npm - @authup/server-core - Versions diffs - 1.0.0-beta.52 → 1.0.0-beta.53 - Mend

@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (742) hide show

package/dist/core/client-certificate/module.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.mjs","names":["AuthorityKeyIdentifierExtension","BasicConstraintsExtension","ExtendedKeyUsage","ExtendedKeyUsageExtension","URL","GENERAL_NAME_URL","KeyUsageFlags","KeyUsagesExtension","SubjectAlternativeNameExtension","SubjectKeyIdentifierExtension","X509Certificate","CLIENT_CERTIFICATE_URI_PREFIX","buildClientCertificateURI","ValidationError","base64URLEncode","MAX_CHAIN_DEPTH","CERTIFICATE_BLOCK_PATTERN","MAX_PATH_SIGNATURE_VERIFICATIONS","HANDLED_CRITICAL_EXTENSION_OIDS","Set","WEAK_SIGNATURE_HASHES","ANY_EXTENDED_KEY_USAGE_OID","ClientCertificateValidator","trustAnchorRepository","crypto","ctx","validateForBinding","evidence","assertClientCertificateEvidenceValidForBinding","validateForAuthentication","client","assertClientCertificatePurpose","certificate","assertClientCertificateIdentity","id","assertCertificateExtensionsUnderstood","assertStrongSignature","anchors","findManyBy","realm_id","enabled","anchor","anchorCertificate","parseAnchorCertificate","budget","remaining","path","buildPath","chain","assertCertificationPath","assertCertificateCurrent","constraints","getExtension","ca","parseClientCertificateChain","pem","blocks","match","length","map","block","buildClientCertificateThumbprint","digest","getThumbprint","String","fromCharCode","Uint8Array","undefined","leaf","intermediates","continuePath","current","available","sameCertificate","isIssuedBy","index","candidate","next","filter","_item","candidateIndex","issuer","subject","authorityKeyIdentifier","keyId","subjectKeyIdentifier","verify","publicKey","signatureOnly","left","right","leftRaw","rawData","rightRaw","every","value","isAnchor","assertIssuerExtendedKeyUsage","keyUsage","usages","keyCertSign","pathLength","extendedKeyUsage","includes","clientAuth","digitalSignature","clientId","subjectAlternativeName","authupUris","names","items","name","type","startsWith","expected","now","Date","notBefore","getTime","notAfter","extension","extensions","critical","has","hash","signatureAlgorithm","toUpperCase"],"sources":["../../../src/core/client-certificate/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n AuthorityKeyIdentifierExtension,\n BasicConstraintsExtension,\n ExtendedKeyUsage,\n ExtendedKeyUsageExtension,\n URL as GENERAL_NAME_URL,\n KeyUsageFlags,\n KeyUsagesExtension,\n SubjectAlternativeNameExtension,\n SubjectKeyIdentifierExtension,\n X509Certificate,\n} from '@peculiar/x509';\nimport type { Client, TrustAnchor } from '@authup/core-kit';\nimport {\n CLIENT_CERTIFICATE_URI_PREFIX,\n buildClientCertificateURI,\n} from '@authup/core-kit';\nimport { ValidationError } from '@authup/errors';\nimport { base64URLEncode } from '@authup/kit';\nimport type {\n ClientCertificateEvidence,\n ClientCertificateValidatorContext,\n IClientCertificateValidator,\n} from './types.ts';\n\nconst MAX_CHAIN_DEPTH = 10;\nconst CERTIFICATE_BLOCK_PATTERN = /-----BEGIN CERTIFICATE-----[\\s\\S]*?-----END CERTIFICATE-----/g;\n\n/**\n * Hard ceiling on signature verifications performed while building a single\n * certification path. A legitimate chain of the maximum accepted length only\n * needs O(depth²) verifications; the ceiling exists purely to defuse the\n * factorial backtracking blow-up an attacker can induce with certificates\n * that mutually \"issue\" one another (shared key, identical subject/issuer\n * DNs). Reaching the ceiling is treated as \"no path found\" (fail closed).\n */\nconst MAX_PATH_SIGNATURE_VERIFICATIONS = 64;\n\n/**\n * OIDs of the certificate extensions this validator actually processes. A\n * certificate carrying a *critical* extension outside this set is rejected\n * (RFC 5280 §4.2): an unprocessed critical constraint must never be silently\n * ignored. Because RFC 5280 requires the NameConstraints extension to be\n * marked critical, this also fails a name-constrained CA closed rather than\n * trusting a chain whose name constraints we do not evaluate.\n */\nconst HANDLED_CRITICAL_EXTENSION_OIDS = new Set<string>([\n '2.5.29.19', // basicConstraints\n '2.5.29.15', // keyUsage\n '2.5.29.37', // extKeyUsage\n '2.5.29.17', // subjectAltName\n '2.5.29.35', // authorityKeyIdentifier\n '2.5.29.14', // subjectKeyIdentifier\n]);\n\nconst WEAK_SIGNATURE_HASHES = new Set<string>(['SHA-1', 'MD5', 'MD2', 'MD4']);\n\n// anyExtendedKeyUsage (RFC 5280 §4.2.1.12) — a CA carrying it is unconstrained.\nconst ANY_EXTENDED_KEY_USAGE_OID = '2.5.29.37.0';\n\ntype SignatureVerificationBudget = { remaining: number };\n\n/**\n * Validates client certificates without performing network I/O. AIA, CRL,\n * and OCSP retrieval are deliberately outside the external-PKI first slice.\n */\nexport class ClientCertificateValidator implements IClientCertificateValidator {\n protected trustAnchorRepository: ClientCertificateValidatorContext['trustAnchorRepository'];\n\n protected crypto?: Crypto;\n\n constructor(ctx: ClientCertificateValidatorContext) {\n this.trustAnchorRepository = ctx.trustAnchorRepository;\n this.crypto = ctx.crypto;\n }\n\n validateForBinding(evidence: ClientCertificateEvidence): void {\n assertClientCertificateEvidenceValidForBinding(evidence);\n }\n\n async validateForAuthentication(\n client: Pick<Client, 'id' | 'realm_id'>,\n evidence: ClientCertificateEvidence,\n ): Promise<void> {\n this.validateForBinding(evidence);\n assertClientCertificatePurpose(evidence.certificate);\n assertClientCertificateIdentity(evidence.certificate, client.id);\n assertCertificateExtensionsUnderstood(evidence.certificate);\n assertStrongSignature(evidence.certificate);\n\n const anchors = await this.trustAnchorRepository.findManyBy({\n realm_id: client.realm_id,\n enabled: true,\n });\n\n for (const anchor of anchors) {\n const anchorCertificate = parseAnchorCertificate(anchor);\n if (!anchorCertificate) {\n continue;\n }\n\n const budget: SignatureVerificationBudget = { remaining: MAX_PATH_SIGNATURE_VERIFICATIONS };\n const path = await buildPath(\n evidence.certificate,\n evidence.chain,\n anchorCertificate,\n budget,\n this.crypto,\n );\n if (!path) {\n continue;\n }\n\n try {\n assertCertificationPath(path);\n return;\n } catch {\n // A chain reaching this anchor failed its CA constraints;\n // another enabled anchor may still yield a valid path.\n continue;\n }\n }\n\n throw new ValidationError('The client certificate is not trusted in this realm.');\n }\n}\n\nexport function assertClientCertificateEvidenceValidForBinding(\n evidence: ClientCertificateEvidence,\n): void {\n assertCertificateCurrent(evidence.certificate);\n\n const constraints = evidence.certificate.getExtension(BasicConstraintsExtension);\n if (constraints?.ca) {\n throw new ValidationError('A CA certificate cannot be used as a client certificate.');\n }\n}\n\nexport function parseClientCertificateChain(pem: string): X509Certificate[] {\n const blocks = pem.match(CERTIFICATE_BLOCK_PATTERN);\n if (!blocks || blocks.length === 0) {\n throw new ValidationError('The certificate chain could not be parsed.');\n }\n\n try {\n return blocks.map((block) => new X509Certificate(block));\n } catch {\n throw new ValidationError('The certificate chain could not be parsed.');\n }\n}\n\nexport async function buildClientCertificateThumbprint(\n certificate: X509Certificate,\n crypto?: Crypto,\n): Promise<string> {\n const digest = await certificate.getThumbprint('SHA-256', crypto);\n\n return base64URLEncode(\n String.fromCharCode(...new Uint8Array(digest)),\n );\n}\n\nfunction parseAnchorCertificate(anchor: TrustAnchor): X509Certificate | undefined {\n try {\n return parseClientCertificateChain(anchor.certificate)[0];\n } catch {\n // Rows are validated on create. Treat a corrupt legacy/database row as\n // unusable trust material instead of turning client authentication into\n // a 500 or accidentally trusting another certificate in its PEM chain.\n return undefined;\n }\n}\n\nasync function buildPath(\n leaf: X509Certificate,\n intermediates: X509Certificate[],\n anchor: X509Certificate,\n budget: SignatureVerificationBudget,\n crypto?: Crypto,\n): Promise<X509Certificate[] | undefined> {\n return continuePath(leaf, intermediates, anchor, [leaf], budget, crypto);\n}\n\nasync function continuePath(\n current: X509Certificate,\n available: X509Certificate[],\n anchor: X509Certificate,\n path: X509Certificate[],\n budget: SignatureVerificationBudget,\n crypto?: Crypto,\n): Promise<X509Certificate[] | undefined> {\n if (path.length > MAX_CHAIN_DEPTH) {\n return undefined;\n }\n\n if (sameCertificate(current, anchor)) {\n return path;\n }\n\n if (await isIssuedBy(current, anchor, budget, crypto)) {\n return [...path, anchor];\n }\n\n for (let index = 0; index < available.length; index += 1) {\n const candidate = available[index];\n if (\n !candidate ||\n sameCertificate(current, candidate) ||\n !await isIssuedBy(current, candidate, budget, crypto)\n ) {\n continue;\n }\n\n const next = await continuePath(\n candidate,\n available.filter((_item, candidateIndex) => candidateIndex !== index),\n anchor,\n [...path, candidate],\n budget,\n crypto,\n );\n if (next) {\n return next;\n }\n }\n\n return undefined;\n}\n\nasync function isIssuedBy(\n certificate: X509Certificate,\n issuer: X509Certificate,\n budget: SignatureVerificationBudget,\n crypto?: Crypto,\n): Promise<boolean> {\n if (certificate.issuer !== issuer.subject) {\n return false;\n }\n\n const authorityKeyIdentifier = certificate.getExtension(AuthorityKeyIdentifierExtension);\n if (authorityKeyIdentifier?.keyId) {\n const subjectKeyIdentifier = issuer.getExtension(SubjectKeyIdentifierExtension);\n if (subjectKeyIdentifier && subjectKeyIdentifier.keyId !== authorityKeyIdentifier.keyId) {\n return false;\n }\n }\n\n // Spend from the shared verification budget only for the expensive\n // cryptographic check (the DN / key-id pre-filters above are cheap). Once\n // exhausted, treat every further edge as unverified so a maliciously\n // crafted mutually-issuing certificate set cannot force factorial work.\n if (budget.remaining <= 0) {\n return false;\n }\n budget.remaining -= 1;\n\n try {\n return await certificate.verify({\n publicKey: issuer,\n signatureOnly: true,\n }, crypto);\n } catch {\n return false;\n }\n}\n\nfunction sameCertificate(left: X509Certificate, right: X509Certificate): boolean {\n const leftRaw = new Uint8Array(left.rawData);\n const rightRaw = new Uint8Array(right.rawData);\n\n return leftRaw.length === rightRaw.length &&\n leftRaw.every((value, index) => value === rightRaw[index]);\n}\n\nfunction assertCertificationPath(path: X509Certificate[]): void {\n if (path.length < 2) {\n throw new ValidationError('The client certificate chain is invalid.');\n }\n\n for (let index = 1; index < path.length; index += 1) {\n const certificate = path[index];\n if (!certificate) {\n throw new ValidationError('The client certificate chain is invalid.');\n }\n\n // The last path element is the configured trust anchor, trusted a\n // priori — its self-signature algorithm and any critical extensions\n // it carries are the operator's responsibility, so the RFC 5280\n // conformance checks below apply only to the issued intermediates.\n const isAnchor = index === path.length - 1;\n if (!isAnchor) {\n assertCertificateExtensionsUnderstood(certificate);\n assertStrongSignature(certificate);\n assertIssuerExtendedKeyUsage(certificate);\n }\n\n assertCertificateCurrent(certificate);\n const constraints = certificate.getExtension(BasicConstraintsExtension);\n if (!constraints?.ca) {\n throw new ValidationError('The client certificate chain contains a non-CA issuer.');\n }\n\n const keyUsage = certificate.getExtension(KeyUsagesExtension);\n if (keyUsage && (keyUsage.usages & KeyUsageFlags.keyCertSign) === 0) {\n throw new ValidationError('A client certificate issuer cannot sign certificates.');\n }\n\n // `index - 1` is the number of non-leaf CA certificates below this\n // issuer in the selected path. A pathLenConstraint of zero therefore\n // permits a directly-issued client leaf and no subordinate CA.\n if (\n typeof constraints.pathLength === 'number' &&\n (index - 1) > constraints.pathLength\n ) {\n throw new ValidationError('The client certificate chain exceeds a CA path-length constraint.');\n }\n }\n}\n\nfunction assertClientCertificatePurpose(certificate: X509Certificate): void {\n const extendedKeyUsage = certificate.getExtension(ExtendedKeyUsageExtension);\n if (\n extendedKeyUsage &&\n !extendedKeyUsage.usages.includes(ExtendedKeyUsage.clientAuth)\n ) {\n throw new ValidationError('The certificate is not valid for TLS client authentication.');\n }\n\n const keyUsage = certificate.getExtension(KeyUsagesExtension);\n if (keyUsage && (keyUsage.usages & KeyUsageFlags.digitalSignature) === 0) {\n throw new ValidationError('The certificate cannot prove possession of its private key.');\n }\n}\n\n/**\n * EKU chaining (RFC 5280 §4.2.1.12): a CA whose Extended Key Usage is present\n * but omits both `clientAuth` and `anyExtendedKeyUsage` is not permitted to\n * issue TLS-client-authentication certificates, so a leaf beneath it must be\n * rejected. (A CA's EKU may be non-critical, so the critical-extension check\n * does not cover this.) A CA with no EKU extension is unconstrained.\n */\nfunction assertIssuerExtendedKeyUsage(certificate: X509Certificate): void {\n const extendedKeyUsage = certificate.getExtension(ExtendedKeyUsageExtension);\n if (\n extendedKeyUsage &&\n !extendedKeyUsage.usages.includes(ExtendedKeyUsage.clientAuth) &&\n !extendedKeyUsage.usages.includes(ANY_EXTENDED_KEY_USAGE_OID)\n ) {\n throw new ValidationError('A client certificate issuer is not permitted to issue TLS client-authentication certificates.');\n }\n}\n\nfunction assertClientCertificateIdentity(certificate: X509Certificate, clientId: string): void {\n const subjectAlternativeName = certificate.getExtension(SubjectAlternativeNameExtension);\n const authupUris = subjectAlternativeName ?\n subjectAlternativeName.names.items\n .filter((name) => name.type === GENERAL_NAME_URL)\n .map((name) => name.value)\n .filter((value) => value.startsWith(CLIENT_CERTIFICATE_URI_PREFIX)) :\n [];\n\n const expected = buildClientCertificateURI(clientId);\n if (authupUris.length !== 1 || authupUris[0] !== expected) {\n throw new ValidationError(`The certificate must contain exactly one Authup client URI SAN: ${expected}.`);\n }\n}\n\nfunction assertCertificateCurrent(certificate: X509Certificate): void {\n const now = Date.now();\n if (\n certificate.notBefore.getTime() > now ||\n certificate.notAfter.getTime() < now\n ) {\n throw new ValidationError('The client certificate is not currently valid.');\n }\n}\n\nfunction assertCertificateExtensionsUnderstood(certificate: X509Certificate): void {\n for (const extension of certificate.extensions) {\n if (extension.critical && !HANDLED_CRITICAL_EXTENSION_OIDS.has(extension.type)) {\n throw new ValidationError(\n `The certificate carries an unsupported critical extension (${extension.type}).`,\n );\n }\n }\n}\n\nfunction assertStrongSignature(certificate: X509Certificate): void {\n const hash = certificate.signatureAlgorithm?.hash?.name;\n if (typeof hash === 'string' && WEAK_SIGNATURE_HASHES.has(hash.toUpperCase())) {\n throw new ValidationError(`The certificate is signed with a weak algorithm (${hash}).`);\n }\n}\n"],"mappings":";;;;;;;;AAgCA,MAAMe,kBAAkB;AACxB,MAAMC,4BAA4B;;;;;;;;GAUlC,MAAMC,mCAAmC;;;;;;;;GAUzC,MAAMC,kDAAkC,IAAIC,IAAY;CACpD;CACA;CACA;CACA;CACA;CACA;CACH;AAED,MAAMC,wCAAwB,IAAID,IAAY;CAAC;CAAS;CAAO;CAAO;CAAM;AAG5E,MAAME,6BAA6B;;;;GAQnC,IAAaC,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKF,wBAAwBE,IAAIF;EACjC,KAAKC,SAASC,IAAID;CACtB;CAEAE,mBAAmBC,UAA2C;EAC1DC,+CAA+CD,QAAAA;CACnD;CAEA,MAAME,0BACFC,QACAH,UACa;EACb,KAAKD,mBAAmBC,QAAAA;EACxBI,+BAA+BJ,SAASK,WAAW;EACnDC,gCAAgCN,SAASK,aAAaF,OAAOI,EAAE;EAC/DC,sCAAsCR,SAASK,WAAW;EAC1DI,sBAAsBT,SAASK,WAAW;EAE1C,MAAMK,UAAU,MAAM,KAAKd,sBAAsBe,WAAW;GACxDC,UAAUT,OAAOS;GACjBC,SAAS;EACb,CAAA;EAEA,KAAK,MAAMC,UAAUJ,SAAS;GAC1B,MAAMK,oBAAoBC,uBAAuBF,MAAAA;GACjD,IAAI,CAACC,mBACD;GAGJ,MAAME,SAAsC,EAAEC,WAAW5B,iCAAiC;GAC1F,MAAM6B,OAAO,MAAMC,UACfpB,SAASK,aACTL,SAASqB,OACTN,mBACAE,QACA,KAAKpB,MAAM;GAEf,IAAI,CAACsB,MACD;GAGJ,IAAI;IACAG,wBAAwBH,IAAAA;IACxB;GACJ,QAAQ;IAGJ;GACJ;EACJ;EAEA,MAAM,IAAIjC,gBAAgB,sDAAA;CAC9B;AACJ;AAEA,SAAgBe,+CACZD,UAAmC;CAEnCuB,yBAAyBvB,SAASK,WAAW;CAG7C,IADoBL,SAASK,YAAYoB,aAAanD,yBAClDkD,CAAAA,EAAaE,IACb,MAAM,IAAIxC,gBAAgB,0DAAA;AAElC;AAEA,SAAgByC,4BAA4BC,KAAW;CACnD,MAAMC,SAASD,IAAIE,MAAMzC,yBAAAA;CACzB,IAAI,CAACwC,UAAUA,OAAOE,WAAW,GAC7B,MAAM,IAAI7C,gBAAgB,4CAAA;CAG9B,IAAI;EACA,OAAO2C,OAAOG,KAAKC,UAAU,IAAIlD,gBAAgBkD,KAAAA,CAAAA;CACrD,QAAQ;EACJ,MAAM,IAAI/C,gBAAgB,4CAAA;CAC9B;AACJ;AAEA,eAAsBgD,iCAClB7B,aACAR,QAAe;CAEf,MAAMsC,SAAS,MAAM9B,YAAY+B,cAAc,WAAWvC,MAAAA;CAE1D,OAAOV,gBACHkD,OAAOC,aAAY,GAAI,IAAIC,WAAWJ,MAAAA,CAAAA,CAAAA;AAE9C;AAEA,SAASnB,uBAAuBF,QAAmB;CAC/C,IAAI;EACA,OAAOa,4BAA4Bb,OAAOT,WAAW,CAAC,CAAC;CAC3D,QAAQ;EAIJ;CACJ;AACJ;AAEA,eAAee,UACXqB,MACAC,eACA5B,QACAG,QACApB,QAAe;CAEf,OAAO8C,aAAaF,MAAMC,eAAe5B,QAAQ,CAAC2B,IAAAA,GAAOxB,QAAQpB,MAAAA;AACrE;AAEA,eAAe8C,aACXC,SACAC,WACA/B,QACAK,MACAF,QACApB,QAAe;CAEf,IAAIsB,KAAKY,SAAS3C,iBACd;CAGJ,IAAI0D,gBAAgBF,SAAS9B,MAAAA,GACzB,OAAOK;CAGX,IAAI,MAAM4B,WAAWH,SAAS9B,QAAQG,QAAQpB,MAAAA,GAC1C,OAAO,CAAA,GAAIsB,MAAML,MAAAA;CAGrB,KAAK,IAAIkC,QAAQ,GAAGA,QAAQH,UAAUd,QAAQiB,SAAS,GAAG;EACtD,MAAMC,YAAYJ,UAAUG;EAC5B,IACI,CAACC,aACDH,gBAAgBF,SAASK,SAAAA,KACzB,CAAC,MAAMF,WAAWH,SAASK,WAAWhC,QAAQpB,MAAAA,GAE9C;EAGJ,MAAMqD,OAAO,MAAMP,aACfM,WACAJ,UAAUM,QAAQC,OAAOC,mBAAmBA,mBAAmBL,KAAAA,GAC/DlC,QACA,CAAA,GAAIK,MAAM8B,SAAAA,GACVhC,QACApB,MAAAA;EAEJ,IAAIqD,MACA,OAAOA;CAEf;AAGJ;AAEA,eAAeH,WACX1C,aACAiD,QACArC,QACApB,QAAe;CAEf,IAAIQ,YAAYiD,WAAWA,OAAOC,SAC9B,OAAO;CAGX,MAAMC,yBAAyBnD,YAAYoB,aAAapD,+BAAAA;CACxD,IAAImF,wBAAwBC,OAAO;EAC/B,MAAMC,uBAAuBJ,OAAO7B,aAAa3C,6BAAAA;EACjD,IAAI4E,wBAAwBA,qBAAqBD,UAAUD,uBAAuBC,OAC9E,OAAO;CAEf;CAMA,IAAIxC,OAAOC,aAAa,GACpB,OAAO;CAEXD,OAAOC,aAAa;CAEpB,IAAI;EACA,OAAO,MAAMb,YAAYsD,OAAO;GAC5BC,WAAWN;GACXO,eAAe;EACnB,GAAGhE,MAAAA;CACP,QAAQ;EACJ,OAAO;CACX;AACJ;AAEA,SAASiD,gBAAgBgB,MAAuBC,OAAsB;CAClE,MAAMC,UAAU,IAAIzB,WAAWuB,KAAKG,OAAO;CAC3C,MAAMC,WAAW,IAAI3B,WAAWwB,MAAME,OAAO;CAE7C,OAAOD,QAAQjC,WAAWmC,SAASnC,UAC/BiC,QAAQG,OAAOC,OAAOpB,UAAUoB,UAAUF,SAASlB,MAAM;AACjE;AAEA,SAAS1B,wBAAwBH,MAAuB;CACpD,IAAIA,KAAKY,SAAS,GACd,MAAM,IAAI7C,gBAAgB,0CAAA;CAG9B,KAAK,IAAI8D,QAAQ,GAAGA,QAAQ7B,KAAKY,QAAQiB,SAAS,GAAG;EACjD,MAAM3C,cAAcc,KAAK6B;EACzB,IAAI,CAAC3C,aACD,MAAM,IAAInB,gBAAgB,0CAAA;EAQ9B,IAAI,EADa8D,UAAU7B,KAAKY,SAAS,IAC1B;GACXvB,sCAAsCH,WAAAA;GACtCI,sBAAsBJ,WAAAA;GACtBiE,6BAA6BjE,WAAAA;EACjC;EAEAkB,yBAAyBlB,WAAAA;EACzB,MAAMmB,cAAcnB,YAAYoB,aAAanD,yBAAAA;EAC7C,IAAI,CAACkD,aAAaE,IACd,MAAM,IAAIxC,gBAAgB,wDAAA;EAG9B,MAAMqF,WAAWlE,YAAYoB,aAAa7C,kBAAAA;EAC1C,IAAI2F,aAAaA,SAASC,SAAS7F,cAAc8F,iBAAiB,GAC9D,MAAM,IAAIvF,gBAAgB,uDAAA;EAM9B,IACI,OAAOsC,YAAYkD,eAAe,YAClC,QAAS,IAAKlD,YAAYkD,YAE1B,MAAM,IAAIxF,gBAAgB,mEAAA;CAElC;AACJ;AAEA,SAASkB,+BAA+BC,aAA4B;CAChE,MAAMsE,mBAAmBtE,YAAYoB,aAAajD,yBAAAA;CAClD,IACImG,oBACA,CAACA,iBAAiBH,OAAOI,SAASrG,iBAAiBsG,UAAU,GAE7D,MAAM,IAAI3F,gBAAgB,6DAAA;CAG9B,MAAMqF,WAAWlE,YAAYoB,aAAa7C,kBAAAA;CAC1C,IAAI2F,aAAaA,SAASC,SAAS7F,cAAcmG,sBAAsB,GACnE,MAAM,IAAI5F,gBAAgB,6DAAA;AAElC;;;;;;;GASA,SAASoF,6BAA6BjE,aAA4B;CAC9D,MAAMsE,mBAAmBtE,YAAYoB,aAAajD,yBAAAA;CAClD,IACImG,oBACA,CAACA,iBAAiBH,OAAOI,SAASrG,iBAAiBsG,UAAU,KAC7D,CAACF,iBAAiBH,OAAOI,SAASlF,0BAAAA,GAElC,MAAM,IAAIR,gBAAgB,+FAAA;AAElC;AAEA,SAASoB,gCAAgCD,aAA8B0E,UAAgB;CACnF,MAAMC,yBAAyB3E,YAAYoB,aAAa5C,+BAAAA;CACxD,MAAMoG,aAAaD,yBACfA,uBAAuBE,MAAMC,MACxBhC,QAAQiC,SAASA,KAAKC,SAAS3G,GAAAA,CAAAA,CAC/BsD,KAAKoD,SAASA,KAAKhB,KAAK,CAAA,CACxBjB,QAAQiB,UAAUA,MAAMkB,WAAWtG,6BAAAA,CAAAA,IACxC,CAAA;CAEJ,MAAMuG,WAAWtG,0BAA0B8F,QAAAA;CAC3C,IAAIE,WAAWlD,WAAW,KAAKkD,WAAW,OAAOM,UAC7C,MAAM,IAAIrG,gBAAgB,mEAAmEqG,SAAS,EAAE;AAEhH;AAEA,SAAShE,yBAAyBlB,aAA4B;CAC1D,MAAMmF,MAAMC,KAAKD,IAAG;CACpB,IACInF,YAAYqF,UAAUC,QAAO,IAAKH,OAClCnF,YAAYuF,SAASD,QAAO,IAAKH,KAEjC,MAAM,IAAItG,gBAAgB,gDAAA;AAElC;AAEA,SAASsB,sCAAsCH,aAA4B;CACvE,KAAK,MAAMwF,aAAaxF,YAAYyF,YAChC,IAAID,UAAUE,YAAY,CAACxG,gCAAgCyG,IAAIH,UAAUR,IAAI,GACzE,MAAM,IAAInG,gBACN,8DAA8D2G,UAAUR,KAAK,GAAG;AAIhG;AAEA,SAAS5E,sBAAsBJ,aAA4B;CACvD,MAAM4F,OAAO5F,YAAY6F,oBAAoBD,MAAMb;CACnD,IAAI,OAAOa,SAAS,YAAYxG,sBAAsBuG,IAAIC,KAAKE,YAAW,CAAA,GACtE,MAAM,IAAIjH,gBAAgB,oDAAoD+G,KAAK,GAAG;AAE9F"}

package/dist/core/client-certificate/types.d.ts ADDED Viewed

@@ -0,0 +1,22 @@
+import type { X509Certificate } from '@peculiar/x509';
+import type { Client } from '@authup/core-kit';
+import type { ITrustAnchorRepository } from '../entities/index.ts';
+/**
+ * Runtime-neutral evidence derived from the certificate used in the external
+ * client-facing TLS handshake. `chain` excludes the leaf and is ordered as it
+ * appeared on the wire when the forwarding format preserves that order.
+ */
+export type ClientCertificateEvidence = {
+    certificate: X509Certificate;
+    chain: X509Certificate[];
+    thumbprint: string;
+};
+export type ClientCertificateValidatorContext = {
+    trustAnchorRepository: Pick<ITrustAnchorRepository, 'findManyBy'>;
+    crypto?: Crypto;
+};
+export interface IClientCertificateValidator {
+    validateForBinding(evidence: ClientCertificateEvidence): void;
+    validateForAuthentication(client: Pick<Client, 'id' | 'realm_id'>, evidence: ClientCertificateEvidence): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/client-certificate/types.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/client-certificate/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,eAAe,CAAC;IAC7B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,qBAAqB,EAAE,IAAI,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAC;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,2BAA2B;IACxC,kBAAkB,CAAC,QAAQ,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC9D,yBAAyB,CACrB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,UAAU,CAAC,EACvC,QAAQ,EAAE,yBAAyB,GACpC,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB"}

package/dist/core/client-certificate/types.mjs ADDED Viewed

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/entities/client/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,~~EAEH~~,eAAe,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAmD5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IA2CZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;~~IAuJI~~,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,eAAe,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAmD5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IA2CZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IA2JI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}

package/dist/core/entities/client/service.mjs CHANGED Viewed

@@ -3,10 +3,10 @@ import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "../../authentication/credential/entities/client/module.mjs";
 import { ValidatorGroup, isUUID } from "@authup/kit";
-import { CLIENT_RESERVED_NAMES, ClientValidator, PermissionName } from "@authup/core-kit";
+import { CLIENT_RESERVED_NAMES, ClientAuthMethod, ClientValidator, PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
 //#region src/core/entities/client/service.ts
 var ClientService = class extends AbstractEntityService {
 	repository;
@@ -115,7 +115,7 @@ var ClientService = class extends AbstractEntityService {
 			group = ValidatorGroup.CREATE;
 		}
 		const validated = await this.validator.run(data, { group });
-		if (typeof validated.name === "string" && CLIENT_RESERVED_NAMES.includes(validated.name) && !(entity && entity.built_in && entity.name === validated.name)) throw new BadRequestError(`The client name '${validated.name}' is reserved.`);
+		if (typeof validated.name === "string" && CLIENT_RESERVED_NAMES.includes(validated.name) && !(entity && entity.built_in && entity.name === validated.name)) throw new ValidationError(`The client name '${validated.name}' is reserved.`);
 		await this.repository.validateJoinColumns(validated);
 		await this.repository.checkUniqueness(validated, entity || void 0);
 		const credentialsService = new ClientCredentialsService();
@@ -139,10 +139,14 @@ var ClientService = class extends AbstractEntityService {
 					...this.resourceRealmMatch(entity)
 				})
 			});
-			if (entity.is_confidential) {
+			if (entity.auth_method === ClientAuthMethod.SECRET) {
 				if (!validated.secret && !entity.secret) validated.secret = credentialsService.generateSecret();
 				if (validated.secret) entity.secret = await credentialsService.protect(validated.secret, entity);
-			} else entity.secret = null;
+			} else {
+				entity.secret = null;
+				entity.secret_hashed = false;
+				entity.secret_encrypted = false;
+			}
 			await this.repository.save(entity);
 			return {
 				entity,
@@ -161,10 +165,14 @@ var ClientService = class extends AbstractEntityService {
 			})
 		});
 		entity = this.repository.create(validated);
-		if (entity.is_confidential) {
+		if (entity.auth_method === ClientAuthMethod.SECRET) {
 			if (!validated.secret) validated.secret = credentialsService.generateSecret();
 			entity.secret = await credentialsService.protect(validated.secret, validated);
-		} else entity.secret = null;
+		} else {
+			entity.secret = null;
+			entity.secret_hashed = false;
+			entity.secret_encrypted = false;
+		}
 		await this.repository.save(entity);
 		return {
 			entity,

package/dist/core/entities/client/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","BadRequestError","EntityNotFoundError","CLIENT_RESERVED_NAMES","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","data","entities","meta","findMany","total","entity","secret","secret_encrypted","secret_hashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","realmId","permissionNames","isMe","identity","type","id","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","built_in","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","is_confidential","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n CLIENT_RESERVED_NAMES,\n ClientValidator,\n PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\n\nexport type ClientServiceContext = {\n repository: IClientRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n protected repository: IClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ClientValidator;\n\n constructor(ctx: ClientServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ClientValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Client>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n const {\n data: entities, \n meta, \n } = await this.repository.findMany(query);\n let { total } = meta;\n\n const data: Client[] = [];\n for (const entity of entities) {\n if (\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n\n continue;\n }\n\n data.push(entity);\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<Client> {\n const permissionNames = [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ];\n\n let isMe = !!actor.identity &&\n actor.identity.type === 'client' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n const entity = await this.repository.findOne(idOrName, query, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n if (\n !isMe &&\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: permissionNames,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Client,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realm_id === 'string' ?\n await this.realmRepository.resolve(data.realm_id) :\n undefined;\n\n let entity: Client \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realm_id = realm.id;\n }\n\n entity = await this.repository.findOneWithSecret(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'client' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n }\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n // Reserve the system-provisioned client names (`system`, `web`) so an\n // API caller can't create or rename a client onto them — that would\n // collide on unique(name, realm_id) or shadow the built_in client.\n // Provisioning and runtime hooks bypass this service, so they remain\n // free to manage the reserved clients. built_in clients are exempt\n // (they ARE the provisioned ones) but API callers can never produce a\n // built_in client since the validator strips the flag.\n if (\n typeof validated.name === 'string' &&\n CLIENT_RESERVED_NAMES.includes(validated.name) &&\n !(entity && entity.built_in && entity.name === validated.name)\n ) {\n throw new BadRequestError(`The client name '${validated.name}' is reserved.`);\n }\n\n await this.repository.validateJoinColumns(validated);\n await this.repository.checkUniqueness(validated, entity \|\| undefined);\n\n const credentialsService = new ClientCredentialsService();\n\n if (entity) {\n if (\n !isSelfEdit &&\n !validated.realm_id &&\n !entity.realm_id\n ) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n if (entity.is_confidential) {\n if (!validated.secret && !entity.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n if (validated.secret) {\n entity.secret = await credentialsService.protect(validated.secret, entity);\n }\n } else {\n entity.secret = null;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realm_id) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n\n entity = this.repository.create(validated);\n\n if (entity.is_confidential) {\n if (!validated.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n entity.secret = await credentialsService.protect(validated.secret, validated);\n } else {\n entity.secret = null;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;AA2BA,IAAaW,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,gBAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,KAAAA;EACnC,IAAI,EAAEY,UAAUF;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMK,UAAUJ,UAAU;GAC3B,IACII,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eACV;IACE,IAAI;KACA,MAAMf,MAAMC,oBAAoBe,cAAc;MAC1Cb,MAAM;OACFb,eAAec;OACfd,eAAee;OACff,eAAegB;;MAEnBC,MAAMxB,iBAAiB;QAAGD,kBAAkBmC,aAAaL;OAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;MAAQ,CAAA;KACxG,CAAA;KACAL,KAAKY,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAJ,KAAKY,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHL;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACe;EACf,MAAMC,kBAAkB;GACpBjC,eAAec;GACfd,eAAee;GACff,eAAegB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMyB,YACfzB,MAAMyB,SAASC,SAAS,aAEpB1B,MAAMyB,SAASlB,KAAKoB,OAAON,YAC3BrB,MAAMyB,SAASlB,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKlB,WAAWkC,QAAQP,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAIzB,oBAAAA;EAGd,IAAIqC,QAAQxB,MAAMyB,SAAUlB,KAAKoB,OAAOf,OAAOe,IAAI;GAC/CH,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACC,QACDZ,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eAER,MAAMf,MAAMC,oBAAoBe,cAAc;GAC1Cb,MAAMoB;GACNhB,MAAMxB,iBAAiB;KAAGD,kBAAkBmC,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFtB,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWxB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMoB,OACFX,UACAd,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKT,UAAUd,MAAMP,OAAO,EAAEiC,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAd,MACAP,OACAkC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO7B,KAAK8B,aAAa,WACnC,MAAM,KAAK1C,gBAAgB2C,QAAQ/B,KAAK8B,QAAQ,IAChDN,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMkB,QAA6B,CAAC;GACpC,IAAItD,OAAOoC,QAAAA,GACPkB,MAAMZ,KAAKN;QAEXkB,MAAMpC,OAAOkB;GAGjB,IAAIe,OACAG,MAAMF,WAAWD,MAAMT;GAG3Bf,SAAS,MAAM,KAAKlB,WAAW8C,kBAAkBD,KAAAA;GACjD,IAAI,CAAC3B,UAAUsB,QAAQD,YACnB,MAAM,IAAI9C,oBAAAA;EAElB,OAAO,IAAI+C,QAAQD,YACf,MAAM,IAAI9C,oBAAAA;EAGd,IAAIsD,aAAa;EACjB,IAAI7B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAee,cAAc,CAAA;GACrF,SAASsC,GAAG;IACR,IACI,CAAC3C,MAAMyB,YACPzB,MAAMyB,SAASC,SAAS,YACxB1B,MAAMyB,SAASlB,KAAKoB,OAAOf,OAAOe,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMzC,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAesD,mBAAmB,CAAA;GAC1F;GACAT,QAAQnD,eAAe6D;EAC3B,OAAO;GACH,MAAM7C,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAewD,cAAc,CAAA;GACjFX,QAAQnD,eAAe+D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKpD,UAAUqD,IAAI1C,MAAM,EAAE4B,MAAM,CAAA;EASzD,IACI,OAAOa,UAAU7C,SAAS,YAC1Bf,sBAAsB8D,SAASF,UAAU7C,IAAI,KAC7C,EAAES,UAAUA,OAAOuC,YAAYvC,OAAOT,SAAS6C,UAAU7C,OAEzD,MAAM,IAAIjB,gBAAgB,oBAAoB8D,UAAU7C,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAW0D,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKtD,WAAW2D,gBAAgBL,WAAWpC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI9D,yBAAAA;EAE/B,IAAIoB,QAAQ;GACR,IACI,CAAC6B,cACD,CAACO,UAAUX,YACX,CAACzB,OAAOyB,UACV;IACE,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;IAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;GAE7B;GAEA,IAAId,YACA,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAesD;IACrBrC,MAAMxB,iBAAiB;MAAGD,kBAAkBmC,aAAa+B;KAAW,GAAG,KAAK9B,mBAAmB8B,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJpC,SAAS,KAAKlB,WAAWgE,MAAM9C,QAAQoC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAee;IACrBE,MAAMxB,iBAAiB;MAAGD,kBAAkBmC,aAAaL;KAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAO+C,iBAAiB;IACxB,IAAI,CAACX,UAAUnC,UAAU,CAACD,OAAOC,QAC7BmC,UAAUnC,SAASyC,mBAAmBM,eAAc;IAGxD,IAAIZ,UAAUnC,QACVD,OAAOC,SAAS,MAAMyC,mBAAmBO,QAAQb,UAAUnC,QAAQD,MAAAA;GAE3E,OACIA,OAAOC,SAAS;GAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAkD,SAAS;GACb;EACJ;EAEA,IAAI,CAACd,UAAUX,UAAU;GACrB,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;GAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;EAE7B;EAEA,MAAMvD,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAewD;GACrBvC,MAAMxB,iBAAiB;KAAGD,kBAAkBmC,aAAa+B;IAAW,GAAG,KAAK9B,mBAAmB8B,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEApC,SAAS,KAAKlB,WAAWmC,OAAOmB,SAAAA;EAEhC,IAAIpC,OAAO+C,iBAAiB;GACxB,IAAI,CAACX,UAAUnC,QACXmC,UAAUnC,SAASyC,mBAAmBM,eAAc;GAGxDhD,OAAOC,SAAS,MAAMyC,mBAAmBO,QAAQb,UAAUnC,QAAQmC,SAAAA;EACvE,OACIpC,OAAOC,SAAS;EAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAkD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFpC,IACA3B,OACe;EACf,MAAMA,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAegB,cAAc,CAAA;EAEjF,MAAMM,SAAS,MAAM,KAAKlB,WAAWsE,UAAU,EAAErC,GAAG,CAAA;EACpD,IAAI,CAACf,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAMa,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAegB;GACrBC,MAAMxB,iBAAiB;KAAGD,kBAAkBmC,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEe,IAAIsC,aAAarD;EACzB,MAAM,KAAKlB,WAAWwE,OAAOtD,MAAAA;EAC7BA,OAAOe,KAAKsC;EAEZ,OAAOrD;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","data","entities","meta","findMany","total","entity","secret","secret_encrypted","secret_hashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","realmId","permissionNames","isMe","identity","type","id","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","built_in","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","auth_method","SECRET","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n CLIENT_RESERVED_NAMES,\n ClientAuthMethod,\n ClientValidator,\n PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\n\nexport type ClientServiceContext = {\n repository: IClientRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n protected repository: IClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ClientValidator;\n\n constructor(ctx: ClientServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ClientValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Client>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n const {\n data: entities, \n meta, \n } = await this.repository.findMany(query);\n let { total } = meta;\n\n const data: Client[] = [];\n for (const entity of entities) {\n if (\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n\n continue;\n }\n\n data.push(entity);\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<Client> {\n const permissionNames = [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ];\n\n let isMe = !!actor.identity &&\n actor.identity.type === 'client' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n const entity = await this.repository.findOne(idOrName, query, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n if (\n !isMe &&\n entity.secret &&\n !entity.secret_encrypted &&\n !entity.secret_hashed\n ) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: permissionNames,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Client,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realm_id === 'string' ?\n await this.realmRepository.resolve(data.realm_id) :\n undefined;\n\n let entity: Client \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realm_id = realm.id;\n }\n\n entity = await this.repository.findOneWithSecret(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'client' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n }\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n // Reserve the system-provisioned client names (`system`, `web`) so an\n // API caller can't create or rename a client onto them — that would\n // collide on unique(name, realm_id) or shadow the built_in client.\n // Provisioning and runtime hooks bypass this service, so they remain\n // free to manage the reserved clients. built_in clients are exempt\n // (they ARE the provisioned ones) but API callers can never produce a\n // built_in client since the validator strips the flag.\n if (\n typeof validated.name === 'string' &&\n CLIENT_RESERVED_NAMES.includes(validated.name) &&\n !(entity && entity.built_in && entity.name === validated.name)\n ) {\n throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n }\n\n await this.repository.validateJoinColumns(validated);\n await this.repository.checkUniqueness(validated, entity \|\| undefined);\n\n const credentialsService = new ClientCredentialsService();\n\n if (entity) {\n if (\n !isSelfEdit &&\n !validated.realm_id &&\n !entity.realm_id\n ) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n if (entity.auth_method === ClientAuthMethod.SECRET) {\n if (!validated.secret && !entity.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n if (validated.secret) {\n entity.secret = await credentialsService.protect(validated.secret, entity);\n }\n } else {\n entity.secret = null;\n entity.secret_hashed = false;\n entity.secret_encrypted = false;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realm_id) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n\n entity = this.repository.create(validated);\n\n if (entity.auth_method === ClientAuthMethod.SECRET) {\n if (!validated.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n entity.secret = await credentialsService.protect(validated.secret, validated);\n } else {\n entity.secret = null;\n entity.secret_hashed = false;\n entity.secret_encrypted = false;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;AA4BA,IAAaY,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,gBAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,KAAAA;EACnC,IAAI,EAAEY,UAAUF;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMK,UAAUJ,UAAU;GAC3B,IACII,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eACV;IACE,IAAI;KACA,MAAMf,MAAMC,oBAAoBe,cAAc;MAC1Cb,MAAM;OACFb,eAAec;OACfd,eAAee;OACff,eAAegB;;MAEnBC,MAAMzB,iBAAiB;QAAGD,kBAAkBoC,aAAaL;OAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;MAAQ,CAAA;KACxG,CAAA;KACAL,KAAKY,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAJ,KAAKY,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHL;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACe;EACf,MAAMC,kBAAkB;GACpBjC,eAAec;GACfd,eAAee;GACff,eAAegB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMyB,YACfzB,MAAMyB,SAASC,SAAS,aAEpB1B,MAAMyB,SAASlB,KAAKoB,OAAON,YAC3BrB,MAAMyB,SAASlB,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKlB,WAAWkC,QAAQP,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAI3B,oBAAAA;EAGd,IAAIuC,QAAQxB,MAAMyB,SAAUlB,KAAKoB,OAAOf,OAAOe,IAAI;GAC/CH,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACC,QACDZ,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eAER,MAAMf,MAAMC,oBAAoBe,cAAc;GAC1Cb,MAAMoB;GACNhB,MAAMzB,iBAAiB;KAAGD,kBAAkBoC,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFtB,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWxB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMoB,OACFX,UACAd,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKT,UAAUd,MAAMP,OAAO,EAAEiC,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAd,MACAP,OACAkC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO7B,KAAK8B,aAAa,WACnC,MAAM,KAAK1C,gBAAgB2C,QAAQ/B,KAAK8B,QAAQ,IAChDN,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMkB,QAA6B,CAAC;GACpC,IAAIvD,OAAOqC,QAAAA,GACPkB,MAAMZ,KAAKN;QAEXkB,MAAMpC,OAAOkB;GAGjB,IAAIe,OACAG,MAAMF,WAAWD,MAAMT;GAG3Bf,SAAS,MAAM,KAAKlB,WAAW8C,kBAAkBD,KAAAA;GACjD,IAAI,CAAC3B,UAAUsB,QAAQD,YACnB,MAAM,IAAIhD,oBAAAA;EAElB,OAAO,IAAIiD,QAAQD,YACf,MAAM,IAAIhD,oBAAAA;EAGd,IAAIwD,aAAa;EACjB,IAAI7B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAee,cAAc,CAAA;GACrF,SAASsC,GAAG;IACR,IACI,CAAC3C,MAAMyB,YACPzB,MAAMyB,SAASC,SAAS,YACxB1B,MAAMyB,SAASlB,KAAKoB,OAAOf,OAAOe,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMzC,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAesD,mBAAmB,CAAA;GAC1F;GACAT,QAAQpD,eAAe8D;EAC3B,OAAO;GACH,MAAM7C,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAewD,cAAc,CAAA;GACjFX,QAAQpD,eAAegE;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKpD,UAAUqD,IAAI1C,MAAM,EAAE4B,MAAM,CAAA;EASzD,IACI,OAAOa,UAAU7C,SAAS,YAC1BhB,sBAAsB+D,SAASF,UAAU7C,IAAI,KAC7C,EAAES,UAAUA,OAAOuC,YAAYvC,OAAOT,SAAS6C,UAAU7C,OAEzD,MAAM,IAAIjB,gBAAgB,oBAAoB8D,UAAU7C,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAW0D,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKtD,WAAW2D,gBAAgBL,WAAWpC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI9D,yBAAAA;EAE/B,IAAIoB,QAAQ;GACR,IACI,CAAC6B,cACD,CAACO,UAAUX,YACX,CAACzB,OAAOyB,UACV;IACE,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;IAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;GAE7B;GAEA,IAAId,YACA,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAesD;IACrBrC,MAAMzB,iBAAiB;MAAGD,kBAAkBoC,aAAa+B;KAAW,GAAG,KAAK9B,mBAAmB8B,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJpC,SAAS,KAAKlB,WAAWgE,MAAM9C,QAAQoC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAee;IACrBE,MAAMzB,iBAAiB;MAAGD,kBAAkBoC,aAAaL;KAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAO+C,gBAAgBvE,iBAAiBwE,QAAQ;IAChD,IAAI,CAACZ,UAAUnC,UAAU,CAACD,OAAOC,QAC7BmC,UAAUnC,SAASyC,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUnC,QACVD,OAAOC,SAAS,MAAMyC,mBAAmBQ,QAAQd,UAAUnC,QAAQD,MAAAA;GAE3E,OAAO;IACHA,OAAOC,SAAS;IAChBD,OAAOG,gBAAgB;IACvBH,OAAOE,mBAAmB;GAC9B;GAEA,MAAM,KAAKpB,WAAWoC,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAmD,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUX,UAAU;GACrB,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;GAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;EAE7B;EAEA,MAAMvD,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAewD;GACrBvC,MAAMzB,iBAAiB;KAAGD,kBAAkBoC,aAAa+B;IAAW,GAAG,KAAK9B,mBAAmB8B,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEApC,SAAS,KAAKlB,WAAWmC,OAAOmB,SAAAA;EAEhC,IAAIpC,OAAO+C,gBAAgBvE,iBAAiBwE,QAAQ;GAChD,IAAI,CAACZ,UAAUnC,QACXmC,UAAUnC,SAASyC,mBAAmBO,eAAc;GAGxDjD,OAAOC,SAAS,MAAMyC,mBAAmBQ,QAAQd,UAAUnC,QAAQmC,SAAAA;EACvE,OAAO;GACHpC,OAAOC,SAAS;GAChBD,OAAOG,gBAAgB;GACvBH,OAAOE,mBAAmB;EAC9B;EAEA,MAAM,KAAKpB,WAAWoC,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAmD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFrC,IACA3B,OACe;EACf,MAAMA,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAegB,cAAc,CAAA;EAEjF,MAAMM,SAAS,MAAM,KAAKlB,WAAWuE,UAAU,EAAEtC,GAAG,CAAA;EACpD,IAAI,CAACf,QACD,MAAM,IAAI3B,oBAAAA;EAGd,MAAMe,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAegB;GACrBC,MAAMzB,iBAAiB;KAAGD,kBAAkBoC,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEe,IAAIuC,aAAatD;EACzB,MAAM,KAAKlB,WAAWyE,OAAOvD,MAAAA;EAC7BA,OAAOe,KAAKuC;EAEZ,OAAOtD;CACX;AACJ"}

package/dist/core/entities/client/web-client.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"~~AAQA~~,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,~~CAcjB~~;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAMtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAsCrE"}
1	+ {"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAMtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAsCrE"}

package/dist/core/entities/client/web-client.mjs CHANGED Viewed

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { CLIENT_WEB_NAME, ScopeName } from "@authup/core-kit";
+import { CLIENT_WEB_NAME, ClientAuthMethod, ClientTokenBindingMethod, ScopeName } from "@authup/core-kit";
 //#region src/core/entities/client/web-client.ts
 /**
 * Build the attribute set for a realm's public `web` client.
@@ -22,7 +22,8 @@ import { CLIENT_WEB_NAME, ScopeName } from "@authup/core-kit";
 	return {
 		name: CLIENT_WEB_NAME,
 		realm_id: realm.id,
-		is_confidential: false,
+		auth_method: ClientAuthMethod.NONE,
+		token_binding_method: ClientTokenBindingMethod.NONE,
 		built_in: true,
 		active: true,
 		grant_types: "authorization_code refresh_token",

package/dist/core/entities/client/web-client.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"web-client.mjs","names":["CLIENT_WEB_NAME","ScopeName","buildWebClientAttributes","realm","appOrigins","originPatterns","map","origin","join","name","realm_id","id","~~is_confidential~~","built_in","active","grant_types","scope","GLOBAL","OPEN_ID","redirect_uri","post_logout_redirect_uri","WebClientProvisioner","clientRepository","logger","ctx","ensureForRealm","attributes","existing","findOneBy","warn","isDirty","Object","keys","some","key","merged","merge","save","entity","create"],"sources":["../../../../src/core/entities/client/web-client.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { CLIENT_WEB_NAME, ScopeName } from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientRepository, IWebClientProvisioner } from './types.ts';\n\nexport type WebClientProvisionerContext = {\n clientRepository: IClientRepository;\n appOrigins: string[];\n logger?: Logger;\n};\n\n/\n Build the attribute set for a realm's public `web` client.\n \n Public (PKCE) client used by authup's own client-web and any downstream\n * UI embedding client-web-kit. `built_in` makes it auto-consent in the\n * /authorize flow and protects it from the API reserved-name guard. The\n * `global` scope lets the issued token drive the management API (parity\n * with the legacy password-grant admin login); `openid` for the id-token.\n \n `grant_types` is an enforced allowlist (`assertClientGrantAllowed` at the\n * /token grants and the /authorize code-request verifier; null = allow-all),\n * so it must list every flow the client uses. `redirect_uri` and\n * `post_logout_redirect_uri` are each one `<origin>/*` wildcard per trusted\n origin (matched by isSimpleMatch).\n /\nexport function buildWebClientAttributes(\n realm: Realm \| { id: string },\n appOrigins: string[],\n): Partial<Client> {\n const originPatterns = appOrigins.map((origin) => `${origin}/*`).join(',');\n\n return {\n name: CLIENT_WEB_NAME,\n realm_id: realm.id,\n ~~is_confidential~~: ~~false~~,\n built_in: true,\n active: true,\n grant_types: 'authorization_code refresh_token',\n scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,\n redirect_uri: originPatterns,\n post_logout_redirect_uri: originPatterns,\n };\n}\n\nexport class WebClientProvisioner implements IWebClientProvisioner {\n protected clientRepository: IClientRepository;\n\n protected appOrigins: string[];\n\n protected logger?: Logger;\n\n constructor(ctx: WebClientProvisionerContext) {\n this.clientRepository = ctx.clientRepository;\n this.appOrigins = ctx.appOrigins;\n this.logger = ctx.logger;\n }\n\n async ensureForRealm(realm: Realm \| { id: string }): Promise<void> {\n const attributes = buildWebClientAttributes(realm, this.appOrigins);\n\n const existing = await this.clientRepository.findOneBy({\n name: CLIENT_WEB_NAME,\n realm_id: realm.id,\n });\n\n if (existing) {\n // Never overwrite a non-built_in client that happens to be named\n // `web` — that would be a user-owned client. Skip and warn.\n if (!existing.built_in) {\n if (this.logger) {\n this.logger.warn(\n `Skipping web client provisioning for realm ${realm.id}: a non-built-in client named '${CLIENT_WEB_NAME}' already exists.`,\n );\n }\n return;\n }\n\n // MERGE: refresh attributes (e.g. redirect_uri) when config\n // changes. Dirty-check first — the attributes are deterministic\n // from config, so a steady-state boot would otherwise issue one\n // redundant UPDATE (bumping updated_at) per realm.\n const isDirty = (Object.keys(attributes) as (keyof Client)[])\n .some((key) => existing[key] !== attributes[key]);\n if (!isDirty) {\n return;\n }\n\n const merged = this.clientRepository.merge(existing, attributes);\n await this.clientRepository.save(merged);\n return;\n }\n\n const entity = this.clientRepository.create(attributes);\n await this.clientRepository.save(entity);\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;~~GAiCA~~,~~SAAgBE~~,yBACZC,OACAC,YAAoB;CAEpB,MAAMC,iBAAiBD,WAAWE,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAEvE,OAAO;EACHC,~~MAAMT~~;~~EACNU~~,UAAUP,MAAMQ;EAChBC,~~iBAAiB~~;~~EACjBC~~,UAAU;EACVC,QAAQ;EACRC,aAAa;EACbC,OAAO,~~GAAGf~~,~~UAAUgB~~,OAAO,~~GAAGhB~~,~~UAAUiB~~;EACxCC,~~cAAcd~~;~~EACde~~,~~0BAA0Bf~~;CAC9B;AACJ;AAEA,~~IAAagB~~,uBAAb,MAAaA;CACCC;~~CAEAlB~~;~~CAEAmB~~;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,mBAAmBE,IAAIF;EAC5B,~~KAAKlB~~,~~aAAaoB~~,~~IAAIpB~~;EACtB,~~KAAKmB~~,SAASC,IAAID;CACtB;CAEA,MAAME,~~eAAetB~~,OAA8C;EAC/D,~~MAAMuB~~,~~aAAaxB~~,yBAAyBC,OAAO,KAAKC,UAAU;EAElE,~~MAAMuB~~,WAAW,MAAM,KAAKL,iBAAiBM,UAAU;~~GACnDnB~~,~~MAAMT~~;~~GACNU~~,UAAUP,MAAMQ;EACpB,CAAA;EAEA,~~IAAIgB~~,UAAU;GAGV,IAAI,CAACA,SAASd,UAAU;IACpB,IAAI,KAAKU,QACL,KAAKA,OAAOM,KACR,~~8CAA8C1B~~,MAAMQ,GAAG,~~iCAAiCX~~,gBAAgB,kBAAkB;IAGlI;GACJ;GAQA,IAAI,CAFY,~~OAAQgC~~,KAAKN,UAAAA,CAAAA,CACxBO,MAAMC,QAAQP,SAASO,SAASR,WAAWQ,IAC3CJ,GACD;GAGJ,MAAMK,SAAS,KAAKb,iBAAiBc,MAAMT,UAAUD,UAAAA;GACrD,MAAM,KAAKJ,iBAAiBe,KAAKF,MAAAA;GACjC;EACJ;EAEA,MAAMG,SAAS,KAAKhB,iBAAiBiB,OAAOb,UAAAA;EAC5C,MAAM,KAAKJ,iBAAiBe,KAAKC,MAAAA;CACrC;AACJ"}
1	+ {"version":3,"file":"web-client.mjs","names":["CLIENT_WEB_NAME","ClientAuthMethod","ClientTokenBindingMethod","ScopeName","buildWebClientAttributes","realm","appOrigins","originPatterns","map","origin","join","name","realm_id","id","auth_method","NONE","token_binding_method","built_in","active","grant_types","scope","GLOBAL","OPEN_ID","redirect_uri","post_logout_redirect_uri","WebClientProvisioner","clientRepository","logger","ctx","ensureForRealm","attributes","existing","findOneBy","warn","isDirty","Object","keys","some","key","merged","merge","save","entity","create"],"sources":["../../../../src/core/entities/client/web-client.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport {\n CLIENT_WEB_NAME,\n ClientAuthMethod,\n ClientTokenBindingMethod,\n ScopeName,\n} from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientRepository, IWebClientProvisioner } from './types.ts';\n\nexport type WebClientProvisionerContext = {\n clientRepository: IClientRepository;\n appOrigins: string[];\n logger?: Logger;\n};\n\n/\n Build the attribute set for a realm's public `web` client.\n \n Public (PKCE) client used by authup's own client-web and any downstream\n * UI embedding client-web-kit. `built_in` makes it auto-consent in the\n * /authorize flow and protects it from the API reserved-name guard. The\n * `global` scope lets the issued token drive the management API (parity\n * with the legacy password-grant admin login); `openid` for the id-token.\n \n `grant_types` is an enforced allowlist (`assertClientGrantAllowed` at the\n * /token grants and the /authorize code-request verifier; null = allow-all),\n * so it must list every flow the client uses. `redirect_uri` and\n * `post_logout_redirect_uri` are each one `<origin>/*` wildcard per trusted\n origin (matched by isSimpleMatch).\n /\nexport function buildWebClientAttributes(\n realm: Realm \| { id: string },\n appOrigins: string[],\n): Partial<Client> {\n const originPatterns = appOrigins.map((origin) => `${origin}/*`).join(',');\n\n return {\n name: CLIENT_WEB_NAME,\n realm_id: realm.id,\n auth_method: ClientAuthMethod.NONE,\n token_binding_method: ClientTokenBindingMethod.NONE,\n built_in: true,\n active: true,\n grant_types: 'authorization_code refresh_token',\n scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,\n redirect_uri: originPatterns,\n post_logout_redirect_uri: originPatterns,\n };\n}\n\nexport class WebClientProvisioner implements IWebClientProvisioner {\n protected clientRepository: IClientRepository;\n\n protected appOrigins: string[];\n\n protected logger?: Logger;\n\n constructor(ctx: WebClientProvisionerContext) {\n this.clientRepository = ctx.clientRepository;\n this.appOrigins = ctx.appOrigins;\n this.logger = ctx.logger;\n }\n\n async ensureForRealm(realm: Realm \| { id: string }): Promise<void> {\n const attributes = buildWebClientAttributes(realm, this.appOrigins);\n\n const existing = await this.clientRepository.findOneBy({\n name: CLIENT_WEB_NAME,\n realm_id: realm.id,\n });\n\n if (existing) {\n // Never overwrite a non-built_in client that happens to be named\n // `web` — that would be a user-owned client. Skip and warn.\n if (!existing.built_in) {\n if (this.logger) {\n this.logger.warn(\n `Skipping web client provisioning for realm ${realm.id}: a non-built-in client named '${CLIENT_WEB_NAME}' already exists.`,\n );\n }\n return;\n }\n\n // MERGE: refresh attributes (e.g. redirect_uri) when config\n // changes. Dirty-check first — the attributes are deterministic\n // from config, so a steady-state boot would otherwise issue one\n // redundant UPDATE (bumping updated_at) per realm.\n const isDirty = (Object.keys(attributes) as (keyof Client)[])\n .some((key) => existing[key] !== attributes[key]);\n if (!isDirty) {\n return;\n }\n\n const merged = this.clientRepository.merge(existing, attributes);\n await this.clientRepository.save(merged);\n return;\n }\n\n const entity = this.clientRepository.create(attributes);\n await this.clientRepository.save(entity);\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;GAsCA,SAAgBI,yBACZC,OACAC,YAAoB;CAEpB,MAAMC,iBAAiBD,WAAWE,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAEvE,OAAO;EACHC,MAAMX;EACNY,UAAUP,MAAMQ;EAChBC,aAAab,iBAAiBc;EAC9BC,sBAAsBd,yBAAyBa;EAC/CE,UAAU;EACVC,QAAQ;EACRC,aAAa;EACbC,OAAO,GAAGjB,UAAUkB,OAAO,GAAGlB,UAAUmB;EACxCC,cAAchB;EACdiB,0BAA0BjB;CAC9B;AACJ;AAEA,IAAakB,uBAAb,MAAaA;CACCC;CAEApB;CAEAqB;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKpB,aAAasB,IAAItB;EACtB,KAAKqB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAexB,OAA8C;EAC/D,MAAMyB,aAAa1B,yBAAyBC,OAAO,KAAKC,UAAU;EAElE,MAAMyB,WAAW,MAAM,KAAKL,iBAAiBM,UAAU;GACnDrB,MAAMX;GACNY,UAAUP,MAAMQ;EACpB,CAAA;EAEA,IAAIkB,UAAU;GAGV,IAAI,CAACA,SAASd,UAAU;IACpB,IAAI,KAAKU,QACL,KAAKA,OAAOM,KACR,8CAA8C5B,MAAMQ,GAAG,iCAAiCb,gBAAgB,kBAAkB;IAGlI;GACJ;GAQA,IAAI,CAFY,OAAQoC,KAAKN,UAAAA,CAAAA,CACxBO,MAAMC,QAAQP,SAASO,SAASR,WAAWQ,IAC3CJ,GACD;GAGJ,MAAMK,SAAS,KAAKb,iBAAiBc,MAAMT,UAAUD,UAAAA;GACrD,MAAM,KAAKJ,iBAAiBe,KAAKF,MAAAA;GACjC;EACJ;EAEA,MAAMG,SAAS,KAAKhB,iBAAiBiB,OAAOb,UAAAA;EAC5C,MAAM,KAAKJ,iBAAiBe,KAAKC,MAAAA;CACrC;AACJ"}

package/dist/core/entities/consent/index.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/consent/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/entities/consent/index.mjs ADDED Viewed

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH } from "./types.mjs";
+import { ConsentService } from "./service.mjs";
+export { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ConsentService };

package/dist/core/entities/consent/service.d.ts ADDED Viewed

@@ -0,0 +1,19 @@
+import type { Consent } from '@authup/core-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { ConsentCoveringInput, ConsentRecordInput, ConsentServiceReadOptions, IConsentRepository, IConsentService } from './types.ts';
+export type ConsentServiceContext = {
+    repository: IConsentRepository;
+};
+export declare class ConsentService extends AbstractEntityService implements IConsentService {
+    protected repository: IConsentRepository;
+    constructor(ctx: ConsentServiceContext);
+    protected isOwnedBy(consent: Consent, actor: ActorContext): boolean;
+    protected normalizeScopeTokens(scope: string | string[] | null): string[];
+    getMany(query: Record<string, any>, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<EntityRepositoryFindManyResult<Consent>>;
+    getOne(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;
+    delete(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;
+    record(input: ConsentRecordInput): Promise<void>;
+    isCovering(input: ConsentCoveringInput): Promise<boolean>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/consent/service.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAIvF,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,eAAe,EAClB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,qBAAqB,GAAG;IAChC,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,qBAAa,cAAe,SAAQ,qBAAsB,YAAW,eAAe;IAChF,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAE7B,GAAG,EAAE,qBAAqB;IAKtC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAMnE,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,GAAG,MAAM,EAAE;IAYnE,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,yBAA8B,GACxC,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAwD7C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,yBAA8B,GAAG,OAAO,CAAC,OAAO,CAAC;IAsBlG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,yBAA8B,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBlG,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAchD,UAAU,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;CAclE"}

package/dist/core/entities/consent/service.mjs ADDED Viewed

@@ -0,0 +1,122 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import "./types.mjs";
+import { PermissionName } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { EntityNotFoundError } from "@authup/errors";
+import { unwrapOAuth2Scope } from "@authup/specs";
+//#region src/core/entities/consent/service.ts
+var ConsentService = class extends AbstractEntityService {
+	repository;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+	}
+	isOwnedBy(consent, actor) {
+		return !!actor.identity && consent.sub === actor.identity.data.id && consent.sub_kind === actor.identity.type;
+	}
+	normalizeScopeTokens(scope) {
+		const tokens = unwrapOAuth2Scope(scope ?? []).filter((token) => token.length > 0 && token.length <= 128);
+		return Array.from(new Set(tokens));
+	}
+	async getMany(query, actor, options = {}) {
+		let canReadAll = true;
+		try {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });
+		} catch (e) {
+			if (!actor.identity) throw e;
+			canReadAll = false;
+		}
+		if (!canReadAll) return this.repository.findMany(query, {
+			owner: {
+				sub: actor.identity.data.id,
+				subKind: actor.identity.type
+			},
+			...options.realmId ? { realmId: options.realmId } : {}
+		});
+		const { data: entities, meta } = await this.repository.findMany(query, { ...options.realmId ? { realmId: options.realmId } : {} });
+		const data = [];
+		let { total } = meta;
+		for (const entity of entities) {
+			if (this.isOwnedBy(entity, actor)) {
+				data.push(entity);
+				continue;
+			}
+			try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.CONSENT_READ,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: entity,
+						...this.resourceRealmMatch(entity)
+					})
+				});
+				data.push(entity);
+			} catch {
+				total -= 1;
+			}
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(id, actor, options = {}) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity || options.realmId && entity.realm_id !== options.realmId) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.CONSENT_READ,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		return entity;
+	}
+	async delete(id, actor, options = {}) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity || options.realmId && entity.realm_id !== options.realmId) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_DELETE });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.CONSENT_DELETE,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+	async record(input) {
+		const tokens = this.normalizeScopeTokens(input.scope);
+		if (tokens.length === 0) return;
+		await this.repository.insertMissing({
+			clientId: input.clientId,
+			realmId: input.realmId,
+			owner: input.owner,
+			scopes: tokens
+		});
+	}
+	async isCovering(input) {
+		const tokens = this.normalizeScopeTokens(input.scope);
+		if (tokens.length === 0) return true;
+		const rows = await this.repository.findAllBySubjectClient(input.clientId, input.owner);
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		return tokens.every((token) => rows.some((row) => row.scope === token && (row.expires_at === null || row.expires_at > now)));
+	}
+};
+//#endregion
+export { ConsentService };
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/consent/service.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityNotFoundError","PermissionName","unwrapOAuth2Scope","AbstractEntityService","CONSENT_SCOPE_MAX_LENGTH","ConsentService","repository","ctx","isOwnedBy","consent","actor","identity","sub","data","id","sub_kind","type","normalizeScopeTokens","scope","tokens","filter","token","length","Array","from","Set","getMany","query","options","canReadAll","permissionEvaluator","preEvaluate","name","CONSENT_READ","e","findMany","owner","subKind","realmId","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","realm_id","delete","CONSENT_DELETE","entityId","remove","record","input","insertMissing","clientId","scopes","isCovering","rows","findAllBySubjectClient","now","Date","toISOString","every","some","row","expires_at"],"sources":["../../../../src/core/entities/consent/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Consent } from '@authup/core-kit';\nimport { unwrapOAuth2Scope } from '@authup/specs';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport {\n CONSENT_SCOPE_MAX_LENGTH,\n} from './types.ts';\nimport type {\n ConsentCoveringInput,\n ConsentRecordInput,\n ConsentServiceReadOptions,\n IConsentRepository,\n IConsentService,\n} from './types.ts';\n\nexport type ConsentServiceContext = {\n repository: IConsentRepository,\n};\n\nexport class ConsentService extends AbstractEntityService implements IConsentService {\n protected repository: IConsentRepository;\n\n constructor(ctx: ConsentServiceContext) {\n super();\n this.repository = ctx.repository;\n }\n\n protected isOwnedBy(consent: Consent, actor: ActorContext): boolean {\n return !!actor.identity &&\n consent.sub === actor.identity.data.id &&\n consent.sub_kind === actor.identity.type;\n }\n\n protected normalizeScopeTokens(scope: string | string[] | null): string[] {\n const tokens = unwrapOAuth2Scope(scope ?? [])\n // Drop empty tokens and any token that does not fit the scope\n // column (varchar 128). An over-long token — only reachable via a\n // non-standard scope riding the `global` verifier bypass — is\n // simply not persisted (never remembered), rather than aborting\n // the whole write and losing the sibling tokens ordered after it.\n .filter((token) => token.length > 0 && token.length <= CONSENT_SCOPE_MAX_LENGTH);\n\n return Array.from(new Set(tokens));\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n options: ConsentServiceReadOptions = {},\n ): Promise<EntityRepositoryFindManyResult<Consent>> {\n let canReadAll = true;\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });\n } catch (e) {\n if (!actor.identity) {\n throw e;\n }\n canReadAll = false;\n }\n\n if (!canReadAll) {\n // self-service: only the actor's own consents\n return this.repository.findMany(query, {\n owner: {\n sub: actor.identity!.data.id,\n subKind: actor.identity!.type,\n },\n ...(options.realmId ? { realmId: options.realmId } : {}),\n });\n }\n\n const { data: entities, meta } = await this.repository.findMany(query, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n\n const data: Consent[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n if (this.isOwnedBy(entity, actor)) {\n data.push(entity);\n continue;\n }\n\n try {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CONSENT_READ,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total,\n },\n };\n }\n\n async getOne(id: string, actor: ActorContext, options: ConsentServiceReadOptions = {}): Promise<Consent> {\n const entity = await this.repository.findOneById(id);\n if (!entity || (options.realmId && entity.realm_id !== options.realmId)) {\n // A realm mismatch on the nested mount fails as not-found (no\n // cross-realm existence oracle).\n throw new EntityNotFoundError();\n }\n\n if (!this.isOwnedBy(entity, actor)) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CONSENT_READ,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n }\n\n return entity;\n }\n\n async delete(id: string, actor: ActorContext, options: ConsentServiceReadOptions = {}): Promise<Consent> {\n const entity = await this.repository.findOneById(id);\n if (!entity || (options.realmId && entity.realm_id !== options.realmId)) {\n throw new EntityNotFoundError();\n }\n\n if (!this.isOwnedBy(entity, actor)) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_DELETE });\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CONSENT_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n }\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n\n async record(input: ConsentRecordInput): Promise<void> {\n const tokens = this.normalizeScopeTokens(input.scope);\n if (tokens.length === 0) {\n return;\n }\n\n await this.repository.insertMissing({\n clientId: input.clientId,\n realmId: input.realmId,\n owner: input.owner,\n scopes: tokens,\n });\n }\n\n async isCovering(input: ConsentCoveringInput): Promise<boolean> {\n const tokens = this.normalizeScopeTokens(input.scope);\n if (tokens.length === 0) {\n return true;\n }\n\n const rows = await this.repository.findAllBySubjectClient(input.clientId, input.owner);\n const now = new Date().toISOString();\n\n return tokens.every((token) => rows.some(\n (row) => row.scope === token &&\n (row.expires_at === null || row.expires_at > now),\n ));\n }\n}\n"],"mappings":";;;;;;;;;;AA6BA,IAAaO,iBAAb,cAAoCF,sBAAAA;CACtBG;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,aAAaL,MAAMC,SAASK;CAC5C;CAEUC,qBAAqBC,OAA2C;EACtE,MAAMC,SAASjB,kBAAkBgB,SAAS,CAAA,CAAE,CACxC,CAKCE,QAAQC,UAAUA,MAAMC,SAAS,KAAKD,MAAMC,UAAAA,GAAUlB;EAE3D,OAAOmB,MAAMC,KAAK,IAAIC,IAAIN,MAAAA,CAAAA;CAC9B;CAEA,MAAMO,QACFC,OACAjB,OACAkB,UAAqC,CAAC,GACU;EAChD,IAAIC,aAAa;EACjB,IAAI;GACA,MAAMnB,MAAMoB,oBAAoBC,YAAY,EAAEC,MAAM/B,eAAegC,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAACxB,MAAMC,UACP,MAAMuB;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKvB,WAAW6B,SAASR,OAAO;GACnCS,OAAO;IACHxB,KAAKF,MAAMC,SAAUE,KAAKC;IAC1BuB,SAAS3B,MAAMC,SAAUK;GAC7B;GACA,GAAIY,QAAQU,UAAU,EAAEA,SAASV,QAAQU,QAAQ,IAAI,CAAC;EAC1D,CAAA;EAGJ,MAAM,EAAEzB,MAAM0B,UAAUC,SAAS,MAAM,KAAKlC,WAAW6B,SAASR,OAAO,EAAE,GAAIC,QAAQU,UAAU,EAAEA,SAASV,QAAQU,QAAQ,IAAI,CAAC,EAAG,CAAA;EAElI,MAAMzB,OAAkB,CAAA;EACxB,IAAI,EAAE4B,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAK/B,UAAUkC,QAAQhC,KAAAA,GAAQ;IAC/BG,KAAK8B,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMhC,MAAMoB,oBAAoBc,SAAS;KACrCZ,MAAM/B,eAAegC;KACrBpB,MAAMd,iBAAiB;OAClBD,kBAAkB+C,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACA7B,KAAK8B,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACH5B;GACA2B,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAOjC,IAAYJ,OAAqBkB,UAAqC,CAAC,GAAqB;EACrG,MAAMc,SAAS,MAAM,KAAKpC,WAAW0C,YAAYlC,EAAAA;EACjD,IAAI,CAAC4B,UAAWd,QAAQU,WAAWI,OAAOO,aAAarB,QAAQU,SAG3D,MAAM,IAAItC,oBAAAA;EAGd,IAAI,CAAC,KAAKQ,UAAUkC,QAAQhC,KAAAA,GAAQ;GAChC,MAAMA,MAAMoB,oBAAoBC,YAAY,EAAEC,MAAM/B,eAAegC,aAAa,CAAA;GAChF,MAAMvB,MAAMoB,oBAAoBc,SAAS;IACrCZ,MAAM/B,eAAegC;IACrBpB,MAAMd,iBAAiB;MAClBD,kBAAkB+C,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMQ,OAAOpC,IAAYJ,OAAqBkB,UAAqC,CAAC,GAAqB;EACrG,MAAMc,SAAS,MAAM,KAAKpC,WAAW0C,YAAYlC,EAAAA;EACjD,IAAI,CAAC4B,UAAWd,QAAQU,WAAWI,OAAOO,aAAarB,QAAQU,SAC3D,MAAM,IAAItC,oBAAAA;EAGd,IAAI,CAAC,KAAKQ,UAAUkC,QAAQhC,KAAAA,GAAQ;GAChC,MAAMA,MAAMoB,oBAAoBC,YAAY,EAAEC,MAAM/B,eAAekD,eAAe,CAAA;GAClF,MAAMzC,MAAMoB,oBAAoBc,SAAS;IACrCZ,MAAM/B,eAAekD;IACrBtC,MAAMd,iBAAiB;MAClBD,kBAAkB+C,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAE5B,IAAIsC,aAAaV;EACzB,MAAM,KAAKpC,WAAW+C,OAAOX,MAAAA;EAC7BA,OAAO5B,KAAKsC;EAEZ,OAAOV;CACX;CAEA,MAAMY,OAAOC,OAA0C;EACnD,MAAMpC,SAAS,KAAKF,qBAAqBsC,MAAMrC,KAAK;EACpD,IAAIC,OAAOG,WAAW,GAClB;EAGJ,MAAM,KAAKhB,WAAWkD,cAAc;GAChCC,UAAUF,MAAME;GAChBnB,SAASiB,MAAMjB;GACfF,OAAOmB,MAAMnB;GACbsB,QAAQvC;EACZ,CAAA;CACJ;CAEA,MAAMwC,WAAWJ,OAA+C;EAC5D,MAAMpC,SAAS,KAAKF,qBAAqBsC,MAAMrC,KAAK;EACpD,IAAIC,OAAOG,WAAW,GAClB,OAAO;EAGX,MAAMsC,OAAO,MAAM,KAAKtD,WAAWuD,uBAAuBN,MAAME,UAAUF,MAAMnB,KAAK;EACrF,MAAM0B,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAElC,OAAO7C,OAAO8C,OAAO5C,UAAUuC,KAAKM,MAC/BC,QAAQA,IAAIjD,UAAUG,UAClB8C,IAAIC,eAAe,QAAQD,IAAIC,aAAaN,IAAE,CAAA;CAE3D;AACJ"}

package/dist/core/entities/consent/types.d.ts ADDED Viewed

@@ -0,0 +1,97 @@
+import type { Consent } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+export type ConsentOwner = {
+    sub: string;
+    subKind: string;
+};
+/**
+ * Max length of a single stored scope token — must equal the
+ * `auth_consents.scope` column width (varchar 128). A longer token (only
+ * reachable via a non-standard scope riding the `global` verifier bypass) is
+ * dropped at normalization rather than overflowing the column.
+ */
+export declare const CONSENT_SCOPE_MAX_LENGTH = 128;
+/**
+ * Filter keys a consent list query may target. Shared by the repository's
+ * rapiq `filters.allowed` so service and adapter can never drift.
+ */
+export declare const CONSENT_FILTER_KEYS: readonly ["id", "client_id", "realm_id", "sub", "sub_kind", "scope"];
+export type ConsentFindManyOptions = {
+    /**
+     * Force the result to a single subject (self-service). Applied as a
+     * mandatory WHERE that a rapiq query filter cannot override.
+     */
+    owner?: ConsentOwner;
+    /**
+     * Restrict the result to a single realm (the `/realms/:realmId/consents`
+     * nested mount). Mandatory WHERE, not overridable by a rapiq filter.
+     */
+    realmId?: string;
+};
+export type ConsentServiceReadOptions = {
+    realmId?: string;
+};
+export type ConsentRecordInput = {
+    clientId: string;
+    realmId: string;
+    owner: ConsentOwner;
+    /**
+     * Raw scope representation(s) — normalized to lowercase tokens via
+     * `unwrapOAuth2Scope` before persistence.
+     */
+    scope: string | string[] | null;
+};
+export type ConsentCoveringInput = {
+    clientId: string;
+    owner: ConsentOwner;
+    scope: string | string[] | null;
+};
+export interface IConsentRepository {
+    findMany(query: Record<string, any>, options?: ConsentFindManyOptions): Promise<EntityRepositoryFindManyResult<Consent>>;
+    findOneById(id: string): Promise<Consent | null>;
+    /**
+     * Covering-lookup source — query-cached
+     * (`CachePrefix.CONSENT_COVERING`, 60s), invalidated by the
+     * `ConsentEntitySubscriber` on insert/update/remove.
+     */
+    findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]>;
+    /**
+     * Union/keep: insert one row per missing scope token, never touching
+     * existing rows. Race-safe under the 4-column unique index.
+     */
+    insertMissing(input: {
+        clientId: string;
+        realmId: string;
+        owner: ConsentOwner;
+        scopes: string[];
+    }): Promise<void>;
+    remove(entity: Consent): Promise<void>;
+}
+export interface IConsentService {
+    /**
+     * List consents. An actor without `CONSENT_READ` is scoped to its own
+     * rows (self-service); an actor with `CONSENT_READ` sees every row its
+     * realm reach permits.
+     */
+    getMany(query: Record<string, any>, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<EntityRepositoryFindManyResult<Consent>>;
+    /**
+     * Read a single consent by id. Own rows need no permission.
+     */
+    getOne(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;
+    /**
+     * Revoke (delete) a single consent by id. Own rows need no permission.
+     */
+    delete(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;
+    /**
+     * Flow integration (POST /authorize approval) — no permission checks:
+     * the subject consents to its own grant. Inputs are server-derived
+     * (verifier-stamped client/realm, token-derived subject), never raw
+     * client input.
+     */
+    record(input: ConsentRecordInput): Promise<void>;
+    /**
+     * Strict covering: every requested token has an unexpired row.
+     */
+    isCovering(input: ConsentCoveringInput): Promise<boolean>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/consent/types.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,MAAM,YAAY,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,sEAOtB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;OAIG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAElF;;;OAGG;IACH,aAAa,CAAC,KAAK,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,YAAY,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAA;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElB,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhJ;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/F;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/F;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D"}