAOG,WAAWH,OAAOG,YAAYnC,aAAa,EAAA;EAClDgC,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,YAAWF,MADE,KAAKxB,gBAAgByB,QAAQN,OAAOO,UAAU,IAAA,EAAA,CAC1CC;EAExB,MAAM,KAAK5B,WAAW6B,KAAKT,MAAAA;EAE3B,IAAI,KAAKvB,QAAQmB,0BACb,IAAI;GACA,MAAMc,cAAc,KAAKjC,QAAQkC,YAC7B,GAAG,KAAKlC,QAAQkC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,kBAAkBZ,OAAOF,kBACvEe,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKnC,qBAAqBoC,OAAO;IAChDC,UAAUzC,iBAAiB0C;IAC3BC,QAAQ;KAAEC,MAAMnB,OAAOF;KAAgBsB,KAAKV;IAAY;IACxDW,QAAQnC,SAASmC;GACrB,CAAA;GAEA,MAAM,KAAK3C,WAAW4C,KAAK;IACvBC,IAAIvB,OAAOwB;IACX,GAAGV;GACP,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKlC,WAAW6C,OAAOzB,MAAAA;GAC7B,MAAM,IAAI9B,gBAAgB,uDAAA;EAC9B;EAGJ,MAAM,KAAKY,cAAc4C,OAAO;GAC5BC,OAAO9D,WAAW+D;GAClBC,MAAMlE,UAAUmE;GAChBC,SAASnE,aAAaoE;GACtBC,OAAOjC,OAAOQ;GACd0B,WAAWpE,aAAakE;GACxBG,SAASnC,OAAOQ;GAChB4B,WAAWpC,OAAO6B;GAClBQ,SAASrC,OAAOO;EACpB,CAAA;EAEA,OAAO,EAAEV,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAMyC,SAASrD,MAAwC;EACnD,MAAMe,SAAS,MAAM,KAAKpB,WAAW2D,UAAU,EAAEzC,eAAeb,KAAKuD,MAAM,CAAA;EAE3E,IAAI,CAACxC,QACD,MAAM,IAAI/B,oBAAAA;EAGd,MAAMwE,SAAS,KAAK7D,WAAW8D,MAAM1C,QAAQ;GACzCH,QAAQ;GACRC,eAAe;EACnB,CAAA;EAEA,MAAM,KAAKlB,WAAW6B,KAAKgC,MAAAA;EAE3B,MAAM,KAAK3D,cAAc4C,OAAO;GAC5BC,OAAO9D,WAAW+D;GAClBC,MAAMlE,UAAUgF;GAChBZ,SAASnE,aAAaoE;GACtBC,OAAOQ,OAAOjC;GACd0B,WAAWpE,aAAakE;GACxBG,SAASM,OAAOjC;GAChB4B,WAAWK,OAAOZ;GAClBQ,SAASI,OAAOlC;EACpB,CAAA;CACJ;AACJ"}

package/dist/core/identity/registration/types.d.ts

@@ -1,10 +1,11 @@
 import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
-import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';
 import type { IdentityWorkflowContext } from '../types.ts';
 export type RegistrationServiceOptions = {
     registrationEnabled?: boolean;
     emailVerificationEnabled?: boolean;
     publicUrl?: string;
+    passwordMinLength?: number;
 };
 export type RegistrationServiceContext = {
     options: RegistrationServiceOptions;
@@ -12,6 +13,7 @@ export type RegistrationServiceContext = {
     mailTemplateRenderer: IMailTemplateRenderer;
     repository: IUserRepository;
     realmRepository: IRealmRepository;
+    eventService?: IEventService;
 };
 export type RegistrationResult = {
     active: boolean;

package/dist/core/identity/registration/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,0BAA0B,GAAG;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,0BAA0B,GAAG;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;IAClC,YAAY,CAAC,EAAE,aAAa,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}

package/dist/core/identity/resolver/module.d.ts

@@ -7,6 +7,13 @@ export declare class IdentityResolver implements IIdentityResolver {
     protected userRepository: IUserIdentityRepository;
     protected robotRepository: IRobotIdentityRepository;
     constructor(ctx: IdentityResolverContext);
+    /**
+     * A UUID key is resolved globally by primary key — `realmKey` scopes NAME
+     * resolution only (UUIDs are globally unique, and the realm hint on the
+     * password grant is always set via the master fallback, so applying it to
+     * UUID keys would break realm-less id-identified logins). See
+     * architecture.md → Password grant realm resolution.
+     */
     resolve(type: `${IdentityType}`, key: string, realmKey?: string): Promise<Identity | null>;
     private resolveClient;
     private resolveRobot;

package/dist/core/identity/resolver/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/resolver/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAGR,QAAQ,EAKX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEzH,qBAAa,gBAAiB,YAAW,iBAAiB;IACtD,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,wBAAwB,CAAC;gBAExC,GAAG,EAAE,uBAAuB;IAMlC,OAAO,CACT,IAAI,EAAE,GAAG,YAAY,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YAgBb,aAAa;YAsBb,YAAY;YAsBZ,WAAW;CAqB5B"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/resolver/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAGR,QAAQ,EAKX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEzH,qBAAa,gBAAiB,YAAW,iBAAiB;IACtD,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,wBAAwB,CAAC;gBAExC,GAAG,EAAE,uBAAuB;IAMxC;;;;;;OAMG;IACG,OAAO,CACT,IAAI,EAAE,GAAG,YAAY,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YAgBb,aAAa;YAsBb,YAAY;YAsBZ,WAAW;CAqB5B"}

package/dist/core/identity/resolver/module.mjs

@@ -13,7 +13,13 @@ var IdentityResolver = class {
 		this.userRepository = ctx.userRepository;
 		this.robotRepository = ctx.robotRepository;
 	}
-	async resolve(type, key, realmKey) {
+	/**
+	* A UUID key is resolved globally by primary key — `realmKey` scopes NAME
+	* resolution only (UUIDs are globally unique, and the realm hint on the
+	* password grant is always set via the master fallback, so applying it to
+	* UUID keys would break realm-less id-identified logins). See
+	* architecture.md → Password grant realm resolution.
+	*/ async resolve(type, key, realmKey) {
 		switch (type) {
 			case IdentityType.CLIENT: return this.resolveClient(key, realmKey);
 			case IdentityType.ROBOT: return this.resolveRobot(key, realmKey);

package/dist/core/identity/resolver/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityType","isUUID","IdentityResolver","clientRepository","userRepository","robotRepository","ctx","resolve","type","key","realmKey","CLIENT","resolveClient","ROBOT","resolveRobot","USER","resolveUser","data","findOneById","findOneByName"],"sources":["../../../../src/core/identity/resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    ClientIdentity, \n    Identity, \n    Robot, \n    RobotIdentity, \n    User, \n    UserIdentity,\n} from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { IIdentityResolver, IdentityResolverContext } from './types.ts';\nimport type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';\n\nexport class IdentityResolver implements IIdentityResolver {\n    protected clientRepository: IClientIdentityRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected robotRepository: IRobotIdentityRepository;\n\n    constructor(ctx: IdentityResolverContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async resolve(\n        type: `${IdentityType}`,\n        key: string,\n        realmKey?: string,\n    ): Promise<Identity | null> {\n        switch (type) {\n            case IdentityType.CLIENT: {\n                return this.resolveClient(key, realmKey);\n            }\n            case IdentityType.ROBOT: {\n                return this.resolveRobot(key, realmKey);\n            }\n            case IdentityType.USER: {\n                return this.resolveUser(key, realmKey);\n            }\n        }\n\n        return null;\n    }\n\n    private async resolveClient(\n        key: string,\n        realmKey?: string,\n    ) : Promise<ClientIdentity | null> {\n        let data : Client | null;\n\n        if (isUUID(key)) {\n            data = await this.clientRepository.findOneById(key);\n        } else {\n            data = await this.clientRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.CLIENT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveRobot(\n        key: string,\n        realmKey?: string,\n    ) : Promise<RobotIdentity | null> {\n        let data : Robot | null;\n\n        if (isUUID(key)) {\n            data = await this.robotRepository.findOneById(key);\n        } else {\n            data = await this.robotRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.ROBOT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveUser(\n        key: string,\n        realmKey?: string,\n    ) : Promise<UserIdentity | null> {\n        let data : User | null;\n\n        if (isUUID(key)) {\n            data = await this.userRepository.findOneById(key);\n        } else {\n            data = await this.userRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.USER,\n                data, \n            };\n        }\n\n        return null;\n    }\n}\n"],"mappings":";;;;;;AAqBA,IAAaE,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,QACFC,MACAC,KACAC,UACwB;EACxB,QAAQF,MAAR;GACI,KAAKR,aAAaW,QACd,OAAO,KAAKC,cAAcH,KAAKC,QAAAA;GAEnC,KAAKV,aAAaa,OACd,OAAO,KAAKC,aAAaL,KAAKC,QAAAA;GAElC,KAAKV,aAAae,MACd,OAAO,KAAKC,YAAYP,KAAKC,QAAAA;EAErC;EAEA,OAAO;CACX;CAEA,MAAcE,cACVH,KACAC,UAC+B;EAC/B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKd,iBAAiBe,YAAYT,GAAAA;OAE/CQ,OAAO,MAAM,KAAKd,iBAAiBgB,cAAcV,KAAKC,QAAAA;EAG1D,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaW;GACnBM;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcH,aACVL,KACAC,UAC8B;EAC9B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKZ,gBAAgBa,YAAYT,GAAAA;OAE9CQ,OAAO,MAAM,KAAKZ,gBAAgBc,cAAcV,KAAKC,QAAAA;EAGzD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaa;GACnBI;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcD,YACVP,KACAC,UAC6B;EAC7B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKb,eAAec,YAAYT,GAAAA;OAE7CQ,OAAO,MAAM,KAAKb,eAAee,cAAcV,KAAKC,QAAAA;EAGxD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAae;GACnBE;EACJ;EAGJ,OAAO;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityType","isUUID","IdentityResolver","clientRepository","userRepository","robotRepository","ctx","resolve","type","key","realmKey","CLIENT","resolveClient","ROBOT","resolveRobot","USER","resolveUser","data","findOneById","findOneByName"],"sources":["../../../../src/core/identity/resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    ClientIdentity, \n    Identity, \n    Robot, \n    RobotIdentity, \n    User, \n    UserIdentity,\n} from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { IIdentityResolver, IdentityResolverContext } from './types.ts';\nimport type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';\n\nexport class IdentityResolver implements IIdentityResolver {\n    protected clientRepository: IClientIdentityRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected robotRepository: IRobotIdentityRepository;\n\n    constructor(ctx: IdentityResolverContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    /**\n     * A UUID key is resolved globally by primary key — `realmKey` scopes NAME\n     * resolution only (UUIDs are globally unique, and the realm hint on the\n     * password grant is always set via the master fallback, so applying it to\n     * UUID keys would break realm-less id-identified logins). See\n     * architecture.md → Password grant realm resolution.\n     */\n    async resolve(\n        type: `${IdentityType}`,\n        key: string,\n        realmKey?: string,\n    ): Promise<Identity | null> {\n        switch (type) {\n            case IdentityType.CLIENT: {\n                return this.resolveClient(key, realmKey);\n            }\n            case IdentityType.ROBOT: {\n                return this.resolveRobot(key, realmKey);\n            }\n            case IdentityType.USER: {\n                return this.resolveUser(key, realmKey);\n            }\n        }\n\n        return null;\n    }\n\n    private async resolveClient(\n        key: string,\n        realmKey?: string,\n    ) : Promise<ClientIdentity | null> {\n        let data : Client | null;\n\n        if (isUUID(key)) {\n            data = await this.clientRepository.findOneById(key);\n        } else {\n            data = await this.clientRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.CLIENT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveRobot(\n        key: string,\n        realmKey?: string,\n    ) : Promise<RobotIdentity | null> {\n        let data : Robot | null;\n\n        if (isUUID(key)) {\n            data = await this.robotRepository.findOneById(key);\n        } else {\n            data = await this.robotRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.ROBOT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveUser(\n        key: string,\n        realmKey?: string,\n    ) : Promise<UserIdentity | null> {\n        let data : User | null;\n\n        if (isUUID(key)) {\n            data = await this.userRepository.findOneById(key);\n        } else {\n            data = await this.userRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.USER,\n                data, \n            };\n        }\n\n        return null;\n    }\n}\n"],"mappings":";;;;;;AAqBA,IAAaE,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;;;;IASA,MAAME,QACFC,MACAC,KACAC,UACwB;EACxB,QAAQF,MAAR;GACI,KAAKR,aAAaW,QACd,OAAO,KAAKC,cAAcH,KAAKC,QAAAA;GAEnC,KAAKV,aAAaa,OACd,OAAO,KAAKC,aAAaL,KAAKC,QAAAA;GAElC,KAAKV,aAAae,MACd,OAAO,KAAKC,YAAYP,KAAKC,QAAAA;EAErC;EAEA,OAAO;CACX;CAEA,MAAcE,cACVH,KACAC,UAC+B;EAC/B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKd,iBAAiBe,YAAYT,GAAAA;OAE/CQ,OAAO,MAAM,KAAKd,iBAAiBgB,cAAcV,KAAKC,QAAAA;EAG1D,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaW;GACnBM;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcH,aACVL,KACAC,UAC8B;EAC9B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKZ,gBAAgBa,YAAYT,GAAAA;OAE9CQ,OAAO,MAAM,KAAKZ,gBAAgBc,cAAcV,KAAKC,QAAAA;EAGzD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaa;GACnBI;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcD,YACVP,KACAC,UAC6B;EAC7B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKb,eAAec,YAAYT,GAAAA;OAE7CQ,OAAO,MAAM,KAAKb,eAAee,cAAcV,KAAKC,QAAAA;EAGxD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAae;GACnBE;EACJ;EAGJ,OAAO;CACX;AACJ"}

package/dist/core/index.d.ts

@@ -1,6 +1,9 @@
 export * from './authentication/index.ts';
+export * from './client-certificate/index.ts';
 export * from './entities/index.ts';
+export * from './key/index.ts';
 export * from './mail/index.ts';
+export * from './metrics/index.ts';
 export * from './oauth2/index.ts';
 export * from './identity/index.ts';
 export * from './ldap/index.ts';

package/dist/core/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAOA,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAOA,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC"}