@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/core/entities/key/service.mjs

@@ -0,0 +1,301 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildEntityDiff } from "../event/diff.mjs";
+import "../event/index.mjs";
+import { assertCertificateMatchesKey, parseCertificateChain } from "../../key/certificate.mjs";
+import { isWrappedKeyMaterial } from "../../key/wrap.mjs";
+import "../../key/index.mjs";
+import { ValidatorGroup, arrayBufferToBase64, base64ToArrayBuffer, createNanoID } from "@authup/kit";
+import { EntityType, EventName, EventScope, KeyStatus, KeyValidator, PermissionName } from "@authup/core-kit";
+import { AbstractEntityService, AsymmetricKey, createAsymmetricKeyPair } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { EntityConflictError, EntityNotFoundError, ValidationError, isError } from "@authup/errors";
+import { JWKType, JWKUse, JWTAlgorithm } from "@authup/specs";
+import { getRandomValues } from "uncrypto";
+//#region src/core/entities/key/service.ts
+const PERMISSION_NAMES = [
+	PermissionName.KEY_READ,
+	PermissionName.KEY_UPDATE,
+	PermissionName.KEY_DELETE
+];
+var KeyService = class extends AbstractEntityService {
+	repository;
+	validator;
+	eventService;
+	requestContext;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.validator = new KeyValidator();
+		this.eventService = ctx.eventService;
+		this.requestContext = ctx.requestContext;
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });
+		const { data: entities, meta } = await this.repository.findMany(query);
+		const data = [];
+		let { total } = meta;
+		for (const entity of entities) try {
+			await actor.permissionEvaluator.evaluateOneOf({
+				name: PERMISSION_NAMES,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+			entity.decryption_key = null;
+			data.push(entity);
+		} catch {
+			total -= 1;
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(idOrName, actor, realmId) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });
+		const entity = await this.repository.findOneByIdOrName(idOrName, realmId);
+		if (!entity) throw new EntityNotFoundError();
+		await actor.permissionEvaluator.evaluateOneOf({
+			name: PERMISSION_NAMES,
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
+		});
+		entity.decryption_key = null;
+		return entity;
+	}
+	async create(data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		const { use } = validated;
+		if (!use) throw new ValidationError("A key use must be specified.");
+		await this.repository.validateJoinColumns(validated);
+		if (!validated.realm_id && actor.identity) {
+			const actorRealmId = this.getActorRealmId(actor);
+			if (actorRealmId) validated.realm_id = actorRealmId;
+		}
+		if (!validated.realm_id) throw new ValidationError("A realm must be specified.");
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.KEY_CREATE,
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: validated,
+				...this.resourceRealmMatch(validated)
+			})
+		});
+		if (!validated.name) validated.name = `${use}-${createNanoID(10)}`;
+		await this.repository.checkUniqueness(validated);
+		if (typeof validated.priority !== "number") {
+			const highest = await this.repository.findHighestPriority(validated.realm_id, use);
+			validated.priority = typeof highest === "number" ? highest + 1 : 0;
+		}
+		if (!validated.status) validated.status = KeyStatus.ACTIVE;
+		const certificate = typeof validated.certificate === "string" ? validated.certificate : null;
+		if (certificate && (!validated.decryption_key || use !== JWKUse.SIGNATURE)) throw new ValidationError("A certificate requires imported signature key material.");
+		const material = validated.decryption_key ? await this.importMaterial(validated, use) : await this.generateMaterial(validated, use);
+		if (certificate) {
+			if (!material.encryptionKey) throw new ValidationError("A certificate requires imported signature key material.");
+			try {
+				assertCertificateMatchesKey(parseCertificateChain(certificate), material.encryptionKey);
+			} catch (e) {
+				throw new ValidationError(isError(e) ? e.message : "The certificate could not be matched against the imported key material.");
+			}
+		}
+		let entity = this.repository.create({
+			...validated,
+			type: material.type,
+			signature_algorithm: material.signatureAlgorithm,
+			decryption_key: material.decryptionKey,
+			encryption_key: material.encryptionKey
+		});
+		entity = await this.repository.save(entity);
+		entity.decryption_key = null;
+		await this.recordEvent(EventName.CREATED, entity, actor);
+		return entity;
+	}
+	async update(idOrName, data, actor, realmId) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });
+		let entity = await this.repository.findOneByIdOrName(idOrName, realmId);
+		if (!entity) throw new EntityNotFoundError();
+		const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.KEY_UPDATE,
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: {
+					...entity,
+					...validated
+				},
+				...this.resourceRealmMatch(entity)
+			})
+		});
+		if (validated.name && validated.name !== entity.name) await this.repository.checkUniqueness({
+			name: validated.name,
+			realm_id: entity.realm_id
+		}, entity);
+		const previous = this.pickAuditFields(entity);
+		entity = this.repository.merge(entity, validated);
+		await this.repository.save(entity);
+		entity.decryption_key = null;
+		const diff = buildEntityDiff(this.pickAuditFields(entity), previous);
+		await this.recordEvent(EventName.UPDATED, entity, actor, { ...Object.keys(diff).length > 0 ? { diff } : {} });
+		return entity;
+	}
+	async delete(id, actor, options = {}) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new EntityNotFoundError();
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.KEY_DELETE,
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
+		});
+		if (entity.use === JWKUse.ENCRYPTION && !options.force) {
+			const references = await this.repository.countBlobReferences(entity.id);
+			if (references > 0) throw new EntityConflictError({
+				message: `The encryption key is still referenced by ${references} encrypted secret(s) — deleting it makes them unrecoverable. Repeat with force to crypto-shred them.`,
+				data: { references }
+			});
+		}
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		entity.decryption_key = null;
+		const forcedCryptoShred = entity.use === JWKUse.ENCRYPTION && !!options.force;
+		await this.recordEvent(EventName.DELETED, entity, actor, { ...forcedCryptoShred ? { force: true } : {} });
+		return entity;
+	}
+	/**
+	* Metadata-only audit trail for key lifecycle operations (issue #3269) —
+	* keys deliberately have no entity subscriber (private material must stay
+	* off the realtime/audit bus), so the security-relevant mutations are
+	* recorded explicitly. The payload never carries key material.
+	*/ async recordEvent(name, entity, actor, data = {}) {
+		const requestContext = this.requestContext ? this.requestContext() : void 0;
+		await this.eventService?.record({
+			scope: EventScope.ENTITY,
+			name,
+			refType: EntityType.KEY,
+			refId: entity.id,
+			realmId: entity.realm_id ?? null,
+			actorType: actor.identity?.type ?? null,
+			actorId: actor.identity?.data.id ?? null,
+			actorName: actor.identity?.data.name ?? null,
+			requestPath: requestContext?.requestPath ?? null,
+			requestMethod: requestContext?.requestMethod ?? null,
+			requestIpAddress: requestContext?.requestIpAddress ?? null,
+			requestUserAgent: requestContext?.requestUserAgent ?? null,
+			data: {
+				name: entity.name,
+				use: entity.use,
+				status: entity.status,
+				...data
+			}
+		});
+	}
+	pickAuditFields(entity) {
+		return {
+			name: entity.name,
+			priority: entity.priority,
+			status: entity.status
+		};
+	}
+	async generateMaterial(validated, use) {
+		if (use === JWKUse.ENCRYPTION) {
+			if (validated.signature_algorithm) throw new ValidationError("An encryption key can not carry a signature algorithm.");
+			const raw = /* @__PURE__ */ new Uint8Array(32);
+			getRandomValues(raw);
+			return {
+				type: JWKType.OCT,
+				signatureAlgorithm: null,
+				decryptionKey: arrayBufferToBase64(raw.buffer),
+				encryptionKey: null
+			};
+		}
+		const algorithm = validated.signature_algorithm ?? JWTAlgorithm.RS256;
+		const keyPair = await createAsymmetricKeyPair(this.buildAsymmetricOptions(algorithm));
+		return {
+			type: algorithm.startsWith("ES") ? JWKType.EC : JWKType.RSA,
+			signatureAlgorithm: algorithm,
+			decryptionKey: await new AsymmetricKey(keyPair.privateKey).toBase64(),
+			encryptionKey: await new AsymmetricKey(keyPair.publicKey).toBase64()
+		};
+	}
+	async importMaterial(validated, use) {
+		if (!validated.decryption_key) throw new ValidationError("Importing key material requires its private part (decryption_key).");
+		if (isWrappedKeyMaterial(validated.decryption_key.trim())) throw new ValidationError("The imported key material is not valid.");
+		const decryptionKey = this.normalizeMaterial(validated.decryption_key);
+		if (use === JWKUse.ENCRYPTION) {
+			if (validated.signature_algorithm) throw new ValidationError("An encryption key can not carry a signature algorithm.");
+			if (validated.encryption_key) throw new ValidationError("An encryption key holds no public part.");
+			let byteLength;
+			try {
+				byteLength = base64ToArrayBuffer(decryptionKey).byteLength;
+			} catch {
+				throw new ValidationError("The key material is not valid base64.");
+			}
+			if (byteLength !== 32) throw new ValidationError("The key material must be 32 base64-encoded bytes.");
+			return {
+				type: JWKType.OCT,
+				signatureAlgorithm: null,
+				decryptionKey,
+				encryptionKey: null
+			};
+		}
+		if (!validated.encryption_key) throw new ValidationError("Importing a signature key requires its public part (encryption_key, SPKI).");
+		const encryptionKey = this.normalizeMaterial(validated.encryption_key);
+		const algorithm = validated.signature_algorithm ?? JWTAlgorithm.RS256;
+		const options = this.buildAsymmetricOptions(algorithm);
+		let privateJwk;
+		let publicJwk;
+		try {
+			const privateKey = await AsymmetricKey.fromBase64({
+				format: "pkcs8",
+				key: decryptionKey,
+				options
+			});
+			const publicKey = await AsymmetricKey.fromBase64({
+				format: "spki",
+				key: encryptionKey,
+				options
+			});
+			privateJwk = await privateKey.toJWK();
+			publicJwk = await publicKey.toJWK();
+		} catch {
+			throw new ValidationError(`The key material could not be imported for ${algorithm}.`);
+		}
+		if ([
+			"kty",
+			"n",
+			"e",
+			"crv",
+			"x",
+			"y"
+		].some((component) => publicJwk[component] !== void 0 && publicJwk[component] !== privateJwk[component])) throw new ValidationError("The private and public key material do not form a pair.");
+		return {
+			type: algorithm.startsWith("ES") ? JWKType.EC : JWKType.RSA,
+			signatureAlgorithm: algorithm,
+			decryptionKey,
+			encryptionKey
+		};
+	}
+	buildAsymmetricOptions(algorithm) {
+		if (!/^(RS|ES)(256|384|512)$/.test(algorithm)) throw new ValidationError(`The signature algorithm ${algorithm} is not supported for stored keys.`);
+		return AsymmetricKey.buildImportOptionsForJWTAlgorithm(algorithm);
+	}
+	normalizeMaterial(value) {
+		if (value.includes("-----BEGIN")) return value.replace(/-----(BEGIN|END)[^-]+-----/g, "").replace(/\s+/g, "");
+		return value.trim();
+	}
+};
+//#endregion
+export { KeyService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/key/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityConflictError","EntityNotFoundError","ValidationError","isError","isRawError","EntityType","EventName","EventScope","KeyStatus","KeyValidator","PermissionName","ValidatorGroup","arrayBufferToBase64","base64ToArrayBuffer","createNanoID","AbstractEntityService","AsymmetricKey","createAsymmetricKeyPair","JWKType","JWKUse","JWTAlgorithm","getRandomValues","buildEntityDiff","assertCertificateMatchesKey","isWrappedKeyMaterial","parseCertificateChain","PERMISSION_NAMES","KEY_READ","KEY_UPDATE","KEY_DELETE","KeyService","repository","validator","eventService","requestContext","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","data","entities","meta","findMany","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","decryption_key","push","getOne","idOrName","realmId","findOneByIdOrName","create","preEvaluate","KEY_CREATE","validated","run","group","CREATE","use","validateJoinColumns","realm_id","identity","actorRealmId","getActorRealmId","evaluate","checkUniqueness","priority","highest","findHighestPriority","status","ACTIVE","certificate","SIGNATURE","material","importMaterial","generateMaterial","encryptionKey","chain","e","message","type","signature_algorithm","signatureAlgorithm","decryptionKey","encryption_key","save","recordEvent","CREATED","update","UPDATE","previous","pickAuditFields","merge","diff","UPDATED","Object","keys","length","delete","id","options","findOneBy","ENCRYPTION","force","references","countBlobReferences","entityId","remove","forcedCryptoShred","DELETED","undefined","record","scope","ENTITY","refType","KEY","refId","actorType","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","raw","Uint8Array","OCT","buffer","algorithm","RS256","buildAsymmetricOptions","keyPair","startsWith","EC","RSA","privateKey","toBase64","publicKey","trim","normalizeMaterial","byteLength","privateJwk","publicJwk","fromBase64","format","key","toJWK","components","mismatch","some","component","test","buildImportOptionsForJWTAlgorithm","value","includes","replace"],"sources":["../../../../src/core/entities/key/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    EntityConflictError,\n    EntityNotFoundError,\n    ValidationError,\n    isError as isRawError,\n} from '@authup/errors';\nimport type { Key } from '@authup/core-kit';\nimport {\n    EntityType,\n    EventName,\n    EventScope,\n    KeyStatus,\n    KeyValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport {\n    ValidatorGroup,\n    arrayBufferToBase64,\n    base64ToArrayBuffer,\n    createNanoID,\n} from '@authup/kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService, AsymmetricKey, createAsymmetricKeyPair } from '@authup/server-kit';\nimport { JWKType, JWKUse, JWTAlgorithm } from '@authup/specs';\nimport { getRandomValues } from 'uncrypto';\nimport { buildEntityDiff } from '../event/index.ts';\nimport type { EventRequestContext, IEventService } from '../event/index.ts';\nimport { assertCertificateMatchesKey, isWrappedKeyMaterial, parseCertificateChain } from '../../key/index.ts';\nimport type { IKeyRepository, IKeyService, KeyDeleteOptions } from './types.ts';\n\nexport type KeyServiceContext = {\n    repository: IKeyRepository;\n    eventService?: IEventService;\n    requestContext?: () => EventRequestContext | undefined;\n};\n\nconst PERMISSION_NAMES = [\n    PermissionName.KEY_READ,\n    PermissionName.KEY_UPDATE,\n    PermissionName.KEY_DELETE,\n];\n\nexport class KeyService extends AbstractEntityService implements IKeyService {\n    protected repository: IKeyRepository;\n\n    protected validator: KeyValidator;\n\n    protected eventService?: IEventService;\n\n    protected requestContext?: () => EventRequestContext | undefined;\n\n    constructor(ctx: KeyServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new KeyValidator();\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Key>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        const { data: entities, meta } = await this.repository.findMany(query);\n\n        const data: Key[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: PERMISSION_NAMES,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                // Belt-and-braces: the read projection never selects private\n                // material, but null it explicitly so no future adapter change\n                // can leak it onto a read surface (cf. authentik CVE-2024-42490).\n                entity.decryption_key = null;\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<Key> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluateOneOf({\n            name: PERMISSION_NAMES,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        // Belt-and-braces null of private material (see getMany).\n        entity.decryption_key = null;\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Key> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n        const { use } = validated;\n        if (!use) {\n            throw new ValidationError('A key use must be specified.');\n        }\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (!validated.realm_id && actor.identity) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realm_id = actorRealmId;\n            }\n        }\n\n        // keys are realm-bound infrastructure — no global (null realm) keys\n        // via the API.\n        if (!validated.realm_id) {\n            throw new ValidationError('A realm must be specified.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: validated,\n                ...this.resourceRealmMatch(validated),\n            }),\n        });\n\n        if (!validated.name) {\n            validated.name = `${use}-${createNanoID(10)}`;\n        }\n\n        await this.repository.checkUniqueness(validated);\n\n        if (typeof validated.priority !== 'number') {\n            const highest = await this.repository.findHighestPriority(validated.realm_id, use);\n            // generate doubles as rotate: a new key outranks the current one.\n            validated.priority = typeof highest === 'number' ? highest + 1 : 0;\n        }\n\n        if (!validated.status) {\n            validated.status = KeyStatus.ACTIVE;\n        }\n\n        const certificate = typeof validated.certificate === 'string' ? validated.certificate : null;\n        if (certificate && (!validated.decryption_key || use !== JWKUse.SIGNATURE)) {\n            throw new ValidationError('A certificate requires imported signature key material.');\n        }\n\n        const material = validated.decryption_key ?\n            await this.importMaterial(validated, use) :\n            await this.generateMaterial(validated, use);\n\n        if (certificate) {\n            if (!material.encryptionKey) {\n                throw new ValidationError('A certificate requires imported signature key material.');\n            }\n\n            try {\n                const chain = parseCertificateChain(certificate);\n                assertCertificateMatchesKey(chain, material.encryptionKey);\n            } catch (e) {\n                throw new ValidationError(\n                    isRawError(e) ?\n                        e.message :\n                        'The certificate could not be matched against the imported key material.',\n                );\n            }\n        }\n\n        let entity = this.repository.create({\n            ...validated,\n            type: material.type,\n            signature_algorithm: material.signatureAlgorithm,\n            decryption_key: material.decryptionKey,\n            encryption_key: material.encryptionKey,\n        });\n\n        entity = await this.repository.save(entity);\n\n        // private material never leaves the server — the response carries\n        // metadata + public part only (authentik CVE-2024-42490).\n        entity.decryption_key = null;\n\n        await this.recordEvent(EventName.CREATED, entity, actor);\n\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<Key> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });\n\n        let entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // only name / priority / status are mounted for UPDATE — material,\n        // use, type and realm are immutable.\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: {\n                    ...entity,\n                    ...validated,\n                },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        if (validated.name && validated.name !== entity.name) {\n            await this.repository.checkUniqueness({\n                name: validated.name,\n                realm_id: entity.realm_id,\n            }, entity);\n        }\n\n        const previous = this.pickAuditFields(entity);\n\n        entity = this.repository.merge(entity, validated);\n        await this.repository.save(entity);\n\n        entity.decryption_key = null;\n\n        const diff = buildEntityDiff(this.pickAuditFields(entity), previous);\n        await this.recordEvent(EventName.UPDATED, entity, actor, { ...(Object.keys(diff).length > 0 ? { diff } : {}) });\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n        options: KeyDeleteOptions = {},\n    ): Promise<Key> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        if (entity.use === JWKUse.ENCRYPTION && !options.force) {\n            const references = await this.repository.countBlobReferences(entity.id);\n            if (references > 0) {\n                throw new EntityConflictError({\n                    message: `The encryption key is still referenced by ${references} encrypted secret(s) — ` +\n                        'deleting it makes them unrecoverable. Repeat with force to crypto-shred them.',\n                    data: { references },\n                });\n            }\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n        entity.decryption_key = null;\n\n        // force only carries crypto-shred semantics for encryption keys — a\n        // sig-key delete with a stray force flag must not read as a shred.\n        const forcedCryptoShred = entity.use === JWKUse.ENCRYPTION && !!options.force;\n        await this.recordEvent(EventName.DELETED, entity, actor, { ...(forcedCryptoShred ? { force: true } : {}) });\n\n        return entity;\n    }\n\n    // ------------------------------------------------------------------\n\n    /**\n     * Metadata-only audit trail for key lifecycle operations (issue #3269) —\n     * keys deliberately have no entity subscriber (private material must stay\n     * off the realtime/audit bus), so the security-relevant mutations are\n     * recorded explicitly. The payload never carries key material.\n     */\n    protected async recordEvent(\n        name: `${EventName}`,\n        entity: Key,\n        actor: ActorContext,\n        data: Record<string, any> = {},\n    ): Promise<void> {\n        const requestContext = this.requestContext ?\n            this.requestContext() :\n            undefined;\n\n        await this.eventService?.record({\n            scope: EventScope.ENTITY,\n            name,\n            refType: EntityType.KEY,\n            refId: entity.id,\n            realmId: entity.realm_id ?? null,\n            actorType: actor.identity?.type ?? null,\n            actorId: actor.identity?.data.id ?? null,\n            actorName: actor.identity?.data.name ?? null,\n            requestPath: requestContext?.requestPath ?? null,\n            requestMethod: requestContext?.requestMethod ?? null,\n            requestIpAddress: requestContext?.requestIpAddress ?? null,\n            requestUserAgent: requestContext?.requestUserAgent ?? null,\n            data: {\n                name: entity.name,\n                use: entity.use,\n                status: entity.status,\n                ...data,\n            },\n        });\n    }\n\n    protected pickAuditFields(entity: Key): Record<string, any> {\n        return {\n            name: entity.name,\n            priority: entity.priority,\n            status: entity.status,\n        };\n    }\n\n    protected async generateMaterial(\n        validated: Partial<Key>,\n        use: `${JWKUse}`,\n    ) : Promise<{\n        type: `${JWKType}`,\n        signatureAlgorithm: `${JWTAlgorithm}` | null,\n        decryptionKey: string,\n        encryptionKey: string | null,\n    }> {\n        if (use === JWKUse.ENCRYPTION) {\n            if (validated.signature_algorithm) {\n                throw new ValidationError('An encryption key can not carry a signature algorithm.');\n            }\n\n            const raw = new Uint8Array(32);\n            getRandomValues(raw);\n\n            return {\n                type: JWKType.OCT,\n                signatureAlgorithm: null,\n                decryptionKey: arrayBufferToBase64(raw.buffer),\n                encryptionKey: null,\n            };\n        }\n\n        const algorithm = validated.signature_algorithm ?? JWTAlgorithm.RS256;\n        const options = this.buildAsymmetricOptions(algorithm);\n\n        const keyPair = await createAsymmetricKeyPair(options);\n\n        return {\n            type: algorithm.startsWith('ES') ? JWKType.EC : JWKType.RSA,\n            signatureAlgorithm: algorithm,\n            decryptionKey: await new AsymmetricKey(keyPair.privateKey).toBase64(),\n            encryptionKey: await new AsymmetricKey(keyPair.publicKey).toBase64(),\n        };\n    }\n\n    protected async importMaterial(\n        validated: Partial<Key>,\n        use: `${JWKUse}`,\n    ) : Promise<{\n        type: `${JWKType}`,\n        signatureAlgorithm: `${JWTAlgorithm}` | null,\n        decryptionKey: string,\n        encryptionKey: string | null,\n    }> {\n        if (!validated.decryption_key) {\n            throw new ValidationError('Importing key material requires its private part (decryption_key).');\n        }\n\n        // Reject material masquerading as an at-rest KEK-wrapped blob — it\n        // would be treated as wrapped on the next read (and, with a KEK,\n        // fail GCM authentication).\n        if (isWrappedKeyMaterial(validated.decryption_key.trim())) {\n            throw new ValidationError('The imported key material is not valid.');\n        }\n\n        const decryptionKey = this.normalizeMaterial(validated.decryption_key);\n\n        if (use === JWKUse.ENCRYPTION) {\n            if (validated.signature_algorithm) {\n                throw new ValidationError('An encryption key can not carry a signature algorithm.');\n            }\n\n            if (validated.encryption_key) {\n                throw new ValidationError('An encryption key holds no public part.');\n            }\n\n            let byteLength : number;\n            try {\n                byteLength = base64ToArrayBuffer(decryptionKey).byteLength;\n            } catch {\n                throw new ValidationError('The key material is not valid base64.');\n            }\n\n            if (byteLength !== 32) {\n                throw new ValidationError('The key material must be 32 base64-encoded bytes.');\n            }\n\n            return {\n                type: JWKType.OCT,\n                signatureAlgorithm: null,\n                decryptionKey,\n                encryptionKey: null,\n            };\n        }\n\n        if (!validated.encryption_key) {\n            throw new ValidationError('Importing a signature key requires its public part (encryption_key, SPKI).');\n        }\n\n        const encryptionKey = this.normalizeMaterial(validated.encryption_key);\n        const algorithm = validated.signature_algorithm ?? JWTAlgorithm.RS256;\n        const options = this.buildAsymmetricOptions(algorithm);\n\n        let privateJwk : JsonWebKey;\n        let publicJwk : JsonWebKey;\n\n        try {\n            const privateKey = await AsymmetricKey.fromBase64({\n                format: 'pkcs8',\n                key: decryptionKey,\n                options,\n            });\n            const publicKey = await AsymmetricKey.fromBase64({\n                format: 'spki',\n                key: encryptionKey,\n                options,\n            });\n\n            privateJwk = await privateKey.toJWK();\n            publicJwk = await publicKey.toJWK();\n        } catch {\n            throw new ValidationError(`The key material could not be imported for ${algorithm}.`);\n        }\n\n        // the public components (RSA: n/e, EC: crv/x/y) must agree — a\n        // private key paired with a foreign public part would publish a\n        // wrong JWKS entry and break verification of every token it signs.\n        const components : (keyof JsonWebKey)[] = ['kty', 'n', 'e', 'crv', 'x', 'y'];\n        const mismatch = components.some(\n            (component) => publicJwk[component] !== undefined &&\n                publicJwk[component] !== privateJwk[component],\n        );\n        if (mismatch) {\n            throw new ValidationError('The private and public key material do not form a pair.');\n        }\n\n        return {\n            type: algorithm.startsWith('ES') ? JWKType.EC : JWKType.RSA,\n            signatureAlgorithm: algorithm,\n            decryptionKey,\n            encryptionKey,\n        };\n    }\n\n    protected buildAsymmetricOptions(algorithm: `${JWTAlgorithm}`) {\n        if (!/^(RS|ES)(256|384|512)$/.test(algorithm)) {\n            throw new ValidationError(`The signature algorithm ${algorithm} is not supported for stored keys.`);\n        }\n\n        return AsymmetricKey.buildImportOptionsForJWTAlgorithm(algorithm);\n    }\n\n    protected normalizeMaterial(value: string) : string {\n        if (value.includes('-----BEGIN')) {\n            // PEM body IS base64 DER — strip armor + whitespace.\n            return value\n                .replace(/-----(BEGIN|END)[^-]+-----/g, '')\n                .replace(/\\s+/g, '');\n        }\n\n        return value.trim();\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA4CA,MAAM4B,mBAAmB;CACrBhB,eAAeiB;CACfjB,eAAekB;CACflB,eAAemB;;AAGnB,IAAaC,aAAb,cAAgCf,sBAAAA;CAClBgB;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwB;EAChC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,YAAY,IAAIvB,aAAAA;EACrB,KAAKwB,eAAeE,IAAIF;EACxB,KAAKC,iBAAiBC,IAAID;CAC9B;CAEA,MAAME,QACFC,OACAC,OAC4C;EAC5C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMf,iBAAiB,CAAA;EAE1E,MAAM,EAAEgB,MAAMC,UAAUC,SAAS,MAAM,KAAKb,WAAWc,SAASR,KAAAA;EAEhE,MAAMK,OAAc,CAAA;EACpB,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UACjB,IAAI;GACA,MAAML,MAAMC,oBAAoBS,cAAc;IAC1CP,MAAMf;IACNgB,MAAM3C,iBAAiB;MAClBD,kBAAkBmD,aAAaF;KAChC,GAAG,KAAKG,mBAAmBH,MAAAA;IAC/B,CAAA;GACJ,CAAA;GAIAA,OAAOI,iBAAiB;GACxBT,KAAKU,KAAKL,MAAAA;EACd,QAAQ;GACJD,SAAS;EACb;EAGJ,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMO,OACFC,UACAhB,OACAiB,SACY;EACZ,MAAMjB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMf,iBAAiB,CAAA;EAE1E,MAAMqB,SAAS,MAAM,KAAKhB,WAAWyB,kBAAkBF,UAAUC,OAAAA;EACjE,IAAI,CAACR,QACD,MAAM,IAAI9C,oBAAAA;EAGd,MAAMqC,MAAMC,oBAAoBS,cAAc;GAC1CP,MAAMf;GACNgB,MAAM3C,iBAAiB;KAClBD,kBAAkBmD,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAGAA,OAAOI,iBAAiB;EAExB,OAAOJ;CACX;CAEA,MAAMU,OACFf,MACAJ,OACY;EACZ,MAAMA,MAAMC,oBAAoBmB,YAAY,EAAEjB,MAAM/B,eAAeiD,WAAW,CAAA;EAE9E,MAAMC,YAAY,MAAM,KAAK5B,UAAU6B,IAAInB,MAAM,EAAEoB,OAAOnD,eAAeoD,OAAO,CAAA;EAChF,MAAM,EAAEC,QAAQJ;EAChB,IAAI,CAACI,KACD,MAAM,IAAI9D,gBAAgB,8BAAA;EAG9B,MAAM,KAAK6B,WAAWkC,oBAAoBL,SAAAA;EAE1C,IAAI,CAACA,UAAUM,YAAY5B,MAAM6B,UAAU;GACvC,MAAMC,eAAe,KAAKC,gBAAgB/B,KAAAA;GAC1C,IAAI8B,cACAR,UAAUM,WAAWE;EAE7B;EAIA,IAAI,CAACR,UAAUM,UACX,MAAM,IAAIhE,gBAAgB,4BAAA;EAG9B,MAAMoC,MAAMC,oBAAoB+B,SAAS;GACrC7B,MAAM/B,eAAeiD;GACrBjB,MAAM3C,iBAAiB;KAClBD,kBAAkBmD,aAAaW;IAChC,GAAG,KAAKV,mBAAmBU,SAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAI,CAACA,UAAUnB,MACXmB,UAAUnB,OAAO,GAAGuB,IAAI,GAAGlD,aAAa,EAAA;EAG5C,MAAM,KAAKiB,WAAWwC,gBAAgBX,SAAAA;EAEtC,IAAI,OAAOA,UAAUY,aAAa,UAAU;GACxC,MAAMC,UAAU,MAAM,KAAK1C,WAAW2C,oBAAoBd,UAAUM,UAAUF,GAAAA;GAE9EJ,UAAUY,WAAW,OAAOC,YAAY,WAAWA,UAAU,IAAI;EACrE;EAEA,IAAI,CAACb,UAAUe,QACXf,UAAUe,SAASnE,UAAUoE;EAGjC,MAAMC,cAAc,OAAOjB,UAAUiB,gBAAgB,WAAWjB,UAAUiB,cAAc;EACxF,IAAIA,gBAAgB,CAACjB,UAAUT,kBAAkBa,QAAQ7C,OAAO2D,YAC5D,MAAM,IAAI5E,gBAAgB,yDAAA;EAG9B,MAAM6E,WAAWnB,UAAUT,iBACvB,MAAM,KAAK6B,eAAepB,WAAWI,GAAAA,IACrC,MAAM,KAAKiB,iBAAiBrB,WAAWI,GAAAA;EAE3C,IAAIa,aAAa;GACb,IAAI,CAACE,SAASG,eACV,MAAM,IAAIhF,gBAAgB,yDAAA;GAG9B,IAAI;IAEAqB,4BADcE,sBAAsBoD,WACRM,GAAOJ,SAASG,aAAa;GAC7D,SAASE,GAAG;IACR,MAAM,IAAIlF,gBACNE,QAAWgF,CAAAA,IACPA,EAAEC,UACF,yEAAA;GAEZ;EACJ;EAEA,IAAItC,SAAS,KAAKhB,WAAW0B,OAAO;GAChC,GAAGG;GACH0B,MAAMP,SAASO;GACfC,qBAAqBR,SAASS;GAC9BrC,gBAAgB4B,SAASU;GACzBC,gBAAgBX,SAASG;EAC7B,CAAA;EAEAnC,SAAS,MAAM,KAAKhB,WAAW4D,KAAK5C,MAAAA;EAIpCA,OAAOI,iBAAiB;EAExB,MAAM,KAAKyC,YAAYtF,UAAUuF,SAAS9C,QAAQT,KAAAA;EAElD,OAAOS;CACX;CAEA,MAAM+C,OACFxC,UACAZ,MACAJ,OACAiB,SACY;EACZ,MAAMjB,MAAMC,oBAAoBmB,YAAY,EAAEjB,MAAM/B,eAAekB,WAAW,CAAA;EAE9E,IAAImB,SAAS,MAAM,KAAKhB,WAAWyB,kBAAkBF,UAAUC,OAAAA;EAC/D,IAAI,CAACR,QACD,MAAM,IAAI9C,oBAAAA;EAKd,MAAM2D,YAAY,MAAM,KAAK5B,UAAU6B,IAAInB,MAAM,EAAEoB,OAAOnD,eAAeoF,OAAO,CAAA;EAEhF,MAAMzD,MAAMC,oBAAoB+B,SAAS;GACrC7B,MAAM/B,eAAekB;GACrBc,MAAM3C,iBAAiB;KAClBD,kBAAkBmD,aAAa;KAC5B,GAAGF;KACH,GAAGa;IACP;IACA,GAAG,KAAKV,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIa,UAAUnB,QAAQmB,UAAUnB,SAASM,OAAON,MAC5C,MAAM,KAAKV,WAAWwC,gBAAgB;GAClC9B,MAAMmB,UAAUnB;GAChByB,UAAUnB,OAAOmB;EACrB,GAAGnB,MAAAA;EAGP,MAAMiD,WAAW,KAAKC,gBAAgBlD,MAAAA;EAEtCA,SAAS,KAAKhB,WAAWmE,MAAMnD,QAAQa,SAAAA;EACvC,MAAM,KAAK7B,WAAW4D,KAAK5C,MAAAA;EAE3BA,OAAOI,iBAAiB;EAExB,MAAMgD,OAAO7E,gBAAgB,KAAK2E,gBAAgBlD,MAAAA,GAASiD,QAAAA;EAC3D,MAAM,KAAKJ,YAAYtF,UAAU8F,SAASrD,QAAQT,OAAO,EAAE,GAAI+D,OAAOC,KAAKH,IAAAA,CAAAA,CAAMI,SAAS,IAAI,EAAEJ,KAAK,IAAI,CAAC,EAAG,CAAA;EAE7G,OAAOpD;CACX;CAEA,MAAMyD,OACFC,IACAnE,OACAoE,UAA4B,CAAC,GACjB;EACZ,MAAMpE,MAAMC,oBAAoBmB,YAAY,EAAEjB,MAAM/B,eAAemB,WAAW,CAAA;EAE9E,MAAMkB,SAAS,MAAM,KAAKhB,WAAW4E,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAAC1D,QACD,MAAM,IAAI9C,oBAAAA;EAGd,MAAMqC,MAAMC,oBAAoB+B,SAAS;GACrC7B,MAAM/B,eAAemB;GACrBa,MAAM3C,iBAAiB;KAClBD,kBAAkBmD,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIA,OAAOiB,QAAQ7C,OAAOyF,cAAc,CAACF,QAAQG,OAAO;GACpD,MAAMC,aAAa,MAAM,KAAK/E,WAAWgF,oBAAoBhE,OAAO0D,EAAE;GACtE,IAAIK,aAAa,GACb,MAAM,IAAI9G,oBAAoB;IAC1BqF,SAAS,6CAA6CyB,WAAW;IAEjEpE,MAAM,EAAEoE,WAAW;GACvB,CAAA;EAER;EAEA,MAAM,EAAEL,IAAIO,aAAajE;EACzB,MAAM,KAAKhB,WAAWkF,OAAOlE,MAAAA;EAC7BA,OAAO0D,KAAKO;EACZjE,OAAOI,iBAAiB;EAIxB,MAAM+D,oBAAoBnE,OAAOiB,QAAQ7C,OAAOyF,cAAc,CAAC,CAACF,QAAQG;EACxE,MAAM,KAAKjB,YAAYtF,UAAU6G,SAASpE,QAAQT,OAAO,EAAE,GAAI4E,oBAAoB,EAAEL,OAAO,KAAK,IAAI,CAAC,EAAG,CAAA;EAEzG,OAAO9D;CACX;;;;;;IAUA,MAAgB6C,YACZnD,MACAM,QACAT,OACAI,OAA4B,CAAC,GAChB;EACb,MAAMR,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBkF,KAAAA;EAEJ,MAAM,KAAKnF,cAAcoF,OAAO;GAC5BC,OAAO/G,WAAWgH;GAClB9E;GACA+E,SAASnH,WAAWoH;GACpBC,OAAO3E,OAAO0D;GACdlD,SAASR,OAAOmB,YAAY;GAC5ByD,WAAWrF,MAAM6B,UAAUmB,QAAQ;GACnCsC,SAAStF,MAAM6B,UAAUzB,KAAK+D,MAAM;GACpCoB,WAAWvF,MAAM6B,UAAUzB,KAAKD,QAAQ;GACxCqF,aAAa5F,gBAAgB4F,eAAe;GAC5CC,eAAe7F,gBAAgB6F,iBAAiB;GAChDC,kBAAkB9F,gBAAgB8F,oBAAoB;GACtDC,kBAAkB/F,gBAAgB+F,oBAAoB;GACtDvF,MAAM;IACFD,MAAMM,OAAON;IACbuB,KAAKjB,OAAOiB;IACZW,QAAQ5B,OAAO4B;IACf,GAAGjC;GACP;EACJ,CAAA;CACJ;CAEUuD,gBAAgBlD,QAAkC;EACxD,OAAO;GACHN,MAAMM,OAAON;GACb+B,UAAUzB,OAAOyB;GACjBG,QAAQ5B,OAAO4B;EACnB;CACJ;CAEA,MAAgBM,iBACZrB,WACAI,KAMD;EACC,IAAIA,QAAQ7C,OAAOyF,YAAY;GAC3B,IAAIhD,UAAU2B,qBACV,MAAM,IAAIrF,gBAAgB,wDAAA;GAG9B,MAAMgI,sBAAM,IAAIC,WAAW,EAAA;GAC3B9G,gBAAgB6G,GAAAA;GAEhB,OAAO;IACH5C,MAAMpE,QAAQkH;IACd5C,oBAAoB;IACpBC,eAAe7E,oBAAoBsH,IAAIG,MAAM;IAC7CnD,eAAe;GACnB;EACJ;EAEA,MAAMoD,YAAY1E,UAAU2B,uBAAuBnE,aAAamH;EAGhE,MAAME,UAAU,MAAMxH,wBAFN,KAAKuH,uBAAuBF,SAEE5B,CAAAA;EAE9C,OAAO;GACHpB,MAAMgD,UAAUI,WAAW,IAAA,IAAQxH,QAAQyH,KAAKzH,QAAQ0H;GACxDpD,oBAAoB8C;GACpB7C,eAAe,MAAM,IAAIzE,cAAcyH,QAAQI,UAAU,CAAA,CAAEC,SAAQ;GACnE5D,eAAe,MAAM,IAAIlE,cAAcyH,QAAQM,SAAS,CAAA,CAAED,SAAQ;EACtE;CACJ;CAEA,MAAgB9D,eACZpB,WACAI,KAMD;EACC,IAAI,CAACJ,UAAUT,gBACX,MAAM,IAAIjD,gBAAgB,oEAAA;EAM9B,IAAIsB,qBAAqBoC,UAAUT,eAAe6F,KAAI,CAAA,GAClD,MAAM,IAAI9I,gBAAgB,yCAAA;EAG9B,MAAMuF,gBAAgB,KAAKwD,kBAAkBrF,UAAUT,cAAc;EAErE,IAAIa,QAAQ7C,OAAOyF,YAAY;GAC3B,IAAIhD,UAAU2B,qBACV,MAAM,IAAIrF,gBAAgB,wDAAA;GAG9B,IAAI0D,UAAU8B,gBACV,MAAM,IAAIxF,gBAAgB,yCAAA;GAG9B,IAAIgJ;GACJ,IAAI;IACAA,aAAarI,oBAAoB4E,aAAAA,CAAAA,CAAeyD;GACpD,QAAQ;IACJ,MAAM,IAAIhJ,gBAAgB,uCAAA;GAC9B;GAEA,IAAIgJ,eAAe,IACf,MAAM,IAAIhJ,gBAAgB,mDAAA;GAG9B,OAAO;IACHoF,MAAMpE,QAAQkH;IACd5C,oBAAoB;IACpBC;IACAP,eAAe;GACnB;EACJ;EAEA,IAAI,CAACtB,UAAU8B,gBACX,MAAM,IAAIxF,gBAAgB,4EAAA;EAG9B,MAAMgF,gBAAgB,KAAK+D,kBAAkBrF,UAAU8B,cAAc;EACrE,MAAM4C,YAAY1E,UAAU2B,uBAAuBnE,aAAamH;EAChE,MAAM7B,UAAU,KAAK8B,uBAAuBF,SAAAA;EAE5C,IAAIa;EACJ,IAAIC;EAEJ,IAAI;GACA,MAAMP,aAAa,MAAM7H,cAAcqI,WAAW;IAC9CC,QAAQ;IACRC,KAAK9D;IACLiB;GACJ,CAAA;GACA,MAAMqC,YAAY,MAAM/H,cAAcqI,WAAW;IAC7CC,QAAQ;IACRC,KAAKrE;IACLwB;GACJ,CAAA;GAEAyC,aAAa,MAAMN,WAAWW,MAAK;GACnCJ,YAAY,MAAML,UAAUS,MAAK;EACrC,QAAQ;GACJ,MAAM,IAAItJ,gBAAgB,8CAA8CoI,UAAU,EAAE;EACxF;EAUA,IAJiBmB;GAD0B;GAAO;GAAK;GAAK;GAAO;GAAK;EACvDA,CAAAA,CAAWE,MACvBC,cAAcR,UAAUQ,eAAexC,KAAAA,KACpCgC,UAAUQ,eAAeT,WAAWS,UAExCF,GACA,MAAM,IAAIxJ,gBAAgB,yDAAA;EAG9B,OAAO;GACHoF,MAAMgD,UAAUI,WAAW,IAAA,IAAQxH,QAAQyH,KAAKzH,QAAQ0H;GACxDpD,oBAAoB8C;GACpB7C;GACAP;EACJ;CACJ;CAEUsD,uBAAuBF,WAA8B;EAC3D,IAAI,CAAC,yBAAyBuB,KAAKvB,SAAAA,GAC/B,MAAM,IAAIpI,gBAAgB,2BAA2BoI,UAAU,mCAAmC;EAGtG,OAAOtH,cAAc8I,kCAAkCxB,SAAAA;CAC3D;CAEUW,kBAAkBc,OAAwB;EAChD,IAAIA,MAAMC,SAAS,YAAA,GAEf,OAAOD,MACFE,QAAQ,+BAA+B,EAAA,CAAA,CACvCA,QAAQ,QAAQ,EAAA;EAGzB,OAAOF,MAAMf,KAAI;CACrB;AACJ"}

package/dist/core/entities/key/types.d.ts

@@ -0,0 +1,33 @@
+import type { Key } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
+export interface IKeyRepository extends IEntityRepository<Key> {
+    checkUniqueness(data: Partial<Key>, existing?: Key): Promise<void>;
+    /**
+     * Count cipher blobs (v1.<key_id>.…) still referencing the key —
+     * today the MFA authenticator seeds; plan-070 consumers extend this.
+     * Deleting a referenced enc key crypto-shreds those blobs.
+     *
+     * @param keyId
+     */
+    countBlobReferences(keyId: string): Promise<number>;
+    /**
+     * Highest priority currently assigned for (realm, use) — create
+     * defaults to max + 1 so "generate" doubles as "rotate".
+     */
+    findHighestPriority(realmId: string, use: string): Promise<number | null>;
+}
+export type KeyDeleteOptions = {
+    /**
+     * Delete an enc key even while cipher blobs still reference it
+     * (crypto-shreds them).
+     */
+    force?: boolean;
+};
+export interface IKeyService {
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<Key>>;
+    getOne(idOrName: string, actor: ActorContext, realmId?: string): Promise<Key>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<Key>;
+    update(idOrName: string, data: Record<string, any>, actor: ActorContext, realmId?: string): Promise<Key>;
+    delete(id: string, actor: ActorContext, options?: KeyDeleteOptions): Promise<Key>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/key/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/key/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE1G,MAAM,WAAW,cAAe,SAAQ,iBAAiB,CAAC,GAAG,CAAC;IAC1D,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnE;;;;;;OAMG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpD;;;OAGG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC7E;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC3B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,WAAW;IACxB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC;IACvG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9E,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACrE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CACrF"}

package/dist/core/entities/key/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/entities/permission/service.mjs

@@ -5,7 +5,7 @@ import { ValidatorGroup, isPropertySet, isUUID } from "@authup/kit";
 import { PermissionName, PermissionValidator, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, RealmScope, SystemPolicyName, definePolicyData } from "@authup/access";
-import { AuthupError, BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { AuthupError, EntityNotFoundError, ValidationError } from "@authup/errors";
 //#region src/core/entities/permission/service.ts
 const REALM_ADMIN_EXCLUDED_PERMISSIONS = [
 	PermissionName.REALM_CREATE,
@@ -110,7 +110,7 @@ var PermissionService = class extends AbstractEntityService {
 		const validated = await this.validator.run(data, { group });
 		await this.repository.validateJoinColumns(validated);
 		if (entity) {
-			if (entity.built_in && isPropertySet(validated, "name") && entity.name !== validated.name) throw new BadRequestError("The name of a built-in permission can not be changed.");
+			if (entity.built_in && isPropertySet(validated, "name") && entity.name !== validated.name) throw new ValidationError("The name of a built-in permission can not be changed.");
 			await actor.permissionEvaluator.evaluate({
 				name: PermissionName.PERMISSION_UPDATE,
 				data: definePolicyData({
@@ -152,7 +152,7 @@ var PermissionService = class extends AbstractEntityService {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });
 		const entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
-		if (entity.built_in) throw new BadRequestError("A built-in permission can not be deleted.");
+		if (entity.built_in) throw new ValidationError("A built-in permission can not be deleted.");
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.PERMISSION_DELETE,
 			data: definePolicyData({

package/dist/core/entities/permission/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","definePolicyData","ValidatorGroup","isPropertySet","isUUID","AuthupError","BadRequestError","EntityNotFoundError","PermissionName","PermissionValidator","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","AbstractEntityService","REALM_ADMIN_EXCLUDED_PERMISSIONS","REALM_CREATE","REALM_UPDATE","REALM_DELETE","REALM_ADMIN_BOUND_PERMISSIONS","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","PermissionService","repository","realmRepository","roleRepository","rolePermissionRepository","policyRepository","permissionPolicyRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","findMany","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","CREATE","validated","run","validateJoinColumns","built_in","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","merge","created","identity","getActorRealmId","resourceRealmMatch","assignDefaultPolicy","assignToAdminRole","assignToRealmAdminRoles","delete","entityId","remove","permission","defaultPolicy","findOneByName","DEFAULT","existing","permission_id","policy_id","entry","permission_realm_id","policy_realm_id","adminRole","role_id","role_realm_id","realm_scope","ANY","includes","isBuiltIn","Object","values","realmScope","OWN","OWN_OR_NULL","realmAdminRoles","findManyBy","role"],"sources":["../../../../src/core/entities/permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { \n    BuiltInPolicyType, \n    RealmScope, \n    SystemPolicyName, \n    definePolicyData, \n} from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { AuthupError, BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    PermissionValidator,\n    ROLE_ADMIN_NAME,\n    ROLE_REALM_ADMIN_NAME,\n} from '@authup/core-kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository } from '../permission-policy/types.ts';\nimport type { IPolicyRepository } from '../policy/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport type { IRoleRepository } from '../role/types.ts';\nimport type { IRolePermissionRepository } from '../role-permission/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IPermissionRepository, IPermissionService } from './types.ts';\n\nconst REALM_ADMIN_EXCLUDED_PERMISSIONS = [\n    PermissionName.REALM_CREATE,\n    PermissionName.REALM_UPDATE,\n    PermissionName.REALM_DELETE,\n];\n\n/**\n * Direct-entity CUD permissions that realm_admin grants at `realm_scope: own`\n * (strictly the actor's own realm — see line 372). Every other realm_admin\n * permission defaults to `ownOrNull` (own realm OR global/null resources) so it\n * can act on global building blocks.\n *\n * Junction CUD (e.g. user_role, role_permission) is intentionally NOT listed here:\n * it stays `ownOrNull` because a junction can legitimately reference a global\n * side (realm_id: null) — a strict `own` would reject those.\n */\nconst REALM_ADMIN_BOUND_PERMISSIONS = [\n    PermissionName.CLIENT_CREATE,\n    PermissionName.CLIENT_UPDATE,\n    PermissionName.CLIENT_DELETE,\n    PermissionName.IDENTITY_PROVIDER_CREATE,\n    PermissionName.IDENTITY_PROVIDER_UPDATE,\n    PermissionName.IDENTITY_PROVIDER_DELETE,\n    PermissionName.PERMISSION_CREATE,\n    PermissionName.PERMISSION_UPDATE,\n    PermissionName.PERMISSION_DELETE,\n    PermissionName.ROBOT_CREATE,\n    PermissionName.ROBOT_UPDATE,\n    PermissionName.ROBOT_DELETE,\n    PermissionName.ROLE_CREATE,\n    PermissionName.ROLE_UPDATE,\n    PermissionName.ROLE_DELETE,\n    PermissionName.SCOPE_CREATE,\n    PermissionName.SCOPE_UPDATE,\n    PermissionName.SCOPE_DELETE,\n    PermissionName.USER_CREATE,\n    PermissionName.USER_UPDATE,\n    PermissionName.USER_DELETE,\n];\n\nexport type PermissionServiceContext = {\n    repository: IPermissionRepository;\n    realmRepository: IRealmRepository;\n    roleRepository: IRoleRepository;\n    rolePermissionRepository: IRolePermissionRepository;\n    policyRepository: IPolicyRepository;\n    permissionPolicyRepository: IPermissionPolicyRepository;\n};\n\nexport class PermissionService extends AbstractEntityService implements IPermissionService {\n    protected repository: IPermissionRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected roleRepository: IRoleRepository;\n\n    protected rolePermissionRepository: IRolePermissionRepository;\n\n    protected policyRepository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    protected validator: PermissionValidator;\n\n    constructor(ctx: PermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.rolePermissionRepository = ctx.rolePermissionRepository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n        this.validator = new PermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Permission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Permission,\n        created: boolean\n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Permission | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            if (\n                entity.built_in &&\n                isPropertySet(validated, 'name') &&\n                entity.name !== validated.name\n            ) {\n                throw new BadRequestError('The name of a built-in permission can not be changed.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            entity = this.repository.merge(entity, validated);\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false,\n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        await this.assignDefaultPolicy(entity);\n        await this.assignToAdminRole(entity);\n        await this.assignToRealmAdminRoles(entity);\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in permission can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    /**\n     * Assign the system.default policy to a newly created permission.\n     * This ensures all permissions are evaluated with the baseline security\n     * policy (identity, permission-binding, realm-match) by default.\n     */\n    private async assignDefaultPolicy(permission: Permission): Promise<void> {\n        const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);\n        }\n\n        const existing = await this.permissionPolicyRepository.findOneBy({\n            permission_id: permission.id,\n            policy_id: defaultPolicy.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.permissionPolicyRepository.create({\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n            policy_id: defaultPolicy.id,\n            policy_realm_id: defaultPolicy.realm_id,\n        });\n        await this.permissionPolicyRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to the global admin role.\n     * The admin role receives every permission without policy restrictions.\n     */\n    private async assignToAdminRole(permission: Permission): Promise<void> {\n        const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);\n        if (!adminRole) {\n            return;\n        }\n\n        const existing = await this.rolePermissionRepository.findOneBy({\n            role_id: adminRole.id,\n            permission_id: permission.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.rolePermissionRepository.create({\n            role_id: adminRole.id,\n            role_realm_id: adminRole.realm_id,\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n            // Global admin: unrestricted realm reach.\n            realm_scope: RealmScope.ANY,\n        });\n        await this.rolePermissionRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to all matching realm_admin roles.\n     *\n     * Uses differentiated realm_scope on the junction:\n     * - CUD on global-capable entity types → own (strictly own realm)\n     * - Everything else → ownOrNull (own realm + null/global resources)\n     *\n     * Eligible permissions:\n     * - Built-in authup permissions (global) — assigned to all realm_admin roles\n     * - Realm-scoped permissions — assigned to the realm_admin in the matching realm\n     *\n     * Excluded:\n     * - Realm CRUD permissions (realm_create, realm_update, realm_delete)\n     * - Custom global permissions (non-built-in with realm_id: null)\n     */\n    private async assignToRealmAdminRoles(permission: Permission): Promise<void> {\n        if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name as PermissionName)) {\n            return;\n        }\n\n        const isBuiltIn = (Object.values(PermissionName) as string[]).includes(permission.name);\n        if (!permission.realm_id && !isBuiltIn) {\n            return;\n        }\n\n        const realmScope = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name as PermissionName) ?\n            RealmScope.OWN :\n            RealmScope.OWN_OR_NULL;\n\n        const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });\n\n        for (const role of realmAdminRoles) {\n            if (permission.realm_id && permission.realm_id !== role.realm_id) {\n                continue;\n            }\n\n            const existing = await this.rolePermissionRepository.findOneBy({\n                role_id: role.id,\n                permission_id: permission.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.rolePermissionRepository.create({\n                role_id: role.id,\n                role_realm_id: role.realm_id,\n                permission_id: permission.id,\n                permission_realm_id: permission.realm_id,\n                realm_scope: realmScope,\n            });\n            await this.rolePermissionRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AA+BA,MAAMe,mCAAmC;CACrCL,eAAeM;CACfN,eAAeO;CACfP,eAAeQ;;;;;;;;;;;GAanB,MAAMC,gCAAgC;CAClCT,eAAeU;CACfV,eAAeW;CACfX,eAAeY;CACfZ,eAAea;CACfb,eAAec;CACfd,eAAee;CACff,eAAegB;CACfhB,eAAeiB;CACfjB,eAAekB;CACflB,eAAemB;CACfnB,eAAeoB;CACfpB,eAAeqB;CACfrB,eAAesB;CACftB,eAAeuB;CACfvB,eAAewB;CACfxB,eAAeyB;CACfzB,eAAe0B;CACf1B,eAAe2B;CACf3B,eAAe4B;CACf5B,eAAe6B;CACf7B,eAAe8B;;AAYnB,IAAaC,oBAAb,cAAuC3B,sBAAAA;CACzB4B;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKP,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIrC,oBAAAA;CACzB;CAEA,MAAMuC,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKc,WAAWe,SAASN,KAAAA;CACpC;CAEA,MAAMO,OACFC,UACAP,OACAQ,OACmB;EACnB,MAAMR,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMiC,SAAS,MAAM,KAAKnB,WAAWoB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAIpD,oBAAAA;EAGd,OAAOoD;CACX;CAEA,MAAME,OACFC,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMZ,KAAAA;EACpD,OAAOS;CACX;CAEA,MAAMM,OACFR,UACAK,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMZ,OAAO,EAAEgB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAZ,OACAiB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,aAAa,WACnC,MAAM,KAAK5B,gBAAgB6B,QAAQR,KAAKO,QAAQ,IAChDL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAInE,OAAOqD,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMlB,OAAOI;GAGjB,IAAIC,OACAa,MAAMF,WAAWX,MAAMc;GAG3Bb,SAAS,MAAM,KAAKnB,WAAWiC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAI3D,oBAAAA;EAElB,OAAO,IAAI4D,QAAQD,YACf,MAAM,IAAI3D,oBAAAA;EAGd,IAAIoD,QAAQ;GACR,MAAMT,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAeiB,kBAAkB,CAAA;GACrF2C,QAAQlE,eAAeyE;EAC3B,OAAO;GACH,MAAMzB,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAegB,kBAAkB,CAAA;GACrF4C,QAAQlE,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK/B,UAAUgC,IAAIhB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK5B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIlB,QAAQ;GACR,IACIA,OAAOqB,YACP7E,cAAc0E,WAAW,MAAA,KACzBlB,OAAON,SAASwB,UAAUxB,MAE1B,MAAM,IAAI/C,gBAAgB,uDAAA;GAG9B,MAAM4C,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAM7C,eAAeiB;IACrBqC,MAAM7D,iBAAiB;MAClBH,kBAAkBoF,aAAa;MAC5B,GAAGvB;MACH,GAAGkB;KACP;MACC/E,kBAAkBqF,cAAcN,UAAUR,YAAYV,OAAOU,YAAY;IAC9E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK7B,WAAW4C,gBAAgBP,WAAWlB,MAAAA;GAEjDA,SAAS,KAAKnB,WAAW6C,MAAM1B,QAAQkB,SAAAA;GAEvC,MAAM,KAAKrC,WAAWuB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,IAAI,CAACnF,cAAc0E,WAAW,UAAA,KAAe3B,MAAMqC,UAC/CV,UAAUR,WAAW,KAAKmB,gBAAgBtC,KAAAA,KAAU;EAGxD,MAAMA,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAegB;GACrBsC,MAAM7D,iBAAiB;KAAGH,kBAAkBoF,aAAaL;IAAW,GAAG,KAAKY,mBAAmBZ,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,SAAAA;EAEtClB,SAAS,KAAKnB,WAAWqB,OAAOgB,SAAAA;EAChClB,SAAS,MAAM,KAAKnB,WAAWuB,KAAKJ,MAAAA;EAEpC,MAAM,KAAK+B,oBAAoB/B,MAAAA;EAC/B,MAAM,KAAKgC,kBAAkBhC,MAAAA;EAC7B,MAAM,KAAKiC,wBAAwBjC,MAAAA;EAEnC,OAAO;GACHA;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMO,OACFrB,IACAtB,OACmB;EACnB,MAAMA,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAekB,kBAAkB,CAAA;EAErF,MAAMiC,SAAS,MAAM,KAAKnB,WAAWiC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAIpD,oBAAAA;EAGd,IAAIoD,OAAOqB,UACP,MAAM,IAAI1E,gBAAgB,2CAAA;EAG9B,MAAM4C,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAekB;GACrBoC,MAAM7D,iBAAiB;KAAGH,kBAAkBoF,aAAavB;IAAQ,GAAG,KAAK8B,mBAAmB9B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEa,IAAIsB,aAAanC;EACzB,MAAM,KAAKnB,WAAWuD,OAAOpC,MAAAA;EAC7BA,OAAOa,KAAKsB;EAEZ,OAAOnC;CACX;;;;;IAOA,MAAc+B,oBAAoBM,YAAuC;EACrE,MAAMC,gBAAgB,MAAM,KAAKrD,iBAAiBsD,cAAclG,iBAAiBmG,OAAO;EACxF,IAAI,CAACF,eACD,MAAM,IAAI5F,YAAY,OAAOL,iBAAiBmG,QAAQ,2FAA2F;EAOrJ,IAAIC,MAJmB,KAAKvD,2BAA2B4B,UAAU;GAC7D4B,eAAeL,WAAWxB;GAC1B8B,WAAWL,cAAczB;EAC7B,CAAA,GAEI;EAGJ,MAAM+B,QAAQ,KAAK1D,2BAA2BgB,OAAO;GACjDwC,eAAeL,WAAWxB;GAC1BgC,qBAAqBR,WAAW3B;GAChCiC,WAAWL,cAAczB;GACzBiC,iBAAiBR,cAAc5B;EACnC,CAAA;EACA,MAAM,KAAKxB,2BAA2BkB,KAAKwC,KAAAA;CAC/C;;;;IAMA,MAAcZ,kBAAkBK,YAAuC;EACnE,MAAMU,YAAY,MAAM,KAAKhE,eAAewD,cAAcxF,eAAAA;EAC1D,IAAI,CAACgG,WACD;EAOJ,IAAIN,MAJmB,KAAKzD,yBAAyB8B,UAAU;GAC3DkC,SAASD,UAAUlC;GACnB6B,eAAeL,WAAWxB;EAC9B,CAAA,GAEI;EAGJ,MAAM+B,QAAQ,KAAK5D,yBAAyBkB,OAAO;GAC/C8C,SAASD,UAAUlC;GACnBoC,eAAeF,UAAUrC;GACzBgC,eAAeL,WAAWxB;GAC1BgC,qBAAqBR,WAAW3B;GAEhCwC,aAAa9G,WAAW+G;EAC5B,CAAA;EACA,MAAM,KAAKnE,yBAAyBoB,KAAKwC,KAAAA;CAC7C;;;;;;;;;;;;;;;IAiBA,MAAcX,wBAAwBI,YAAuC;EACzE,IAAInF,iCAAiCkG,SAASf,WAAW3C,IAAI,GACzD;EAGJ,MAAM2D,YAAY,OAAQE,OAAO1G,cAAAA,CAAAA,CAA6BuG,SAASf,WAAW3C,IAAI;EACtF,IAAI,CAAC2C,WAAW3B,YAAY,CAAC2C,WACzB;EAGJ,MAAMG,aAAalG,8BAA8B8F,SAASf,WAAW3C,IAAI,IACrEtD,WAAWqH,MACXrH,WAAWsH;EAEf,MAAMC,kBAAkB,MAAM,KAAK5E,eAAe6E,WAAW,EAAElE,MAAM1C,sBAAsB,CAAA;EAE3F,KAAK,MAAM6G,QAAQF,iBAAiB;GAChC,IAAItB,WAAW3B,YAAY2B,WAAW3B,aAAamD,KAAKnD,UACpD;GAOJ,IAAI+B,MAJmB,KAAKzD,yBAAyB8B,UAAU;IAC3DkC,SAASa,KAAKhD;IACd6B,eAAeL,WAAWxB;GAC9B,CAAA,GAEI;GAGJ,MAAM+B,QAAQ,KAAK5D,yBAAyBkB,OAAO;IAC/C8C,SAASa,KAAKhD;IACdoC,eAAeY,KAAKnD;IACpBgC,eAAeL,WAAWxB;IAC1BgC,qBAAqBR,WAAW3B;IAChCwC,aAAaM;GACjB,CAAA;GACA,MAAM,KAAKxE,yBAAyBoB,KAAKwC,KAAAA;EAC7C;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","definePolicyData","ValidatorGroup","isPropertySet","isUUID","AuthupError","EntityNotFoundError","ValidationError","PermissionName","PermissionValidator","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","AbstractEntityService","REALM_ADMIN_EXCLUDED_PERMISSIONS","REALM_CREATE","REALM_UPDATE","REALM_DELETE","REALM_ADMIN_BOUND_PERMISSIONS","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","PermissionService","repository","realmRepository","roleRepository","rolePermissionRepository","policyRepository","permissionPolicyRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","findMany","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","CREATE","validated","run","validateJoinColumns","built_in","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","merge","created","identity","getActorRealmId","resourceRealmMatch","assignDefaultPolicy","assignToAdminRole","assignToRealmAdminRoles","delete","entityId","remove","permission","defaultPolicy","findOneByName","DEFAULT","existing","permission_id","policy_id","entry","permission_realm_id","policy_realm_id","adminRole","role_id","role_realm_id","realm_scope","ANY","includes","isBuiltIn","Object","values","realmScope","OWN","OWN_OR_NULL","realmAdminRoles","findManyBy","role"],"sources":["../../../../src/core/entities/permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { \n    BuiltInPolicyType, \n    RealmScope, \n    SystemPolicyName, \n    definePolicyData, \n} from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { AuthupError, EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    PermissionValidator,\n    ROLE_ADMIN_NAME,\n    ROLE_REALM_ADMIN_NAME,\n} from '@authup/core-kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository } from '../permission-policy/types.ts';\nimport type { IPolicyRepository } from '../policy/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport type { IRoleRepository } from '../role/types.ts';\nimport type { IRolePermissionRepository } from '../role-permission/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IPermissionRepository, IPermissionService } from './types.ts';\n\nconst REALM_ADMIN_EXCLUDED_PERMISSIONS = [\n    PermissionName.REALM_CREATE,\n    PermissionName.REALM_UPDATE,\n    PermissionName.REALM_DELETE,\n];\n\n/**\n * Direct-entity CUD permissions that realm_admin grants at `realm_scope: own`\n * (strictly the actor's own realm — see line 372). Every other realm_admin\n * permission defaults to `ownOrNull` (own realm OR global/null resources) so it\n * can act on global building blocks.\n *\n * Junction CUD (e.g. user_role, role_permission) is intentionally NOT listed here:\n * it stays `ownOrNull` because a junction can legitimately reference a global\n * side (realm_id: null) — a strict `own` would reject those.\n */\nconst REALM_ADMIN_BOUND_PERMISSIONS = [\n    PermissionName.CLIENT_CREATE,\n    PermissionName.CLIENT_UPDATE,\n    PermissionName.CLIENT_DELETE,\n    PermissionName.IDENTITY_PROVIDER_CREATE,\n    PermissionName.IDENTITY_PROVIDER_UPDATE,\n    PermissionName.IDENTITY_PROVIDER_DELETE,\n    PermissionName.PERMISSION_CREATE,\n    PermissionName.PERMISSION_UPDATE,\n    PermissionName.PERMISSION_DELETE,\n    PermissionName.ROBOT_CREATE,\n    PermissionName.ROBOT_UPDATE,\n    PermissionName.ROBOT_DELETE,\n    PermissionName.ROLE_CREATE,\n    PermissionName.ROLE_UPDATE,\n    PermissionName.ROLE_DELETE,\n    PermissionName.SCOPE_CREATE,\n    PermissionName.SCOPE_UPDATE,\n    PermissionName.SCOPE_DELETE,\n    PermissionName.USER_CREATE,\n    PermissionName.USER_UPDATE,\n    PermissionName.USER_DELETE,\n];\n\nexport type PermissionServiceContext = {\n    repository: IPermissionRepository;\n    realmRepository: IRealmRepository;\n    roleRepository: IRoleRepository;\n    rolePermissionRepository: IRolePermissionRepository;\n    policyRepository: IPolicyRepository;\n    permissionPolicyRepository: IPermissionPolicyRepository;\n};\n\nexport class PermissionService extends AbstractEntityService implements IPermissionService {\n    protected repository: IPermissionRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected roleRepository: IRoleRepository;\n\n    protected rolePermissionRepository: IRolePermissionRepository;\n\n    protected policyRepository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    protected validator: PermissionValidator;\n\n    constructor(ctx: PermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.rolePermissionRepository = ctx.rolePermissionRepository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n        this.validator = new PermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Permission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Permission,\n        created: boolean\n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Permission | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            if (\n                entity.built_in &&\n                isPropertySet(validated, 'name') &&\n                entity.name !== validated.name\n            ) {\n                throw new ValidationError('The name of a built-in permission can not be changed.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            entity = this.repository.merge(entity, validated);\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false,\n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        await this.assignDefaultPolicy(entity);\n        await this.assignToAdminRole(entity);\n        await this.assignToRealmAdminRoles(entity);\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new ValidationError('A built-in permission can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    /**\n     * Assign the system.default policy to a newly created permission.\n     * This ensures all permissions are evaluated with the baseline security\n     * policy (identity, permission-binding, realm-match) by default.\n     */\n    private async assignDefaultPolicy(permission: Permission): Promise<void> {\n        const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);\n        }\n\n        const existing = await this.permissionPolicyRepository.findOneBy({\n            permission_id: permission.id,\n            policy_id: defaultPolicy.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.permissionPolicyRepository.create({\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n            policy_id: defaultPolicy.id,\n            policy_realm_id: defaultPolicy.realm_id,\n        });\n        await this.permissionPolicyRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to the global admin role.\n     * The admin role receives every permission without policy restrictions.\n     */\n    private async assignToAdminRole(permission: Permission): Promise<void> {\n        const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);\n        if (!adminRole) {\n            return;\n        }\n\n        const existing = await this.rolePermissionRepository.findOneBy({\n            role_id: adminRole.id,\n            permission_id: permission.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.rolePermissionRepository.create({\n            role_id: adminRole.id,\n            role_realm_id: adminRole.realm_id,\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n            // Global admin: unrestricted realm reach.\n            realm_scope: RealmScope.ANY,\n        });\n        await this.rolePermissionRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to all matching realm_admin roles.\n     *\n     * Uses differentiated realm_scope on the junction:\n     * - CUD on global-capable entity types → own (strictly own realm)\n     * - Everything else → ownOrNull (own realm + null/global resources)\n     *\n     * Eligible permissions:\n     * - Built-in authup permissions (global) — assigned to all realm_admin roles\n     * - Realm-scoped permissions — assigned to the realm_admin in the matching realm\n     *\n     * Excluded:\n     * - Realm CRUD permissions (realm_create, realm_update, realm_delete)\n     * - Custom global permissions (non-built-in with realm_id: null)\n     */\n    private async assignToRealmAdminRoles(permission: Permission): Promise<void> {\n        if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name as PermissionName)) {\n            return;\n        }\n\n        const isBuiltIn = (Object.values(PermissionName) as string[]).includes(permission.name);\n        if (!permission.realm_id && !isBuiltIn) {\n            return;\n        }\n\n        const realmScope = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name as PermissionName) ?\n            RealmScope.OWN :\n            RealmScope.OWN_OR_NULL;\n\n        const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });\n\n        for (const role of realmAdminRoles) {\n            if (permission.realm_id && permission.realm_id !== role.realm_id) {\n                continue;\n            }\n\n            const existing = await this.rolePermissionRepository.findOneBy({\n                role_id: role.id,\n                permission_id: permission.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.rolePermissionRepository.create({\n                role_id: role.id,\n                role_realm_id: role.realm_id,\n                permission_id: permission.id,\n                permission_realm_id: permission.realm_id,\n                realm_scope: realmScope,\n            });\n            await this.rolePermissionRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AA+BA,MAAMe,mCAAmC;CACrCL,eAAeM;CACfN,eAAeO;CACfP,eAAeQ;;;;;;;;;;;GAanB,MAAMC,gCAAgC;CAClCT,eAAeU;CACfV,eAAeW;CACfX,eAAeY;CACfZ,eAAea;CACfb,eAAec;CACfd,eAAee;CACff,eAAegB;CACfhB,eAAeiB;CACfjB,eAAekB;CACflB,eAAemB;CACfnB,eAAeoB;CACfpB,eAAeqB;CACfrB,eAAesB;CACftB,eAAeuB;CACfvB,eAAewB;CACfxB,eAAeyB;CACfzB,eAAe0B;CACf1B,eAAe2B;CACf3B,eAAe4B;CACf5B,eAAe6B;CACf7B,eAAe8B;;AAYnB,IAAaC,oBAAb,cAAuC3B,sBAAAA;CACzB4B;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKP,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIrC,oBAAAA;CACzB;CAEA,MAAMuC,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKc,WAAWe,SAASN,KAAAA;CACpC;CAEA,MAAMO,OACFC,UACAP,OACAQ,OACmB;EACnB,MAAMR,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMiC,SAAS,MAAM,KAAKnB,WAAWoB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAIrD,oBAAAA;EAGd,OAAOqD;CACX;CAEA,MAAME,OACFC,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMZ,KAAAA;EACpD,OAAOS;CACX;CAEA,MAAMM,OACFR,UACAK,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMZ,OAAO,EAAEgB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAZ,OACAiB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,aAAa,WACnC,MAAM,KAAK5B,gBAAgB6B,QAAQR,KAAKO,QAAQ,IAChDL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAInE,OAAOqD,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMlB,OAAOI;GAGjB,IAAIC,OACAa,MAAMF,WAAWX,MAAMc;GAG3Bb,SAAS,MAAM,KAAKnB,WAAWiC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAI5D,oBAAAA;EAElB,OAAO,IAAI6D,QAAQD,YACf,MAAM,IAAI5D,oBAAAA;EAGd,IAAIqD,QAAQ;GACR,MAAMT,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAeiB,kBAAkB,CAAA;GACrF2C,QAAQlE,eAAeyE;EAC3B,OAAO;GACH,MAAMzB,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAegB,kBAAkB,CAAA;GACrF4C,QAAQlE,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK/B,UAAUgC,IAAIhB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK5B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIlB,QAAQ;GACR,IACIA,OAAOqB,YACP7E,cAAc0E,WAAW,MAAA,KACzBlB,OAAON,SAASwB,UAAUxB,MAE1B,MAAM,IAAI9C,gBAAgB,uDAAA;GAG9B,MAAM2C,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAM7C,eAAeiB;IACrBqC,MAAM7D,iBAAiB;MAClBH,kBAAkBoF,aAAa;MAC5B,GAAGvB;MACH,GAAGkB;KACP;MACC/E,kBAAkBqF,cAAcN,UAAUR,YAAYV,OAAOU,YAAY;IAC9E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK7B,WAAW4C,gBAAgBP,WAAWlB,MAAAA;GAEjDA,SAAS,KAAKnB,WAAW6C,MAAM1B,QAAQkB,SAAAA;GAEvC,MAAM,KAAKrC,WAAWuB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,IAAI,CAACnF,cAAc0E,WAAW,UAAA,KAAe3B,MAAMqC,UAC/CV,UAAUR,WAAW,KAAKmB,gBAAgBtC,KAAAA,KAAU;EAGxD,MAAMA,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAegB;GACrBsC,MAAM7D,iBAAiB;KAAGH,kBAAkBoF,aAAaL;IAAW,GAAG,KAAKY,mBAAmBZ,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,SAAAA;EAEtClB,SAAS,KAAKnB,WAAWqB,OAAOgB,SAAAA;EAChClB,SAAS,MAAM,KAAKnB,WAAWuB,KAAKJ,MAAAA;EAEpC,MAAM,KAAK+B,oBAAoB/B,MAAAA;EAC/B,MAAM,KAAKgC,kBAAkBhC,MAAAA;EAC7B,MAAM,KAAKiC,wBAAwBjC,MAAAA;EAEnC,OAAO;GACHA;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMO,OACFrB,IACAtB,OACmB;EACnB,MAAMA,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAekB,kBAAkB,CAAA;EAErF,MAAMiC,SAAS,MAAM,KAAKnB,WAAWiC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAIrD,oBAAAA;EAGd,IAAIqD,OAAOqB,UACP,MAAM,IAAIzE,gBAAgB,2CAAA;EAG9B,MAAM2C,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAekB;GACrBoC,MAAM7D,iBAAiB;KAAGH,kBAAkBoF,aAAavB;IAAQ,GAAG,KAAK8B,mBAAmB9B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEa,IAAIsB,aAAanC;EACzB,MAAM,KAAKnB,WAAWuD,OAAOpC,MAAAA;EAC7BA,OAAOa,KAAKsB;EAEZ,OAAOnC;CACX;;;;;IAOA,MAAc+B,oBAAoBM,YAAuC;EACrE,MAAMC,gBAAgB,MAAM,KAAKrD,iBAAiBsD,cAAclG,iBAAiBmG,OAAO;EACxF,IAAI,CAACF,eACD,MAAM,IAAI5F,YAAY,OAAOL,iBAAiBmG,QAAQ,2FAA2F;EAOrJ,IAAIC,MAJmB,KAAKvD,2BAA2B4B,UAAU;GAC7D4B,eAAeL,WAAWxB;GAC1B8B,WAAWL,cAAczB;EAC7B,CAAA,GAEI;EAGJ,MAAM+B,QAAQ,KAAK1D,2BAA2BgB,OAAO;GACjDwC,eAAeL,WAAWxB;GAC1BgC,qBAAqBR,WAAW3B;GAChCiC,WAAWL,cAAczB;GACzBiC,iBAAiBR,cAAc5B;EACnC,CAAA;EACA,MAAM,KAAKxB,2BAA2BkB,KAAKwC,KAAAA;CAC/C;;;;IAMA,MAAcZ,kBAAkBK,YAAuC;EACnE,MAAMU,YAAY,MAAM,KAAKhE,eAAewD,cAAcxF,eAAAA;EAC1D,IAAI,CAACgG,WACD;EAOJ,IAAIN,MAJmB,KAAKzD,yBAAyB8B,UAAU;GAC3DkC,SAASD,UAAUlC;GACnB6B,eAAeL,WAAWxB;EAC9B,CAAA,GAEI;EAGJ,MAAM+B,QAAQ,KAAK5D,yBAAyBkB,OAAO;GAC/C8C,SAASD,UAAUlC;GACnBoC,eAAeF,UAAUrC;GACzBgC,eAAeL,WAAWxB;GAC1BgC,qBAAqBR,WAAW3B;GAEhCwC,aAAa9G,WAAW+G;EAC5B,CAAA;EACA,MAAM,KAAKnE,yBAAyBoB,KAAKwC,KAAAA;CAC7C;;;;;;;;;;;;;;;IAiBA,MAAcX,wBAAwBI,YAAuC;EACzE,IAAInF,iCAAiCkG,SAASf,WAAW3C,IAAI,GACzD;EAGJ,MAAM2D,YAAY,OAAQE,OAAO1G,cAAAA,CAAAA,CAA6BuG,SAASf,WAAW3C,IAAI;EACtF,IAAI,CAAC2C,WAAW3B,YAAY,CAAC2C,WACzB;EAGJ,MAAMG,aAAalG,8BAA8B8F,SAASf,WAAW3C,IAAI,IACrEtD,WAAWqH,MACXrH,WAAWsH;EAEf,MAAMC,kBAAkB,MAAM,KAAK5E,eAAe6E,WAAW,EAAElE,MAAM1C,sBAAsB,CAAA;EAE3F,KAAK,MAAM6G,QAAQF,iBAAiB;GAChC,IAAItB,WAAW3B,YAAY2B,WAAW3B,aAAamD,KAAKnD,UACpD;GAOJ,IAAI+B,MAJmB,KAAKzD,yBAAyB8B,UAAU;IAC3DkC,SAASa,KAAKhD;IACd6B,eAAeL,WAAWxB;GAC9B,CAAA,GAEI;GAGJ,MAAM+B,QAAQ,KAAK5D,yBAAyBkB,OAAO;IAC/C8C,SAASa,KAAKhD;IACdoC,eAAeY,KAAKnD;IACpBgC,eAAeL,WAAWxB;IAC1BgC,qBAAqBR,WAAW3B;IAChCwC,aAAaM;GACjB,CAAA;GACA,MAAM,KAAKxE,yBAAyBoB,KAAKwC,KAAAA;EAC7C;CACJ;AACJ"}

package/dist/core/entities/policy/service.mjs

@@ -6,7 +6,7 @@ import { ValidatorGroup, extendObject, isPropertySet, isUUID, removeObjectProper
 import { PermissionName, PolicyValidator } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
 //#region src/core/entities/policy/service.ts
 var PolicyService = class extends AbstractEntityService {
 	repository;
@@ -67,9 +67,9 @@ var PolicyService = class extends AbstractEntityService {
 		}
 		const validated = await this.validate(data, group);
 		await this.repository.validateJoinColumns(validated);
-		if (validated.parent && validated.parent.type !== BuiltInPolicyType.COMPOSITE) throw new BadRequestError("The parent policy must be of type group.");
+		if (validated.parent && validated.parent.type !== BuiltInPolicyType.COMPOSITE) throw new ValidationError("The parent policy must be of type group.");
 		if (entity) {
-			if (entity.built_in) throw new BadRequestError("A built-in policy can not be updated.");
+			if (entity.built_in) throw new ValidationError("A built-in policy can not be updated.");
 			await actor.permissionEvaluator.evaluate({
 				name: PermissionName.PERMISSION_UPDATE,
 				data: definePolicyData({
@@ -119,7 +119,7 @@ var PolicyService = class extends AbstractEntityService {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });
 		const entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
-		if (entity.built_in) throw new BadRequestError("A built-in policy can not be deleted.");
+		if (entity.built_in) throw new ValidationError("A built-in policy can not be deleted.");
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.PERMISSION_DELETE,
 			data: definePolicyData({