@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/core/entities/policy/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","extendObject","isPropertySet","isUUID","removeObjectProperty","BadRequestError","EntityNotFoundError","PermissionName","PolicyValidator","AbstractEntityService","PolicyAttributesValidator","PolicyService","repository","realmRepository","validator","attributesValidator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","PERMISSION_DELETE","findMany","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","PERMISSION_CREATE","CREATE","validated","validate","validateJoinColumns","parent","type","COMPOSITE","built_in","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","saveWithEA","created","identity","getActorRealmId","resourceRealmMatch","run","attributes","Array","isArray","children","promises","map","child","Promise","all","delete","entityId","deleteFromTree"],"sources":["../../../../src/core/entities/policy/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    ValidatorGroup,\n    extendObject,\n    isPropertySet,\n    isUUID,\n    removeObjectProperty,\n} from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    PolicyValidator,\n} from '@authup/core-kit';\nimport type { Policy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { PolicyAttributesValidator } from './attributes-validator.ts';\nimport type { IPolicyRepository, IPolicyService } from './types.ts';\n\nexport type PolicyServiceContext = {\n    repository: IPolicyRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class PolicyService extends AbstractEntityService implements IPolicyService {\n    protected repository: IPolicyRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: PolicyValidator;\n\n    protected attributesValidator: PolicyAttributesValidator;\n\n    constructor(ctx: PolicyServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new PolicyValidator();\n        this.attributesValidator = new PolicyAttributesValidator({});\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Policy>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Policy> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Policy,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Policy | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validate(data, group);\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (\n            validated.parent &&\n            validated.parent.type !== BuiltInPolicyType.COMPOSITE\n        ) {\n            throw new BadRequestError('The parent policy must be of type group.');\n        }\n\n        if (entity) {\n            if (entity.built_in) {\n                throw new BadRequestError('A built-in policy can not be updated.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            extendObject(entity, validated);\n\n            await this.repository.saveWithEA(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        await this.repository.saveWithEA(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    private async validate(\n        data: Record<string, any>,\n        group: string,\n    ): Promise<Policy> {\n        const validated = await this.validator.run(data, { group });\n\n        const attributes = await this.attributesValidator.run(data);\n        extendObject(validated, attributes);\n\n        if (Array.isArray(data.children)) {\n            if (data.type === BuiltInPolicyType.COMPOSITE) {\n                const promises = data.children.map(\n                    (child) => this.validate(child, group),\n                );\n                validated.children = await Promise.all(promises);\n            }\n        }\n\n        return validated;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in policy can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n\n        await this.repository.deleteFromTree(entity);\n\n        entity.id = entityId;\n\n        // todo: remove after PolicyEntity - parent delete on cascade\n        removeObjectProperty(entity, 'children');\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;AAgCA,IAAaa,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,YAAY,IAAIN,gBAAAA;EACrB,KAAKO,sBAAsB,IAAIL,0BAA0B,CAAC,CAAA;CAC9D;CAEA,MAAMO,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,UACAT,OACAU,OACe;EACf,MAAMV,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKlB,WAAWmB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAIxB,oBAAAA;EAGd,OAAOwB;CACX;CAEA,MAAME,OACFC,MACAd,OACe;EACf,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMd,KAAAA;EACpD,OAAOW;CACX;CAEA,MAAMM,OACFR,UACAK,MACAd,OACe;EACf,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMd,OAAO,EAAEkB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAd,OACAmB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,aAAa,WACnC,MAAM,KAAK3B,gBAAgB4B,QAAQR,KAAKO,QAAQ,IAChDL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAIvC,OAAOyB,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMpB,OAAOM;GAGjB,IAAIC,OACAa,MAAMF,WAAWX,MAAMc;GAG3Bb,SAAS,MAAM,KAAKlB,WAAWgC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAI/B,oBAAAA;EAElB,OAAO,IAAIgC,QAAQD,YACf,MAAM,IAAI/B,oBAAAA;EAGd,IAAIwB,QAAQ;GACR,MAAMX,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMf,eAAeiB,kBAAkB,CAAA;GACrFe,QAAQvC,eAAe8C;EAC3B,OAAO;GACH,MAAM3B,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMf,eAAewC,kBAAkB,CAAA;GACrFR,QAAQvC,eAAegD;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKC,SAASjB,MAAMM,KAAAA;EAE5C,MAAM,KAAK3B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IACIA,UAAUG,UACVH,UAAUG,OAAOC,SAASvD,kBAAkBwD,WAE5C,MAAM,IAAIjD,gBAAgB,0CAAA;EAG9B,IAAIyB,QAAQ;GACR,IAAIA,OAAOyB,UACP,MAAM,IAAIlD,gBAAgB,uCAAA;GAG9B,MAAMc,MAAMC,oBAAoBoC,SAAS;IACrClC,MAAMf,eAAeiB;IACrBS,MAAMlC,iBAAiB;MAClBD,kBAAkB2D,aAAa;MAC5B,GAAG3B;MACH,GAAGmB;KACP;MACCnD,kBAAkB4D,cAAcT,UAAUT,YAAYV,OAAOU,YAAY;IAC9E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK5B,WAAW+C,gBAAgBV,WAAWnB,MAAAA;GAEjD7B,aAAa6B,QAAQmB,SAAAA;GAErB,MAAM,KAAKrC,WAAWgD,WAAW9B,MAAAA;GAEjC,OAAO;IACHA;IACA+B,SAAS;GACb;EACJ;EAEA,IAAI,CAAC3D,cAAc+C,WAAW,UAAA,KAAe9B,MAAM2C,UAC/Cb,UAAUT,WAAW,KAAKuB,gBAAgB5C,KAAAA,KAAU;EAGxD,MAAMA,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMf,eAAewC;GACrBd,MAAMlC,iBAAiB;KAAGD,kBAAkB2D,aAAaR;IAAW,GAAG,KAAKe,mBAAmBf,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW+C,gBAAgBV,SAAAA;EAEtCnB,SAAS,KAAKlB,WAAWoB,OAAOiB,SAAAA;EAChC,MAAM,KAAKrC,WAAWgD,WAAW9B,MAAAA;EAEjC,OAAO;GACHA;GACA+B,SAAS;EACb;CACJ;CAEA,MAAcX,SACVjB,MACAM,OACe;EACf,MAAMU,YAAY,MAAM,KAAKnC,UAAUmD,IAAIhC,MAAM,EAAEM,MAAM,CAAA;EAGzDtC,aAAagD,WAAWiB,MADC,KAAKnD,oBAAoBkD,IAAIhC,IAAAA,CAC9BiC;EAExB,IAAIC,MAAMC,QAAQnC,KAAKoC,QAAQ;OACvBpC,KAAKoB,SAASvD,kBAAkBwD,WAAW;IAC3C,MAAMgB,WAAWrC,KAAKoC,SAASE,KAC1BC,UAAU,KAAKtB,SAASsB,OAAOjC,KAAAA,CAAAA;IAEpCU,UAAUoB,WAAW,MAAMI,QAAQC,IAAIJ,QAAAA;GAC3C;;EAGJ,OAAOrB;CACX;CAEA,MAAM0B,OACFhC,IACAxB,OACe;EACf,MAAMA,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMf,eAAekB,kBAAkB,CAAA;EAErF,MAAMK,SAAS,MAAM,KAAKlB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAIxB,oBAAAA;EAGd,IAAIwB,OAAOyB,UACP,MAAM,IAAIlD,gBAAgB,uCAAA;EAG9B,MAAMc,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMf,eAAekB;GACrBQ,MAAMlC,iBAAiB;KAAGD,kBAAkB2D,aAAa3B;IAAQ,GAAG,KAAKkC,mBAAmBlC,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEa,IAAIiC,aAAa9C;EAEzB,MAAM,KAAKlB,WAAWiE,eAAe/C,MAAAA;EAErCA,OAAOa,KAAKiC;EAGZxE,qBAAqB0B,QAAQ,UAAA;EAE7B,OAAOA;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","extendObject","isPropertySet","isUUID","removeObjectProperty","EntityNotFoundError","ValidationError","PermissionName","PolicyValidator","AbstractEntityService","PolicyAttributesValidator","PolicyService","repository","realmRepository","validator","attributesValidator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","PERMISSION_DELETE","findMany","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","PERMISSION_CREATE","CREATE","validated","validate","validateJoinColumns","parent","type","COMPOSITE","built_in","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","saveWithEA","created","identity","getActorRealmId","resourceRealmMatch","run","attributes","Array","isArray","children","promises","map","child","Promise","all","delete","entityId","deleteFromTree"],"sources":["../../../../src/core/entities/policy/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    ValidatorGroup,\n    extendObject,\n    isPropertySet,\n    isUUID,\n    removeObjectProperty,\n} from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    PolicyValidator,\n} from '@authup/core-kit';\nimport type { Policy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { PolicyAttributesValidator } from './attributes-validator.ts';\nimport type { IPolicyRepository, IPolicyService } from './types.ts';\n\nexport type PolicyServiceContext = {\n    repository: IPolicyRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class PolicyService extends AbstractEntityService implements IPolicyService {\n    protected repository: IPolicyRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: PolicyValidator;\n\n    protected attributesValidator: PolicyAttributesValidator;\n\n    constructor(ctx: PolicyServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new PolicyValidator();\n        this.attributesValidator = new PolicyAttributesValidator({});\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Policy>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Policy> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Policy,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Policy | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validate(data, group);\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (\n            validated.parent &&\n            validated.parent.type !== BuiltInPolicyType.COMPOSITE\n        ) {\n            throw new ValidationError('The parent policy must be of type group.');\n        }\n\n        if (entity) {\n            if (entity.built_in) {\n                throw new ValidationError('A built-in policy can not be updated.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            extendObject(entity, validated);\n\n            await this.repository.saveWithEA(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        await this.repository.saveWithEA(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    private async validate(\n        data: Record<string, any>,\n        group: string,\n    ): Promise<Policy> {\n        const validated = await this.validator.run(data, { group });\n\n        const attributes = await this.attributesValidator.run(data);\n        extendObject(validated, attributes);\n\n        if (Array.isArray(data.children)) {\n            if (data.type === BuiltInPolicyType.COMPOSITE) {\n                const promises = data.children.map(\n                    (child) => this.validate(child, group),\n                );\n                validated.children = await Promise.all(promises);\n            }\n        }\n\n        return validated;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new ValidationError('A built-in policy can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n\n        await this.repository.deleteFromTree(entity);\n\n        entity.id = entityId;\n\n        // todo: remove after PolicyEntity - parent delete on cascade\n        removeObjectProperty(entity, 'children');\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;AAgCA,IAAaa,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,YAAY,IAAIN,gBAAAA;EACrB,KAAKO,sBAAsB,IAAIL,0BAA0B,CAAC,CAAA;CAC9D;CAEA,MAAMO,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,UACAT,OACAU,OACe;EACf,MAAMV,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKlB,WAAWmB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAIzB,oBAAAA;EAGd,OAAOyB;CACX;CAEA,MAAME,OACFC,MACAd,OACe;EACf,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMd,KAAAA;EACpD,OAAOW;CACX;CAEA,MAAMM,OACFR,UACAK,MACAd,OACe;EACf,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMd,OAAO,EAAEkB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAd,OACAmB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,aAAa,WACnC,MAAM,KAAK3B,gBAAgB4B,QAAQR,KAAKO,QAAQ,IAChDL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAIvC,OAAOyB,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMpB,OAAOM;GAGjB,IAAIC,OACAa,MAAMF,WAAWX,MAAMc;GAG3Bb,SAAS,MAAM,KAAKlB,WAAWgC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAIhC,oBAAAA;EAElB,OAAO,IAAIiC,QAAQD,YACf,MAAM,IAAIhC,oBAAAA;EAGd,IAAIyB,QAAQ;GACR,MAAMX,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMf,eAAeiB,kBAAkB,CAAA;GACrFe,QAAQvC,eAAe8C;EAC3B,OAAO;GACH,MAAM3B,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMf,eAAewC,kBAAkB,CAAA;GACrFR,QAAQvC,eAAegD;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKC,SAASjB,MAAMM,KAAAA;EAE5C,MAAM,KAAK3B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IACIA,UAAUG,UACVH,UAAUG,OAAOC,SAASvD,kBAAkBwD,WAE5C,MAAM,IAAIhD,gBAAgB,0CAAA;EAG9B,IAAIwB,QAAQ;GACR,IAAIA,OAAOyB,UACP,MAAM,IAAIjD,gBAAgB,uCAAA;GAG9B,MAAMa,MAAMC,oBAAoBoC,SAAS;IACrClC,MAAMf,eAAeiB;IACrBS,MAAMlC,iBAAiB;MAClBD,kBAAkB2D,aAAa;MAC5B,GAAG3B;MACH,GAAGmB;KACP;MACCnD,kBAAkB4D,cAAcT,UAAUT,YAAYV,OAAOU,YAAY;IAC9E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK5B,WAAW+C,gBAAgBV,WAAWnB,MAAAA;GAEjD7B,aAAa6B,QAAQmB,SAAAA;GAErB,MAAM,KAAKrC,WAAWgD,WAAW9B,MAAAA;GAEjC,OAAO;IACHA;IACA+B,SAAS;GACb;EACJ;EAEA,IAAI,CAAC3D,cAAc+C,WAAW,UAAA,KAAe9B,MAAM2C,UAC/Cb,UAAUT,WAAW,KAAKuB,gBAAgB5C,KAAAA,KAAU;EAGxD,MAAMA,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMf,eAAewC;GACrBd,MAAMlC,iBAAiB;KAAGD,kBAAkB2D,aAAaR;IAAW,GAAG,KAAKe,mBAAmBf,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW+C,gBAAgBV,SAAAA;EAEtCnB,SAAS,KAAKlB,WAAWoB,OAAOiB,SAAAA;EAChC,MAAM,KAAKrC,WAAWgD,WAAW9B,MAAAA;EAEjC,OAAO;GACHA;GACA+B,SAAS;EACb;CACJ;CAEA,MAAcX,SACVjB,MACAM,OACe;EACf,MAAMU,YAAY,MAAM,KAAKnC,UAAUmD,IAAIhC,MAAM,EAAEM,MAAM,CAAA;EAGzDtC,aAAagD,WAAWiB,MADC,KAAKnD,oBAAoBkD,IAAIhC,IAAAA,CAC9BiC;EAExB,IAAIC,MAAMC,QAAQnC,KAAKoC,QAAQ;OACvBpC,KAAKoB,SAASvD,kBAAkBwD,WAAW;IAC3C,MAAMgB,WAAWrC,KAAKoC,SAASE,KAC1BC,UAAU,KAAKtB,SAASsB,OAAOjC,KAAAA,CAAAA;IAEpCU,UAAUoB,WAAW,MAAMI,QAAQC,IAAIJ,QAAAA;GAC3C;;EAGJ,OAAOrB;CACX;CAEA,MAAM0B,OACFhC,IACAxB,OACe;EACf,MAAMA,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMf,eAAekB,kBAAkB,CAAA;EAErF,MAAMK,SAAS,MAAM,KAAKlB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAIzB,oBAAAA;EAGd,IAAIyB,OAAOyB,UACP,MAAM,IAAIjD,gBAAgB,uCAAA;EAG9B,MAAMa,MAAMC,oBAAoBoC,SAAS;GACrClC,MAAMf,eAAekB;GACrBQ,MAAMlC,iBAAiB;KAAGD,kBAAkB2D,aAAa3B;IAAQ,GAAG,KAAKkC,mBAAmBlC,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEa,IAAIiC,aAAa9C;EAEzB,MAAM,KAAKlB,WAAWiE,eAAe/C,MAAAA;EAErCA,OAAOa,KAAKiC;EAGZxE,qBAAqB0B,QAAQ,UAAA;EAE7B,OAAOA;CACX;AACJ"}

package/dist/core/entities/realm/service.d.ts

@@ -3,16 +3,19 @@ import type { Realm } from '@authup/core-kit';
 import type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';
 import { AbstractEntityService } from '@authup/server-kit';
 import type { IWebClientProvisioner } from '../client/types.ts';
+import type { IKeyProvisioner } from '../../key/types.ts';
 import type { IRealmRepository, IRealmService } from './types.ts';
 export type RealmServiceContext = {
     repository: IRealmRepository;
     webClientProvisioner?: IWebClientProvisioner;
+    keyProvisioner?: IKeyProvisioner;
     logger?: Logger;
 };
 export declare class RealmService extends AbstractEntityService implements IRealmService {
     protected repository: IRealmRepository;
     protected validator: RealmValidator;
     protected webClientProvisioner?: IWebClientProvisioner;
+    protected keyProvisioner?: IKeyProvisioner;
     protected logger?: Logger;
     constructor(ctx: RealmServiceContext);
     getMany(query: Record<string, any>): Promise<EntityRepositoryFindManyResult<Realm>>;

package/dist/core/entities/realm/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/realm/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAG,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC;IAEpC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAEvD,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAQ9B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAI3C,MAAM,CACR,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,KAAK,CAAC;IASX,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAwFI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;CAuBpB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/realm/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAG,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC;IAEpC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAEvD,SAAS,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC;IAE3C,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAS9B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAI3C,MAAM,CACR,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,KAAK,CAAC;IASX,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IA8FI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;CAuBpB"}

package/dist/core/entities/realm/service.mjs

@@ -5,17 +5,19 @@ import { ValidatorGroup, isPropertySet, isUUID } from "@authup/kit";
 import { PermissionName, REALM_MASTER_NAME, RealmValidator } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
 //#region src/core/entities/realm/service.ts
 var RealmService = class extends AbstractEntityService {
 	repository;
 	validator;
 	webClientProvisioner;
+	keyProvisioner;
 	logger;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
 		this.webClientProvisioner = ctx.webClientProvisioner;
+		this.keyProvisioner = ctx.keyProvisioner;
 		this.logger = ctx.logger;
 		this.validator = new RealmValidator();
 	}
@@ -62,7 +64,7 @@ var RealmService = class extends AbstractEntityService {
 					...validated
 				} })
 			});
-			if (entity.name === REALM_MASTER_NAME && isPropertySet(validated, "name") && entity.name !== validated.name) throw new BadRequestError(`The name of the ${REALM_MASTER_NAME} can not be changed.`);
+			if (entity.name === REALM_MASTER_NAME && isPropertySet(validated, "name") && entity.name !== validated.name) throw new ValidationError(`The name of the ${REALM_MASTER_NAME} can not be changed.`);
 			entity = this.repository.merge(entity, validated);
 			await this.repository.save(entity);
 			return {
@@ -81,6 +83,7 @@ var RealmService = class extends AbstractEntityService {
 		} catch (e) {
 			if (this.logger) this.logger.warn(`Failed to provision web client for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`);
 		}
+		if (this.keyProvisioner) await this.keyProvisioner.ensureForRealm(entity);
 		return {
 			entity,
 			created: true
@@ -90,7 +93,7 @@ var RealmService = class extends AbstractEntityService {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_DELETE });
 		const entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
-		if (entity.built_in) throw new BadRequestError("A built-in realm can not be deleted.");
+		if (entity.built_in) throw new ValidationError("A built-in realm can not be deleted.");
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.REALM_DELETE,
 			data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity })

package/dist/core/entities/realm/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","BadRequestError","EntityNotFoundError","PermissionName","REALM_MASTER_NAME","RealmValidator","AbstractEntityService","RealmService","repository","validator","webClientProvisioner","logger","ctx","getMany","query","findMany","getOne","idOrName","entity","findOneByIdOrName","create","data","actor","save","undefined","update","updateOnly","options","group","where","id","name","findOneBy","permissionEvaluator","preEvaluate","REALM_UPDATE","UPDATE","REALM_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","merge","created","ensureForRealm","e","warn","Error","message","String","delete","REALM_DELETE","built_in","entityId","remove"],"sources":["../../../../src/core/entities/realm/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    REALM_MASTER_NAME,\n    RealmValidator,\n} from '@authup/core-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IWebClientProvisioner } from '../client/types.ts';\nimport type { IRealmRepository, IRealmService } from './types.ts';\n\nexport type RealmServiceContext = {\n    repository: IRealmRepository;\n    webClientProvisioner?: IWebClientProvisioner;\n    logger?: Logger;\n};\n\nexport class RealmService extends AbstractEntityService implements IRealmService {\n    protected repository: IRealmRepository;\n\n    protected validator: RealmValidator;\n\n    protected webClientProvisioner?: IWebClientProvisioner;\n\n    protected logger?: Logger;\n\n    constructor(ctx: RealmServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.webClientProvisioner = ctx.webClientProvisioner;\n        this.logger = ctx.logger;\n        this.validator = new RealmValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n    ): Promise<EntityRepositoryFindManyResult<Realm>> {\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n    ): Promise<Realm> {\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Realm,\n        created: boolean \n    }> {\n        let group: string;\n\n        let entity: Realm | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.REALM_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            if (entity.name === REALM_MASTER_NAME && isPropertySet(validated, 'name') && entity.name !== validated.name) {\n                throw new BadRequestError(`The name of the ${REALM_MASTER_NAME} can not be changed.`);\n            }\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        // Provision the realm's public `web` client via the system-level\n        // provisioner (NOT clientService.create) — it must not be gated on\n        // the actor's CLIENT_CREATE, since a realm creator may lack it.\n        // Realm creation must stay atomic from the caller's perspective: the\n        // realm is already persisted, so a provisioning failure is logged and\n        // swallowed (startup provisioning reconciles every realm's web client).\n        if (this.webClientProvisioner) {\n            try {\n                await this.webClientProvisioner.ensureForRealm(entity);\n            } catch (e) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Failed to provision web client for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`,\n                    );\n                }\n            }\n        }\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in realm can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AA2BA,IAAaW,eAAb,cAAkCD,sBAAAA;CACpBE;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKE,uBAAuBE,IAAIF;EAChC,KAAKC,SAASC,IAAID;EAClB,KAAKF,YAAY,IAAIJ,eAAAA;CACzB;CAEA,MAAMQ,QACFC,OAC8C;EAC9C,OAAO,KAAKN,WAAWO,SAASD,KAAAA;CACpC;CAEA,MAAME,OACFC,UACc;EACd,MAAMC,SAAS,MAAM,KAAKV,WAAWW,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIhB,oBAAAA;EAGd,OAAOgB;CACX;CAEA,MAAME,OACFC,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKC,KAAAA,GAAWH,MAAMC,KAAAA;EACpD,OAAOJ;CACX;CAEA,MAAMO,OACFR,UACAI,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKN,UAAUI,MAAMC,OAAO,EAAEI,YAAY,KAAK,CAAA;EAC7E,OAAOR;CACX;CAEA,MAAMK,KACFN,UACAI,MACAC,OACAK,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,IAAIV;EACJ,IAAID,UAAU;GACV,MAAMY,QAA6B,CAAC;GACpC,IAAI7B,OAAOiB,QAAAA,GACPY,MAAMC,KAAKb;QAEXY,MAAME,OAAOd;GAGjBC,SAAS,MAAM,KAAKV,WAAWwB,UAAUH,KAAAA;GACzC,IAAI,CAACX,UAAUS,QAAQD,YACnB,MAAM,IAAIxB,oBAAAA;EAElB,OAAO,IAAIyB,QAAQD,YACf,MAAM,IAAIxB,oBAAAA;EAGd,IAAIgB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM5B,eAAegC,aAAa,CAAA;GAChFP,QAAQ9B,eAAesC;EAC3B,OAAO;GACH,MAAMd,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM5B,eAAekC,aAAa,CAAA;GAChFT,QAAQ9B,eAAewC;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK9B,UAAU+B,IAAInB,MAAM,EAAEO,MAAM,CAAA;EAEzD,MAAM,KAAKpB,WAAWiC,oBAAoBF,SAAAA;EAE1C,IAAIrB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBS,SAAS;IACrCX,MAAM5B,eAAegC;IACrBd,MAAMxB,iBAAiB,GAClBD,kBAAkB+C,aAAa;KAC5B,GAAGzB;KACH,GAAGqB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,IAAIrB,OAAOa,SAAS3B,qBAAqBL,cAAcwC,WAAW,MAAA,KAAWrB,OAAOa,SAASQ,UAAUR,MACnG,MAAM,IAAI9B,gBAAgB,mBAAmBG,kBAAkB,qBAAqB;GAGxFc,SAAS,KAAKV,WAAWoC,MAAM1B,QAAQqB,SAAAA;GACvC,MAAM,KAAK/B,WAAWe,KAAKL,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,MAAMvB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM5B,eAAekC;GACrBhB,MAAMxB,iBAAiB,GAAGD,kBAAkB+C,aAAaJ,UAAU,CAAA;EACvE,CAAA;EAEArB,SAAS,KAAKV,WAAWY,OAAOmB,SAAAA;EAChC,MAAM,KAAK/B,WAAWe,KAAKL,MAAAA;EAQ3B,IAAI,KAAKR,sBACL,IAAI;GACA,MAAM,KAAKA,qBAAqBoC,eAAe5B,MAAAA;EACnD,SAAS6B,GAAG;GACR,IAAI,KAAKpC,QACL,KAAKA,OAAOqC,KACR,4CAA4C9B,OAAOY,GAAG,IAAIiB,aAAaE,QAAQF,EAAEG,UAAUC,OAAOJ,CAAAA,GAAI;EAGlH;EAGJ,OAAO;GACH7B;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMO,OACFtB,IACAR,OACc;EACd,MAAMA,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM5B,eAAekD,aAAa,CAAA;EAEhF,MAAMnC,SAAS,MAAM,KAAKV,WAAWwB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACZ,QACD,MAAM,IAAIhB,oBAAAA;EAGd,IAAIgB,OAAOoC,UACP,MAAM,IAAIrD,gBAAgB,sCAAA;EAG9B,MAAMqB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM5B,eAAekD;GACrBhC,MAAMxB,iBAAiB,GAAGD,kBAAkB+C,aAAazB,OAAO,CAAA;EACpE,CAAA;EAEA,MAAM,EAAEY,IAAIyB,aAAarC;EACzB,MAAM,KAAKV,WAAWgD,OAAOtC,MAAAA;EAC7BA,OAAOY,KAAKyB;EAEZ,OAAOrC;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","ValidationError","PermissionName","REALM_MASTER_NAME","RealmValidator","AbstractEntityService","RealmService","repository","validator","webClientProvisioner","keyProvisioner","logger","ctx","getMany","query","findMany","getOne","idOrName","entity","findOneByIdOrName","create","data","actor","save","undefined","update","updateOnly","options","group","where","id","name","findOneBy","permissionEvaluator","preEvaluate","REALM_UPDATE","UPDATE","REALM_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","merge","created","ensureForRealm","e","warn","Error","message","String","delete","REALM_DELETE","built_in","entityId","remove"],"sources":["../../../../src/core/entities/realm/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    REALM_MASTER_NAME,\n    RealmValidator,\n} from '@authup/core-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IWebClientProvisioner } from '../client/types.ts';\nimport type { IKeyProvisioner } from '../../key/types.ts';\nimport type { IRealmRepository, IRealmService } from './types.ts';\n\nexport type RealmServiceContext = {\n    repository: IRealmRepository;\n    webClientProvisioner?: IWebClientProvisioner;\n    keyProvisioner?: IKeyProvisioner;\n    logger?: Logger;\n};\n\nexport class RealmService extends AbstractEntityService implements IRealmService {\n    protected repository: IRealmRepository;\n\n    protected validator: RealmValidator;\n\n    protected webClientProvisioner?: IWebClientProvisioner;\n\n    protected keyProvisioner?: IKeyProvisioner;\n\n    protected logger?: Logger;\n\n    constructor(ctx: RealmServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.webClientProvisioner = ctx.webClientProvisioner;\n        this.keyProvisioner = ctx.keyProvisioner;\n        this.logger = ctx.logger;\n        this.validator = new RealmValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n    ): Promise<EntityRepositoryFindManyResult<Realm>> {\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n    ): Promise<Realm> {\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Realm,\n        created: boolean \n    }> {\n        let group: string;\n\n        let entity: Realm | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.REALM_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            if (entity.name === REALM_MASTER_NAME && isPropertySet(validated, 'name') && entity.name !== validated.name) {\n                throw new ValidationError(`The name of the ${REALM_MASTER_NAME} can not be changed.`);\n            }\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        // Provision the realm's public `web` client via the system-level\n        // provisioner (NOT clientService.create) — it must not be gated on\n        // the actor's CLIENT_CREATE, since a realm creator may lack it.\n        // Realm creation must stay atomic from the caller's perspective: the\n        // realm is already persisted, so a provisioning failure is logged and\n        // swallowed (startup provisioning reconciles every realm's web client).\n        if (this.webClientProvisioner) {\n            try {\n                await this.webClientProvisioner.ensureForRealm(entity);\n            } catch (e) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Failed to provision web client for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`,\n                    );\n                }\n            }\n        }\n\n        // Mint the realm's sig + enc keys eagerly (plan 071 hybrid model) —\n        // same system-level, never-fail posture as the web client above.\n        if (this.keyProvisioner) {\n            await this.keyProvisioner.ensureForRealm(entity);\n        }\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new ValidationError('A built-in realm can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AA6BA,IAAaW,eAAb,cAAkCD,sBAAAA;CACpBE;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKL,aAAaK,IAAIL;EACtB,KAAKE,uBAAuBG,IAAIH;EAChC,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,SAASC,IAAID;EAClB,KAAKH,YAAY,IAAIJ,eAAAA;CACzB;CAEA,MAAMS,QACFC,OAC8C;EAC9C,OAAO,KAAKP,WAAWQ,SAASD,KAAAA;CACpC;CAEA,MAAME,OACFC,UACc;EACd,MAAMC,SAAS,MAAM,KAAKX,WAAWY,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIlB,oBAAAA;EAGd,OAAOkB;CACX;CAEA,MAAME,OACFC,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKC,KAAAA,GAAWH,MAAMC,KAAAA;EACpD,OAAOJ;CACX;CAEA,MAAMO,OACFR,UACAI,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKN,UAAUI,MAAMC,OAAO,EAAEI,YAAY,KAAK,CAAA;EAC7E,OAAOR;CACX;CAEA,MAAMK,KACFN,UACAI,MACAC,OACAK,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,IAAIV;EACJ,IAAID,UAAU;GACV,MAAMY,QAA6B,CAAC;GACpC,IAAI9B,OAAOkB,QAAAA,GACPY,MAAMC,KAAKb;QAEXY,MAAME,OAAOd;GAGjBC,SAAS,MAAM,KAAKX,WAAWyB,UAAUH,KAAAA;GACzC,IAAI,CAACX,UAAUS,QAAQD,YACnB,MAAM,IAAI1B,oBAAAA;EAElB,OAAO,IAAI2B,QAAQD,YACf,MAAM,IAAI1B,oBAAAA;EAGd,IAAIkB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM7B,eAAeiC,aAAa,CAAA;GAChFP,QAAQ/B,eAAeuC;EAC3B,OAAO;GACH,MAAMd,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM7B,eAAemC,aAAa,CAAA;GAChFT,QAAQ/B,eAAeyC;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK/B,UAAUgC,IAAInB,MAAM,EAAEO,MAAM,CAAA;EAEzD,MAAM,KAAKrB,WAAWkC,oBAAoBF,SAAAA;EAE1C,IAAIrB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBS,SAAS;IACrCX,MAAM7B,eAAeiC;IACrBd,MAAMzB,iBAAiB,GAClBD,kBAAkBgD,aAAa;KAC5B,GAAGzB;KACH,GAAGqB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,IAAIrB,OAAOa,SAAS5B,qBAAqBL,cAAcyC,WAAW,MAAA,KAAWrB,OAAOa,SAASQ,UAAUR,MACnG,MAAM,IAAI9B,gBAAgB,mBAAmBE,kBAAkB,qBAAqB;GAGxFe,SAAS,KAAKX,WAAWqC,MAAM1B,QAAQqB,SAAAA;GACvC,MAAM,KAAKhC,WAAWgB,KAAKL,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,MAAMvB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM7B,eAAemC;GACrBhB,MAAMzB,iBAAiB,GAAGD,kBAAkBgD,aAAaJ,UAAU,CAAA;EACvE,CAAA;EAEArB,SAAS,KAAKX,WAAWa,OAAOmB,SAAAA;EAChC,MAAM,KAAKhC,WAAWgB,KAAKL,MAAAA;EAQ3B,IAAI,KAAKT,sBACL,IAAI;GACA,MAAM,KAAKA,qBAAqBqC,eAAe5B,MAAAA;EACnD,SAAS6B,GAAG;GACR,IAAI,KAAKpC,QACL,KAAKA,OAAOqC,KACR,4CAA4C9B,OAAOY,GAAG,IAAIiB,aAAaE,QAAQF,EAAEG,UAAUC,OAAOJ,CAAAA,GAAI;EAGlH;EAKJ,IAAI,KAAKrC,gBACL,MAAM,KAAKA,eAAeoC,eAAe5B,MAAAA;EAG7C,OAAO;GACHA;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMO,OACFtB,IACAR,OACc;EACd,MAAMA,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM7B,eAAemD,aAAa,CAAA;EAEhF,MAAMnC,SAAS,MAAM,KAAKX,WAAWyB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACZ,QACD,MAAM,IAAIlB,oBAAAA;EAGd,IAAIkB,OAAOoC,UACP,MAAM,IAAIrD,gBAAgB,sCAAA;EAG9B,MAAMqB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM7B,eAAemD;GACrBhC,MAAMzB,iBAAiB,GAAGD,kBAAkBgD,aAAazB,OAAO,CAAA;EACpE,CAAA;EAEA,MAAM,EAAEY,IAAIyB,aAAarC;EACzB,MAAM,KAAKX,WAAWiD,OAAOtC,MAAAA;EAC7BA,OAAOY,KAAKyB;EAEZ,OAAOrC;CACX;AACJ"}

package/dist/core/entities/role/service.mjs

@@ -5,7 +5,7 @@ import { ValidatorGroup, isPropertySet, isUUID } from "@authup/kit";
 import { PermissionName, ROLE_ADMIN_NAME, RoleValidator } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
 //#region src/core/entities/role/service.ts
 var RoleService = class extends AbstractEntityService {
 	repository;
@@ -103,7 +103,7 @@ var RoleService = class extends AbstractEntityService {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_DELETE });
 		const entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
-		if (entity.name === ROLE_ADMIN_NAME) throw new BadRequestError("The default admin role can not be deleted.");
+		if (entity.name === ROLE_ADMIN_NAME) throw new ValidationError("The default admin role can not be deleted.");
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.ROLE_DELETE,
 			data: definePolicyData({

package/dist/core/entities/role/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","BadRequestError","EntityNotFoundError","PermissionName","ROLE_ADMIN_NAME","RoleValidator","AbstractEntityService","RoleService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","ROLE_READ","ROLE_UPDATE","ROLE_DELETE","findMany","getOne","idOrName","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","ROLE_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","REALM_MATCH","merge","checkUniqueness","created","identity","getActorRealmId","resourceRealmMatch","delete","entityId","remove"],"sources":["../../../../src/core/entities/role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    ROLE_ADMIN_NAME,\n    RoleValidator,\n} from '@authup/core-kit';\nimport type { Role } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRoleRepository, IRoleService } from './types.ts';\n\nexport type RoleServiceContext = {\n    repository: IRoleRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class RoleService extends AbstractEntityService implements IRoleService {\n    protected repository: IRoleRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: RoleValidator;\n\n    constructor(ctx: RoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new RoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Role>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n    ): Promise<Role> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Role> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Role> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Role,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Role | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.ROLE_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null,\n                }),\n            });\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.checkUniqueness(validated, entity);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Role> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.name === ROLE_ADMIN_NAME) {\n            throw new BadRequestError('The default admin role can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AA0BA,IAAaW,cAAb,cAAiCD,sBAAAA;CACnBE;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIL,cAAAA;CACzB;CAEA,MAAMO,QACFC,OACAC,OAC6C;EAC7C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,UACAT,OACa;EACb,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAItB,oBAAAA;EAGd,OAAOsB;CACX;CAEA,MAAME,OACFC,MACAb,OACa;EACb,MAAM,EAAEU,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMb,KAAAA;EACpD,OAAOU;CACX;CAEA,MAAMM,OACFP,UACAI,MACAb,OACa;EACb,MAAM,EAAEU,WAAW,MAAM,KAAKI,KAAKL,UAAUI,MAAMb,OAAO,EAAEiB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFL,UACAI,MACAb,OACAkB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOP,KAAKQ,aAAa,WACnC,MAAM,KAAK1B,gBAAgB2B,QAAQT,KAAKQ,QAAQ,IAChDN,KAAAA;EAEJ,IAAIL;EACJ,IAAID,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAIrC,OAAOuB,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMpB,OAAOM;GAGjB,IAAIW,OACAG,MAAMF,WAAWD,MAAMI;GAG3Bd,SAAS,MAAM,KAAKhB,WAAW+B,UAAUF,KAAAA;GACzC,IAAI,CAACb,UAAUQ,QAAQD,YACnB,MAAM,IAAI7B,oBAAAA;EAElB,OAAO,IAAI8B,QAAQD,YACf,MAAM,IAAI7B,oBAAAA;EAGd,IAAIsB,QAAQ;GACR,MAAMV,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMd,eAAegB,YAAY,CAAA;GAC/Ec,QAAQnC,eAAe2C;EAC3B,OAAO;GACH,MAAM3B,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMd,eAAeuC,YAAY,CAAA;GAC/ET,QAAQnC,eAAe6C;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKlC,UAAUmC,IAAIlB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAKzB,WAAWsC,oBAAoBF,SAAAA;EAE1C,IAAIpB,QAAQ;GACR,MAAMV,MAAMC,oBAAoBgC,SAAS;IACrC9B,MAAMd,eAAegB;IACrBQ,MAAM9B,iBAAiB;MAClBD,kBAAkBoD,aAAa;MAC5B,GAAGxB;MACH,GAAGoB;KACP;MACChD,kBAAkBqD,cAAcL,UAAUT,YAAYX,OAAOW,YAAY;IAC9E,CAAA;GACJ,CAAA;GAEAX,SAAS,KAAKhB,WAAW0C,MAAM1B,QAAQoB,SAAAA;GACvC,MAAM,KAAKpC,WAAW2C,gBAAgBP,WAAWpB,MAAAA;GACjD,MAAM,KAAKhB,WAAWoB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA4B,SAAS;GACb;EACJ;EAEA,IAAI,CAACrD,cAAc6C,WAAW,UAAA,KAAe9B,MAAMuC,UAC/CT,UAAUT,WAAW,KAAKmB,gBAAgBxC,KAAAA,KAAU;EAGxD,MAAMA,MAAMC,oBAAoBgC,SAAS;GACrC9B,MAAMd,eAAeuC;GACrBf,MAAM9B,iBAAiB;KAAGD,kBAAkBoD,aAAaJ;IAAW,GAAG,KAAKW,mBAAmBX,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKpC,WAAW2C,gBAAgBP,SAAAA;EAEtCpB,SAAS,KAAKhB,WAAWkB,OAAOkB,SAAAA;EAChC,MAAM,KAAKpC,WAAWoB,KAAKJ,MAAAA;EAE3B,OAAO;GACHA;GACA4B,SAAS;EACb;CACJ;CAEA,MAAMI,OACFlB,IACAxB,OACa;EACb,MAAMA,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMd,eAAeiB,YAAY,CAAA;EAE/E,MAAMI,SAAS,MAAM,KAAKhB,WAAW+B,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAItB,oBAAAA;EAGd,IAAIsB,OAAOP,SAASb,iBAChB,MAAM,IAAIH,gBAAgB,4CAAA;EAG9B,MAAMa,MAAMC,oBAAoBgC,SAAS;GACrC9B,MAAMd,eAAeiB;GACrBO,MAAM9B,iBAAiB;KAAGD,kBAAkBoD,aAAaxB;IAAQ,GAAG,KAAK+B,mBAAmB/B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAImB,aAAajC;EACzB,MAAM,KAAKhB,WAAWkD,OAAOlC,MAAAA;EAC7BA,OAAOc,KAAKmB;EAEZ,OAAOjC;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","ValidationError","PermissionName","ROLE_ADMIN_NAME","RoleValidator","AbstractEntityService","RoleService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","ROLE_READ","ROLE_UPDATE","ROLE_DELETE","findMany","getOne","idOrName","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","ROLE_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","REALM_MATCH","merge","checkUniqueness","created","identity","getActorRealmId","resourceRealmMatch","delete","entityId","remove"],"sources":["../../../../src/core/entities/role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    ROLE_ADMIN_NAME,\n    RoleValidator,\n} from '@authup/core-kit';\nimport type { Role } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRoleRepository, IRoleService } from './types.ts';\n\nexport type RoleServiceContext = {\n    repository: IRoleRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class RoleService extends AbstractEntityService implements IRoleService {\n    protected repository: IRoleRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: RoleValidator;\n\n    constructor(ctx: RoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new RoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Role>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n    ): Promise<Role> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Role> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Role> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Role,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Role | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.ROLE_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null,\n                }),\n            });\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.checkUniqueness(validated, entity);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Role> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.name === ROLE_ADMIN_NAME) {\n            throw new ValidationError('The default admin role can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AA0BA,IAAaW,cAAb,cAAiCD,sBAAAA;CACnBE;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIL,cAAAA;CACzB;CAEA,MAAMO,QACFC,OACAC,OAC6C;EAC7C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,UACAT,OACa;EACb,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,OAAOuB;CACX;CAEA,MAAME,OACFC,MACAb,OACa;EACb,MAAM,EAAEU,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMb,KAAAA;EACpD,OAAOU;CACX;CAEA,MAAMM,OACFP,UACAI,MACAb,OACa;EACb,MAAM,EAAEU,WAAW,MAAM,KAAKI,KAAKL,UAAUI,MAAMb,OAAO,EAAEiB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFL,UACAI,MACAb,OACAkB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOP,KAAKQ,aAAa,WACnC,MAAM,KAAK1B,gBAAgB2B,QAAQT,KAAKQ,QAAQ,IAChDN,KAAAA;EAEJ,IAAIL;EACJ,IAAID,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAIrC,OAAOuB,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMpB,OAAOM;GAGjB,IAAIW,OACAG,MAAMF,WAAWD,MAAMI;GAG3Bd,SAAS,MAAM,KAAKhB,WAAW+B,UAAUF,KAAAA;GACzC,IAAI,CAACb,UAAUQ,QAAQD,YACnB,MAAM,IAAI9B,oBAAAA;EAElB,OAAO,IAAI+B,QAAQD,YACf,MAAM,IAAI9B,oBAAAA;EAGd,IAAIuB,QAAQ;GACR,MAAMV,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMd,eAAegB,YAAY,CAAA;GAC/Ec,QAAQnC,eAAe2C;EAC3B,OAAO;GACH,MAAM3B,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMd,eAAeuC,YAAY,CAAA;GAC/ET,QAAQnC,eAAe6C;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKlC,UAAUmC,IAAIlB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAKzB,WAAWsC,oBAAoBF,SAAAA;EAE1C,IAAIpB,QAAQ;GACR,MAAMV,MAAMC,oBAAoBgC,SAAS;IACrC9B,MAAMd,eAAegB;IACrBQ,MAAM9B,iBAAiB;MAClBD,kBAAkBoD,aAAa;MAC5B,GAAGxB;MACH,GAAGoB;KACP;MACChD,kBAAkBqD,cAAcL,UAAUT,YAAYX,OAAOW,YAAY;IAC9E,CAAA;GACJ,CAAA;GAEAX,SAAS,KAAKhB,WAAW0C,MAAM1B,QAAQoB,SAAAA;GACvC,MAAM,KAAKpC,WAAW2C,gBAAgBP,WAAWpB,MAAAA;GACjD,MAAM,KAAKhB,WAAWoB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA4B,SAAS;GACb;EACJ;EAEA,IAAI,CAACrD,cAAc6C,WAAW,UAAA,KAAe9B,MAAMuC,UAC/CT,UAAUT,WAAW,KAAKmB,gBAAgBxC,KAAAA,KAAU;EAGxD,MAAMA,MAAMC,oBAAoBgC,SAAS;GACrC9B,MAAMd,eAAeuC;GACrBf,MAAM9B,iBAAiB;KAAGD,kBAAkBoD,aAAaJ;IAAW,GAAG,KAAKW,mBAAmBX,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKpC,WAAW2C,gBAAgBP,SAAAA;EAEtCpB,SAAS,KAAKhB,WAAWkB,OAAOkB,SAAAA;EAChC,MAAM,KAAKpC,WAAWoB,KAAKJ,MAAAA;EAE3B,OAAO;GACHA;GACA4B,SAAS;EACb;CACJ;CAEA,MAAMI,OACFlB,IACAxB,OACa;EACb,MAAMA,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMd,eAAeiB,YAAY,CAAA;EAE/E,MAAMI,SAAS,MAAM,KAAKhB,WAAW+B,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAIvB,oBAAAA;EAGd,IAAIuB,OAAOP,SAASb,iBAChB,MAAM,IAAIF,gBAAgB,4CAAA;EAG9B,MAAMY,MAAMC,oBAAoBgC,SAAS;GACrC9B,MAAMd,eAAeiB;GACrBO,MAAM9B,iBAAiB;KAAGD,kBAAkBoD,aAAaxB;IAAQ,GAAG,KAAK+B,mBAAmB/B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAImB,aAAajC;EACzB,MAAM,KAAKhB,WAAWkD,OAAOlC,MAAAA;EAC7BA,OAAOc,KAAKmB;EAEZ,OAAOjC;CACX;AACJ"}

package/dist/core/entities/role-attribute/service.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
 //#region src/core/entities/role-attribute/service.ts
 var RoleAttributeService = class extends AbstractEntityService {
 	repository;
@@ -71,7 +71,7 @@ var RoleAttributeService = class extends AbstractEntityService {
 	async create(data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });
 		await this.repository.validateJoinColumns(data);
-		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new BadRequestError(`The role-attribute name '${data.name}' collides with a Role entity column.`);
+		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new ValidationError(`The role-attribute name '${data.name}' collides with a Role entity column.`);
 		data.realm_id = data.role.realm_id;
 		const entity = this.repository.create(data);
 		await actor.permissionEvaluator.evaluate({
@@ -87,7 +87,7 @@ var RoleAttributeService = class extends AbstractEntityService {
 	async update(id, data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });
 		await this.repository.validateJoinColumns(data);
-		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new BadRequestError(`The role-attribute name '${data.name}' collides with a Role entity column.`);
+		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new ValidationError(`The role-attribute name '${data.name}' collides with a Role entity column.`);
 		let entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
 		delete data.role_id;

package/dist/core/entities/role-attribute/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","BadRequestError","EntityNotFoundError","PermissionName","AbstractEntityService","RoleAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","ROLE_READ","ROLE_UPDATE","ROLE_DELETE","data","entities","meta","findMany","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","id","findOneBy","create","preEvaluate","validateJoinColumns","has","realm_id","role","evaluate","value","save","update","role_id","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/role-attribute/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PermissionName } from '@authup/core-kit';\nimport type { RoleAttribute } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRoleAttributeRepository, IRoleAttributeService } from './types.ts';\n\nexport type RoleAttributeServiceContext = {\n    repository: IRoleAttributeRepository;\n    reservedNames?: ReadonlySet<string>;\n};\n\nexport class RoleAttributeService extends AbstractEntityService implements IRoleAttributeService {\n    protected repository: IRoleAttributeRepository;\n\n    protected reservedNames: ReadonlySet<string>;\n\n    constructor(ctx: RoleAttributeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.reservedNames = ctx.reservedNames ?? new Set();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<RoleAttribute>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n\n        const data: RoleAttribute[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: [\n                        PermissionName.ROLE_READ,\n                        PermissionName.ROLE_UPDATE,\n                        PermissionName.ROLE_DELETE,\n                    ],\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n                data.push(entity);\n            } catch {\n                total--;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new BadRequestError(`The role-attribute name '${data.name}' collides with a Role entity column.`);\n        }\n\n        data.realm_id = data.role.realm_id;\n\n        const entity = this.repository.create(data);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new BadRequestError(`The role-attribute name '${data.name}' collides with a Role entity column.`);\n        }\n\n        let entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // An attribute belongs to a fixed role; its owner (and the role-derived realm_id) is\n        // IMMUTABLE on update — strip both from the body. This blocks reassigning the attribute\n        // to another role (which would otherwise be authorized against the new realm, not the\n        // one the attribute currently lives in) and blocks a caller-supplied realm_id that would\n        // gate ROLE_UPDATE against a realm of their choosing. To move an attribute, delete + recreate.\n        delete data.role_id;\n        delete data.role;\n        delete data.realm_id;\n\n        entity = this.repository.merge(entity, data);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_UPDATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;AAoBA,IAAaM,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,KAAAA;EAEnC,MAAMQ,OAAwB,CAAA;EAC9B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UACjB,IAAI;GACA,MAAMR,MAAMC,oBAAoBY,cAAc;IAC1CV,MAAM;KACFZ,eAAea;KACfb,eAAec;KACfd,eAAee;;IAEnBC,MAAMnB,iBAAiB;MAAGD,kBAAkB2B,aAAaF;KAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;IAAQ,CAAA;GACxG,CAAA;GACAL,KAAKS,KAAKJ,MAAAA;EACd,QAAQ;GACJD;EACJ;EAGJ,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,IACAlB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKlB,WAAWyB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACN,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMU,MAAMC,oBAAoBY,cAAc;GAC1CV,MAAM;IACFZ,eAAea;IACfb,eAAec;IACfd,eAAee;;GAEnBC,MAAMnB,iBAAiB;KAAGD,kBAAkB2B,aAAaF;IAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMQ,OACFb,MACAP,OACsB;EACtB,MAAMA,MAAMC,oBAAoBoB,YAAY,EAAElB,MAAMZ,eAAec,YAAY,CAAA;EAE/E,MAAM,KAAKX,WAAW4B,oBAAoBf,IAAAA;EAE1C,IAAI,OAAOA,KAAKJ,SAAS,YAAY,KAAKR,cAAc4B,IAAIhB,KAAKJ,IAAI,GACjE,MAAM,IAAId,gBAAgB,4BAA4BkB,KAAKJ,KAAK,sCAAsC;EAG1GI,KAAKiB,WAAWjB,KAAKkB,KAAKD;EAE1B,MAAMZ,SAAS,KAAKlB,WAAW0B,OAAOb,IAAAA;EAEtC,MAAMP,MAAMC,oBAAoByB,SAAS;GACrCvB,MAAMZ,eAAec;GACrBE,MAAMnB,iBAAiB;KAClBD,kBAAkB2B,aAAa,GAAGP,KAAKJ,OAAOI,KAAKoB,MAAM;IAC1D,GAAG,KAAKZ,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKlB,WAAWkC,KAAKhB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMiB,OACFX,IACAX,MACAP,OACsB;EACtB,MAAMA,MAAMC,oBAAoBoB,YAAY,EAAElB,MAAMZ,eAAec,YAAY,CAAA;EAE/E,MAAM,KAAKX,WAAW4B,oBAAoBf,IAAAA;EAE1C,IAAI,OAAOA,KAAKJ,SAAS,YAAY,KAAKR,cAAc4B,IAAIhB,KAAKJ,IAAI,GACjE,MAAM,IAAId,gBAAgB,4BAA4BkB,KAAKJ,KAAK,sCAAsC;EAG1G,IAAIS,SAAS,MAAM,KAAKlB,WAAWyB,UAAU,EAAED,GAAG,CAAA;EAClD,IAAI,CAACN,QACD,MAAM,IAAItB,oBAAAA;EAQd,OAAOiB,KAAKuB;EACZ,OAAOvB,KAAKkB;EACZ,OAAOlB,KAAKiB;EAEZZ,SAAS,KAAKlB,WAAWqC,MAAMnB,QAAQL,IAAAA;EAEvC,MAAMP,MAAMC,oBAAoByB,SAAS;GACrCvB,MAAMZ,eAAec;GACrBE,MAAMnB,iBAAiB;KAClBD,kBAAkB2B,aAAa,GAAGF,OAAOT,OAAOS,OAAOe,MAAM;IAC9D,GAAG,KAAKZ,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKlB,WAAWkC,KAAKhB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMoB,OACFd,IACAlB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBoB,YAAY,EAAElB,MAAMZ,eAAec,YAAY,CAAA;EAE/E,MAAMO,SAAS,MAAM,KAAKlB,WAAWyB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACN,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMU,MAAMC,oBAAoByB,SAAS;GACrCvB,MAAMZ,eAAec;GACrBE,MAAMnB,iBAAiB;KAAGD,kBAAkB2B,aAAaF;IAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEM,IAAIe,aAAarB;EACzB,MAAM,KAAKlB,WAAWwC,OAAOtB,MAAAA;EAC7BA,OAAOM,KAAKe;EAEZ,OAAOrB;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityNotFoundError","ValidationError","PermissionName","AbstractEntityService","RoleAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","ROLE_READ","ROLE_UPDATE","ROLE_DELETE","data","entities","meta","findMany","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","id","findOneBy","create","preEvaluate","validateJoinColumns","has","realm_id","role","evaluate","value","save","update","role_id","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/role-attribute/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { PermissionName } from '@authup/core-kit';\nimport type { RoleAttribute } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRoleAttributeRepository, IRoleAttributeService } from './types.ts';\n\nexport type RoleAttributeServiceContext = {\n    repository: IRoleAttributeRepository;\n    reservedNames?: ReadonlySet<string>;\n};\n\nexport class RoleAttributeService extends AbstractEntityService implements IRoleAttributeService {\n    protected repository: IRoleAttributeRepository;\n\n    protected reservedNames: ReadonlySet<string>;\n\n    constructor(ctx: RoleAttributeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.reservedNames = ctx.reservedNames ?? new Set();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<RoleAttribute>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n\n        const data: RoleAttribute[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: [\n                        PermissionName.ROLE_READ,\n                        PermissionName.ROLE_UPDATE,\n                        PermissionName.ROLE_DELETE,\n                    ],\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n                data.push(entity);\n            } catch {\n                total--;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new ValidationError(`The role-attribute name '${data.name}' collides with a Role entity column.`);\n        }\n\n        data.realm_id = data.role.realm_id;\n\n        const entity = this.repository.create(data);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new ValidationError(`The role-attribute name '${data.name}' collides with a Role entity column.`);\n        }\n\n        let entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // An attribute belongs to a fixed role; its owner (and the role-derived realm_id) is\n        // IMMUTABLE on update — strip both from the body. This blocks reassigning the attribute\n        // to another role (which would otherwise be authorized against the new realm, not the\n        // one the attribute currently lives in) and blocks a caller-supplied realm_id that would\n        // gate ROLE_UPDATE against a realm of their choosing. To move an attribute, delete + recreate.\n        delete data.role_id;\n        delete data.role;\n        delete data.realm_id;\n\n        entity = this.repository.merge(entity, data);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_UPDATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;AAoBA,IAAaM,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,KAAAA;EAEnC,MAAMQ,OAAwB,CAAA;EAC9B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UACjB,IAAI;GACA,MAAMR,MAAMC,oBAAoBY,cAAc;IAC1CV,MAAM;KACFZ,eAAea;KACfb,eAAec;KACfd,eAAee;;IAEnBC,MAAMnB,iBAAiB;MAAGD,kBAAkB2B,aAAaF;KAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;IAAQ,CAAA;GACxG,CAAA;GACAL,KAAKS,KAAKJ,MAAAA;EACd,QAAQ;GACJD;EACJ;EAGJ,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,IACAlB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKlB,WAAWyB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACN,QACD,MAAM,IAAIvB,oBAAAA;EAGd,MAAMW,MAAMC,oBAAoBY,cAAc;GAC1CV,MAAM;IACFZ,eAAea;IACfb,eAAec;IACfd,eAAee;;GAEnBC,MAAMnB,iBAAiB;KAAGD,kBAAkB2B,aAAaF;IAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMQ,OACFb,MACAP,OACsB;EACtB,MAAMA,MAAMC,oBAAoBoB,YAAY,EAAElB,MAAMZ,eAAec,YAAY,CAAA;EAE/E,MAAM,KAAKX,WAAW4B,oBAAoBf,IAAAA;EAE1C,IAAI,OAAOA,KAAKJ,SAAS,YAAY,KAAKR,cAAc4B,IAAIhB,KAAKJ,IAAI,GACjE,MAAM,IAAIb,gBAAgB,4BAA4BiB,KAAKJ,KAAK,sCAAsC;EAG1GI,KAAKiB,WAAWjB,KAAKkB,KAAKD;EAE1B,MAAMZ,SAAS,KAAKlB,WAAW0B,OAAOb,IAAAA;EAEtC,MAAMP,MAAMC,oBAAoByB,SAAS;GACrCvB,MAAMZ,eAAec;GACrBE,MAAMnB,iBAAiB;KAClBD,kBAAkB2B,aAAa,GAAGP,KAAKJ,OAAOI,KAAKoB,MAAM;IAC1D,GAAG,KAAKZ,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKlB,WAAWkC,KAAKhB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMiB,OACFX,IACAX,MACAP,OACsB;EACtB,MAAMA,MAAMC,oBAAoBoB,YAAY,EAAElB,MAAMZ,eAAec,YAAY,CAAA;EAE/E,MAAM,KAAKX,WAAW4B,oBAAoBf,IAAAA;EAE1C,IAAI,OAAOA,KAAKJ,SAAS,YAAY,KAAKR,cAAc4B,IAAIhB,KAAKJ,IAAI,GACjE,MAAM,IAAIb,gBAAgB,4BAA4BiB,KAAKJ,KAAK,sCAAsC;EAG1G,IAAIS,SAAS,MAAM,KAAKlB,WAAWyB,UAAU,EAAED,GAAG,CAAA;EAClD,IAAI,CAACN,QACD,MAAM,IAAIvB,oBAAAA;EAQd,OAAOkB,KAAKuB;EACZ,OAAOvB,KAAKkB;EACZ,OAAOlB,KAAKiB;EAEZZ,SAAS,KAAKlB,WAAWqC,MAAMnB,QAAQL,IAAAA;EAEvC,MAAMP,MAAMC,oBAAoByB,SAAS;GACrCvB,MAAMZ,eAAec;GACrBE,MAAMnB,iBAAiB;KAClBD,kBAAkB2B,aAAa,GAAGF,OAAOT,OAAOS,OAAOe,MAAM;IAC9D,GAAG,KAAKZ,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKlB,WAAWkC,KAAKhB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMoB,OACFd,IACAlB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBoB,YAAY,EAAElB,MAAMZ,eAAec,YAAY,CAAA;EAE/E,MAAMO,SAAS,MAAM,KAAKlB,WAAWyB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACN,QACD,MAAM,IAAIvB,oBAAAA;EAGd,MAAMW,MAAMC,oBAAoByB,SAAS;GACrCvB,MAAMZ,eAAec;GACrBE,MAAMnB,iBAAiB;KAAGD,kBAAkB2B,aAAaF;IAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEM,IAAIe,aAAarB;EACzB,MAAM,KAAKlB,WAAWwC,OAAOtB,MAAAA;EAC7BA,OAAOM,KAAKe;EAEZ,OAAOrB;CACX;AACJ"}

package/dist/core/entities/session/service.mjs

@@ -7,7 +7,7 @@ import { isObject } from "@authup/kit";
 import { PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
-import { EntityNotFoundError, UnauthorizedError } from "@authup/errors";
+import { AuthupError, EntityNotFoundError, ErrorCode } from "@authup/errors";
 //#region src/core/entities/session/service.ts
 var SessionService = class extends AbstractEntityService {
 	repository;
@@ -93,7 +93,10 @@ var SessionService = class extends AbstractEntityService {
 		return entity;
 	}
 	async deleteMany(actor, options = {}) {
-		if (!actor.identity) throw new UnauthorizedError();
+		if (!actor.identity) throw new AuthupError({
+			code: ErrorCode.IDENTITY_UNAUTHORIZED,
+			message: "Authentication required."
+		});
 		if (this.hasTargetFilter(options.query)) return this.deleteManyByQuery(actor, options.query);
 		return this.deleteManyForSelf(actor, options.currentSessionId);
 	}

package/dist/core/entities/session/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityNotFoundError","UnauthorizedError","isObject","PermissionName","AbstractEntityService","SESSION_FILTER_KEYS","SessionService","repository","ctx","isOwnedBy","session","actor","identity","sub","data","id","sub_kind","type","getMany","query","canReadAll","permissionEvaluator","preEvaluate","name","SESSION_READ","e","findMany","owner","subKind","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","delete","SESSION_DELETE","entityId","remove","deleteMany","options","hasTargetFilter","deleteManyByQuery","deleteManyForSelf","currentSessionId","filter","some","key","value","sessions","findAllByOwner","count","findAllByQuery"],"sources":["../../../../src/core/entities/session/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError, UnauthorizedError } from '@authup/errors';\nimport { isObject } from '@authup/kit';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Session } from '@authup/core-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { ISessionRepository } from '../../authentication/index.ts';\nimport { SESSION_FILTER_KEYS } from '../../authentication/index.ts';\nimport type { ISessionService, SessionDeleteManyOptions, SessionDeleteManyResult } from './types.ts';\n\nexport type SessionServiceContext = {\n    repository: ISessionRepository,\n};\n\nexport class SessionService extends AbstractEntityService implements ISessionService {\n    protected repository: ISessionRepository;\n\n    constructor(ctx: SessionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n    }\n\n    protected isOwnedBy(session: Session, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            session.sub === actor.identity.data.id &&\n            session.sub_kind === actor.identity.type;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own sessions\n            return this.repository.findMany(query, {\n                owner: {\n                    sub: actor.identity!.data.id,\n                    subKind: actor.identity!.type,\n                },\n            });\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(query);\n\n        const data: Session[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.SESSION_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext): Promise<Session> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SESSION_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n\n    async delete(id: string, actor: ActorContext): Promise<Session> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SESSION_DELETE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    async deleteMany(\n        actor: ActorContext,\n        options: SessionDeleteManyOptions = {},\n    ): Promise<SessionDeleteManyResult> {\n        if (!actor.identity) {\n            throw new UnauthorizedError();\n        }\n\n        if (this.hasTargetFilter(options.query)) {\n            return this.deleteManyByQuery(actor, options.query!);\n        }\n\n        return this.deleteManyForSelf(actor, options.currentSessionId);\n    }\n\n    /**\n     * True when the query carries at least one recognized target filter — the\n     * discriminator between the admin bulk-revoke path and self-service. An\n     * unrecognized / empty filter falls through to self-service (fail-safe: a\n     * typo can never trigger an unconstrained mass delete).\n     */\n    protected hasTargetFilter(query?: Record<string, any>): boolean {\n        const filter = query?.filter;\n        if (!isObject(filter)) {\n            return false;\n        }\n\n        return SESSION_FILTER_KEYS.some((key) => {\n            const value = filter[key];\n            return typeof value !== 'undefined' && value !== '';\n        });\n    }\n\n    protected async deleteManyForSelf(\n        actor: ActorContext,\n        currentSessionId?: string,\n    ): Promise<SessionDeleteManyResult> {\n        const sessions = await this.repository.findAllByOwner({\n            sub: actor.identity!.data.id,\n            subKind: actor.identity!.type,\n        });\n\n        let count = 0;\n        for (const session of sessions) {\n            if (currentSessionId && session.id === currentSessionId) {\n                continue;\n            }\n            await this.repository.remove(session);\n            count += 1;\n        }\n\n        return { count };\n    }\n\n    protected async deleteManyByQuery(\n        actor: ActorContext,\n        query: Record<string, any>,\n    ): Promise<SessionDeleteManyResult> {\n        // Gate: an actor without SESSION_DELETE cannot force-logout anyone → 403.\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n\n        const sessions = await this.repository.findAllByQuery(query);\n\n        let count = 0;\n        for (const session of sessions) {\n            // Own sessions are always deletable by the actor (mirrors getMany).\n            // Otherwise per-session realm-match: a realm_admin only reaches\n            // sessions in its realm — cross-realm rows are skipped, not failed,\n            // so filter breadth cannot escalate beyond the actor's reach.\n            if (!this.isOwnedBy(session, actor)) {\n                try {\n                    await actor.permissionEvaluator.evaluate({\n                        name: PermissionName.SESSION_DELETE,\n                        data: definePolicyData({\n                            [BuiltInPolicyType.ATTRIBUTES]: session,\n                            ...this.resourceRealmMatch(session),\n                        }),\n                    });\n                } catch {\n                    continue;\n                }\n            }\n\n            await this.repository.remove(session);\n            count += 1;\n        }\n\n        return { count };\n    }\n}\n"],"mappings":";;;;;;;;;;;AAsBA,IAAaQ,iBAAb,cAAoCF,sBAAAA;CACtBG;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,aAAaL,MAAMC,SAASK;CAC5C;CAEA,MAAMC,QACFC,OACAR,OACgD;EAChD,IAAIS,aAAa;EACjB,IAAI;GACA,MAAMT,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqB,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAACd,MAAMC,UACP,MAAMa;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKb,WAAWmB,SAASP,OAAO,EACnCQ,OAAO;GACHd,KAAKF,MAAMC,SAAUE,KAAKC;GAC1Ba,SAASjB,MAAMC,SAAUK;EAC7B,EACJ,CAAA;EAGJ,MAAM,EAAEH,MAAMe,UAAUC,SAAS,MAAM,KAAKvB,WAAWmB,SAASP,KAAAA;EAEhE,MAAML,OAAkB,CAAA;EACxB,IAAI,EAAEiB,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAKpB,UAAUuB,QAAQrB,KAAAA,GAAQ;IAC/BG,KAAKmB,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMrB,MAAMU,oBAAoBa,SAAS;KACrCX,MAAMpB,eAAeqB;KACrBV,MAAMf,iBAAiB;OAClBD,kBAAkBqC,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAlB,KAAKmB,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHjB;GACAgB,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAOtB,IAAYJ,OAAuC;EAC5D,MAAMqB,SAAS,MAAM,KAAKzB,WAAW+B,YAAYvB,EAAAA;EACjD,IAAI,CAACiB,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAAC,KAAKS,UAAUuB,QAAQrB,KAAAA,GAAQ;GAChC,MAAMA,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqB,aAAa,CAAA;GAChF,MAAMb,MAAMU,oBAAoBa,SAAS;IACrCX,MAAMpB,eAAeqB;IACrBV,MAAMf,iBAAiB;MAClBD,kBAAkBqC,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMO,OAAOxB,IAAYJ,OAAuC;EAC5D,MAAMqB,SAAS,MAAM,KAAKzB,WAAW+B,YAAYvB,EAAAA;EACjD,IAAI,CAACiB,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAAC,KAAKS,UAAUuB,QAAQrB,KAAAA,GAAQ;GAChC,MAAMA,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqC,eAAe,CAAA;GAClF,MAAM7B,MAAMU,oBAAoBa,SAAS;IACrCX,MAAMpB,eAAeqC;IACrB1B,MAAMf,iBAAiB;MAClBD,kBAAkBqC,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAEjB,IAAI0B,aAAaT;EACzB,MAAM,KAAKzB,WAAWmC,OAAOV,MAAAA;EAC7BA,OAAOjB,KAAK0B;EAEZ,OAAOT;CACX;CAEA,MAAMW,WACFhC,OACAiC,UAAoC,CAAC,GACL;EAChC,IAAI,CAACjC,MAAMC,UACP,MAAM,IAAIX,kBAAAA;EAGd,IAAI,KAAK4C,gBAAgBD,QAAQzB,KAAK,GAClC,OAAO,KAAK2B,kBAAkBnC,OAAOiC,QAAQzB,KAAK;EAGtD,OAAO,KAAK4B,kBAAkBpC,OAAOiC,QAAQI,gBAAgB;CACjE;;;;;;IAQA,gBAA0B7B,OAAsC;EAC5D,MAAM8B,SAAS9B,OAAO8B;EACtB,IAAI,CAAC/C,SAAS+C,MAAAA,GACV,OAAO;EAGX,OAAO5C,oBAAoB6C,MAAMC,QAAAA;GAC7B,MAAMC,QAAQH,OAAOE;GACrB,OAAO,OAAOC,UAAU,eAAeA,UAAU;EACrD,CAAA;CACJ;CAEA,MAAgBL,kBACZpC,OACAqC,kBACgC;EAChC,MAAMK,WAAW,MAAM,KAAK9C,WAAW+C,eAAe;GAClDzC,KAAKF,MAAMC,SAAUE,KAAKC;GAC1Ba,SAASjB,MAAMC,SAAUK;EAC7B,CAAA;EAEA,IAAIsC,QAAQ;EACZ,KAAK,MAAM7C,WAAW2C,UAAU;GAC5B,IAAIL,oBAAoBtC,QAAQK,OAAOiC,kBACnC;GAEJ,MAAM,KAAKzC,WAAWmC,OAAOhC,OAAAA;GAC7B6C,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;CAEA,MAAgBT,kBACZnC,OACAQ,OACgC;EAEhC,MAAMR,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqC,eAAe,CAAA;EAElF,MAAMa,WAAW,MAAM,KAAK9C,WAAWiD,eAAerC,KAAAA;EAEtD,IAAIoC,QAAQ;EACZ,KAAK,MAAM7C,WAAW2C,UAAU;GAK5B,IAAI,CAAC,KAAK5C,UAAUC,SAASC,KAAAA,GACzB,IAAI;IACA,MAAMA,MAAMU,oBAAoBa,SAAS;KACrCX,MAAMpB,eAAeqC;KACrB1B,MAAMf,iBAAiB;OAClBD,kBAAkBqC,aAAazB;MAChC,GAAG,KAAK0B,mBAAmB1B,OAAAA;KAC/B,CAAA;IACJ,CAAA;GACJ,QAAQ;IACJ;GACJ;GAGJ,MAAM,KAAKH,WAAWmC,OAAOhC,OAAAA;GAC7B6C,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","AuthupError","EntityNotFoundError","ErrorCode","isObject","PermissionName","AbstractEntityService","SESSION_FILTER_KEYS","SessionService","repository","ctx","isOwnedBy","session","actor","identity","sub","data","id","sub_kind","type","getMany","query","canReadAll","permissionEvaluator","preEvaluate","name","SESSION_READ","e","findMany","owner","subKind","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","delete","SESSION_DELETE","entityId","remove","deleteMany","options","code","IDENTITY_UNAUTHORIZED","message","hasTargetFilter","deleteManyByQuery","deleteManyForSelf","currentSessionId","filter","some","key","value","sessions","findAllByOwner","count","findAllByQuery"],"sources":["../../../../src/core/entities/session/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { AuthupError, EntityNotFoundError, ErrorCode } from '@authup/errors';\nimport { isObject } from '@authup/kit';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Session } from '@authup/core-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { ISessionRepository } from '../../authentication/index.ts';\nimport { SESSION_FILTER_KEYS } from '../../authentication/index.ts';\nimport type { ISessionService, SessionDeleteManyOptions, SessionDeleteManyResult } from './types.ts';\n\nexport type SessionServiceContext = {\n    repository: ISessionRepository,\n};\n\nexport class SessionService extends AbstractEntityService implements ISessionService {\n    protected repository: ISessionRepository;\n\n    constructor(ctx: SessionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n    }\n\n    protected isOwnedBy(session: Session, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            session.sub === actor.identity.data.id &&\n            session.sub_kind === actor.identity.type;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own sessions\n            return this.repository.findMany(query, {\n                owner: {\n                    sub: actor.identity!.data.id,\n                    subKind: actor.identity!.type,\n                },\n            });\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(query);\n\n        const data: Session[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.SESSION_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext): Promise<Session> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SESSION_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n\n    async delete(id: string, actor: ActorContext): Promise<Session> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SESSION_DELETE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    async deleteMany(\n        actor: ActorContext,\n        options: SessionDeleteManyOptions = {},\n    ): Promise<SessionDeleteManyResult> {\n        if (!actor.identity) {\n            throw new AuthupError({ code: ErrorCode.IDENTITY_UNAUTHORIZED, message: 'Authentication required.' });\n        }\n\n        if (this.hasTargetFilter(options.query)) {\n            return this.deleteManyByQuery(actor, options.query!);\n        }\n\n        return this.deleteManyForSelf(actor, options.currentSessionId);\n    }\n\n    /**\n     * True when the query carries at least one recognized target filter — the\n     * discriminator between the admin bulk-revoke path and self-service. An\n     * unrecognized / empty filter falls through to self-service (fail-safe: a\n     * typo can never trigger an unconstrained mass delete).\n     */\n    protected hasTargetFilter(query?: Record<string, any>): boolean {\n        const filter = query?.filter;\n        if (!isObject(filter)) {\n            return false;\n        }\n\n        return SESSION_FILTER_KEYS.some((key) => {\n            const value = filter[key];\n            return typeof value !== 'undefined' && value !== '';\n        });\n    }\n\n    protected async deleteManyForSelf(\n        actor: ActorContext,\n        currentSessionId?: string,\n    ): Promise<SessionDeleteManyResult> {\n        const sessions = await this.repository.findAllByOwner({\n            sub: actor.identity!.data.id,\n            subKind: actor.identity!.type,\n        });\n\n        let count = 0;\n        for (const session of sessions) {\n            if (currentSessionId && session.id === currentSessionId) {\n                continue;\n            }\n            await this.repository.remove(session);\n            count += 1;\n        }\n\n        return { count };\n    }\n\n    protected async deleteManyByQuery(\n        actor: ActorContext,\n        query: Record<string, any>,\n    ): Promise<SessionDeleteManyResult> {\n        // Gate: an actor without SESSION_DELETE cannot force-logout anyone → 403.\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n\n        const sessions = await this.repository.findAllByQuery(query);\n\n        let count = 0;\n        for (const session of sessions) {\n            // Own sessions are always deletable by the actor (mirrors getMany).\n            // Otherwise per-session realm-match: a realm_admin only reaches\n            // sessions in its realm — cross-realm rows are skipped, not failed,\n            // so filter breadth cannot escalate beyond the actor's reach.\n            if (!this.isOwnedBy(session, actor)) {\n                try {\n                    await actor.permissionEvaluator.evaluate({\n                        name: PermissionName.SESSION_DELETE,\n                        data: definePolicyData({\n                            [BuiltInPolicyType.ATTRIBUTES]: session,\n                            ...this.resourceRealmMatch(session),\n                        }),\n                    });\n                } catch {\n                    continue;\n                }\n            }\n\n            await this.repository.remove(session);\n            count += 1;\n        }\n\n        return { count };\n    }\n}\n"],"mappings":";;;;;;;;;;;AAsBA,IAAaS,iBAAb,cAAoCF,sBAAAA;CACtBG;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,aAAaL,MAAMC,SAASK;CAC5C;CAEA,MAAMC,QACFC,OACAR,OACgD;EAChD,IAAIS,aAAa;EACjB,IAAI;GACA,MAAMT,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqB,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAACd,MAAMC,UACP,MAAMa;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKb,WAAWmB,SAASP,OAAO,EACnCQ,OAAO;GACHd,KAAKF,MAAMC,SAAUE,KAAKC;GAC1Ba,SAASjB,MAAMC,SAAUK;EAC7B,EACJ,CAAA;EAGJ,MAAM,EAAEH,MAAMe,UAAUC,SAAS,MAAM,KAAKvB,WAAWmB,SAASP,KAAAA;EAEhE,MAAML,OAAkB,CAAA;EACxB,IAAI,EAAEiB,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAKpB,UAAUuB,QAAQrB,KAAAA,GAAQ;IAC/BG,KAAKmB,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMrB,MAAMU,oBAAoBa,SAAS;KACrCX,MAAMpB,eAAeqB;KACrBV,MAAMhB,iBAAiB;OAClBD,kBAAkBsC,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAlB,KAAKmB,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHjB;GACAgB,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAOtB,IAAYJ,OAAuC;EAC5D,MAAMqB,SAAS,MAAM,KAAKzB,WAAW+B,YAAYvB,EAAAA;EACjD,IAAI,CAACiB,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAAC,KAAKS,UAAUuB,QAAQrB,KAAAA,GAAQ;GAChC,MAAMA,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqB,aAAa,CAAA;GAChF,MAAMb,MAAMU,oBAAoBa,SAAS;IACrCX,MAAMpB,eAAeqB;IACrBV,MAAMhB,iBAAiB;MAClBD,kBAAkBsC,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMO,OAAOxB,IAAYJ,OAAuC;EAC5D,MAAMqB,SAAS,MAAM,KAAKzB,WAAW+B,YAAYvB,EAAAA;EACjD,IAAI,CAACiB,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAAC,KAAKS,UAAUuB,QAAQrB,KAAAA,GAAQ;GAChC,MAAMA,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqC,eAAe,CAAA;GAClF,MAAM7B,MAAMU,oBAAoBa,SAAS;IACrCX,MAAMpB,eAAeqC;IACrB1B,MAAMhB,iBAAiB;MAClBD,kBAAkBsC,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAEjB,IAAI0B,aAAaT;EACzB,MAAM,KAAKzB,WAAWmC,OAAOV,MAAAA;EAC7BA,OAAOjB,KAAK0B;EAEZ,OAAOT;CACX;CAEA,MAAMW,WACFhC,OACAiC,UAAoC,CAAC,GACL;EAChC,IAAI,CAACjC,MAAMC,UACP,MAAM,IAAIb,YAAY;GAAE8C,MAAM5C,UAAU6C;GAAuBC,SAAS;EAA2B,CAAA;EAGvG,IAAI,KAAKC,gBAAgBJ,QAAQzB,KAAK,GAClC,OAAO,KAAK8B,kBAAkBtC,OAAOiC,QAAQzB,KAAK;EAGtD,OAAO,KAAK+B,kBAAkBvC,OAAOiC,QAAQO,gBAAgB;CACjE;;;;;;IAQA,gBAA0BhC,OAAsC;EAC5D,MAAMiC,SAASjC,OAAOiC;EACtB,IAAI,CAAClD,SAASkD,MAAAA,GACV,OAAO;EAGX,OAAO/C,oBAAoBgD,MAAMC,QAAAA;GAC7B,MAAMC,QAAQH,OAAOE;GACrB,OAAO,OAAOC,UAAU,eAAeA,UAAU;EACrD,CAAA;CACJ;CAEA,MAAgBL,kBACZvC,OACAwC,kBACgC;EAChC,MAAMK,WAAW,MAAM,KAAKjD,WAAWkD,eAAe;GAClD5C,KAAKF,MAAMC,SAAUE,KAAKC;GAC1Ba,SAASjB,MAAMC,SAAUK;EAC7B,CAAA;EAEA,IAAIyC,QAAQ;EACZ,KAAK,MAAMhD,WAAW8C,UAAU;GAC5B,IAAIL,oBAAoBzC,QAAQK,OAAOoC,kBACnC;GAEJ,MAAM,KAAK5C,WAAWmC,OAAOhC,OAAAA;GAC7BgD,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;CAEA,MAAgBT,kBACZtC,OACAQ,OACgC;EAEhC,MAAMR,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqC,eAAe,CAAA;EAElF,MAAMgB,WAAW,MAAM,KAAKjD,WAAWoD,eAAexC,KAAAA;EAEtD,IAAIuC,QAAQ;EACZ,KAAK,MAAMhD,WAAW8C,UAAU;GAK5B,IAAI,CAAC,KAAK/C,UAAUC,SAASC,KAAAA,GACzB,IAAI;IACA,MAAMA,MAAMU,oBAAoBa,SAAS;KACrCX,MAAMpB,eAAeqC;KACrB1B,MAAMhB,iBAAiB;OAClBD,kBAAkBsC,aAAazB;MAChC,GAAG,KAAK0B,mBAAmB1B,OAAAA;KAC/B,CAAA;IACJ,CAAA;GACJ,QAAQ;IACJ;GACJ;GAGJ,MAAM,KAAKH,WAAWmC,OAAOhC,OAAAA;GAC7BgD,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;AACJ"}

package/dist/core/entities/trust-anchor/index.d.ts

@@ -0,0 +1,3 @@
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/trust-anchor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/entities/trust-anchor/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { TrustAnchorService } from "./service.mjs";
+export { TrustAnchorService };

package/dist/core/entities/trust-anchor/service.d.ts

@@ -0,0 +1,33 @@
+import type { TrustAnchor } from '@authup/core-kit';
+import { EventName, TrustAnchorValidator } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { EventRequestContext, IEventService } from '../event/index.ts';
+import type { ITrustAnchorRepository, ITrustAnchorService } from './types.ts';
+export type TrustAnchorServiceContext = {
+    repository: ITrustAnchorRepository;
+    eventService?: IEventService;
+    requestContext?: () => EventRequestContext | undefined;
+};
+export declare class TrustAnchorService extends AbstractEntityService implements ITrustAnchorService {
+    protected repository: ITrustAnchorRepository;
+    protected validator: TrustAnchorValidator;
+    protected eventService?: IEventService;
+    protected requestContext?: () => EventRequestContext | undefined;
+    constructor(ctx: TrustAnchorServiceContext);
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<TrustAnchor>>;
+    getOne(idOrName: string, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<TrustAnchor>;
+    update(idOrName: string, data: Record<string, any>, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;
+    delete(id: string, actor: ActorContext): Promise<TrustAnchor>;
+    /**
+     * Metadata-only audit trail for trust-anchor lifecycle operations
+     * (issue #3269) — trust anchors have no entity subscriber, so the
+     * security-relevant mutations (an enabled CA anchor turns on mTLS client
+     * auth for a realm) are recorded explicitly. The payload never carries
+     * certificate bytes.
+     */
+    protected recordEvent(name: `${EventName}`, entity: TrustAnchor, actor: ActorContext, data?: Record<string, any>): Promise<void>;
+    protected pickAuditFields(entity: TrustAnchor): Record<string, any>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/trust-anchor/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/service.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAEH,SAAS,EAGT,oBAAoB,EACvB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,MAAM,yBAAyB,GAAG;IACpC,UAAU,EAAE,sBAAsB,CAAC;IACnC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;CAC1D,CAAC;AAQF,qBAAa,kBAAmB,SAAQ,qBAAsB,YAAW,mBAAmB;IACxF,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;IAE1C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;gBAErD,GAAG,EAAE,yBAAyB;IAQpC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAgCjD,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAmBjB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IA6CjB,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAuCjB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IA2BvB;;;;;;OAMG;cACa,WAAW,CACvB,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,YAAY,EACnB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IA0BhB,SAAS,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;CAMtE"}