@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/core/entities/event/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["randomUUID","BuiltInPolicyType","definePolicyData","PermissionName","EntityNotFoundError","AbstractEntityService","EVENT_LOG_RETENTION_DAYS_DEFAULT","sanitizeEventData","DAY_IN_MS","EventService","repository","options","logger","ctx","isOwnedBy","entity","actor","identity","actor_id","data","id","actor_type","type","canReadRealm","realmId","permissionEvaluator","evaluate","name","EVENT_READ","REALM_MATCH","policiesIncluded","COMPOSITE","PERMISSION_BINDING","resolveReadVisibility","actorRealmId","getActorRealmId","foreignRealmId","undefined","realmIds","push","owner","actorId","actorType","record","input","info","scope","ref_type","refType","ref_id","refId","client_id","clientId","realm_id","enabled","retentionDays","create","truncate","actor_name","actorName","request_path","requestPath","request_method","requestMethod","request_ip_address","requestIpAddress","request_user_agent","requestUserAgent","expiring","expires_at","Date","now","toISOString","save","warn","getMany","query","canReadAll","preEvaluate","e","findMany","visibility","entities","meta","ATTRIBUTES","resourceRealmMatch","total","length","getOne","findOneById","value","maxLength","substring"],"sources":["../../../../src/core/entities/event/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Event } from '@authup/core-kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from './constants.ts';\nimport { sanitizeEventData } from './sanitize.ts';\nimport type {\n    EventReadVisibility,\n    EventRecordInput,\n    EventServiceOptions,\n    EventServiceReadOptions,\n    IEventRepository,\n    IEventService,\n} from './types.ts';\n\nexport type EventServiceContext = {\n    repository: IEventRepository,\n    options?: EventServiceOptions,\n    logger?: Logger,\n};\n\nconst DAY_IN_MS = 86_400_000;\n\nexport class EventService extends AbstractEntityService implements IEventService {\n    protected repository: IEventRepository;\n\n    protected options: EventServiceOptions;\n\n    protected logger?: Logger;\n\n    constructor(ctx: EventServiceContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.options = ctx.options ?? {};\n        this.logger = ctx.logger;\n    }\n\n    protected isOwnedBy(entity: Event, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            !!entity.actor_id &&\n            entity.actor_id === actor.identity.data.id &&\n            entity.actor_type === actor.identity.type;\n    }\n\n    protected async canReadRealm(actor: ActorContext, realmId: string | null): Promise<boolean> {\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({ [BuiltInPolicyType.REALM_MATCH]: realmId }),\n                options: {\n                    policiesIncluded: [\n                        BuiltInPolicyType.COMPOSITE,\n                        BuiltInPolicyType.PERMISSION_BINDING,\n                        BuiltInPolicyType.REALM_MATCH,\n                    ],\n                },\n            });\n            return true;\n        } catch {\n            return false;\n        }\n    }\n\n    protected async resolveReadVisibility(actor: ActorContext): Promise<EventReadVisibility | undefined> {\n        const actorRealmId = this.getActorRealmId(actor);\n        let foreignRealmId = randomUUID();\n        while (foreignRealmId === actorRealmId) {\n            foreignRealmId = randomUUID();\n        }\n\n        if (await this.canReadRealm(actor, foreignRealmId)) {\n            return undefined;\n        }\n\n        const realmIds: Array<string | null> = [];\n        if (actorRealmId && await this.canReadRealm(actor, actorRealmId)) {\n            realmIds.push(actorRealmId);\n        }\n        if (await this.canReadRealm(actor, null)) {\n            realmIds.push(null);\n        }\n\n        return {\n            realmIds,\n            ...(actor.identity ? {\n                owner: {\n                    actorId: actor.identity.data.id,\n                    actorType: actor.identity.type,\n                },\n            } : {}),\n        };\n    }\n\n    async record(input: EventRecordInput): Promise<void> {\n        const data = sanitizeEventData(input.data);\n\n        // complementary structured log line — fires even when persistence is\n        // disabled, so a SIEM/Loki pipeline can pick the events up for free.\n        this.logger?.info(`audit: ${input.scope}.${input.name}`, {\n            scope: input.scope,\n            name: input.name,\n            ref_type: input.refType ?? null,\n            ref_id: input.refId ?? null,\n            client_id: input.clientId ?? null,\n            actor_type: input.actorType ?? null,\n            actor_id: input.actorId ?? null,\n            realm_id: input.realmId ?? null,\n            ...(data ? { data } : {}),\n        });\n\n        if (this.options.enabled === false) {\n            return;\n        }\n\n        try {\n            const retentionDays = input.retentionDays ?? this.options.retentionDays ?? EVENT_LOG_RETENTION_DAYS_DEFAULT;\n\n            const entity = this.repository.create({\n                id: randomUUID(),\n                scope: input.scope,\n                name: input.name,\n                ref_type: truncate(input.refType, 64),\n                ref_id: truncate(input.refId, 64),\n                client_id: input.clientId ?? null,\n                actor_type: input.actorType ?? null,\n                actor_id: input.actorId ?? null,\n                actor_name: truncate(input.actorName, 128),\n                request_path: truncate(input.requestPath, 256),\n                request_method: truncate(input.requestMethod, 10),\n                request_ip_address: truncate(input.requestIpAddress, 45),\n                request_user_agent: truncate(input.requestUserAgent, 512),\n                realm_id: input.realmId ?? null,\n                data,\n                expiring: retentionDays > 0,\n                expires_at: retentionDays > 0 ?\n                    new Date(Date.now() + (retentionDays * DAY_IN_MS)).toISOString() :\n                    null,\n            });\n\n            await this.repository.save(entity);\n        } catch {\n            // an audit write failure must never fail the originating operation\n            this.logger?.warn(`Recording the audit event ${input.scope}.${input.name} failed.`);\n        }\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: EventServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Event>> {\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own rows (\"my sign-in history\")\n            return this.repository.findMany(query, {\n                owner: {\n                    actorId: actor.identity!.data.id,\n                    actorType: actor.identity!.type,\n                },\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        const visibility = await this.resolveReadVisibility(actor);\n        const { data: entities, meta } = await this.repository.findMany(query, {\n            ...(options.realmId ? { realmId: options.realmId } : {}),\n            ...(visibility ? { visibility } : {}),\n        });\n\n        const data: Event[] = [];\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.EVENT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                continue;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total: meta.total - (entities.length - data.length),\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext, options: EventServiceReadOptions = {}): Promise<Event> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realm_id !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n}\n\nfunction truncate(value: string | null | undefined, maxLength: number): string | null {\n    if (typeof value !== 'string') {\n        return null;\n    }\n\n    if (value.length <= maxLength) {\n        return value;\n    }\n\n    return value.substring(0, maxLength);\n}\n"],"mappings":";;;;;;;;;;;AA+BA,MAAMQ,YAAY;AAElB,IAAaC,eAAb,cAAkCJ,sBAAAA;CACpBK;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,UAAUE,IAAIF,WAAW,CAAC;EAC/B,KAAKC,SAASC,IAAID;CACtB;CAEUE,UAAUC,QAAeC,OAA8B;EAC7D,OAAO,CAAC,CAACA,MAAMC,YACX,CAAC,CAACF,OAAOG,YACTH,OAAOG,aAAaF,MAAMC,SAASE,KAAKC,MACxCL,OAAOM,eAAeL,MAAMC,SAASK;CAC7C;CAEA,MAAgBC,aAAaP,OAAqBQ,SAA0C;EACxF,IAAI;GACA,MAAMR,MAAMS,oBAAoBC,SAAS;IACrCC,MAAMxB,eAAeyB;IACrBT,MAAMjB,iBAAiB,GAAGD,kBAAkB4B,cAAcL,QAAQ,CAAA;IAClEb,SAAS,EACLmB,kBAAkB;KACd7B,kBAAkB8B;KAClB9B,kBAAkB+B;KAClB/B,kBAAkB4B;MAE1B;GACJ,CAAA;GACA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;CAEA,MAAgBI,sBAAsBjB,OAA+D;EACjG,MAAMkB,eAAe,KAAKC,gBAAgBnB,KAAAA;EAC1C,IAAIoB,iBAAiBpC,WAAAA;EACrB,OAAOoC,mBAAmBF,cACtBE,iBAAiBpC,WAAAA;EAGrB,IAAI,MAAM,KAAKuB,aAAaP,OAAOoB,cAAAA,GAC/B;EAGJ,MAAME,WAAiC,CAAA;EACvC,IAAIJ,gBAAgB,MAAM,KAAKX,aAAaP,OAAOkB,YAAAA,GAC/CI,SAASC,KAAKL,YAAAA;EAElB,IAAI,MAAM,KAAKX,aAAaP,OAAO,IAAA,GAC/BsB,SAASC,KAAK,IAAA;EAGlB,OAAO;GACHD;GACA,GAAItB,MAAMC,WAAW,EACjBuB,OAAO;IACHC,SAASzB,MAAMC,SAASE,KAAKC;IAC7BsB,WAAW1B,MAAMC,SAASK;GAC9B,EACJ,IAAI,CAAC;EACT;CACJ;CAEA,MAAMqB,OAAOC,OAAwC;EACjD,MAAMzB,OAAOZ,kBAAkBqC,MAAMzB,IAAI;EAIzC,KAAKP,QAAQiC,KAAK,UAAUD,MAAME,MAAM,GAAGF,MAAMjB,QAAQ;GACrDmB,OAAOF,MAAME;GACbnB,MAAMiB,MAAMjB;GACZoB,UAAUH,MAAMI,WAAW;GAC3BC,QAAQL,MAAMM,SAAS;GACvBC,WAAWP,MAAMQ,YAAY;GAC7B/B,YAAYuB,MAAMF,aAAa;GAC/BxB,UAAU0B,MAAMH,WAAW;GAC3BY,UAAUT,MAAMpB,WAAW;GAC3B,GAAIL,OAAO,EAAEA,KAAK,IAAI,CAAC;EAC3B,CAAA;EAEA,IAAI,KAAKR,QAAQ2C,YAAY,OACzB;EAGJ,IAAI;GACA,MAAMC,gBAAgBX,MAAMW,iBAAiB,KAAK5C,QAAQ4C,iBAAAA;GAE1D,MAAMxC,SAAS,KAAKL,WAAW8C,OAAO;IAClCpC,IAAIpB,WAAAA;IACJ8C,OAAOF,MAAME;IACbnB,MAAMiB,MAAMjB;IACZoB,UAAUU,SAASb,MAAMI,SAAS,EAAA;IAClCC,QAAQQ,SAASb,MAAMM,OAAO,EAAA;IAC9BC,WAAWP,MAAMQ,YAAY;IAC7B/B,YAAYuB,MAAMF,aAAa;IAC/BxB,UAAU0B,MAAMH,WAAW;IAC3BiB,YAAYD,SAASb,MAAMe,WAAW,GAAA;IACtCC,cAAcH,SAASb,MAAMiB,aAAa,GAAA;IAC1CC,gBAAgBL,SAASb,MAAMmB,eAAe,EAAA;IAC9CC,oBAAoBP,SAASb,MAAMqB,kBAAkB,EAAA;IACrDC,oBAAoBT,SAASb,MAAMuB,kBAAkB,GAAA;IACrDd,UAAUT,MAAMpB,WAAW;IAC3BL;IACAiD,UAAUb,gBAAgB;IAC1Bc,YAAYd,gBAAgB,IACxB,IAAIe,KAAKA,KAAKC,IAAG,IAAMhB,gBAAgB/C,SAAAA,CAAAA,CAAYgE,YAAW,IAC9D;GACR,CAAA;GAEA,MAAM,KAAK9D,WAAW+D,KAAK1D,MAAAA;EAC/B,QAAQ;GAEJ,KAAKH,QAAQ8D,KAAK,6BAA6B9B,MAAME,MAAM,GAAGF,MAAMjB,KAAK,SAAS;EACtF;CACJ;CAEA,MAAMgD,QACFC,OACA5D,OACAL,UAAmC,CAAC,GACU;EAC9C,IAAIkE,aAAa;EACjB,IAAI;GACA,MAAM7D,MAAMS,oBAAoBqD,YAAY,EAAEnD,MAAMxB,eAAeyB,WAAW,CAAA;EAClF,SAASmD,GAAG;GACR,IAAI,CAAC/D,MAAMC,UACP,MAAM8D;GAEVF,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKnE,WAAWsE,SAASJ,OAAO;GACnCpC,OAAO;IACHC,SAASzB,MAAMC,SAAUE,KAAKC;IAC9BsB,WAAW1B,MAAMC,SAAUK;GAC/B;GACA,GAAIX,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;EAC1D,CAAA;EAGJ,MAAMyD,aAAa,MAAM,KAAKhD,sBAAsBjB,KAAAA;EACpD,MAAM,EAAEG,MAAM+D,UAAUC,SAAS,MAAM,KAAKzE,WAAWsE,SAASJ,OAAO;GACnE,GAAIjE,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;GACtD,GAAIyD,aAAa,EAAEA,WAAW,IAAI,CAAC;EACvC,CAAA;EAEA,MAAM9D,OAAgB,CAAA;EAEtB,KAAK,MAAMJ,UAAUmE,UAAU;GAC3B,IAAI,KAAKpE,UAAUC,QAAQC,KAAAA,GAAQ;IAC/BG,KAAKoB,KAAKxB,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMC,MAAMS,oBAAoBC,SAAS;KACrCC,MAAMxB,eAAeyB;KACrBT,MAAMjB,iBAAiB;OAClBD,kBAAkBmF,aAAarE;MAChC,GAAG,KAAKsE,mBAAmBtE,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAI,KAAKoB,KAAKxB,MAAAA;GACd,QAAQ;IACJ;GACJ;EACJ;EAEA,OAAO;GACHI;GACAgE,MAAM;IACF,GAAGA;IACHG,OAAOH,KAAKG,SAASJ,SAASK,SAASpE,KAAKoE;GAChD;EACJ;CACJ;CAEA,MAAMC,OAAOpE,IAAYJ,OAAqBL,UAAmC,CAAC,GAAmB;EACjG,MAAMI,SAAS,MAAM,KAAKL,WAAW+E,YAAYrE,EAAAA;EACjD,IAAI,CAACL,UAAWJ,QAAQa,WAAWT,OAAOsC,aAAa1C,QAAQa,SAC3D,MAAM,IAAIpB,oBAAAA;EAGd,IAAI,CAAC,KAAKU,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMS,oBAAoBqD,YAAY,EAAEnD,MAAMxB,eAAeyB,WAAW,CAAA;GAC9E,MAAMZ,MAAMS,oBAAoBC,SAAS;IACrCC,MAAMxB,eAAeyB;IACrBT,MAAMjB,iBAAiB;MAClBD,kBAAkBmF,aAAarE;KAChC,GAAG,KAAKsE,mBAAmBtE,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;AACJ;AAEA,SAAS0C,SAASiC,OAAkCC,WAAiB;CACjE,IAAI,OAAOD,UAAU,UACjB,OAAO;CAGX,IAAIA,MAAMH,UAAUI,WAChB,OAAOD;CAGX,OAAOA,MAAME,UAAU,GAAGD,SAAAA;AAC9B"}

package/dist/core/entities/event/types.d.ts

@@ -0,0 +1,124 @@
+import type { Event, EventName, EventScope, IdentityType } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+export type EventOwner = {
+    actorId: string;
+    actorType: string;
+};
+export type EventReadVisibility = {
+    owner?: EventOwner;
+    realmIds: Array<string | null>;
+};
+export type EventFindManyOptions = {
+    /**
+     * Mandatory owner constraint (self-service scope) — not overridable by a
+     * rapiq filter.
+     */
+    owner?: EventOwner;
+    realmId?: string;
+    /**
+     * Rows reachable through the actor's realm-scoped permission, plus the
+     * actor's own rows. Applied before pagination so meta.total cannot include
+     * events outside that reach.
+     */
+    visibility?: EventReadVisibility;
+};
+export type EventCountRecentFilter = {
+    name: `${EventName}`;
+    actorName?: string;
+    requestIpAddress?: string;
+    realmId?: string | null;
+    /**
+     * Window start (iso) — only rows created after this instant count.
+     */
+    since: string;
+};
+export interface IEventRepository {
+    create(data: Partial<Event>): Event;
+    save(entity: Event): Promise<Event>;
+    findMany(query: Record<string, any>, options?: EventFindManyOptions): Promise<EntityRepositoryFindManyResult<Event>>;
+    findOneById(id: string): Promise<Event | null>;
+    countRecent(filter: EventCountRecentFilter): Promise<number>;
+    /**
+     * Retention sweep: drop every expiring row whose expires_at lies before
+     * the given instant (non-expiring rows are kept forever). Returns the
+     * number of removed rows.
+     */
+    deleteExpired(now: string): Promise<number>;
+}
+export type EventRecordInput = {
+    scope: `${EventScope}`;
+    name: `${EventName}`;
+    refType?: string | null;
+    refId?: string | null;
+    clientId?: string | null;
+    actorType?: `${IdentityType}` | null;
+    actorId?: string | null;
+    actorName?: string | null;
+    requestPath?: string | null;
+    requestMethod?: string | null;
+    requestIpAddress?: string | null;
+    requestUserAgent?: string | null;
+    realmId?: string | null;
+    data?: Record<string, any> | null;
+    /**
+     * Per-event retention override in days — wins over the service-level
+     * retentionDays; 0 = keep forever. expiring/expires_at derive from the
+     * effective value.
+     */
+    retentionDays?: number;
+};
+export type EventServiceOptions = {
+    /**
+     * config.eventLogEnabled — when false, record() only emits the structured
+     * log line and persists nothing.
+     */
+    enabled?: boolean;
+    /**
+     * config.eventLogRetentionDays — stamped per row as expiring/expires_at
+     * at write time; 0 = keep forever (expiring stays false, expires_at null).
+     */
+    retentionDays?: number;
+};
+export type EventServiceReadOptions = {
+    realmId?: string;
+};
+/**
+ * Actor + request attribution for entity-CRUD audit rows. The shape is
+ * defined here (core) so core never imports from adapters/http — the wiring
+ * injects the HTTP adapter's AsyncLocalStorage getter, and writes outside an
+ * HTTP request (provisioning, CLI, cron) simply resolve to undefined.
+ */
+export type EventRequestContext = {
+    actorType: `${IdentityType}` | null;
+    actorId: string | null;
+    actorName: string | null;
+    requestPath: string | null;
+    requestMethod: string | null;
+    requestIpAddress: string | null;
+    requestUserAgent: string | null;
+};
+export type EntityEventHandlerOptions = {
+    /**
+     * Per-row retention (days) for entity-CRUD audit rows — entity churn
+     * self-prunes on a short TTL (config eventLogEntityRetentionDays).
+     */
+    retentionDays?: number;
+};
+export interface IEventService {
+    /**
+     * Persist an audit event. Fire-and-forget-safe: never throws — a write
+     * failure must not fail the originating auth operation.
+     */
+    record(input: EventRecordInput): Promise<void>;
+    /**
+     * List audit events. An actor without EVENT_READ is scoped to its own
+     * rows ("my sign-in history"); an actor with EVENT_READ sees every row
+     * its realm reach permits.
+     */
+    getMany(query: Record<string, any>, actor: ActorContext, options?: EventServiceReadOptions): Promise<EntityRepositoryFindManyResult<Event>>;
+    /**
+     * Read a single audit event. Own rows need no permission.
+     */
+    getOne(id: string, actor: ActorContext, options?: EventServiceReadOptions): Promise<Event>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/event/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,KAAK,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,MAAM,UAAU,GAAG;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,mBAAmB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IAEpC,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAEpC,QAAQ,CACJ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,OAAO,CAAC,EAAE,oBAAoB,GAC/B,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IAElD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAE/C,WAAW,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7D;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC3B,KAAK,EAAE,GAAG,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAC9B,SAAS,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACpC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;;;OAIG;IACH,OAAO,CACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,uBAAuB,GAClC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IAElD;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CAC9F"}

package/dist/core/entities/event/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/entities/identity-provider-role-mapping/service.mjs

@@ -5,7 +5,7 @@ import { ValidatorGroup } from "@authup/kit";
 import { IdentityProviderRoleMappingValidator, PermissionName } from "@authup/core-kit";
 import { JunctionEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, PermissionError, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityConflictError, EntityNotFoundError } from "@authup/errors";
+import { EntityConflictError, EntityNotFoundError, ValidationError } from "@authup/errors";
 //#region src/core/entities/identity-provider-role-mapping/service.ts
 var IdentityProviderRoleMappingService = class extends JunctionEntityService {
 	ownerRealmKey = "provider_realm_id";
@@ -50,7 +50,7 @@ var IdentityProviderRoleMappingService = class extends JunctionEntityService {
 		})) throw new EntityConflictError({ entity: "identity-provider-role-mapping" });
 		if (validated.provider) validated.provider_realm_id = validated.provider.realm_id;
 		if (validated.role) validated.role_realm_id = validated.role.realm_id;
-		if (validated.role_realm_id && validated.provider_realm_id && validated.role_realm_id !== validated.provider_realm_id) throw new BadRequestError("It is not possible to map an identity provider to a role of another realm.");
+		if (validated.role_realm_id && validated.provider_realm_id && validated.role_realm_id !== validated.provider_realm_id) throw new ValidationError("It is not possible to map an identity provider to a role of another realm.");
 		if (validated.role && actor.identity) {
 			if (!await this.identityPermissionProvider.isSuperset({
 				type: actor.identity.type,

package/dist/core/entities/identity-provider-role-mapping/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","BadRequestError","EntityConflictError","EntityNotFoundError","ValidatorGroup","IdentityProviderRoleMappingValidator","PermissionName","JunctionEntityService","IdentityProviderRoleMappingService","ownerRealmKey","repository","roleRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","IDENTITY_PROVIDER_ROLE_READ","IDENTITY_PROVIDER_READ","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","IDENTITY_PROVIDER_ROLE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","provider_id","role_id","provider","provider_realm_id","realm_id","role","role_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","message","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","IDENTITY_PROVIDER_ROLE_UPDATE","UPDATE","findOneById","merged","merge","delete","IDENTITY_PROVIDER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/identity-provider-role-mapping/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { BadRequestError, EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { IdentityProviderRoleMappingValidator, PermissionName } from '@authup/core-kit';\nimport type { IdentityProviderRoleMapping, Role } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IIdentityProviderRoleMappingRepository, IIdentityProviderRoleMappingService } from './types.ts';\n\nexport type IdentityProviderRoleMappingServiceContext = {\n    repository: IIdentityProviderRoleMappingRepository;\n    roleRepository: IEntityRepository<Role>;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class IdentityProviderRoleMappingService extends JunctionEntityService implements IIdentityProviderRoleMappingService {\n    protected readonly ownerRealmKey = 'provider_realm_id';\n\n    protected repository: IIdentityProviderRoleMappingRepository;\n\n    protected roleRepository: IEntityRepository<Role>;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: IdentityProviderRoleMappingValidator;\n\n    constructor(ctx: IdentityProviderRoleMappingServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.roleRepository = ctx.roleRepository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new IdentityProviderRoleMappingValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<IdentityProviderRoleMapping>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.IDENTITY_PROVIDER_ROLE_READ,\n                PermissionName.IDENTITY_PROVIDER_READ,\n                PermissionName.IDENTITY_PROVIDER_UPDATE,\n                PermissionName.IDENTITY_PROVIDER_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.IDENTITY_PROVIDER_ROLE_READ,\n                PermissionName.IDENTITY_PROVIDER_READ,\n                PermissionName.IDENTITY_PROVIDER_UPDATE,\n                PermissionName.IDENTITY_PROVIDER_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            provider_id: validated.provider_id,\n            role_id: validated.role_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'identity-provider-role-mapping' });\n        }\n\n        if (validated.provider) {\n            validated.provider_realm_id = validated.provider.realm_id;\n        }\n\n        if (validated.role) {\n            validated.role_realm_id = validated.role.realm_id;\n        }\n\n        if (\n            validated.role_realm_id &&\n            validated.provider_realm_id &&\n            validated.role_realm_id !== validated.provider_realm_id\n        ) {\n            throw new BadRequestError('It is not possible to map an identity provider to a role of another realm.');\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.role_id,\n                    clientId: validated.role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n            }\n        }\n\n        // Stamp the owner (identity-provider) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        // `role_id` is immutable on update (CREATE-group only in the validator), so the conferred\n        // role never changes here — only the attribute-matching criteria do. Still re-verify the\n        // actor OWNS that role before letting it edit (e.g. broaden) the mapping, mirroring create()\n        // and the permission-junction member gate (#3164): you may not modify a role-conferring\n        // mapping for a role you no longer own.\n        const role = await this.roleRepository.findOneById(entity.role_id);\n        if (role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: role.id,\n                    clientId: role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n            }\n        }\n\n        const merged = this.repository.merge(entity, validated);\n\n        // Stamp the owner (identity-provider) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n            }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (identity-provider) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAuBA,IAAaU,qCAAb,cAAwDD,sBAAAA;CACjCE,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;EACxD,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,iBAAiBG,IAAIH;EAC1B,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIR,qCAAAA;CACzB;CAEA,MAAMU,QACFC,OACAC,OACoE;EACpE,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKd,WAAWe,SAAST,KAAAA;CACpC;CAEA,MAAMU,OACFC,IACAV,OACoC;EACpC,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKlB,WAAWmB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIzB,oBAAAA;EAGd,OAAOyB;CACX;CAEA,MAAME,OACFC,MACAd,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMd,eAAe2B,8BAA8B,CAAA;EAEjG,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAOhC,eAAeiC,OAAO,CAAA;EAEhF,MAAM,KAAK3B,WAAW4B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK7B,WAAWmB,UAAU;GAC7CW,aAAaN,UAAUM;GACvBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIvC,oBAAoB,EAAE0B,QAAQ,iCAAiC,CAAA;EAG7E,IAAIM,UAAUQ,UACVR,UAAUS,oBAAoBT,UAAUQ,SAASE;EAGrD,IAAIV,UAAUW,MACVX,UAAUY,gBAAgBZ,UAAUW,KAAKD;EAG7C,IACIV,UAAUY,iBACVZ,UAAUS,qBACVT,UAAUY,kBAAkBZ,UAAUS,mBAEtC,MAAM,IAAI1C,gBAAgB,4EAAA;EAG9B,IAAIiC,UAAUW,QAAQ5B,MAAM8B;OAYpB,CAACC,MAXwB,KAAKpC,2BAA2BqC,WACzD;IACIC,MAAMjC,MAAM8B,SAASG;IACrBvB,IAAIV,MAAM8B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIO,UAAUO;IACdU,UAAUjB,UAAUW,KAAKO;GAC7B,CAAA,GAGA,MAAM,IAAIrD,gBAAgB,EAAEsD,SAAS,0CAA2C,CAAA;EAAA;EAKxF,MAAMpC,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMd,eAAe2B;GACrBF,MAAM/B,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBtB,SAAAA;KACvDpC,kBAAkB2D,cAAc,KAAKC,sBAAsBxB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKlB,WAAWoB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKlB,WAAWiD,KAAK/B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMgC,OACFjC,IACAI,MACAd,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMd,eAAeuD,8BAA8B,CAAA;EAEjG,MAAMjC,SAAS,MAAM,KAAKlB,WAAWmB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAM+B,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAOhC,eAAe0D,OAAO,CAAA;EAEhF,MAAM,KAAKpD,WAAW4B,oBAAoBJ,SAAAA;EAO1C,MAAMW,OAAO,MAAM,KAAKlC,eAAeoD,YAAYnC,OAAOa,OAAO;EACjE,IAAII,QAAQ5B,MAAM8B;OAYV,CAACC,MAXwB,KAAKpC,2BAA2BqC,WACzD;IACIC,MAAMjC,MAAM8B,SAASG;IACrBvB,IAAIV,MAAM8B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIkB,KAAKlB;IACTwB,UAAUN,KAAKO;GACnB,CAAA,GAGA,MAAM,IAAIrD,gBAAgB,EAAEsD,SAAS,0CAA2C,CAAA;EAAA;EAIxF,MAAMW,SAAS,KAAKtD,WAAWuD,MAAMrC,QAAQM,SAAAA;EAG7C,MAAMjB,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMd,eAAeuD;GACrB9B,MAAM/B,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBQ,MAAAA;KACvDlE,kBAAkB2D,cAAc,KAAKC,sBAAsBM,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAKtD,WAAWiD,KAAKK,MAAAA;CAChC;CAEA,MAAME,OACFvC,IACAV,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMd,eAAe6D,8BAA8B,CAAA;EAEjG,MAAMvC,SAAS,MAAM,KAAKlB,WAAWmB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIzB,oBAAAA;EAId,MAAMc,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMd,eAAe6D;GACrBpC,MAAM/B,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmB5B,MAAAA;KACvD9B,kBAAkB2D,cAAc,KAAKC,sBAAsB9B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIyC,aAAaxC;EACzB,MAAM,KAAKlB,WAAW2D,OAAOzC,MAAAA;EAC7BA,OAAOD,KAAKyC;EAEZ,OAAOxC;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","EntityConflictError","EntityNotFoundError","ValidationError","ValidatorGroup","IdentityProviderRoleMappingValidator","PermissionName","JunctionEntityService","IdentityProviderRoleMappingService","ownerRealmKey","repository","roleRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","IDENTITY_PROVIDER_ROLE_READ","IDENTITY_PROVIDER_READ","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","IDENTITY_PROVIDER_ROLE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","provider_id","role_id","provider","provider_realm_id","realm_id","role","role_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","message","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","IDENTITY_PROVIDER_ROLE_UPDATE","UPDATE","findOneById","merged","merge","delete","IDENTITY_PROVIDER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/identity-provider-role-mapping/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { IdentityProviderRoleMappingValidator, PermissionName } from '@authup/core-kit';\nimport type { IdentityProviderRoleMapping, Role } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IIdentityProviderRoleMappingRepository, IIdentityProviderRoleMappingService } from './types.ts';\n\nexport type IdentityProviderRoleMappingServiceContext = {\n    repository: IIdentityProviderRoleMappingRepository;\n    roleRepository: IEntityRepository<Role>;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class IdentityProviderRoleMappingService extends JunctionEntityService implements IIdentityProviderRoleMappingService {\n    protected readonly ownerRealmKey = 'provider_realm_id';\n\n    protected repository: IIdentityProviderRoleMappingRepository;\n\n    protected roleRepository: IEntityRepository<Role>;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: IdentityProviderRoleMappingValidator;\n\n    constructor(ctx: IdentityProviderRoleMappingServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.roleRepository = ctx.roleRepository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new IdentityProviderRoleMappingValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<IdentityProviderRoleMapping>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.IDENTITY_PROVIDER_ROLE_READ,\n                PermissionName.IDENTITY_PROVIDER_READ,\n                PermissionName.IDENTITY_PROVIDER_UPDATE,\n                PermissionName.IDENTITY_PROVIDER_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.IDENTITY_PROVIDER_ROLE_READ,\n                PermissionName.IDENTITY_PROVIDER_READ,\n                PermissionName.IDENTITY_PROVIDER_UPDATE,\n                PermissionName.IDENTITY_PROVIDER_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            provider_id: validated.provider_id,\n            role_id: validated.role_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'identity-provider-role-mapping' });\n        }\n\n        if (validated.provider) {\n            validated.provider_realm_id = validated.provider.realm_id;\n        }\n\n        if (validated.role) {\n            validated.role_realm_id = validated.role.realm_id;\n        }\n\n        if (\n            validated.role_realm_id &&\n            validated.provider_realm_id &&\n            validated.role_realm_id !== validated.provider_realm_id\n        ) {\n            throw new ValidationError('It is not possible to map an identity provider to a role of another realm.');\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.role_id,\n                    clientId: validated.role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n            }\n        }\n\n        // Stamp the owner (identity-provider) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_ROLE_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        // `role_id` is immutable on update (CREATE-group only in the validator), so the conferred\n        // role never changes here — only the attribute-matching criteria do. Still re-verify the\n        // actor OWNS that role before letting it edit (e.g. broaden) the mapping, mirroring create()\n        // and the permission-junction member gate (#3164): you may not modify a role-conferring\n        // mapping for a role you no longer own.\n        const role = await this.roleRepository.findOneById(entity.role_id);\n        if (role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: role.id,\n                    clientId: role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n            }\n        }\n\n        const merged = this.repository.merge(entity, validated);\n\n        // Stamp the owner (identity-provider) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_ROLE_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n            }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<IdentityProviderRoleMapping> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (identity-provider) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.IDENTITY_PROVIDER_ROLE_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAuBA,IAAaU,qCAAb,cAAwDD,sBAAAA;CACjCE,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;EACxD,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,iBAAiBG,IAAIH;EAC1B,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIR,qCAAAA;CACzB;CAEA,MAAMU,QACFC,OACAC,OACoE;EACpE,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKd,WAAWe,SAAST,KAAAA;CACpC;CAEA,MAAMU,OACFC,IACAV,OACoC;EACpC,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKlB,WAAWmB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAd,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMd,eAAe2B,8BAA8B,CAAA;EAEjG,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAOhC,eAAeiC,OAAO,CAAA;EAEhF,MAAM,KAAK3B,WAAW4B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK7B,WAAWmB,UAAU;GAC7CW,aAAaN,UAAUM;GACvBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIxC,oBAAoB,EAAE2B,QAAQ,iCAAiC,CAAA;EAG7E,IAAIM,UAAUQ,UACVR,UAAUS,oBAAoBT,UAAUQ,SAASE;EAGrD,IAAIV,UAAUW,MACVX,UAAUY,gBAAgBZ,UAAUW,KAAKD;EAG7C,IACIV,UAAUY,iBACVZ,UAAUS,qBACVT,UAAUY,kBAAkBZ,UAAUS,mBAEtC,MAAM,IAAIxC,gBAAgB,4EAAA;EAG9B,IAAI+B,UAAUW,QAAQ5B,MAAM8B;OAYpB,CAACC,MAXwB,KAAKpC,2BAA2BqC,WACzD;IACIC,MAAMjC,MAAM8B,SAASG;IACrBvB,IAAIV,MAAM8B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIO,UAAUO;IACdU,UAAUjB,UAAUW,KAAKO;GAC7B,CAAA,GAGA,MAAM,IAAIrD,gBAAgB,EAAEsD,SAAS,0CAA2C,CAAA;EAAA;EAKxF,MAAMpC,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMd,eAAe2B;GACrBF,MAAM/B,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBtB,SAAAA;KACvDpC,kBAAkB2D,cAAc,KAAKC,sBAAsBxB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKlB,WAAWoB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKlB,WAAWiD,KAAK/B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMgC,OACFjC,IACAI,MACAd,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMd,eAAeuD,8BAA8B,CAAA;EAEjG,MAAMjC,SAAS,MAAM,KAAKlB,WAAWmB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,MAAMgC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAOhC,eAAe0D,OAAO,CAAA;EAEhF,MAAM,KAAKpD,WAAW4B,oBAAoBJ,SAAAA;EAO1C,MAAMW,OAAO,MAAM,KAAKlC,eAAeoD,YAAYnC,OAAOa,OAAO;EACjE,IAAII,QAAQ5B,MAAM8B;OAYV,CAACC,MAXwB,KAAKpC,2BAA2BqC,WACzD;IACIC,MAAMjC,MAAM8B,SAASG;IACrBvB,IAAIV,MAAM8B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIkB,KAAKlB;IACTwB,UAAUN,KAAKO;GACnB,CAAA,GAGA,MAAM,IAAIrD,gBAAgB,EAAEsD,SAAS,0CAA2C,CAAA;EAAA;EAIxF,MAAMW,SAAS,KAAKtD,WAAWuD,MAAMrC,QAAQM,SAAAA;EAG7C,MAAMjB,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMd,eAAeuD;GACrB9B,MAAM/B,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBQ,MAAAA;KACvDlE,kBAAkB2D,cAAc,KAAKC,sBAAsBM,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAKtD,WAAWiD,KAAKK,MAAAA;CAChC;CAEA,MAAME,OACFvC,IACAV,OACoC;EACpC,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMd,eAAe6D,8BAA8B,CAAA;EAEjG,MAAMvC,SAAS,MAAM,KAAKlB,WAAWmB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAId,MAAMe,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMd,eAAe6D;GACrBpC,MAAM/B,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmB5B,MAAAA;KACvD9B,kBAAkB2D,cAAc,KAAKC,sBAAsB9B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIyC,aAAaxC;EACzB,MAAM,KAAKlB,WAAW2D,OAAOzC,MAAAA;EAC7BA,OAAOD,KAAKyC;EAEZ,OAAOxC;CACX;AACJ"}

package/dist/core/entities/index.d.ts

@@ -2,7 +2,10 @@ export * from './client/index.ts';
 export * from './client-permission/index.ts';
 export * from './client-role/index.ts';
 export * from './client-scope/index.ts';
+export * from './consent/index.ts';
+export * from './event/index.ts';
 export * from './identity-provider/index.ts';
+export * from './key/index.ts';
 export * from './permission/index.ts';
 export * from './permission-policy/index.ts';
 export * from './policy/index.ts';
@@ -15,8 +18,10 @@ export * from './role-attribute/index.ts';
 export * from './role-permission/index.ts';
 export * from './scope/index.ts';
 export * from './session/index.ts';
+export * from './trust-anchor/index.ts';
 export * from './user/index.ts';
 export * from './user-attribute/index.ts';
+export * from './user-authenticator/index.ts';
 export * from './user-permission/index.ts';
 export * from './user-role/index.ts';
 export * from './identity-provider-role-mapping/index.ts';

package/dist/core/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}

package/dist/core/entities/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH } from "./consent/types.mjs";
 import { ClientService } from "./client/service.mjs";
 import { WebClientProvisioner, buildWebClientAttributes } from "./client/web-client.mjs";
 import "./client/index.mjs";
@@ -10,6 +11,16 @@ import { ClientRoleService } from "./client-role/service.mjs";
 import "./client-role/index.mjs";
 import { ClientScopeService } from "./client-scope/service.mjs";
 import "./client-scope/index.mjs";
+import { ConsentService } from "./consent/service.mjs";
+import "./consent/index.mjs";
+import { EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./event/constants.mjs";
+import { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDiff } from "./event/diff.mjs";
+import { EntityEventHandler } from "./event/entity-event-handler.mjs";
+import { sanitizeEventData } from "./event/sanitize.mjs";
+import { EventService } from "./event/service.mjs";
+import "./event/index.mjs";
+import { KeyService } from "./key/service.mjs";
+import "./key/index.mjs";
 import { PermissionService } from "./permission/service.mjs";
 import "./permission/index.mjs";
 import { PermissionPolicyService } from "./permission-policy/service.mjs";
@@ -34,14 +45,22 @@ import { ScopeService } from "./scope/service.mjs";
 import "./scope/index.mjs";
 import { SessionService } from "./session/service.mjs";
 import "./session/index.mjs";
+import { TrustAnchorService } from "./trust-anchor/service.mjs";
+import "./trust-anchor/index.mjs";
 import { UserService } from "./user/service.mjs";
 import "./user/index.mjs";
 import { UserAttributeService } from "./user-attribute/service.mjs";
 import "./user-attribute/index.mjs";
+import { USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX } from "./user-authenticator/constants.mjs";
+import { generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse } from "./user-authenticator/helpers.mjs";
+import { buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, verifyWebauthnAuthentication, verifyWebauthnRegistration } from "./user-authenticator/webauthn.mjs";
+import { UserAuthenticatorService } from "./user-authenticator/service.mjs";
+import { USER_AUTHENTICATOR_FILTER_KEYS } from "./user-authenticator/types.mjs";
+import "./user-authenticator/index.mjs";
 import { UserPermissionService } from "./user-permission/service.mjs";
 import "./user-permission/index.mjs";
 import { UserRoleService } from "./user-role/service.mjs";
 import "./user-role/index.mjs";
 import { IdentityProviderRoleMappingService } from "./identity-provider-role-mapping/service.mjs";
 import "./identity-provider-role-mapping/index.mjs";
-export { ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, IdentityProviderRoleMappingService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RobotPermissionService, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleService, ScopeService, SessionService, UserAttributeService, UserPermissionService, UserRoleService, UserService, WebClientProvisioner, buildWebClientAttributes };
+export { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, ConsentService, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, IdentityProviderRoleMappingService, KeyService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RobotPermissionService, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleService, ScopeService, SessionService, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticatorService, UserPermissionService, UserRoleService, UserService, WebClientProvisioner, buildEntityDiff, buildWebClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse, sanitizeEventData, verifyWebauthnAuthentication, verifyWebauthnRegistration };

package/dist/core/entities/key/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/key/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/key/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/entities/key/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { KeyService } from "./service.mjs";
+export { KeyService };

package/dist/core/entities/key/service.d.ts

@@ -0,0 +1,55 @@
+import type { Key } from '@authup/core-kit';
+import { EventName, KeyValidator } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import { JWKType, JWKUse, JWTAlgorithm } from '@authup/specs';
+import type { EventRequestContext, IEventService } from '../event/index.ts';
+import type { IKeyRepository, IKeyService, KeyDeleteOptions } from './types.ts';
+export type KeyServiceContext = {
+    repository: IKeyRepository;
+    eventService?: IEventService;
+    requestContext?: () => EventRequestContext | undefined;
+};
+export declare class KeyService extends AbstractEntityService implements IKeyService {
+    protected repository: IKeyRepository;
+    protected validator: KeyValidator;
+    protected eventService?: IEventService;
+    protected requestContext?: () => EventRequestContext | undefined;
+    constructor(ctx: KeyServiceContext);
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<Key>>;
+    getOne(idOrName: string, actor: ActorContext, realmId?: string): Promise<Key>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<Key>;
+    update(idOrName: string, data: Record<string, any>, actor: ActorContext, realmId?: string): Promise<Key>;
+    delete(id: string, actor: ActorContext, options?: KeyDeleteOptions): Promise<Key>;
+    /**
+     * Metadata-only audit trail for key lifecycle operations (issue #3269) —
+     * keys deliberately have no entity subscriber (private material must stay
+     * off the realtime/audit bus), so the security-relevant mutations are
+     * recorded explicitly. The payload never carries key material.
+     */
+    protected recordEvent(name: `${EventName}`, entity: Key, actor: ActorContext, data?: Record<string, any>): Promise<void>;
+    protected pickAuditFields(entity: Key): Record<string, any>;
+    protected generateMaterial(validated: Partial<Key>, use: `${JWKUse}`): Promise<{
+        type: `${JWKType}`;
+        signatureAlgorithm: `${JWTAlgorithm}` | null;
+        decryptionKey: string;
+        encryptionKey: string | null;
+    }>;
+    protected importMaterial(validated: Partial<Key>, use: `${JWKUse}`): Promise<{
+        type: `${JWKType}`;
+        signatureAlgorithm: `${JWTAlgorithm}` | null;
+        decryptionKey: string;
+        encryptionKey: string | null;
+    }>;
+    protected buildAsymmetricOptions(algorithm: `${JWTAlgorithm}`): {
+        name: import("@authup/server-kit").CryptoAsymmetricAlgorithm;
+        hash: string;
+        namedCurve?: undefined;
+    } | {
+        name: import("@authup/server-kit").CryptoAsymmetricAlgorithm;
+        namedCurve: string;
+        hash?: undefined;
+    };
+    protected normalizeMaterial(value: string): string;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/key/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/key/service.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAEH,SAAS,EAGT,YAAY,EAEf,MAAM,kBAAkB,CAAC;AAO1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAA0C,MAAM,oBAAoB,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEhF,MAAM,MAAM,iBAAiB,GAAG;IAC5B,UAAU,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;CAC1D,CAAC;AAQF,qBAAa,UAAW,SAAQ,qBAAsB,YAAW,WAAW;IACxE,SAAS,CAAC,UAAU,EAAE,cAAc,CAAC;IAErC,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC;IAElC,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;gBAErD,GAAG,EAAE,iBAAiB;IAQ5B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC;IAoCzC,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC;IAsBT,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,GAAG,CAAC;IA6FT,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC;IA2CT,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,gBAAqB,GAC/B,OAAO,CAAC,GAAG,CAAC;IA0Cf;;;;;OAKG;cACa,WAAW,CACvB,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,GAAG,EACX,KAAK,EAAE,YAAY,EACnB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IA2BhB,SAAS,CAAC,eAAe,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;cAQ3C,gBAAgB,CAC5B,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EACvB,GAAG,EAAE,GAAG,MAAM,EAAE,GAChB,OAAO,CAAC;QACR,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;QACnB,kBAAkB,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;QAC7C,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,CAAC;cA8Bc,cAAc,CAC1B,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EACvB,GAAG,EAAE,GAAG,MAAM,EAAE,GAChB,OAAO,CAAC;QACR,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;QACnB,kBAAkB,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;QAC7C,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,CAAC;IA2FF,SAAS,CAAC,sBAAsB,CAAC,SAAS,EAAE,GAAG,YAAY,EAAE;;;;;;;;;IAQ7D,SAAS,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAI,MAAM;CAUtD"}