@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/app/modules/database/repositories/key/repository.d.ts

@@ -0,0 +1,50 @@
+import type { Key } from '@authup/core-kit';
+import { type EntityRepositoryFindManyResult, type ISymmetricCipher, type Logger } from '@authup/server-kit';
+import { JWKUse } from '@authup/specs';
+import type { DataSource, Repository } from 'typeorm';
+import { KeyEntity } from '../../../../../adapters/database/index.ts';
+import type { IKeyRepository, IKeyStore, IRealmRepository } from '../../../../../core/index.ts';
+export type KeyRepositoryAdapterOptions = {
+    /**
+     * Optional KEK (config secretsEncryptionKey) — when present, key
+     * material is persisted wrapped and unwrapped transparently on read.
+     */
+    secretsCipher?: ISymmetricCipher | null;
+    logger?: Logger;
+};
+/**
+ * One adapter, two ports: the entity CRUD surface (IKeyRepository) for the
+ * key management API and the material-resolving store (IKeyStore) for the
+ * signer / verifier / realm cipher. Entity reads never select
+ * decryption_key; only the IKeyStore surface hands out (unwrapped) material.
+ */
+export declare class KeyRepositoryAdapter implements IKeyRepository, IKeyStore {
+    protected dataSource: DataSource;
+    protected secretsCipher: ISymmetricCipher | null;
+    protected realmRepository: IRealmRepository;
+    protected logger?: Logger;
+    constructor(dataSource: DataSource, options?: KeyRepositoryAdapterOptions);
+    protected get repository(): Repository<KeyEntity>;
+    resolveOrCreate(realmId: string, use: `${JWKUse}`): Promise<Key>;
+    resolveById(id: string): Promise<Key | null>;
+    protected createSignatureKey(repository: Repository<KeyEntity>, realmId: string): Promise<Key>;
+    protected createEncryptionKey(repository: Repository<KeyEntity>, realmId: string): Promise<Key>;
+    protected generateName(use: `${JWKUse}`): string;
+    protected afterLoad(repository: Repository<KeyEntity>, entity: KeyEntity): Promise<Key>;
+    protected protect(material: string): Promise<string>;
+    findMany(query: Record<string, any>): Promise<EntityRepositoryFindManyResult<Key>>;
+    findOneById(id: string): Promise<Key | null>;
+    findOneByName(name: string, realmKey?: string): Promise<Key | null>;
+    findOneByIdOrName(idOrName: string, realm?: string): Promise<Key | null>;
+    findManyBy(where: Record<string, any>): Promise<Key[]>;
+    findOneBy(where: Record<string, any>): Promise<Key | null>;
+    create(data: Partial<Key>): Key;
+    merge(entity: Key, data: Partial<Key>): Key;
+    save(entity: Key): Promise<Key>;
+    remove(entity: Key): Promise<void>;
+    validateJoinColumns(data: Partial<Key>): Promise<void>;
+    checkUniqueness(data: Partial<Key>, existing?: Key): Promise<void>;
+    countBlobReferences(keyId: string): Promise<number>;
+    findHighestPriority(realmId: string, use: string): Promise<number | null>;
+}
+//# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/database/repositories/key/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/key/repository.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,EAGH,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACrB,KAAK,MAAM,EAEd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAW,MAAM,EAAgB,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAoB,UAAU,EAAE,MAAM,SAAS,CAAC;AAIxE,OAAO,EAEH,SAAS,EAGZ,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAUhG,MAAM,MAAM,2BAA2B,GAAG;IACtC;;;OAGG;IACH,aAAa,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,cAAc,EAAE,SAAS;IAClE,SAAS,CAAC,UAAU,EAAG,UAAU,CAAC;IAElC,SAAS,CAAC,aAAa,EAAG,gBAAgB,GAAG,IAAI,CAAC;IAElD,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAEf,UAAU,EAAE,UAAU,EAAE,OAAO,GAAE,2BAAgC;IAO7E,SAAS,KAAK,UAAU,IAAK,UAAU,CAAC,SAAS,CAAC,CAEjD;IAMK,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAmDhE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;cAkClC,kBAAkB,CAC9B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC;cA2BA,mBAAmB,CAC/B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC;IAwBhB,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,MAAM;cAIjC,SAAS,CACrB,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,MAAM,EAAE,SAAS,GACjB,OAAO,CAAC,GAAG,CAAC;cA6BA,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC;IAYrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC;IAuClF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAI5C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAenE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAMxE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAItD,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAIhE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG;IAI/B,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG;IAIrC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAgB/B,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAalE,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGlF"}

package/dist/app/modules/database/repositories/key/repository.mjs

@@ -0,0 +1,273 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RealmEntity } from "../../../../../adapters/database/domains/realm/entity.mjs";
+import { KeyEntity } from "../../../../../adapters/database/domains/key/entity.mjs";
+import { UserAuthenticatorEntity } from "../../../../../adapters/database/domains/user-authenticator/entity.mjs";
+import "../../../../../core/key/constants.mjs";
+import { isWrappedKeyMaterial, unwrapKeyMaterial, wrapKeyMaterial } from "../../../../../core/key/wrap.mjs";
+import "../../../../../core/index.mjs";
+import { applyRealmScopeSelect, translateWhereConditions } from "../helpers.mjs";
+import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
+import "../../../../../adapters/database/index.mjs";
+import { RealmRepositoryAdapter } from "../realm/repository.mjs";
+import { Like } from "typeorm";
+import { arrayBufferToBase64, createNanoID, isUUID } from "@authup/kit";
+import { KeyStatus } from "@authup/core-kit";
+import { AsymmetricKey, CryptoAsymmetricAlgorithm, createAsymmetricKeyPair } from "@authup/server-kit";
+import { AuthupError } from "@authup/errors";
+import { JWKType, JWKUse, JWTAlgorithm } from "@authup/specs";
+import { getRandomValues } from "uncrypto";
+import { applyQuery, isEntityUnique, validateEntityJoinColumns } from "typeorm-extension";
+//#region src/app/modules/database/repositories/key/repository.ts
+/**
+* One adapter, two ports: the entity CRUD surface (IKeyRepository) for the
+* key management API and the material-resolving store (IKeyStore) for the
+* signer / verifier / realm cipher. Entity reads never select
+* decryption_key; only the IKeyStore surface hands out (unwrapped) material.
+*/ var KeyRepositoryAdapter = class {
+	dataSource;
+	secretsCipher;
+	realmRepository;
+	logger;
+	constructor(dataSource, options = {}) {
+		this.dataSource = dataSource;
+		this.secretsCipher = options.secretsCipher ?? null;
+		this.logger = options.logger;
+		this.realmRepository = new RealmRepositoryAdapter(dataSource.getRepository(RealmEntity));
+	}
+	get repository() {
+		return this.dataSource.getRepository(KeyEntity);
+	}
+	async resolveOrCreate(realmId, use) {
+		const { repository } = this;
+		const entity = await repository.findOne({
+			select: {
+				id: true,
+				name: true,
+				type: true,
+				use: true,
+				status: true,
+				signature_algorithm: true,
+				encryption_key: true,
+				decryption_key: true,
+				realm_id: true
+			},
+			where: {
+				realm_id: realmId,
+				use,
+				status: KeyStatus.ACTIVE
+			},
+			order: {
+				priority: "DESC",
+				created_at: "DESC",
+				id: "ASC"
+			}
+		});
+		if (entity) return this.afterLoad(repository, entity);
+		const total = await repository.countBy({
+			realm_id: realmId,
+			use
+		});
+		if (total > 0) throw new AuthupError(`No active ${use} key is available for realm ${realmId} (${total} key(s) exist, none active).`);
+		if (use === JWKUse.ENCRYPTION) return this.createEncryptionKey(repository, realmId);
+		return this.createSignatureKey(repository, realmId);
+	}
+	async resolveById(id) {
+		const { repository } = this;
+		if (!isUUID(id)) return null;
+		const entity = await repository.findOne({
+			select: {
+				id: true,
+				name: true,
+				type: true,
+				use: true,
+				status: true,
+				signature_algorithm: true,
+				encryption_key: true,
+				decryption_key: true,
+				realm_id: true
+			},
+			where: { id }
+		});
+		if (!entity) return null;
+		return this.afterLoad(repository, entity);
+	}
+	async createSignatureKey(repository, realmId) {
+		const keyPair = await createAsymmetricKeyPair({ name: CryptoAsymmetricAlgorithm.RSASSA_PKCS1_V1_5 });
+		const privateKeyContainer = new AsymmetricKey(keyPair.privateKey);
+		const publicKeyContainer = new AsymmetricKey(keyPair.publicKey);
+		const material = await privateKeyContainer.toBase64();
+		const entity = repository.create({
+			name: this.generateName(JWKUse.SIGNATURE),
+			type: JWKType.RSA,
+			use: JWKUse.SIGNATURE,
+			status: KeyStatus.ACTIVE,
+			decryption_key: await this.protect(material),
+			encryption_key: await publicKeyContainer.toBase64(),
+			realm_id: realmId,
+			signature_algorithm: `${JWTAlgorithm.RS256}`
+		});
+		await repository.save(entity);
+		entity.decryption_key = material;
+		return entity;
+	}
+	async createEncryptionKey(repository, realmId) {
+		const raw = /* @__PURE__ */ new Uint8Array(32);
+		getRandomValues(raw);
+		const material = arrayBufferToBase64(raw.buffer);
+		const entity = repository.create({
+			name: this.generateName(JWKUse.ENCRYPTION),
+			type: JWKType.OCT,
+			use: JWKUse.ENCRYPTION,
+			status: KeyStatus.ACTIVE,
+			decryption_key: await this.protect(material),
+			encryption_key: null,
+			realm_id: realmId,
+			signature_algorithm: null
+		});
+		await repository.save(entity);
+		entity.decryption_key = material;
+		return entity;
+	}
+	generateName(use) {
+		return `${use}-${createNanoID(10)}`;
+	}
+	async afterLoad(repository, entity) {
+		if (!entity.decryption_key) return entity;
+		if (isWrappedKeyMaterial(entity.decryption_key)) {
+			entity.decryption_key = await unwrapKeyMaterial(this.secretsCipher, entity.decryption_key);
+			return entity;
+		}
+		if (this.secretsCipher) {
+			const material = entity.decryption_key;
+			try {
+				await repository.update(entity.id, { decryption_key: await wrapKeyMaterial(this.secretsCipher, material) });
+			} catch (e) {
+				this.logger?.warn(`Failed to wrap key material at rest for key ${entity.id}.`, { error: e });
+			}
+			entity.decryption_key = material;
+		}
+		return entity;
+	}
+	async protect(material) {
+		if (!this.secretsCipher) return material;
+		return wrapKeyMaterial(this.secretsCipher, material);
+	}
+	async findMany(query) {
+		const qb = this.repository.createQueryBuilder("keyEntity");
+		qb.groupBy("keyEntity.id");
+		const { pagination } = applyQuery(qb, query, {
+			defaultAlias: "keyEntity",
+			fields: {
+				default: [
+					"id",
+					"name",
+					"type",
+					"use",
+					"priority",
+					"status",
+					"signature_algorithm",
+					"realm_id",
+					"created_at",
+					"updated_at"
+				],
+				allowed: ["encryption_key", "certificate"]
+			},
+			filters: { allowed: [
+				"id",
+				"name",
+				"type",
+				"use",
+				"status",
+				"realm_id"
+			] },
+			pagination: { maxLimit: 50 },
+			sort: { allowed: [
+				"id",
+				"name",
+				"priority",
+				"use",
+				"status",
+				"created_at",
+				"updated_at"
+			] }
+		});
+		applyRealmScopeSelect(qb, "keyEntity");
+		const [entities, total] = await qb.getManyAndCount();
+		return {
+			data: entities,
+			meta: {
+				total,
+				...pagination
+			}
+		};
+	}
+	async findOneById(id) {
+		return this.findOneBy({ id });
+	}
+	async findOneByName(name, realmKey) {
+		const where = { name };
+		if (realmKey) {
+			const realmId = await this.realmRepository.resolveId(realmKey);
+			if (!realmId) return null;
+			where.realm_id = realmId;
+		}
+		return this.repository.findOneBy(where);
+	}
+	async findOneByIdOrName(idOrName, realm) {
+		return isUUID(idOrName) ? this.findOneById(idOrName) : this.findOneByName(idOrName, realm);
+	}
+	async findManyBy(where) {
+		return this.repository.findBy(translateWhereConditions(where));
+	}
+	async findOneBy(where) {
+		return this.repository.findOneBy(translateWhereConditions(where));
+	}
+	create(data) {
+		return this.repository.create(data);
+	}
+	merge(entity, data) {
+		return this.repository.merge(entity, data);
+	}
+	async save(entity) {
+		if (entity.decryption_key && this.secretsCipher && !isWrappedKeyMaterial(entity.decryption_key)) {
+			const material = entity.decryption_key;
+			entity.decryption_key = await wrapKeyMaterial(this.secretsCipher, material);
+			const saved = await this.repository.save(entity);
+			saved.decryption_key = material;
+			return saved;
+		}
+		return this.repository.save(entity);
+	}
+	async remove(entity) {
+		await this.repository.remove(entity);
+	}
+	async validateJoinColumns(data) {
+		await validateEntityJoinColumns(data, {
+			dataSource: this.dataSource,
+			entityTarget: KeyEntity
+		});
+	}
+	async checkUniqueness(data, existing) {
+		if (!await isEntityUnique({
+			dataSource: this.dataSource,
+			entityTarget: KeyEntity,
+			entity: data,
+			entityExisting: existing
+		})) throw new DatabaseConflictError();
+	}
+	async countBlobReferences(keyId) {
+		return this.dataSource.getRepository(UserAuthenticatorEntity).countBy({ secret: Like(`v1.${keyId}.%`) });
+	}
+	async findHighestPriority(realmId, use) {
+		return this.repository.maximum("priority", {
+			realm_id: realmId,
+			use
+		});
+	}
+};
+//#endregion
+export { KeyRepositoryAdapter };
+
+//# sourceMappingURL=repository.mjs.map

package/dist/app/modules/database/repositories/key/repository.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.mjs","names":["AuthupError","KeyStatus","arrayBufferToBase64","createNanoID","isUUID","AsymmetricKey","CryptoAsymmetricAlgorithm","createAsymmetricKeyPair","JWKType","JWKUse","JWTAlgorithm","Like","applyQuery","isEntityUnique","validateEntityJoinColumns","getRandomValues","DatabaseConflictError","KeyEntity","RealmEntity","UserAuthenticatorEntity","REALM_CIPHER_BLOB_VERSION","isWrappedKeyMaterial","unwrapKeyMaterial","wrapKeyMaterial","applyRealmScopeSelect","translateWhereConditions","RealmRepositoryAdapter","KeyRepositoryAdapter","dataSource","secretsCipher","realmRepository","logger","options","getRepository","repository","resolveOrCreate","realmId","use","entity","findOne","select","id","name","type","status","signature_algorithm","encryption_key","decryption_key","realm_id","where","ACTIVE","order","priority","created_at","afterLoad","total","countBy","ENCRYPTION","createEncryptionKey","createSignatureKey","resolveById","keyPair","RSASSA_PKCS1_V1_5","privateKeyContainer","privateKey","publicKeyContainer","publicKey","material","toBase64","create","generateName","SIGNATURE","RSA","protect","RS256","save","raw","Uint8Array","buffer","OCT","update","e","warn","error","findMany","query","qb","createQueryBuilder","groupBy","pagination","defaultAlias","fields","default","allowed","filters","maxLimit","sort","entities","getManyAndCount","data","meta","findOneById","findOneBy","findOneByName","realmKey","resolveId","findOneByIdOrName","idOrName","realm","findManyBy","findBy","merge","saved","remove","validateJoinColumns","entityTarget","checkUniqueness","existing","isUnique","entityExisting","countBlobReferences","keyId","secret","findHighestPriority","maximum"],"sources":["../../../../../../src/app/modules/database/repositories/key/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\nimport type { Key } from '@authup/core-kit';\nimport { KeyStatus } from '@authup/core-kit';\nimport { arrayBufferToBase64, createNanoID, isUUID } from '@authup/kit';\nimport {\n    AsymmetricKey,\n    CryptoAsymmetricAlgorithm,\n    type EntityRepositoryFindManyResult,\n    type ISymmetricCipher,\n    type Logger,\n    createAsymmetricKeyPair,\n} from '@authup/server-kit';\nimport { JWKType, JWKUse, JWTAlgorithm } from '@authup/specs';\nimport type { DataSource, FindOptionsWhere, Repository } from 'typeorm';\nimport { Like } from 'typeorm';\nimport { applyQuery, isEntityUnique, validateEntityJoinColumns } from 'typeorm-extension';\nimport { getRandomValues } from 'uncrypto';\nimport {\n    DatabaseConflictError,\n    KeyEntity,\n    RealmEntity,\n    UserAuthenticatorEntity,\n} from '../../../../../adapters/database/index.ts';\nimport type { IKeyRepository, IKeyStore, IRealmRepository } from '../../../../../core/index.ts';\nimport {\n    REALM_CIPHER_BLOB_VERSION,\n    isWrappedKeyMaterial,\n    unwrapKeyMaterial,\n    wrapKeyMaterial,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect, translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type KeyRepositoryAdapterOptions = {\n    /**\n     * Optional KEK (config secretsEncryptionKey) — when present, key\n     * material is persisted wrapped and unwrapped transparently on read.\n     */\n    secretsCipher?: ISymmetricCipher | null,\n    logger?: Logger,\n};\n\n/**\n * One adapter, two ports: the entity CRUD surface (IKeyRepository) for the\n * key management API and the material-resolving store (IKeyStore) for the\n * signer / verifier / realm cipher. Entity reads never select\n * decryption_key; only the IKeyStore surface hands out (unwrapped) material.\n */\nexport class KeyRepositoryAdapter implements IKeyRepository, IKeyStore {\n    protected dataSource : DataSource;\n\n    protected secretsCipher : ISymmetricCipher | null;\n\n    protected realmRepository : IRealmRepository;\n\n    protected logger? : Logger;\n\n    constructor(dataSource: DataSource, options: KeyRepositoryAdapterOptions = {}) {\n        this.dataSource = dataSource;\n        this.secretsCipher = options.secretsCipher ?? null;\n        this.logger = options.logger;\n        this.realmRepository = new RealmRepositoryAdapter(dataSource.getRepository(RealmEntity));\n    }\n\n    protected get repository() : Repository<KeyEntity> {\n        return this.dataSource.getRepository(KeyEntity);\n    }\n\n    // ------------------------------------------------------------------\n    // IKeyStore — material resolution (signer / verifier / realm cipher)\n    // ------------------------------------------------------------------\n\n    async resolveOrCreate(realmId: string, use: `${JWKUse}`): Promise<Key> {\n        const { repository } = this;\n\n        const entity = await repository.findOne({\n            select: {\n                id: true,\n                name: true,\n                type: true,\n                use: true,\n                status: true,\n                signature_algorithm: true,\n                encryption_key: true,\n                decryption_key: true,\n                realm_id: true,\n            },\n            where: {\n                realm_id: realmId,\n                use,\n                status: KeyStatus.ACTIVE,\n            },\n            // created_at + id break priority ties deterministically (e.g.\n            // duplicate mints from a concurrent zero-row backstop race —\n            // benign, both keys verify, but selection must be stable).\n            order: {\n                priority: 'DESC', \n                created_at: 'DESC', \n                id: 'ASC', \n            },\n        });\n\n        if (entity) {\n            return this.afterLoad(repository, entity);\n        }\n\n        const total = await repository.countBy({ realm_id: realmId, use });\n        if (total > 0) {\n            // an admin who disabled every key meant it — do not silently\n            // re-mint around the kill switch.\n            throw new AuthupError(\n                `No active ${use} key is available for realm ${realmId} ` +\n                `(${total} key(s) exist, none active).`,\n            );\n        }\n\n        if (use === JWKUse.ENCRYPTION) {\n            return this.createEncryptionKey(repository, realmId);\n        }\n\n        return this.createSignatureKey(repository, realmId);\n    }\n\n    async resolveById(id: string): Promise<Key | null> {\n        const { repository } = this;\n\n        // `id` reaches here from an attacker-controlled JWT `kid` header on the\n        // token-verification hot path. A non-UUID value binds against a\n        // postgres `uuid` column as a driver-level type error (500) instead of\n        // a clean miss — short-circuit to \"not found\" so a garbage kid is a\n        // plain verification failure.\n        if (!isUUID(id)) {\n            return null;\n        }\n\n        const entity = await repository.findOne({\n            select: {\n                id: true,\n                name: true,\n                type: true,\n                use: true,\n                status: true,\n                signature_algorithm: true,\n                encryption_key: true,\n                decryption_key: true,\n                realm_id: true,\n            },\n            where: { id },\n        });\n\n        if (!entity) {\n            return null;\n        }\n\n        return this.afterLoad(repository, entity);\n    }\n\n    protected async createSignatureKey(\n        repository: Repository<KeyEntity>,\n        realmId: string,\n    ) : Promise<Key> {\n        const keyPair = await createAsymmetricKeyPair({ name: CryptoAsymmetricAlgorithm.RSASSA_PKCS1_V1_5 });\n\n        const privateKeyContainer = new AsymmetricKey(keyPair.privateKey);\n        const publicKeyContainer = new AsymmetricKey(keyPair.publicKey);\n\n        const material = await privateKeyContainer.toBase64();\n\n        const entity = repository.create({\n            name: this.generateName(JWKUse.SIGNATURE),\n            type: JWKType.RSA,\n            use: JWKUse.SIGNATURE,\n            status: KeyStatus.ACTIVE,\n            decryption_key: await this.protect(material),\n            encryption_key: await publicKeyContainer.toBase64(),\n            realm_id: realmId,\n            signature_algorithm: `${JWTAlgorithm.RS256}`,\n        });\n\n        await repository.save(entity);\n\n        // hand the caller usable material regardless of the persisted form.\n        entity.decryption_key = material;\n\n        return entity;\n    }\n\n    protected async createEncryptionKey(\n        repository: Repository<KeyEntity>,\n        realmId: string,\n    ) : Promise<Key> {\n        const raw = new Uint8Array(32);\n        getRandomValues(raw);\n\n        const material = arrayBufferToBase64(raw.buffer);\n\n        const entity = repository.create({\n            name: this.generateName(JWKUse.ENCRYPTION),\n            type: JWKType.OCT,\n            use: JWKUse.ENCRYPTION,\n            status: KeyStatus.ACTIVE,\n            decryption_key: await this.protect(material),\n            encryption_key: null,\n            realm_id: realmId,\n            signature_algorithm: null,\n        });\n\n        await repository.save(entity);\n\n        entity.decryption_key = material;\n\n        return entity;\n    }\n\n    protected generateName(use: `${JWKUse}`) : string {\n        return `${use}-${createNanoID(10)}`;\n    }\n\n    protected async afterLoad(\n        repository: Repository<KeyEntity>,\n        entity: KeyEntity,\n    ) : Promise<Key> {\n        if (!entity.decryption_key) {\n            return entity;\n        }\n\n        if (isWrappedKeyMaterial(entity.decryption_key)) {\n            entity.decryption_key = await unwrapKeyMaterial(this.secretsCipher, entity.decryption_key);\n            return entity;\n        }\n\n        if (this.secretsCipher) {\n            // lazy wrap-on-read: a KEK added to a running deployment\n            // hardens existing rows without a migration step. Best-effort —\n            // the material stays readable either way.\n            const material = entity.decryption_key;\n            try {\n                await repository.update(entity.id, { decryption_key: await wrapKeyMaterial(this.secretsCipher, material) });\n            } catch (e) {\n                // Best-effort — the material stays readable and the next read\n                // retries. Surface it though: a persistent failure (e.g. a\n                // read-only replica) means the row is never hardened at rest.\n                this.logger?.warn(`Failed to wrap key material at rest for key ${entity.id}.`, { error: e });\n            }\n            entity.decryption_key = material;\n        }\n\n        return entity;\n    }\n\n    protected async protect(material: string) : Promise<string> {\n        if (!this.secretsCipher) {\n            return material;\n        }\n\n        return wrapKeyMaterial(this.secretsCipher, material);\n    }\n\n    // ------------------------------------------------------------------\n    // IKeyRepository — entity CRUD surface (key management API)\n    // ------------------------------------------------------------------\n\n    async findMany(query: Record<string, any>): Promise<EntityRepositoryFindManyResult<Key>> {\n        const qb = this.repository.createQueryBuilder('keyEntity');\n        qb.groupBy('keyEntity.id');\n\n        const { pagination } = applyQuery(qb, query, {\n            defaultAlias: 'keyEntity',\n            fields: {\n                default: [\n                    'id',\n                    'name',\n                    'type',\n                    'use',\n                    'priority',\n                    'status',\n                    'signature_algorithm',\n                    'realm_id',\n                    'created_at',\n                    'updated_at',\n                ],\n                allowed: ['encryption_key', 'certificate'],\n            },\n            filters: { allowed: ['id', 'name', 'type', 'use', 'status', 'realm_id'] },\n            pagination: { maxLimit: 50 },\n            sort: { allowed: ['id', 'name', 'priority', 'use', 'status', 'created_at', 'updated_at'] },\n        });\n\n        applyRealmScopeSelect(qb, 'keyEntity');\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Key | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<Key | null> {\n        const where : FindOptionsWhere<KeyEntity> = { name };\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n\n            where.realm_id = realmId;\n        }\n\n        return this.repository.findOneBy(where);\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<Key | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<Key[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<Key | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<Key>): Key {\n        return this.repository.create(data);\n    }\n\n    merge(entity: Key, data: Partial<Key>): Key {\n        return this.repository.merge(entity as KeyEntity, data);\n    }\n\n    async save(entity: Key): Promise<Key> {\n        if (\n            entity.decryption_key &&\n            this.secretsCipher &&\n            !isWrappedKeyMaterial(entity.decryption_key)\n        ) {\n            const material = entity.decryption_key;\n            entity.decryption_key = await wrapKeyMaterial(this.secretsCipher, material);\n            const saved = await this.repository.save(entity as KeyEntity);\n            saved.decryption_key = material;\n            return saved;\n        }\n\n        return this.repository.save(entity as KeyEntity);\n    }\n\n    async remove(entity: Key): Promise<void> {\n        await this.repository.remove(entity as KeyEntity);\n    }\n\n    async validateJoinColumns(data: Partial<Key>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.dataSource,\n            entityTarget: KeyEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<Key>, existing?: Key): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.dataSource,\n            entityTarget: KeyEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async countBlobReferences(keyId: string): Promise<number> {\n        return this.dataSource.getRepository(UserAuthenticatorEntity).countBy({ secret: Like(`${REALM_CIPHER_BLOB_VERSION}.${keyId}.%`) });\n    }\n\n    async findHighestPriority(realmId: string, use: string): Promise<number | null> {\n        return this.repository.maximum('priority', { realm_id: realmId, use: use as `${JWKUse}` });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDA,IAAa2B,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYH,YAAwBI,UAAuC,CAAC,GAAG;EAC3E,KAAKJ,aAAaA;EAClB,KAAKC,gBAAgBG,QAAQH,iBAAiB;EAC9C,KAAKE,SAASC,QAAQD;EACtB,KAAKD,kBAAkB,IAAIJ,uBAAuBE,WAAWK,cAAcf,WAAAA,CAAAA;CAC/E;CAEA,IAAcgB,aAAqC;EAC/C,OAAO,KAAKN,WAAWK,cAAchB,SAAAA;CACzC;CAMA,MAAMkB,gBAAgBC,SAAiBC,KAAgC;EACnE,MAAM,EAAEH,eAAe;EAEvB,MAAMI,SAAS,MAAMJ,WAAWK,QAAQ;GACpCC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNN,KAAK;IACLO,QAAQ;IACRC,qBAAqB;IACrBC,gBAAgB;IAChBC,gBAAgB;IAChBC,UAAU;GACd;GACAC,OAAO;IACHD,UAAUZ;IACVC;IACAO,QAAQ3C,UAAUiD;GACtB;GAIAC,OAAO;IACHC,UAAU;IACVC,YAAY;IACZZ,IAAI;GACR;EACJ,CAAA;EAEA,IAAIH,QACA,OAAO,KAAKgB,UAAUpB,YAAYI,MAAAA;EAGtC,MAAMiB,QAAQ,MAAMrB,WAAWsB,QAAQ;GAAER,UAAUZ;GAASC;EAAI,CAAA;EAChE,IAAIkB,QAAQ,GAGR,MAAM,IAAIvD,YACN,aAAaqC,IAAI,8BAA8BD,QAAQ,IACnDmB,MAAM,6BAA6B;EAI/C,IAAIlB,QAAQ5B,OAAOgD,YACf,OAAO,KAAKC,oBAAoBxB,YAAYE,OAAAA;EAGhD,OAAO,KAAKuB,mBAAmBzB,YAAYE,OAAAA;CAC/C;CAEA,MAAMwB,YAAYnB,IAAiC;EAC/C,MAAM,EAAEP,eAAe;EAOvB,IAAI,CAAC9B,OAAOqC,EAAAA,GACR,OAAO;EAGX,MAAMH,SAAS,MAAMJ,WAAWK,QAAQ;GACpCC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNN,KAAK;IACLO,QAAQ;IACRC,qBAAqB;IACrBC,gBAAgB;IAChBC,gBAAgB;IAChBC,UAAU;GACd;GACAC,OAAO,EAAER,GAAG;EAChB,CAAA;EAEA,IAAI,CAACH,QACD,OAAO;EAGX,OAAO,KAAKgB,UAAUpB,YAAYI,MAAAA;CACtC;CAEA,MAAgBqB,mBACZzB,YACAE,SACa;EACb,MAAMyB,UAAU,MAAMtD,wBAAwB,EAAEmC,MAAMpC,0BAA0BwD,kBAAkB,CAAA;EAElG,MAAMC,sBAAsB,IAAI1D,cAAcwD,QAAQG,UAAU;EAChE,MAAMC,qBAAqB,IAAI5D,cAAcwD,QAAQK,SAAS;EAE9D,MAAMC,WAAW,MAAMJ,oBAAoBK,SAAQ;EAEnD,MAAM9B,SAASJ,WAAWmC,OAAO;GAC7B3B,MAAM,KAAK4B,aAAa7D,OAAO8D,SAAS;GACxC5B,MAAMnC,QAAQgE;GACdnC,KAAK5B,OAAO8D;GACZ3B,QAAQ3C,UAAUiD;GAClBH,gBAAgB,MAAM,KAAK0B,QAAQN,QAAAA;GACnCrB,gBAAgB,MAAMmB,mBAAmBG,SAAQ;GACjDpB,UAAUZ;GACVS,qBAAqB,GAAGnC,aAAagE;EACzC,CAAA;EAEA,MAAMxC,WAAWyC,KAAKrC,MAAAA;EAGtBA,OAAOS,iBAAiBoB;EAExB,OAAO7B;CACX;CAEA,MAAgBoB,oBACZxB,YACAE,SACa;EACb,MAAMwC,sBAAM,IAAIC,WAAW,EAAA;EAC3B9D,gBAAgB6D,GAAAA;EAEhB,MAAMT,WAAWjE,oBAAoB0E,IAAIE,MAAM;EAE/C,MAAMxC,SAASJ,WAAWmC,OAAO;GAC7B3B,MAAM,KAAK4B,aAAa7D,OAAOgD,UAAU;GACzCd,MAAMnC,QAAQuE;GACd1C,KAAK5B,OAAOgD;GACZb,QAAQ3C,UAAUiD;GAClBH,gBAAgB,MAAM,KAAK0B,QAAQN,QAAAA;GACnCrB,gBAAgB;GAChBE,UAAUZ;GACVS,qBAAqB;EACzB,CAAA;EAEA,MAAMX,WAAWyC,KAAKrC,MAAAA;EAEtBA,OAAOS,iBAAiBoB;EAExB,OAAO7B;CACX;CAEUgC,aAAajC,KAA2B;EAC9C,OAAO,GAAGA,IAAI,GAAGlC,aAAa,EAAA;CAClC;CAEA,MAAgBmD,UACZpB,YACAI,QACa;EACb,IAAI,CAACA,OAAOS,gBACR,OAAOT;EAGX,IAAIjB,qBAAqBiB,OAAOS,cAAc,GAAG;GAC7CT,OAAOS,iBAAiB,MAAMzB,kBAAkB,KAAKO,eAAeS,OAAOS,cAAc;GACzF,OAAOT;EACX;EAEA,IAAI,KAAKT,eAAe;GAIpB,MAAMsC,WAAW7B,OAAOS;GACxB,IAAI;IACA,MAAMb,WAAW8C,OAAO1C,OAAOG,IAAI,EAAEM,gBAAgB,MAAMxB,gBAAgB,KAAKM,eAAesC,QAAAA,EAAU,CAAA;GAC7G,SAASc,GAAG;IAIR,KAAKlD,QAAQmD,KAAK,+CAA+C5C,OAAOG,GAAG,IAAI,EAAE0C,OAAOF,EAAE,CAAA;GAC9F;GACA3C,OAAOS,iBAAiBoB;EAC5B;EAEA,OAAO7B;CACX;CAEA,MAAgBmC,QAAQN,UAAoC;EACxD,IAAI,CAAC,KAAKtC,eACN,OAAOsC;EAGX,OAAO5C,gBAAgB,KAAKM,eAAesC,QAAAA;CAC/C;CAMA,MAAMiB,SAASC,OAA0E;EACrF,MAAMC,KAAK,KAAKpD,WAAWqD,mBAAmB,WAAA;EAC9CD,GAAGE,QAAQ,cAAA;EAEX,MAAM,EAAEC,eAAe7E,WAAW0E,IAAID,OAAO;GACzCK,cAAc;GACdC,QAAQ;IACJC,SAAS;KACL;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;;IAEJC,SAAS,CAAC,kBAAkB,aAAA;GAChC;GACAC,SAAS,EAAED,SAAS;IAAC;IAAM;IAAQ;IAAQ;IAAO;IAAU;KAAY;GACxEJ,YAAY,EAAEM,UAAU,GAAG;GAC3BC,MAAM,EAAEH,SAAS;IAAC;IAAM;IAAQ;IAAY;IAAO;IAAU;IAAc;KAAc;EAC7F,CAAA;EAEArE,sBAAsB8D,IAAI,WAAA;EAE1B,MAAM,CAACW,UAAU1C,SAAS,MAAM+B,GAAGY,gBAAe;EAElD,OAAO;GACHC,MAAMF;GACNG,MAAM;IACF7C;IACA,GAAGkC;GACP;EACJ;CACJ;CAEA,MAAMY,YAAY5D,IAAiC;EAC/C,OAAO,KAAK6D,UAAU,EAAE7D,GAAG,CAAA;CAC/B;CAEA,MAAM8D,cAAc7D,MAAc8D,UAAwC;EACtE,MAAMvD,QAAsC,EAAEP,KAAK;EAEnD,IAAI8D,UAAU;GACV,MAAMpE,UAAU,MAAM,KAAKN,gBAAgB2E,UAAUD,QAAAA;GACrD,IAAI,CAACpE,SACD,OAAO;GAGXa,MAAMD,WAAWZ;EACrB;EAEA,OAAO,KAAKF,WAAWoE,UAAUrD,KAAAA;CACrC;CAEA,MAAMyD,kBAAkBC,UAAkBC,OAAqC;EAC3E,OAAOxG,OAAOuG,QAAAA,IACV,KAAKN,YAAYM,QAAAA,IACjB,KAAKJ,cAAcI,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAW5D,OAA4C;EACzD,OAAO,KAAKf,WAAW4E,OAAOrF,yBAAyBwB,KAAAA,CAAAA;CAC3D;CAEA,MAAMqD,UAAUrD,OAAiD;EAC7D,OAAO,KAAKf,WAAWoE,UAAU7E,yBAAyBwB,KAAAA,CAAAA;CAC9D;CAEAoB,OAAO8B,MAAyB;EAC5B,OAAO,KAAKjE,WAAWmC,OAAO8B,IAAAA;CAClC;CAEAY,MAAMzE,QAAa6D,MAAyB;EACxC,OAAO,KAAKjE,WAAW6E,MAAMzE,QAAqB6D,IAAAA;CACtD;CAEA,MAAMxB,KAAKrC,QAA2B;EAClC,IACIA,OAAOS,kBACP,KAAKlB,iBACL,CAACR,qBAAqBiB,OAAOS,cAAc,GAC7C;GACE,MAAMoB,WAAW7B,OAAOS;GACxBT,OAAOS,iBAAiB,MAAMxB,gBAAgB,KAAKM,eAAesC,QAAAA;GAClE,MAAM6C,QAAQ,MAAM,KAAK9E,WAAWyC,KAAKrC,MAAAA;GACzC0E,MAAMjE,iBAAiBoB;GACvB,OAAO6C;EACX;EAEA,OAAO,KAAK9E,WAAWyC,KAAKrC,MAAAA;CAChC;CAEA,MAAM2E,OAAO3E,QAA4B;EACrC,MAAM,KAAKJ,WAAW+E,OAAO3E,MAAAA;CACjC;CAEA,MAAM4E,oBAAoBf,MAAmC;EACzD,MAAMrF,0BAA0BqF,MAAM;GAClCvE,YAAY,KAAKA;GACjBuF,cAAclG;EAClB,CAAA;CACJ;CAEA,MAAMmG,gBAAgBjB,MAAoBkB,UAA+B;EAQrE,IAAI,CAACC,MAPkBzG,eAAe;GAClCe,YAAY,KAAKA;GACjBuF,cAAclG;GACdqB,QAAQ6D;GACRoB,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAIrG,sBAAAA;CAElB;CAEA,MAAMwG,oBAAoBC,OAAgC;EACtD,OAAO,KAAK7F,WAAWK,cAAcd,uBAAAA,CAAAA,CAAyBqC,QAAQ,EAAEkE,QAAQ/G,KAAK,MAAgC8G,MAAM,GAAG,EAAE,CAAA;CACpI;CAEA,MAAME,oBAAoBvF,SAAiBC,KAAqC;EAC5E,OAAO,KAAKH,WAAW0F,QAAQ,YAAY;GAAE5E,UAAUZ;GAAcC;EAAmB,CAAA;CAC5F;AACJ"}

package/dist/app/modules/database/repositories/permission-provider/module.mjs

@@ -2,8 +2,8 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { CachePrefix } from "../../../../../adapters/database/domains/constants.mjs";
-import { PermissionEntity } from "../../../../../adapters/database/domains/permission/entity.mjs";
 import { PolicyRepository } from "../../../../../adapters/database/domains/policy/repository.mjs";
+import { PermissionEntity } from "../../../../../adapters/database/domains/permission/entity.mjs";
 import { PermissionPolicyEntity } from "../../../../../adapters/database/domains/permission-policy/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
 import { IsNull } from "typeorm";

package/dist/app/modules/database/repositories/trust-anchor/index.d.ts

@@ -0,0 +1,2 @@
+export * from './repository.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/app/modules/database/repositories/trust-anchor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/trust-anchor/index.ts"],"names":[],"mappings":"AAOA,cAAc,iBAAiB,CAAC"}

package/dist/app/modules/database/repositories/trust-anchor/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { TrustAnchorRepositoryAdapter } from "./repository.mjs";
+export { TrustAnchorRepositoryAdapter };

package/dist/app/modules/database/repositories/trust-anchor/repository.d.ts

@@ -0,0 +1,24 @@
+import type { TrustAnchor } from '@authup/core-kit';
+import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { DataSource, Repository } from 'typeorm';
+import { TrustAnchorEntity } from '../../../../../adapters/database/index.ts';
+import type { IRealmRepository, ITrustAnchorRepository } from '../../../../../core/index.ts';
+export declare class TrustAnchorRepositoryAdapter implements ITrustAnchorRepository {
+    protected dataSource: DataSource;
+    protected realmRepository: IRealmRepository;
+    constructor(dataSource: DataSource);
+    protected get repository(): Repository<TrustAnchorEntity>;
+    findMany(query: Record<string, any>): Promise<EntityRepositoryFindManyResult<TrustAnchor>>;
+    findOneById(id: string): Promise<TrustAnchor | null>;
+    findOneByName(name: string, realmKey?: string): Promise<TrustAnchor | null>;
+    findOneByIdOrName(idOrName: string, realm?: string): Promise<TrustAnchor | null>;
+    findManyBy(where: Record<string, any>): Promise<TrustAnchor[]>;
+    findOneBy(where: Record<string, any>): Promise<TrustAnchor | null>;
+    create(data: Partial<TrustAnchor>): TrustAnchor;
+    merge(entity: TrustAnchor, data: Partial<TrustAnchor>): TrustAnchor;
+    save(entity: TrustAnchor): Promise<TrustAnchor>;
+    remove(entity: TrustAnchor): Promise<void>;
+    validateJoinColumns(data: Partial<TrustAnchor>): Promise<void>;
+    checkUniqueness(data: Partial<TrustAnchor>, existing?: TrustAnchor): Promise<void>;
+}
+//# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/database/repositories/trust-anchor/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/trust-anchor/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAoB,UAAU,EAAE,MAAM,SAAS,CAAC;AAExE,OAAO,EAAsC,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAClH,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAI7F,qBAAa,4BAA6B,YAAW,sBAAsB;IACvE,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC;IAEjC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,UAAU,EAAE,UAAU;IAKlC,SAAS,KAAK,UAAU,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAExD;IAEK,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAmC1F,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAIpD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAe3E,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAMhF,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAI9D,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAIxE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,WAAW;IAI/C,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,WAAW;IAI7D,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAI/C,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1C,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9D,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAY3F"}

package/dist/app/modules/database/repositories/trust-anchor/repository.mjs

@@ -0,0 +1,113 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RealmEntity } from "../../../../../adapters/database/domains/realm/entity.mjs";
+import { TrustAnchorEntity } from "../../../../../adapters/database/domains/trust-anchor/entity.mjs";
+import { applyRealmScopeSelect, translateWhereConditions } from "../helpers.mjs";
+import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
+import "../../../../../adapters/database/index.mjs";
+import { RealmRepositoryAdapter } from "../realm/repository.mjs";
+import { isUUID } from "@authup/kit";
+import { applyQuery, isEntityUnique, validateEntityJoinColumns } from "typeorm-extension";
+//#region src/app/modules/database/repositories/trust-anchor/repository.ts
+var TrustAnchorRepositoryAdapter = class {
+	dataSource;
+	realmRepository;
+	constructor(dataSource) {
+		this.dataSource = dataSource;
+		this.realmRepository = new RealmRepositoryAdapter(dataSource.getRepository(RealmEntity));
+	}
+	get repository() {
+		return this.dataSource.getRepository(TrustAnchorEntity);
+	}
+	async findMany(query) {
+		const qb = this.repository.createQueryBuilder("trustAnchor");
+		qb.groupBy("trustAnchor.id");
+		const { pagination } = applyQuery(qb, query, {
+			defaultAlias: "trustAnchor",
+			fields: { allowed: [
+				"id",
+				"name",
+				"certificate",
+				"enabled",
+				"realm_id",
+				"created_at",
+				"updated_at"
+			] },
+			filters: { allowed: [
+				"id",
+				"name",
+				"enabled",
+				"realm_id"
+			] },
+			pagination: { maxLimit: 50 },
+			sort: { allowed: [
+				"id",
+				"name",
+				"enabled",
+				"created_at",
+				"updated_at"
+			] }
+		});
+		applyRealmScopeSelect(qb, "trustAnchor");
+		const [entities, total] = await qb.getManyAndCount();
+		return {
+			data: entities,
+			meta: {
+				total,
+				...pagination
+			}
+		};
+	}
+	async findOneById(id) {
+		return this.findOneBy({ id });
+	}
+	async findOneByName(name, realmKey) {
+		const where = { name };
+		if (realmKey) {
+			const realmId = await this.realmRepository.resolveId(realmKey);
+			if (!realmId) return null;
+			where.realm_id = realmId;
+		}
+		return this.repository.findOneBy(where);
+	}
+	async findOneByIdOrName(idOrName, realm) {
+		return isUUID(idOrName) ? this.findOneById(idOrName) : this.findOneByName(idOrName, realm);
+	}
+	async findManyBy(where) {
+		return this.repository.findBy(translateWhereConditions(where));
+	}
+	async findOneBy(where) {
+		return this.repository.findOneBy(translateWhereConditions(where));
+	}
+	create(data) {
+		return this.repository.create(data);
+	}
+	merge(entity, data) {
+		return this.repository.merge(entity, data);
+	}
+	async save(entity) {
+		return this.repository.save(entity);
+	}
+	async remove(entity) {
+		await this.repository.remove(entity);
+	}
+	async validateJoinColumns(data) {
+		await validateEntityJoinColumns(data, {
+			dataSource: this.dataSource,
+			entityTarget: TrustAnchorEntity
+		});
+	}
+	async checkUniqueness(data, existing) {
+		if (!await isEntityUnique({
+			dataSource: this.dataSource,
+			entityTarget: TrustAnchorEntity,
+			entity: data,
+			entityExisting: existing
+		})) throw new DatabaseConflictError();
+	}
+};
+//#endregion
+export { TrustAnchorRepositoryAdapter };
+
+//# sourceMappingURL=repository.mjs.map

package/dist/app/modules/database/repositories/trust-anchor/repository.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.mjs","names":["isUUID","applyQuery","isEntityUnique","validateEntityJoinColumns","DatabaseConflictError","RealmEntity","TrustAnchorEntity","applyRealmScopeSelect","translateWhereConditions","RealmRepositoryAdapter","TrustAnchorRepositoryAdapter","dataSource","realmRepository","getRepository","repository","findMany","query","qb","createQueryBuilder","groupBy","pagination","defaultAlias","fields","allowed","filters","maxLimit","sort","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","name","realmKey","where","realmId","resolveId","realm_id","findOneByIdOrName","idOrName","realm","findManyBy","findBy","create","merge","entity","save","remove","validateJoinColumns","entityTarget","checkUniqueness","existing","isUnique","entityExisting"],"sources":["../../../../../../src/app/modules/database/repositories/trust-anchor/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { TrustAnchor } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { DataSource, FindOptionsWhere, Repository } from 'typeorm';\nimport { applyQuery, isEntityUnique, validateEntityJoinColumns } from 'typeorm-extension';\nimport { DatabaseConflictError, RealmEntity, TrustAnchorEntity } from '../../../../../adapters/database/index.ts';\nimport type { IRealmRepository, ITrustAnchorRepository } from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect, translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport class TrustAnchorRepositoryAdapter implements ITrustAnchorRepository {\n    protected dataSource: DataSource;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(dataSource: DataSource) {\n        this.dataSource = dataSource;\n        this.realmRepository = new RealmRepositoryAdapter(dataSource.getRepository(RealmEntity));\n    }\n\n    protected get repository(): Repository<TrustAnchorEntity> {\n        return this.dataSource.getRepository(TrustAnchorEntity);\n    }\n\n    async findMany(query: Record<string, any>): Promise<EntityRepositoryFindManyResult<TrustAnchor>> {\n        const qb = this.repository.createQueryBuilder('trustAnchor');\n        qb.groupBy('trustAnchor.id');\n\n        const { pagination } = applyQuery(qb, query, {\n            defaultAlias: 'trustAnchor',\n            fields: {\n                allowed: [\n                    'id',\n                    'name',\n                    'certificate',\n                    'enabled',\n                    'realm_id',\n                    'created_at',\n                    'updated_at',\n                ],\n            },\n            filters: { allowed: ['id', 'name', 'enabled', 'realm_id'] },\n            pagination: { maxLimit: 50 },\n            sort: { allowed: ['id', 'name', 'enabled', 'created_at', 'updated_at'] },\n        });\n\n        applyRealmScopeSelect(qb, 'trustAnchor');\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<TrustAnchor | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<TrustAnchor | null> {\n        const where: FindOptionsWhere<TrustAnchorEntity> = { name };\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n\n            where.realm_id = realmId;\n        }\n\n        return this.repository.findOneBy(where);\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<TrustAnchor | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<TrustAnchor[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<TrustAnchor | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<TrustAnchor>): TrustAnchor {\n        return this.repository.create(data);\n    }\n\n    merge(entity: TrustAnchor, data: Partial<TrustAnchor>): TrustAnchor {\n        return this.repository.merge(entity as TrustAnchorEntity, data);\n    }\n\n    async save(entity: TrustAnchor): Promise<TrustAnchor> {\n        return this.repository.save(entity as TrustAnchorEntity);\n    }\n\n    async remove(entity: TrustAnchor): Promise<void> {\n        await this.repository.remove(entity as TrustAnchorEntity);\n    }\n\n    async validateJoinColumns(data: Partial<TrustAnchor>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.dataSource,\n            entityTarget: TrustAnchorEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<TrustAnchor>, existing?: TrustAnchor): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.dataSource,\n            entityTarget: TrustAnchorEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAiBA,IAAaU,+BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,YAAwB;EAChC,KAAKA,aAAaA;EAClB,KAAKC,kBAAkB,IAAIH,uBAAuBE,WAAWE,cAAcR,WAAAA,CAAAA;CAC/E;CAEA,IAAcS,aAA4C;EACtD,OAAO,KAAKH,WAAWE,cAAcP,iBAAAA;CACzC;CAEA,MAAMS,SAASC,OAAkF;EAC7F,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,aAAA;EAC9CD,GAAGE,QAAQ,gBAAA;EAEX,MAAM,EAAEC,eAAenB,WAAWgB,IAAID,OAAO;GACzCK,cAAc;GACdC,QAAQ,EACJC,SAAS;IACL;IACA;IACA;IACA;IACA;IACA;IACA;KAER;GACAC,SAAS,EAAED,SAAS;IAAC;IAAM;IAAQ;IAAW;KAAY;GAC1DH,YAAY,EAAEK,UAAU,GAAG;GAC3BC,MAAM,EAAEH,SAAS;IAAC;IAAM;IAAQ;IAAW;IAAc;KAAc;EAC3E,CAAA;EAEAhB,sBAAsBU,IAAI,aAAA;EAE1B,MAAM,CAACU,UAAUC,SAAS,MAAMX,GAAGY,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGR;GACP;EACJ;CACJ;CAEA,MAAMY,YAAYC,IAAyC;EACvD,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,cAAcC,MAAcC,UAAgD;EAC9E,MAAMC,QAA6C,EAAEF,KAAK;EAE1D,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAK3B,gBAAgB4B,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAGXD,MAAMG,WAAWF;EACrB;EAEA,OAAO,KAAKzB,WAAWoB,UAAUI,KAAAA;CACrC;CAEA,MAAMI,kBAAkBC,UAAkBC,OAA6C;EACnF,OAAO5C,OAAO2C,QAAAA,IACV,KAAKX,YAAYW,QAAAA,IACjB,KAAKR,cAAcQ,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWP,OAAoD;EACjE,OAAO,KAAKxB,WAAWgC,OAAOtC,yBAAyB8B,KAAAA,CAAAA;CAC3D;CAEA,MAAMJ,UAAUI,OAAyD;EACrE,OAAO,KAAKxB,WAAWoB,UAAU1B,yBAAyB8B,KAAAA,CAAAA;CAC9D;CAEAS,OAAOjB,MAAyC;EAC5C,OAAO,KAAKhB,WAAWiC,OAAOjB,IAAAA;CAClC;CAEAkB,MAAMC,QAAqBnB,MAAyC;EAChE,OAAO,KAAKhB,WAAWkC,MAAMC,QAA6BnB,IAAAA;CAC9D;CAEA,MAAMoB,KAAKD,QAA2C;EAClD,OAAO,KAAKnC,WAAWoC,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAAoC;EAC7C,MAAM,KAAKnC,WAAWqC,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBtB,MAA2C;EACjE,MAAM3B,0BAA0B2B,MAAM;GAClCnB,YAAY,KAAKA;GACjB0C,cAAc/C;EAClB,CAAA;CACJ;CAEA,MAAMgD,gBAAgBxB,MAA4ByB,UAAuC;EAQrF,IAAI,CAACC,MAPkBtD,eAAe;GAClCS,YAAY,KAAKA;GACjB0C,cAAc/C;GACd2C,QAAQnB;GACR2B,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAInD,sBAAAA;CAElB;AACJ"}

package/dist/app/modules/database/repositories/user-authenticator/index.d.ts

@@ -0,0 +1,2 @@
+export * from './repository.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/app/modules/database/repositories/user-authenticator/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/user-authenticator/index.ts"],"names":[],"mappings":"AAOA,cAAc,iBAAiB,CAAC"}

package/dist/app/modules/database/repositories/user-authenticator/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { UserAuthenticatorRepositoryAdapter } from "./repository.mjs";
+export { UserAuthenticatorRepositoryAdapter };

package/dist/app/modules/database/repositories/user-authenticator/repository.d.ts

@@ -0,0 +1,19 @@
+import type { UserAuthenticator, UserAuthenticatorKind } from '@authup/core-kit';
+import type { Repository } from 'typeorm';
+import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { IUserAuthenticatorRepository, UserAuthenticatorFindManyOptions, UserAuthenticatorSecretsFilter } from '../../../../../core/index.ts';
+export declare class UserAuthenticatorRepositoryAdapter implements IUserAuthenticatorRepository {
+    private readonly repository;
+    constructor(repository: Repository<UserAuthenticator>);
+    create(data: Partial<UserAuthenticator>): UserAuthenticator;
+    save(entity: UserAuthenticator): Promise<UserAuthenticator>;
+    remove(entity: UserAuthenticator): Promise<void>;
+    removeAllByUser(userId: string, kind: `${UserAuthenticatorKind}`): Promise<void>;
+    findOneById(id: string): Promise<UserAuthenticator | null>;
+    findOneWithSecretsById(id: string): Promise<UserAuthenticator | null>;
+    findAllByUser(userId: string): Promise<UserAuthenticator[]>;
+    findAllWithSecretsByUser(userId: string, filter?: UserAuthenticatorSecretsFilter): Promise<UserAuthenticator[]>;
+    hasConfirmedByUser(userId: string): Promise<boolean>;
+    findMany(query: Record<string, any>, options?: UserAuthenticatorFindManyOptions): Promise<EntityRepositoryFindManyResult<UserAuthenticator>>;
+}
+//# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/database/repositories/user-authenticator/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/user-authenticator/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EACR,4BAA4B,EAC5B,gCAAgC,EAChC,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AAGtC,qBAAa,kCAAmC,YAAW,4BAA4B;IACnF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgC;gBAE/C,UAAU,EAAE,UAAU,CAAC,iBAAiB,CAAC;IAIrD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB;IAIrD,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAI3D,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhF,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAI1D,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAOrE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAI3D,wBAAwB,CAC1B,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,8BAAmC,GAC5C,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAgBzB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKpD,QAAQ,CACV,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,OAAO,GAAE,gCAAqC,GAC/C,OAAO,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;CAwChE"}