npm - @authup/server-core - Versions diffs - 1.0.0-beta.52 → 1.0.0-beta.53 - Mend

@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (742) hide show

package/dist/core/entities/trust-anchor/service.mjs ADDED Viewed

@@ -0,0 +1,175 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildEntityDiff } from "../event/diff.mjs";
+import "../event/index.mjs";
+import { parseCertificateChain } from "../../key/certificate.mjs";
+import "../../key/index.mjs";
+import { ValidatorGroup } from "@authup/kit";
+import { EntityType, EventName, EventScope, PermissionName, TrustAnchorValidator } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
+//#region src/core/entities/trust-anchor/service.ts
+const PERMISSION_NAMES = [
+	PermissionName.KEY_READ,
+	PermissionName.KEY_UPDATE,
+	PermissionName.KEY_DELETE
+];
+var TrustAnchorService = class extends AbstractEntityService {
+	repository;
+	validator;
+	eventService;
+	requestContext;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.validator = new TrustAnchorValidator();
+		this.eventService = ctx.eventService;
+		this.requestContext = ctx.requestContext;
+	}
+	async getMany(query, actor) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });
+		const { data: entities, meta } = await this.repository.findMany(query);
+		const data = [];
+		let { total } = meta;
+		for (const entity of entities) try {
+			await actor.permissionEvaluator.evaluateOneOf({
+				name: PERMISSION_NAMES,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+			data.push(entity);
+		} catch {
+			total -= 1;
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(idOrName, actor, realmId) {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });
+		const entity = await this.repository.findOneByIdOrName(idOrName, realmId);
+		if (!entity) throw new EntityNotFoundError();
+		await actor.permissionEvaluator.evaluateOneOf({
+			name: PERMISSION_NAMES,
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
+		});
+		return entity;
+	}
+	async create(data, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });
+		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
+		if (!validated.realm_id && actor.identity) {
+			const actorRealmId = this.getActorRealmId(actor);
+			if (actorRealmId) validated.realm_id = actorRealmId;
+		}
+		if (!validated.realm_id) throw new ValidationError("A realm must be specified.");
+		await this.repository.validateJoinColumns(validated);
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.KEY_CREATE,
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: validated,
+				...this.resourceRealmMatch(validated)
+			})
+		});
+		await this.repository.checkUniqueness(validated);
+		const chain = parseCertificateChain(validated.certificate);
+		if (!chain[0] || !chain[0].ca) throw new ValidationError("A trust anchor must contain a CA certificate.");
+		if (typeof validated.enabled !== "boolean") validated.enabled = true;
+		let entity = this.repository.create(validated);
+		entity = await this.repository.save(entity);
+		await this.recordEvent(EventName.CREATED, entity, actor);
+		return entity;
+	}
+	async update(idOrName, data, actor, realmId) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });
+		let entity = await this.repository.findOneByIdOrName(idOrName, realmId);
+		if (!entity) throw new EntityNotFoundError();
+		const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.KEY_UPDATE,
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: {
+					...entity,
+					...validated
+				},
+				...this.resourceRealmMatch(entity)
+			})
+		});
+		if (validated.name && validated.name !== entity.name) await this.repository.checkUniqueness({
+			name: validated.name,
+			realm_id: entity.realm_id
+		}, entity);
+		const previous = this.pickAuditFields(entity);
+		entity = this.repository.merge(entity, validated);
+		entity = await this.repository.save(entity);
+		const diff = buildEntityDiff(this.pickAuditFields(entity), previous);
+		await this.recordEvent(EventName.UPDATED, entity, actor, { ...Object.keys(diff).length > 0 ? { diff } : {} });
+		return entity;
+	}
+	async delete(id, actor) {
+		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });
+		const entity = await this.repository.findOneBy({ id });
+		if (!entity) throw new EntityNotFoundError();
+		await actor.permissionEvaluator.evaluate({
+			name: PermissionName.KEY_DELETE,
+			data: definePolicyData({
+				[BuiltInPolicyType.ATTRIBUTES]: entity,
+				...this.resourceRealmMatch(entity)
+			})
+		});
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		await this.recordEvent(EventName.DELETED, entity, actor);
+		return entity;
+	}
+	/**
+	* Metadata-only audit trail for trust-anchor lifecycle operations
+	* (issue #3269) — trust anchors have no entity subscriber, so the
+	* security-relevant mutations (an enabled CA anchor turns on mTLS client
+	* auth for a realm) are recorded explicitly. The payload never carries
+	* certificate bytes.
+	*/ async recordEvent(name, entity, actor, data = {}) {
+		const requestContext = this.requestContext ? this.requestContext() : void 0;
+		await this.eventService?.record({
+			scope: EventScope.ENTITY,
+			name,
+			refType: EntityType.TRUST_ANCHOR,
+			refId: entity.id,
+			realmId: entity.realm_id ?? null,
+			actorType: actor.identity?.type ?? null,
+			actorId: actor.identity?.data.id ?? null,
+			actorName: actor.identity?.data.name ?? null,
+			requestPath: requestContext?.requestPath ?? null,
+			requestMethod: requestContext?.requestMethod ?? null,
+			requestIpAddress: requestContext?.requestIpAddress ?? null,
+			requestUserAgent: requestContext?.requestUserAgent ?? null,
+			data: {
+				name: entity.name,
+				enabled: entity.enabled,
+				...data
+			}
+		});
+	}
+	pickAuditFields(entity) {
+		return {
+			name: entity.name,
+			enabled: entity.enabled
+		};
+	}
+};
+//#endregion
+export { TrustAnchorService };
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/trust-anchor/service.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityType","EventName","EventScope","PermissionName","TrustAnchorValidator","EntityNotFoundError","ValidationError","ValidatorGroup","AbstractEntityService","buildEntityDiff","parseCertificateChain","PERMISSION_NAMES","KEY_READ","KEY_UPDATE","KEY_DELETE","TrustAnchorService","repository","validator","eventService","requestContext","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","data","entities","meta","findMany","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","realmId","findOneByIdOrName","create","preEvaluate","KEY_CREATE","validated","run","group","CREATE","realm_id","identity","actorRealmId","getActorRealmId","validateJoinColumns","evaluate","checkUniqueness","chain","certificate","ca","enabled","save","recordEvent","CREATED","update","UPDATE","previous","pickAuditFields","merge","diff","UPDATED","Object","keys","length","delete","id","findOneBy","entityId","remove","DELETED","undefined","record","scope","ENTITY","refType","TRUST_ANCHOR","refId","actorType","type","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent"],"sources":["../../../../src/core/entities/trust-anchor/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport {\n EntityType,\n EventName,\n EventScope,\n PermissionName,\n TrustAnchorValidator,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { buildEntityDiff } from '../event/index.ts';\nimport type { EventRequestContext, IEventService } from '../event/index.ts';\nimport { parseCertificateChain } from '../../key/index.ts';\nimport type { ITrustAnchorRepository, ITrustAnchorService } from './types.ts';\n\nexport type TrustAnchorServiceContext = {\n repository: ITrustAnchorRepository,\n eventService?: IEventService,\n requestContext?: () => EventRequestContext | undefined,\n};\n\nconst PERMISSION_NAMES = [\n PermissionName.KEY_READ,\n PermissionName.KEY_UPDATE,\n PermissionName.KEY_DELETE,\n];\n\nexport class TrustAnchorService extends AbstractEntityService implements ITrustAnchorService {\n protected repository: ITrustAnchorRepository;\n\n protected validator: TrustAnchorValidator;\n\n protected eventService?: IEventService;\n\n protected requestContext?: () => EventRequestContext | undefined;\n\n constructor(ctx: TrustAnchorServiceContext) {\n super();\n this.repository = ctx.repository;\n this.validator = new TrustAnchorValidator();\n this.eventService = ctx.eventService;\n this.requestContext = ctx.requestContext;\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<TrustAnchor>> {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n const { data: entities, meta } = await this.repository.findMany(query);\n\n const data: TrustAnchor[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: PERMISSION_NAMES,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total,\n },\n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n realmId?: string,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n const entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluateOneOf({\n name: PERMISSION_NAMES,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n if (!validated.realm_id && actor.identity) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n if (!validated.realm_id) {\n throw new ValidationError('A realm must be specified.');\n }\n\n await this.repository.validateJoinColumns(validated);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.KEY_CREATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: validated,\n ...this.resourceRealmMatch(validated),\n }),\n });\n\n await this.repository.checkUniqueness(validated);\n\n const chain = parseCertificateChain(validated.certificate as string);\n if (!chain[0] || !chain[0].ca) {\n throw new ValidationError('A trust anchor must contain a CA certificate.');\n }\n\n if (typeof validated.enabled !== 'boolean') {\n validated.enabled = true;\n }\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n await this.recordEvent(EventName.CREATED, entity, actor);\n\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realmId?: string,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });\n\n let entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.KEY_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n if (validated.name && validated.name !== entity.name) {\n await this.repository.checkUniqueness({\n name: validated.name,\n realm_id: entity.realm_id,\n }, entity);\n }\n\n const previous = this.pickAuditFields(entity);\n\n entity = this.repository.merge(entity, validated);\n entity = await this.repository.save(entity);\n\n const diff = buildEntityDiff(this.pickAuditFields(entity), previous);\n await this.recordEvent(EventName.UPDATED, entity, actor, { ...(Object.keys(diff).length > 0 ? { diff } : {}) });\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.KEY_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n await this.recordEvent(EventName.DELETED, entity, actor);\n\n return entity;\n }\n\n // ------------------------------------------------------------------\n\n /**\n * Metadata-only audit trail for trust-anchor lifecycle operations\n * (issue #3269) — trust anchors have no entity subscriber, so the\n * security-relevant mutations (an enabled CA anchor turns on mTLS client\n * auth for a realm) are recorded explicitly. The payload never carries\n * certificate bytes.\n */\n protected async recordEvent(\n name: `${EventName}`,\n entity: TrustAnchor,\n actor: ActorContext,\n data: Record<string, any> = {},\n ): Promise<void> {\n const requestContext = this.requestContext ?\n this.requestContext() :\n undefined;\n\n await this.eventService?.record({\n scope: EventScope.ENTITY,\n name,\n refType: EntityType.TRUST_ANCHOR,\n refId: entity.id,\n realmId: entity.realm_id ?? null,\n actorType: actor.identity?.type ?? null,\n actorId: actor.identity?.data.id ?? null,\n actorName: actor.identity?.data.name ?? null,\n requestPath: requestContext?.requestPath ?? null,\n requestMethod: requestContext?.requestMethod ?? null,\n requestIpAddress: requestContext?.requestIpAddress ?? null,\n requestUserAgent: requestContext?.requestUserAgent ?? null,\n data: {\n name: entity.name,\n enabled: entity.enabled,\n ...data,\n },\n });\n }\n\n protected pickAuditFields(entity: TrustAnchor): Record<string, any> {\n return {\n name: entity.name,\n enabled: entity.enabled,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;AA+BA,MAAMa,mBAAmB;CACrBR,eAAeS;CACfT,eAAeU;CACfV,eAAeW;;AAGnB,IAAaC,qBAAb,cAAwCP,sBAAAA;CAC1BQ;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,YAAY,IAAIb,qBAAAA;EACrB,KAAKc,eAAeE,IAAIF;EACxB,KAAKC,iBAAiBC,IAAID;CAC9B;CAEA,MAAME,QACFC,OACAC,OACoD;EACpD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMf,iBAAiB,CAAA;EAE1E,MAAM,EAAEgB,MAAMC,UAAUC,SAAS,MAAM,KAAKb,WAAWc,SAASR,KAAAA;EAEhE,MAAMK,OAAsB,CAAA;EAC5B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UACjB,IAAI;GACA,MAAML,MAAMC,oBAAoBS,cAAc;IAC1CP,MAAMf;IACNgB,MAAM5B,iBAAiB;MAClBD,kBAAkBoC,aAAaF;KAChC,GAAG,KAAKG,mBAAmBH,MAAAA;IAC/B,CAAA;GACJ,CAAA;GACAL,KAAKS,KAAKJ,MAAAA;EACd,QAAQ;GACJD,SAAS;EACb;EAGJ,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,UACAf,OACAgB,SACoB;EACpB,MAAMhB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMf,iBAAiB,CAAA;EAE1E,MAAMqB,SAAS,MAAM,KAAKhB,WAAWwB,kBAAkBF,UAAUC,OAAAA;EACjE,IAAI,CAACP,QACD,MAAM,IAAI3B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBS,cAAc;GAC1CP,MAAMf;GACNgB,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMS,OACFd,MACAJ,OACoB;EACpB,MAAMA,MAAMC,oBAAoBkB,YAAY,EAAEhB,MAAMvB,eAAewC,WAAW,CAAA;EAE9E,MAAMC,YAAY,MAAM,KAAK3B,UAAU4B,IAAIlB,MAAM,EAAEmB,OAAOvC,eAAewC,OAAO,CAAA;EAEhF,IAAI,CAACH,UAAUI,YAAYzB,MAAM0B,UAAU;GACvC,MAAMC,eAAe,KAAKC,gBAAgB5B,KAAAA;GAC1C,IAAI2B,cACAN,UAAUI,WAAWE;EAE7B;EAEA,IAAI,CAACN,UAAUI,UACX,MAAM,IAAI1C,gBAAgB,4BAAA;EAG9B,MAAM,KAAKU,WAAWoC,oBAAoBR,SAAAA;EAE1C,MAAMrB,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMvB,eAAewC;GACrBhB,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAaU;IAChC,GAAG,KAAKT,mBAAmBS,SAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAK5B,WAAWsC,gBAAgBV,SAAAA;EAEtC,MAAMW,QAAQ7C,sBAAsBkC,UAAUY,WAAW;EACzD,IAAI,CAACD,MAAM,MAAM,CAACA,MAAM,EAAE,CAACE,IACvB,MAAM,IAAInD,gBAAgB,+CAAA;EAG9B,IAAI,OAAOsC,UAAUc,YAAY,WAC7Bd,UAAUc,UAAU;EAGxB,IAAI1B,SAAS,KAAKhB,WAAWyB,OAAOG,SAAAA;EACpCZ,SAAS,MAAM,KAAKhB,WAAW2C,KAAK3B,MAAAA;EAEpC,MAAM,KAAK4B,YAAY3D,UAAU4D,SAAS7B,QAAQT,KAAAA;EAElD,OAAOS;CACX;CAEA,MAAM8B,OACFxB,UACAX,MACAJ,OACAgB,SACoB;EACpB,MAAMhB,MAAMC,oBAAoBkB,YAAY,EAAEhB,MAAMvB,eAAeU,WAAW,CAAA;EAE9E,IAAImB,SAAS,MAAM,KAAKhB,WAAWwB,kBAAkBF,UAAUC,OAAAA;EAC/D,IAAI,CAACP,QACD,MAAM,IAAI3B,oBAAAA;EAGd,MAAMuC,YAAY,MAAM,KAAK3B,UAAU4B,IAAIlB,MAAM,EAAEmB,OAAOvC,eAAewD,OAAO,CAAA;EAEhF,MAAMxC,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMvB,eAAeU;GACrBc,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAa;KAC5B,GAAGF;KACH,GAAGY;IACP;IACA,GAAG,KAAKT,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIY,UAAUlB,QAAQkB,UAAUlB,SAASM,OAAON,MAC5C,MAAM,KAAKV,WAAWsC,gBAAgB;GAClC5B,MAAMkB,UAAUlB;GAChBsB,UAAUhB,OAAOgB;EACrB,GAAGhB,MAAAA;EAGP,MAAMgC,WAAW,KAAKC,gBAAgBjC,MAAAA;EAEtCA,SAAS,KAAKhB,WAAWkD,MAAMlC,QAAQY,SAAAA;EACvCZ,SAAS,MAAM,KAAKhB,WAAW2C,KAAK3B,MAAAA;EAEpC,MAAMmC,OAAO1D,gBAAgB,KAAKwD,gBAAgBjC,MAAAA,GAASgC,QAAAA;EAC3D,MAAM,KAAKJ,YAAY3D,UAAUmE,SAASpC,QAAQT,OAAO,EAAE,GAAI8C,OAAOC,KAAKH,IAAAA,CAAAA,CAAMI,SAAS,IAAI,EAAEJ,KAAK,IAAI,CAAC,EAAG,CAAA;EAE7G,OAAOnC;CACX;CAEA,MAAMwC,OACFC,IACAlD,OACoB;EACpB,MAAMA,MAAMC,oBAAoBkB,YAAY,EAAEhB,MAAMvB,eAAeW,WAAW,CAAA;EAE9E,MAAMkB,SAAS,MAAM,KAAKhB,WAAW0D,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACzC,QACD,MAAM,IAAI3B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMvB,eAAeW;GACrBa,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,EAAEyC,IAAIE,aAAa3C;EACzB,MAAM,KAAKhB,WAAW4D,OAAO5C,MAAAA;EAC7BA,OAAOyC,KAAKE;EAEZ,MAAM,KAAKf,YAAY3D,UAAU4E,SAAS7C,QAAQT,KAAAA;EAElD,OAAOS;CACX;;;;;;;IAWA,MAAgB4B,YACZlC,MACAM,QACAT,OACAI,OAA4B,CAAC,GAChB;EACb,MAAMR,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnB2D,KAAAA;EAEJ,MAAM,KAAK5D,cAAc6D,OAAO;GAC5BC,OAAO9E,WAAW+E;GAClBvD;GACAwD,SAASlF,WAAWmF;GACpBC,OAAOpD,OAAOyC;GACdlC,SAASP,OAAOgB,YAAY;GAC5BqC,WAAW9D,MAAM0B,UAAUqC,QAAQ;GACnCC,SAAShE,MAAM0B,UAAUtB,KAAK8C,MAAM;GACpCe,WAAWjE,MAAM0B,UAAUtB,KAAKD,QAAQ;GACxC+D,aAAatE,gBAAgBsE,eAAe;GAC5CC,eAAevE,gBAAgBuE,iBAAiB;GAChDC,kBAAkBxE,gBAAgBwE,oBAAoB;GACtDC,kBAAkBzE,gBAAgByE,oBAAoB;GACtDjE,MAAM;IACFD,MAAMM,OAAON;IACbgC,SAAS1B,OAAO0B;IAChB,GAAG/B;GACP;EACJ,CAAA;CACJ;CAEUsC,gBAAgBjC,QAA0C;EAChE,OAAO;GACHN,MAAMM,OAAON;GACbgC,SAAS1B,OAAO0B;EACpB;CACJ;AACJ"}

package/dist/core/entities/trust-anchor/types.d.ts ADDED Viewed

@@ -0,0 +1,14 @@
+import type { TrustAnchor } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
+export interface ITrustAnchorRepository extends IEntityRepository<TrustAnchor> {
+    checkUniqueness(data: Partial<TrustAnchor>, existing?: TrustAnchor): Promise<void>;
+    findOneByIdOrName(idOrName: string, realm?: string): Promise<TrustAnchor | null>;
+}
+export interface ITrustAnchorService {
+    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<TrustAnchor>>;
+    getOne(idOrName: string, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<TrustAnchor>;
+    update(idOrName: string, data: Record<string, any>, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;
+    delete(id: string, actor: ActorContext): Promise<TrustAnchor>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/trust-anchor/types.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE1G,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB,CAAC,WAAW,CAAC;IAC1E,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnF,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,mBAAmB;IAChC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/G,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjE"}

package/dist/core/entities/trust-anchor/types.mjs ADDED Viewed

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/entities/user/service.mjs CHANGED Viewed

@@ -6,7 +6,7 @@ import { ValidatorGroup, isUUID } from "@authup/kit";
 import { PermissionName, UserValidator } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
 //#region src/core/entities/user/service.ts
 var UserService = class extends AbstractEntityService {
 	repository;
@@ -170,7 +170,7 @@ var UserService = class extends AbstractEntityService {
 	}
 	async delete(id, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });
-		if (actor.identity && actor.identity.type === "user" && actor.identity.data.id === id) throw new BadRequestError("The own user can not be deleted.");
+		if (actor.identity && actor.identity.type === "user" && actor.identity.data.id === id) throw new ValidationError("The own user can not be deleted.");
 		const entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
 		await actor.permissionEvaluator.evaluate({

package/dist/core/entities/user/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","BadRequestError","EntityNotFoundError","PermissionName","UserValidator","AbstractEntityService","UserCredentialsService","UserService","repository","realmRepository","validator","ctx","passwordMinLength","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_READ","USER_UPDATE","USER_DELETE","data","entities","meta","findMany","total","entity","identity","type","id","push","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","getOne","idOrName","realmId","permissionNames","isMe","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneBy","isSelfEdit","preEvaluate","e","USER_SELF_MANAGE","UPDATE","USER_CREATE","CREATE","validated","run","validateJoinColumns","credentialsService","originalName","originalNameLocked","name_locked","evaluate","merge","REALM_MATCH","password","protect","created","actorRealmId","getActorRealmId","delete","entityId","remove"],"sources":["../../../../src/core/entities/user/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n PermissionName,\n UserValidator,\n} from '@authup/core-kit';\nimport type { User } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type { IUserRepository, IUserService } from './types.ts';\n\nexport type UserServiceContext = {\n repository: IUserRepository;\n realmRepository: IRealmRepository;\n passwordMinLength?: number;\n};\n\nexport class UserService extends AbstractEntityService implements IUserService {\n protected repository: IUserRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: UserValidator;\n\n constructor(ctx: UserServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new UserValidator({ passwordMinLength: ctx.passwordMinLength });\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<User>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_READ,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ],\n });\n\n const {\n data: entities, \n meta, \n } = await this.repository.findMany(query);\n\n const data: User[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n if (\n actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === entity.id\n ) {\n data.push(entity);\n continue;\n }\n\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.USER_READ,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ],\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n data.push(entity);\n } catch {\n total -= 1;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<User> {\n const permissionNames = [\n PermissionName.USER_READ,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ];\n\n let isMe = !!actor.identity &&\n actor.identity.type === 'user' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n const entity = await this.repository.findOne(idOrName, query, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n if (!isMe) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: permissionNames,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<User> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<User> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: User,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realm_id === 'string' ?\n await this.realmRepository.resolve(data.realm_id) :\n undefined;\n\n let entity: User \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realm_id = realm.id;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'user' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n }\n\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_CREATE });\n\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n await this.repository.validateJoinColumns(validated);\n\n const credentialsService = new UserCredentialsService();\n\n if (entity) {\n const originalName = entity.name;\n const originalNameLocked = entity.name_locked;\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (\n validated.name &&\n validated.name !== originalName\n ) {\n if (validated.name_locked) {\n entity.name_locked = validated.name_locked;\n }\n\n if (originalNameLocked && validated.name_locked !== false) {\n entity.name = originalName;\n }\n }\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n [BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null,\n }),\n });\n }\n\n if (validated.password) {\n entity.password = await credentialsService.protect(validated.password);\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realm_id) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n entity = this.repository.create(validated);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n if (validated.password) {\n entity.password = await credentialsService.protect(validated.password);\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<User> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });\n\n if (\n actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === id\n ) {\n throw new BadRequestError('The own user can not be deleted.');\n }\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;AA2BA,IAAaU,cAAb,cAAiCF,sBAAAA;CACnBG;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIN,cAAc,EAAEQ,mBAAmBD,IAAIC,kBAAkB,CAAA;CAClF;CAEA,MAAMC,QACFC,OACAC,OAC6C;EAC7C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKhB,WAAWiB,SAASX,KAAAA;EAEnC,MAAMQ,OAAe,CAAA;EACrB,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UAAU;GAC3B,IACIR,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,IACpC;IACER,KAAKS,KAAKJ,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMZ,MAAMC,oBAAoBgB,cAAc;KAC1Cd,MAAM;MACFf,eAAegB;MACfhB,eAAeiB;MACfjB,eAAekB;;KAEnBC,MAAMxB,iBAAiB;OAAGD,kBAAkBoC,aAAaN;MAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;KAAQ,CAAA;IACxG,CAAA;IAEAL,KAAKS,KAAKJ,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACa;EACb,MAAMC,kBAAkB;GACpBnC,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMa,YACfb,MAAMa,SAASC,SAAS,WAEpBd,MAAMa,SAASN,KAAKQ,OAAOM,YAC3BrB,MAAMa,SAASN,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKnB,WAAWgC,QAAQJ,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAIzB,oBAAAA;EAGd,IAAIqC,QAAQxB,MAAMa,SAAUN,KAAKQ,OAAOH,OAAOG,IAAI;GAC/CS,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IAAI,CAACC,MACD,MAAMxB,MAAMC,oBAAoBgB,cAAc;GAC1Cd,MAAMoB;GACNhB,MAAMxB,iBAAiB;KAAGD,kBAAkBoC,aAAaN;IAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMc,OACFnB,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKC,KAAAA,GAAWrB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMiB,OACFR,UACAd,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKN,UAAUd,MAAMP,OAAO,EAAE8B,YAAY,KAAK,CAAA;EAC7E,OAAOlB;CACX;CAEA,MAAMe,KACFN,UACAd,MACAP,OACA+B,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO1B,KAAK2B,aAAa,WACnC,MAAM,KAAKxC,gBAAgByC,QAAQ5B,KAAK2B,QAAQ,IAChDN,KAAAA;EAEJ,IAAIhB;EACJ,IAAIS,UAAU;GACV,MAAMe,QAA6B,CAAC;GACpC,IAAInD,OAAOoC,QAAAA,GACPe,MAAMrB,KAAKM;QAEXe,MAAMjC,OAAOkB;GAGjB,IAAIY,OACAG,MAAMF,WAAWD,MAAMlB;GAG3BH,SAAS,MAAM,KAAKnB,WAAW4C,UAAUD,KAAAA;GACzC,IAAI,CAACxB,UAAUmB,QAAQD,YACnB,MAAM,IAAI3C,oBAAAA;EAElB,OAAO,IAAI4C,QAAQD,YACf,MAAM,IAAI3C,oBAAAA;EAGd,IAAImD,aAAa;EACjB,IAAI1B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeiB,YAAY,CAAA;GACnF,SAASmC,GAAG;IACR,IACI,CAACxC,MAAMa,YACPb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,IAElC,MAAMyB;IAEVF,aAAa;IACb,MAAMtC,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeqD,iBAAiB,CAAA;GACxF;GAEAT,QAAQhD,eAAe0D;EAC3B,OAAO;GACH,MAAM1C,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeuD,YAAY,CAAA;GAE/EX,QAAQhD,eAAe4D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKlD,UAAUmD,IAAIvC,MAAM,EAAEyB,MAAM,CAAA;EAEzD,MAAM,KAAKvC,WAAWsD,oBAAoBF,SAAAA;EAE1C,MAAMG,qBAAqB,IAAIzD,uBAAAA;EAE/B,IAAIqB,QAAQ;GACR,MAAMqC,eAAerC,OAAOT;GAC5B,MAAM+C,qBAAqBtC,OAAOuC;GAElC,IAAIb,YACA,MAAMtC,MAAMC,oBAAoBmD,SAAS;IACrCjD,MAAMf,eAAeqD;IACrBlC,MAAMxB,iBAAiB;MAAGD,kBAAkBoC,aAAa2B;KAAW,GAAG,KAAK1B,mBAAmB0B,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJjC,SAAS,KAAKnB,WAAW4D,MAAMzC,QAAQiC,SAAAA;GAEvC,IACIA,UAAU1C,QACV0C,UAAU1C,SAAS8C,cACrB;IACE,IAAIJ,UAAUM,aACVvC,OAAOuC,cAAcN,UAAUM;IAGnC,IAAID,sBAAsBL,UAAUM,gBAAgB,OAChDvC,OAAOT,OAAO8C;GAEtB;GAEA,IAAI,CAACX,YACD,MAAMtC,MAAMC,oBAAoBmD,SAAS;IACrCjD,MAAMf,eAAeiB;IACrBE,MAAMxB,iBAAiB;MAClBD,kBAAkBoC,aAAa;MAC5B,GAAGN;MACH,GAAGiC;KACP;MACC/D,kBAAkBwE,cAAcT,UAAUX,YAAYtB,OAAOsB,YAAY;IAC9E,CAAA;GACJ,CAAA;GAGJ,IAAIW,UAAUU,UACV3C,OAAO2C,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;GAGzE,MAAM,KAAK9D,WAAWkC,KAAKf,MAAAA;GAE3B,OAAO;IACHA;IACA6C,SAAS;GACb;EACJ;EAEA,IAAI,CAACZ,UAAUX,UAAU;GACrB,MAAMwB,eAAe,KAAKC,gBAAgB3D,KAAAA;GAC1C,IAAI0D,cACAb,UAAUX,WAAWwB;EAE7B;EAEA9C,SAAS,KAAKnB,WAAWiC,OAAOmB,SAAAA;EAEhC,MAAM7C,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMf,eAAeuD;GACrBpC,MAAMxB,iBAAiB;KAAGD,kBAAkBoC,aAAaN;IAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,IAAIiC,UAAUU,UACV3C,OAAO2C,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;EAGzE,MAAM,KAAK9D,WAAWkC,KAAKf,MAAAA;EAE3B,OAAO;GACHA;GACA6C,SAAS;EACb;CACJ;CAEA,MAAMG,OACF7C,IACAf,OACa;EACb,MAAMA,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAekB,YAAY,CAAA;EAE/E,IACIN,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOA,IAE3B,MAAM,IAAI7B,gBAAgB,kCAAA;EAG9B,MAAM0B,SAAS,MAAM,KAAKnB,WAAW4C,UAAU,EAAEtB,GAAG,CAAA;EACpD,IAAI,CAACH,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAMa,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMf,eAAekB;GACrBC,MAAMxB,iBAAiB;KAAGD,kBAAkBoC,aAAaN;IAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEG,IAAI8C,aAAajD;EACzB,MAAM,KAAKnB,WAAWqE,OAAOlD,MAAAA;EAC7BA,OAAOG,KAAK8C;EAEZ,OAAOjD;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","PermissionName","UserValidator","AbstractEntityService","UserCredentialsService","UserService","repository","realmRepository","validator","ctx","passwordMinLength","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_READ","USER_UPDATE","USER_DELETE","data","entities","meta","findMany","total","entity","identity","type","id","push","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","getOne","idOrName","realmId","permissionNames","isMe","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneBy","isSelfEdit","preEvaluate","e","USER_SELF_MANAGE","UPDATE","USER_CREATE","CREATE","validated","run","validateJoinColumns","credentialsService","originalName","originalNameLocked","name_locked","evaluate","merge","REALM_MATCH","password","protect","created","actorRealmId","getActorRealmId","delete","entityId","remove"],"sources":["../../../../src/core/entities/user/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n PermissionName,\n UserValidator,\n} from '@authup/core-kit';\nimport type { User } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type { IUserRepository, IUserService } from './types.ts';\n\nexport type UserServiceContext = {\n repository: IUserRepository;\n realmRepository: IRealmRepository;\n passwordMinLength?: number;\n};\n\nexport class UserService extends AbstractEntityService implements IUserService {\n protected repository: IUserRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: UserValidator;\n\n constructor(ctx: UserServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new UserValidator({ passwordMinLength: ctx.passwordMinLength });\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<User>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_READ,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ],\n });\n\n const {\n data: entities, \n meta, \n } = await this.repository.findMany(query);\n\n const data: User[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n if (\n actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === entity.id\n ) {\n data.push(entity);\n continue;\n }\n\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.USER_READ,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ],\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n data.push(entity);\n } catch {\n total -= 1;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<User> {\n const permissionNames = [\n PermissionName.USER_READ,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ];\n\n let isMe = !!actor.identity &&\n actor.identity.type === 'user' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n const entity = await this.repository.findOne(idOrName, query, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n if (!isMe) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: permissionNames,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<User> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<User> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: User,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realm_id === 'string' ?\n await this.realmRepository.resolve(data.realm_id) :\n undefined;\n\n let entity: User \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realm_id = realm.id;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'user' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n }\n\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_CREATE });\n\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n await this.repository.validateJoinColumns(validated);\n\n const credentialsService = new UserCredentialsService();\n\n if (entity) {\n const originalName = entity.name;\n const originalNameLocked = entity.name_locked;\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (\n validated.name &&\n validated.name !== originalName\n ) {\n if (validated.name_locked) {\n entity.name_locked = validated.name_locked;\n }\n\n if (originalNameLocked && validated.name_locked !== false) {\n entity.name = originalName;\n }\n }\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n [BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null,\n }),\n });\n }\n\n if (validated.password) {\n entity.password = await credentialsService.protect(validated.password);\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realm_id) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n entity = this.repository.create(validated);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n if (validated.password) {\n entity.password = await credentialsService.protect(validated.password);\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<User> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });\n\n if (\n actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === id\n ) {\n throw new ValidationError('The own user can not be deleted.');\n }\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;AA2BA,IAAaU,cAAb,cAAiCF,sBAAAA;CACnBG;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIN,cAAc,EAAEQ,mBAAmBD,IAAIC,kBAAkB,CAAA;CAClF;CAEA,MAAMC,QACFC,OACAC,OAC6C;EAC7C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKhB,WAAWiB,SAASX,KAAAA;EAEnC,MAAMQ,OAAe,CAAA;EACrB,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UAAU;GAC3B,IACIR,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,IACpC;IACER,KAAKS,KAAKJ,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMZ,MAAMC,oBAAoBgB,cAAc;KAC1Cd,MAAM;MACFf,eAAegB;MACfhB,eAAeiB;MACfjB,eAAekB;;KAEnBC,MAAMxB,iBAAiB;OAAGD,kBAAkBoC,aAAaN;MAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;KAAQ,CAAA;IACxG,CAAA;IAEAL,KAAKS,KAAKJ,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACa;EACb,MAAMC,kBAAkB;GACpBnC,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMa,YACfb,MAAMa,SAASC,SAAS,WAEpBd,MAAMa,SAASN,KAAKQ,OAAOM,YAC3BrB,MAAMa,SAASN,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKnB,WAAWgC,QAAQJ,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAI1B,oBAAAA;EAGd,IAAIsC,QAAQxB,MAAMa,SAAUN,KAAKQ,OAAOH,OAAOG,IAAI;GAC/CS,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IAAI,CAACC,MACD,MAAMxB,MAAMC,oBAAoBgB,cAAc;GAC1Cd,MAAMoB;GACNhB,MAAMxB,iBAAiB;KAAGD,kBAAkBoC,aAAaN;IAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMc,OACFnB,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKC,KAAAA,GAAWrB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMiB,OACFR,UACAd,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKN,UAAUd,MAAMP,OAAO,EAAE8B,YAAY,KAAK,CAAA;EAC7E,OAAOlB;CACX;CAEA,MAAMe,KACFN,UACAd,MACAP,OACA+B,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO1B,KAAK2B,aAAa,WACnC,MAAM,KAAKxC,gBAAgByC,QAAQ5B,KAAK2B,QAAQ,IAChDN,KAAAA;EAEJ,IAAIhB;EACJ,IAAIS,UAAU;GACV,MAAMe,QAA6B,CAAC;GACpC,IAAInD,OAAOoC,QAAAA,GACPe,MAAMrB,KAAKM;QAEXe,MAAMjC,OAAOkB;GAGjB,IAAIY,OACAG,MAAMF,WAAWD,MAAMlB;GAG3BH,SAAS,MAAM,KAAKnB,WAAW4C,UAAUD,KAAAA;GACzC,IAAI,CAACxB,UAAUmB,QAAQD,YACnB,MAAM,IAAI5C,oBAAAA;EAElB,OAAO,IAAI6C,QAAQD,YACf,MAAM,IAAI5C,oBAAAA;EAGd,IAAIoD,aAAa;EACjB,IAAI1B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeiB,YAAY,CAAA;GACnF,SAASmC,GAAG;IACR,IACI,CAACxC,MAAMa,YACPb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,IAElC,MAAMyB;IAEVF,aAAa;IACb,MAAMtC,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeqD,iBAAiB,CAAA;GACxF;GAEAT,QAAQhD,eAAe0D;EAC3B,OAAO;GACH,MAAM1C,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeuD,YAAY,CAAA;GAE/EX,QAAQhD,eAAe4D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKlD,UAAUmD,IAAIvC,MAAM,EAAEyB,MAAM,CAAA;EAEzD,MAAM,KAAKvC,WAAWsD,oBAAoBF,SAAAA;EAE1C,MAAMG,qBAAqB,IAAIzD,uBAAAA;EAE/B,IAAIqB,QAAQ;GACR,MAAMqC,eAAerC,OAAOT;GAC5B,MAAM+C,qBAAqBtC,OAAOuC;GAElC,IAAIb,YACA,MAAMtC,MAAMC,oBAAoBmD,SAAS;IACrCjD,MAAMf,eAAeqD;IACrBlC,MAAMxB,iBAAiB;MAAGD,kBAAkBoC,aAAa2B;KAAW,GAAG,KAAK1B,mBAAmB0B,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJjC,SAAS,KAAKnB,WAAW4D,MAAMzC,QAAQiC,SAAAA;GAEvC,IACIA,UAAU1C,QACV0C,UAAU1C,SAAS8C,cACrB;IACE,IAAIJ,UAAUM,aACVvC,OAAOuC,cAAcN,UAAUM;IAGnC,IAAID,sBAAsBL,UAAUM,gBAAgB,OAChDvC,OAAOT,OAAO8C;GAEtB;GAEA,IAAI,CAACX,YACD,MAAMtC,MAAMC,oBAAoBmD,SAAS;IACrCjD,MAAMf,eAAeiB;IACrBE,MAAMxB,iBAAiB;MAClBD,kBAAkBoC,aAAa;MAC5B,GAAGN;MACH,GAAGiC;KACP;MACC/D,kBAAkBwE,cAAcT,UAAUX,YAAYtB,OAAOsB,YAAY;IAC9E,CAAA;GACJ,CAAA;GAGJ,IAAIW,UAAUU,UACV3C,OAAO2C,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;GAGzE,MAAM,KAAK9D,WAAWkC,KAAKf,MAAAA;GAE3B,OAAO;IACHA;IACA6C,SAAS;GACb;EACJ;EAEA,IAAI,CAACZ,UAAUX,UAAU;GACrB,MAAMwB,eAAe,KAAKC,gBAAgB3D,KAAAA;GAC1C,IAAI0D,cACAb,UAAUX,WAAWwB;EAE7B;EAEA9C,SAAS,KAAKnB,WAAWiC,OAAOmB,SAAAA;EAEhC,MAAM7C,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMf,eAAeuD;GACrBpC,MAAMxB,iBAAiB;KAAGD,kBAAkBoC,aAAaN;IAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,IAAIiC,UAAUU,UACV3C,OAAO2C,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;EAGzE,MAAM,KAAK9D,WAAWkC,KAAKf,MAAAA;EAE3B,OAAO;GACHA;GACA6C,SAAS;EACb;CACJ;CAEA,MAAMG,OACF7C,IACAf,OACa;EACb,MAAMA,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAekB,YAAY,CAAA;EAE/E,IACIN,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOA,IAE3B,MAAM,IAAI5B,gBAAgB,kCAAA;EAG9B,MAAMyB,SAAS,MAAM,KAAKnB,WAAW4C,UAAU,EAAEtB,GAAG,CAAA;EACpD,IAAI,CAACH,QACD,MAAM,IAAI1B,oBAAAA;EAGd,MAAMc,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMf,eAAekB;GACrBC,MAAMxB,iBAAiB;KAAGD,kBAAkBoC,aAAaN;IAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEG,IAAI8C,aAAajD;EACzB,MAAM,KAAKnB,WAAWqE,OAAOlD,MAAAA;EAC7BA,OAAOG,KAAK8C;EAEZ,OAAOjD;CACX;AACJ"}

package/dist/core/entities/user-attribute/service.mjs CHANGED Viewed

@@ -4,7 +4,7 @@ import.meta.url;
 import { PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, PermissionError, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
 import { buildErrorMessageForAttribute } from "validup";
 //#region src/core/entities/user-attribute/service.ts
 var UserAttributeService = class extends AbstractEntityService {
@@ -49,12 +49,12 @@ var UserAttributeService = class extends AbstractEntityService {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });
 		}
 		await this.repository.validateJoinColumns(data);
-		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);
+		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new ValidationError(`The user-attribute name '${data.name}' collides with a User entity column.`);
 		if (data.user) data.realm_id = data.user.realm_id;
 		else if (actor.identity && actor.identity.type === "user") {
 			data.user_id = actor.identity.data.id;
 			data.realm_id = actor.identity.data.realm_id;
-		} else throw new BadRequestError(buildErrorMessageForAttribute("user_id"));
+		} else throw new ValidationError(buildErrorMessageForAttribute("user_id"));
 		const entity = this.repository.create(data);
 		if (isSelfFallback) await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_SELF_MANAGE,
@@ -72,7 +72,7 @@ var UserAttributeService = class extends AbstractEntityService {
 	}
 	async update(id, data, actor) {
 		await this.repository.validateJoinColumns(data);
-		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);
+		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new ValidationError(`The user-attribute name '${data.name}' collides with a User entity column.`);
 		let entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
 		const isSelfTarget = !!actor.identity && actor.identity.type === "user" && actor.identity.data.id === entity.user_id;

package/dist/core/entities/user-attribute/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","BadRequestError","EntityNotFoundError","PermissionName","buildErrorMessageForAttribute","AbstractEntityService","UserAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_UPDATE","USER_SELF_MANAGE","data","entities","meta","findMany","total","entity","canRead","canReadUserAttribute","push","getOne","id","findOneBy","create","targetUserId","user_id","user","isSelfTarget","identity","type","isSelfFallback","preEvaluate","e","validateJoinColumns","has","realm_id","evaluate","ATTRIBUTES","value","resourceRealmMatch","save","update","merge","delete","entityId","remove","isMe"],"sources":["../../../../src/core/entities/user-attribute/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PermissionName } from '@authup/core-kit';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { buildErrorMessageForAttribute } from 'validup';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IUserAttributeRepository, IUserAttributeService } from './types.ts';\n\nexport type UserAttributeServiceContext = {\n repository: IUserAttributeRepository;\n reservedNames?: ReadonlySet<string>;\n};\n\nexport class UserAttributeService extends AbstractEntityService implements IUserAttributeService {\n protected repository: IUserAttributeRepository;\n\n protected reservedNames: ReadonlySet<string>;\n\n constructor(ctx: UserAttributeServiceContext) {\n super();\n this.repository = ctx.repository;\n this.reservedNames = ctx.reservedNames ?? new Set();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<UserAttribute>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_UPDATE,\n PermissionName.USER_SELF_MANAGE,\n ],\n });\n\n const {\n data: entities,\n meta,\n } = await this.repository.findMany(query);\n\n const data: UserAttribute[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n const canRead = await this.canReadUserAttribute(actor, entity);\n if (canRead) {\n data.push(entity);\n } else {\n total--;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total,\n },\n };\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_UPDATE,\n PermissionName.USER_SELF_MANAGE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const canRead = await this.canReadUserAttribute(actor, entity);\n if (!canRead) {\n throw new PermissionError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n const targetUserId: string \| undefined = data.user_id \|\|\n (data.user && data.user.id);\n\n const isSelfTarget = !!actor.identity &&\n actor.identity.type === 'user' &&\n (!targetUserId \|\| targetUserId === actor.identity.data.id);\n\n let isSelfFallback = false;\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n } catch (e) {\n if (!isSelfTarget) {\n throw e;\n }\n isSelfFallback = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n }\n\n await this.repository.validateJoinColumns(data);\n\n if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n }\n\n if (data.user) {\n data.realm_id = data.user.realm_id;\n } else if (\n actor.identity &&\n actor.identity.type === 'user'\n ) {\n data.user_id = actor.identity.data.id;\n data.realm_id = actor.identity.data.realm_id;\n } else {\n throw new BadRequestError(buildErrorMessageForAttribute('user_id'));\n }\n\n const entity = this.repository.create(data);\n\n if (isSelfFallback) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } }),\n });\n } else {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n await this.repository.validateJoinColumns(data);\n\n if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n }\n\n let entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const isSelfTarget = !!actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === entity.user_id;\n\n let isSelfFallback = false;\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n } catch (e) {\n if (!isSelfTarget) {\n throw e;\n }\n isSelfFallback = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n }\n\n // An attribute belongs to a fixed user; its owner (and the user-derived realm_id) is\n // IMMUTABLE on update — strip both from the body. This blocks a self-manage or admin\n // caller from reassigning the attribute to another user (isSelfTarget was decided from\n // the ORIGINAL owner), and blocks a caller-supplied realm_id that would gate USER_UPDATE\n // against a realm of their choosing. To move an attribute, delete + recreate.\n delete data.user_id;\n delete data.user;\n delete data.realm_id;\n\n entity = this.repository.merge(entity, data);\n\n if (isSelfFallback) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } }),\n });\n } else {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_UPDATE,\n PermissionName.USER_SELF_MANAGE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const canRead = await this.canReadUserAttribute(actor, entity);\n if (!canRead) {\n throw new PermissionError();\n }\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n\n private async canReadUserAttribute(\n actor: ActorContext,\n entity: UserAttribute,\n ): Promise<boolean> {\n const isMe = actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === entity.user_id;\n\n if (isMe) {\n return true;\n }\n\n try {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n return true;\n } catch {\n return false;\n }\n }\n}\n"],"mappings":";;;;;;;;;AAqBA,IAAaQ,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKd,WAAWe,SAASV,KAAAA;EAEnC,MAAMO,OAAwB,CAAA;EAC9B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UAEjB,IAAIK,MADkB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnDL,KAAKQ,KAAKH,MAAAA;OAEVD;EAIR,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMK,OACFC,IACAhB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAId,IAAI,CAACuB,MADiB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnD,MAAM,IAAIzB,gBAAAA;EAGd,OAAOyB;CACX;CAEA,MAAMO,OACFZ,MACAN,OACsB;EACtB,MAAMmB,eAAmCb,KAAKc,WACzCd,KAAKe,QAAQf,KAAKe,KAAKL;EAE5B,MAAMM,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,WACvB,CAACL,gBAAgBA,iBAAiBnB,MAAMuB,SAASjB,KAAKU;EAE3D,IAAIS,iBAAiB;EACrB,IAAI;GACA,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,YAAY,CAAA;EACnF,SAASuB,GAAG;GACR,IAAI,CAACL,cACD,MAAMK;GAEVF,iBAAiB;GACjB,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,iBAAiB,CAAA;EACxF;EAEA,MAAM,KAAKX,WAAWkC,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,IAAI,GACjE,MAAM,IAAIf,gBAAgB,4BAA4BkB,KAAKH,KAAK,sCAAsC;EAG1G,IAAIG,KAAKe,MACLf,KAAKwB,WAAWxB,KAAKe,KAAKS;OACvB,IACH9B,MAAMuB,YACNvB,MAAMuB,SAASC,SAAS,QAC1B;GACElB,KAAKc,UAAUpB,MAAMuB,SAASjB,KAAKU;GACnCV,KAAKwB,WAAW9B,MAAMuB,SAASjB,KAAKwB;EACxC,OACI,MAAM,IAAI1C,gBAAgBG,8BAA8B,SAAA,CAAA;EAG5D,MAAMoB,SAAS,KAAKjB,WAAWwB,OAAOZ,IAAAA;EAEtC,IAAImB,gBACA,MAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrBC,MAAMnB,iBAAiB,GAAGF,kBAAkB+C,aAAa,GAAG1B,KAAKH,OAAOG,KAAK2B,MAAM,EAAE,CAAA;EACzF,CAAA;OAEA,MAAMjC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrBE,MAAMnB,iBAAiB;KAAGF,kBAAkB+C,aAAarB;IAAQ,GAAG,KAAKuB,mBAAmBvB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMyB,OACFpB,IACAV,MACAN,OACsB;EACtB,MAAM,KAAKN,WAAWkC,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,IAAI,GACjE,MAAM,IAAIf,gBAAgB,4BAA4BkB,KAAKH,KAAK,sCAAsC;EAG1G,IAAIQ,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EAClD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMiC,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS;EAEtC,IAAIK,iBAAiB;EACrB,IAAI;GACA,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,YAAY,CAAA;EACnF,SAASuB,GAAG;GACR,IAAI,CAACL,cACD,MAAMK;GAEVF,iBAAiB;GACjB,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,iBAAiB,CAAA;EACxF;EAOA,OAAOC,KAAKc;EACZ,OAAOd,KAAKe;EACZ,OAAOf,KAAKwB;EAEZnB,SAAS,KAAKjB,WAAW2C,MAAM1B,QAAQL,IAAAA;EAEvC,IAAImB,gBACA,MAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrBC,MAAMnB,iBAAiB,GAAGF,kBAAkB+C,aAAa,GAAGrB,OAAOR,OAAOQ,OAAOsB,MAAM,EAAE,CAAA;EAC7F,CAAA;OAEA,MAAMjC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrBE,MAAMnB,iBAAiB;KAAGF,kBAAkB+C,aAAarB;IAAQ,GAAG,KAAKuB,mBAAmBvB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAM2B,OACFtB,IACAhB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAId,IAAI,CAACuB,MADiB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnD,MAAM,IAAIzB,gBAAAA;EAGd,MAAM,EAAE8B,IAAIuB,aAAa5B;EACzB,MAAM,KAAKjB,WAAW8C,OAAO7B,MAAAA;EAC7BA,OAAOK,KAAKuB;EAEZ,OAAO5B;CACX;CAEA,MAAcE,qBACVb,OACAW,QACgB;EAKhB,IAJaX,MAAMuB,YACfvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS,SAGlC,OAAO;EAGX,IAAI;GACA,MAAMpB,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAMb,eAAec;IACrBE,MAAMnB,iBAAiB;MAAGF,kBAAkB+C,aAAarB;KAAQ,GAAG,KAAKuB,mBAAmBvB,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAEA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","EntityNotFoundError","ValidationError","PermissionName","buildErrorMessageForAttribute","AbstractEntityService","UserAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_UPDATE","USER_SELF_MANAGE","data","entities","meta","findMany","total","entity","canRead","canReadUserAttribute","push","getOne","id","findOneBy","create","targetUserId","user_id","user","isSelfTarget","identity","type","isSelfFallback","preEvaluate","e","validateJoinColumns","has","realm_id","evaluate","ATTRIBUTES","value","resourceRealmMatch","save","update","merge","delete","entityId","remove","isMe"],"sources":["../../../../src/core/entities/user-attribute/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { PermissionName } from '@authup/core-kit';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { buildErrorMessageForAttribute } from 'validup';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IUserAttributeRepository, IUserAttributeService } from './types.ts';\n\nexport type UserAttributeServiceContext = {\n repository: IUserAttributeRepository;\n reservedNames?: ReadonlySet<string>;\n};\n\nexport class UserAttributeService extends AbstractEntityService implements IUserAttributeService {\n protected repository: IUserAttributeRepository;\n\n protected reservedNames: ReadonlySet<string>;\n\n constructor(ctx: UserAttributeServiceContext) {\n super();\n this.repository = ctx.repository;\n this.reservedNames = ctx.reservedNames ?? new Set();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<UserAttribute>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_UPDATE,\n PermissionName.USER_SELF_MANAGE,\n ],\n });\n\n const {\n data: entities,\n meta,\n } = await this.repository.findMany(query);\n\n const data: UserAttribute[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n const canRead = await this.canReadUserAttribute(actor, entity);\n if (canRead) {\n data.push(entity);\n } else {\n total--;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total,\n },\n };\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_UPDATE,\n PermissionName.USER_SELF_MANAGE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const canRead = await this.canReadUserAttribute(actor, entity);\n if (!canRead) {\n throw new PermissionError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n const targetUserId: string \| undefined = data.user_id \|\|\n (data.user && data.user.id);\n\n const isSelfTarget = !!actor.identity &&\n actor.identity.type === 'user' &&\n (!targetUserId \|\| targetUserId === actor.identity.data.id);\n\n let isSelfFallback = false;\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n } catch (e) {\n if (!isSelfTarget) {\n throw e;\n }\n isSelfFallback = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n }\n\n await this.repository.validateJoinColumns(data);\n\n if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n throw new ValidationError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n }\n\n if (data.user) {\n data.realm_id = data.user.realm_id;\n } else if (\n actor.identity &&\n actor.identity.type === 'user'\n ) {\n data.user_id = actor.identity.data.id;\n data.realm_id = actor.identity.data.realm_id;\n } else {\n throw new ValidationError(buildErrorMessageForAttribute('user_id'));\n }\n\n const entity = this.repository.create(data);\n\n if (isSelfFallback) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } }),\n });\n } else {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n await this.repository.validateJoinColumns(data);\n\n if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n throw new ValidationError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n }\n\n let entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const isSelfTarget = !!actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === entity.user_id;\n\n let isSelfFallback = false;\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n } catch (e) {\n if (!isSelfTarget) {\n throw e;\n }\n isSelfFallback = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n }\n\n // An attribute belongs to a fixed user; its owner (and the user-derived realm_id) is\n // IMMUTABLE on update — strip both from the body. This blocks a self-manage or admin\n // caller from reassigning the attribute to another user (isSelfTarget was decided from\n // the ORIGINAL owner), and blocks a caller-supplied realm_id that would gate USER_UPDATE\n // against a realm of their choosing. To move an attribute, delete + recreate.\n delete data.user_id;\n delete data.user;\n delete data.realm_id;\n\n entity = this.repository.merge(entity, data);\n\n if (isSelfFallback) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } }),\n });\n } else {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<UserAttribute> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_UPDATE,\n PermissionName.USER_SELF_MANAGE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const canRead = await this.canReadUserAttribute(actor, entity);\n if (!canRead) {\n throw new PermissionError();\n }\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n\n private async canReadUserAttribute(\n actor: ActorContext,\n entity: UserAttribute,\n ): Promise<boolean> {\n const isMe = actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === entity.user_id;\n\n if (isMe) {\n return true;\n }\n\n try {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n return true;\n } catch {\n return false;\n }\n }\n}\n"],"mappings":";;;;;;;;;AAqBA,IAAaQ,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKd,WAAWe,SAASV,KAAAA;EAEnC,MAAMO,OAAwB,CAAA;EAC9B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UAEjB,IAAIK,MADkB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnDL,KAAKQ,KAAKH,MAAAA;OAEVD;EAIR,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMK,OACFC,IACAhB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACL,QACD,MAAM,IAAIvB,oBAAAA;EAId,IAAI,CAACwB,MADiB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnD,MAAM,IAAIzB,gBAAAA;EAGd,OAAOyB;CACX;CAEA,MAAMO,OACFZ,MACAN,OACsB;EACtB,MAAMmB,eAAmCb,KAAKc,WACzCd,KAAKe,QAAQf,KAAKe,KAAKL;EAE5B,MAAMM,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,WACvB,CAACL,gBAAgBA,iBAAiBnB,MAAMuB,SAASjB,KAAKU;EAE3D,IAAIS,iBAAiB;EACrB,IAAI;GACA,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,YAAY,CAAA;EACnF,SAASuB,GAAG;GACR,IAAI,CAACL,cACD,MAAMK;GAEVF,iBAAiB;GACjB,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,iBAAiB,CAAA;EACxF;EAEA,MAAM,KAAKX,WAAWkC,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,IAAI,GACjE,MAAM,IAAId,gBAAgB,4BAA4BiB,KAAKH,KAAK,sCAAsC;EAG1G,IAAIG,KAAKe,MACLf,KAAKwB,WAAWxB,KAAKe,KAAKS;OACvB,IACH9B,MAAMuB,YACNvB,MAAMuB,SAASC,SAAS,QAC1B;GACElB,KAAKc,UAAUpB,MAAMuB,SAASjB,KAAKU;GACnCV,KAAKwB,WAAW9B,MAAMuB,SAASjB,KAAKwB;EACxC,OACI,MAAM,IAAIzC,gBAAgBE,8BAA8B,SAAA,CAAA;EAG5D,MAAMoB,SAAS,KAAKjB,WAAWwB,OAAOZ,IAAAA;EAEtC,IAAImB,gBACA,MAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrBC,MAAMnB,iBAAiB,GAAGF,kBAAkB+C,aAAa,GAAG1B,KAAKH,OAAOG,KAAK2B,MAAM,EAAE,CAAA;EACzF,CAAA;OAEA,MAAMjC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrBE,MAAMnB,iBAAiB;KAAGF,kBAAkB+C,aAAarB;IAAQ,GAAG,KAAKuB,mBAAmBvB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMyB,OACFpB,IACAV,MACAN,OACsB;EACtB,MAAM,KAAKN,WAAWkC,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,IAAI,GACjE,MAAM,IAAId,gBAAgB,4BAA4BiB,KAAKH,KAAK,sCAAsC;EAG1G,IAAIQ,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EAClD,IAAI,CAACL,QACD,MAAM,IAAIvB,oBAAAA;EAGd,MAAMkC,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS;EAEtC,IAAIK,iBAAiB;EACrB,IAAI;GACA,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,YAAY,CAAA;EACnF,SAASuB,GAAG;GACR,IAAI,CAACL,cACD,MAAMK;GAEVF,iBAAiB;GACjB,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,iBAAiB,CAAA;EACxF;EAOA,OAAOC,KAAKc;EACZ,OAAOd,KAAKe;EACZ,OAAOf,KAAKwB;EAEZnB,SAAS,KAAKjB,WAAW2C,MAAM1B,QAAQL,IAAAA;EAEvC,IAAImB,gBACA,MAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrBC,MAAMnB,iBAAiB,GAAGF,kBAAkB+C,aAAa,GAAGrB,OAAOR,OAAOQ,OAAOsB,MAAM,EAAE,CAAA;EAC7F,CAAA;OAEA,MAAMjC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrBE,MAAMnB,iBAAiB;KAAGF,kBAAkB+C,aAAarB;IAAQ,GAAG,KAAKuB,mBAAmBvB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAM2B,OACFtB,IACAhB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACL,QACD,MAAM,IAAIvB,oBAAAA;EAId,IAAI,CAACwB,MADiB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnD,MAAM,IAAIzB,gBAAAA;EAGd,MAAM,EAAE8B,IAAIuB,aAAa5B;EACzB,MAAM,KAAKjB,WAAW8C,OAAO7B,MAAAA;EAC7BA,OAAOK,KAAKuB;EAEZ,OAAO5B;CACX;CAEA,MAAcE,qBACVb,OACAW,QACgB;EAKhB,IAJaX,MAAMuB,YACfvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS,SAGlC,OAAO;EAGX,IAAI;GACA,MAAMpB,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAMb,eAAec;IACrBE,MAAMnB,iBAAiB;MAAGF,kBAAkB+C,aAAarB;KAAQ,GAAG,KAAKuB,mBAAmBvB,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAEA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ"}

package/dist/core/entities/user-authenticator/constants.d.ts ADDED Viewed

@@ -0,0 +1,26 @@
+export declare const USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX = "mfaAttempt";
+export declare const USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX = "mfaThrottle";
+export declare const USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX = "mfaVerifyLock";
+export declare const USER_AUTHENTICATOR_VERIFY_LOCK_TTL = 10000;
+export declare const USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL: number;
+/**
+ * Per-account exponential backoff for failed challenge codes:
+ * lock = min(MAX, FACTOR * 2^(n-1)) seconds after the n-th failure,
+ * reset on success. The counter itself expires after the window.
+ */
+export declare const USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR = 1;
+export declare const USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX = 300;
+export declare const USER_AUTHENTICATOR_ATTEMPT_WINDOW = 3600;
+export declare const USER_AUTHENTICATOR_TOTP_ALGORITHM = "SHA1";
+export declare const USER_AUTHENTICATOR_TOTP_DIGITS = 6;
+export declare const USER_AUTHENTICATOR_TOTP_PERIOD = 30;
+export declare const USER_AUTHENTICATOR_RECOVERY_CODE_COUNT = 10;
+export declare const USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX = "mfaEmailCode";
+export declare const USER_AUTHENTICATOR_EMAIL_CODE_LENGTH = 6;
+export declare const USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES = 10;
+export declare const USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX = "mfaEmailSend";
+export declare const USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN = 60;
+export declare const USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX = "mfaWebauthnReg";
+export declare const USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX = "mfaWebauthnAuth";
+export declare const USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW = 300;
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/entities/user-authenticator/constants.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-authenticator/constants.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,uCAAuC,eAAe,CAAC;AACpE,eAAO,MAAM,wCAAwC,gBAAgB,CAAC;AAKtE,eAAO,MAAM,2CAA2C,kBAAkB,CAAC;AAC3E,eAAO,MAAM,kCAAkC,QAAS,CAAC;AACzD,eAAO,MAAM,6CAA6C,QAEzD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,IAAI,CAAC;AACxD,eAAO,MAAM,mCAAmC,MAAM,CAAC;AACvD,eAAO,MAAM,iCAAiC,OAAQ,CAAC;AAEvD,eAAO,MAAM,iCAAiC,SAAS,CAAC;AACxD,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAChD,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAEjD,eAAO,MAAM,sCAAsC,KAAK,CAAC;AAEzD,eAAO,MAAM,0CAA0C,iBAAiB,CAAC;AACzE,eAAO,MAAM,oCAAoC,IAAI,CAAC;AACtD,eAAO,MAAM,gDAAgD,KAAK,CAAC;AAKnE,eAAO,MAAM,0CAA0C,iBAAiB,CAAC;AACzE,eAAO,MAAM,sCAAsC,KAAK,CAAC;AAEzD,eAAO,MAAM,4CAA4C,mBAAmB,CAAC;AAC7E,eAAO,MAAM,6CAA6C,oBAAoB,CAAC;AAC/E,eAAO,MAAM,4CAA4C,MAAM,CAAC"}

package/dist/core/entities/user-authenticator/constants.mjs ADDED Viewed

@@ -0,0 +1,32 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/entities/user-authenticator/constants.ts
+const USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX = "mfaAttempt";
+const USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX = "mfaThrottle";
+const USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX = "mfaVerifyLock";
+const USER_AUTHENTICATOR_VERIFY_LOCK_TTL = 1e4;
+const USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL = Math.floor(USER_AUTHENTICATOR_VERIFY_LOCK_TTL / 3);
+/**
+* Per-account exponential backoff for failed challenge codes:
+* lock = min(MAX, FACTOR * 2^(n-1)) seconds after the n-th failure,
+* reset on success. The counter itself expires after the window.
+*/ const USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR = 1;
+const USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX = 300;
+const USER_AUTHENTICATOR_ATTEMPT_WINDOW = 3600;
+const USER_AUTHENTICATOR_TOTP_ALGORITHM = "SHA1";
+const USER_AUTHENTICATOR_TOTP_DIGITS = 6;
+const USER_AUTHENTICATOR_TOTP_PERIOD = 30;
+const USER_AUTHENTICATOR_RECOVERY_CODE_COUNT = 10;
+const USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX = "mfaEmailCode";
+const USER_AUTHENTICATOR_EMAIL_CODE_LENGTH = 6;
+const USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES = 10;
+const USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX = "mfaEmailSend";
+const USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN = 60;
+const USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX = "mfaWebauthnReg";
+const USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX = "mfaWebauthnAuth";
+const USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW = 300;
+//#endregion
+export { USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX };
+//# sourceMappingURL=constants.mjs.map

package/dist/core/entities/user-authenticator/constants.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"constants.mjs","names":["USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX","USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX","USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX","USER_AUTHENTICATOR_VERIFY_LOCK_TTL","USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL","Math","floor","USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR","USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX","USER_AUTHENTICATOR_ATTEMPT_WINDOW","USER_AUTHENTICATOR_TOTP_ALGORITHM","USER_AUTHENTICATOR_TOTP_DIGITS","USER_AUTHENTICATOR_TOTP_PERIOD","USER_AUTHENTICATOR_RECOVERY_CODE_COUNT","USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX","USER_AUTHENTICATOR_EMAIL_CODE_LENGTH","USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES","USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX","USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN","USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX","USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX","USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW"],"sources":["../../../../src/core/entities/user-authenticator/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n// Failed-attempt counter — a raw number bumped via the cache's atomic\n// increment, so concurrent failures (verify or confirm) never under-count\n// the exponential backoff. The lockout deadline lives under its own prefix.\nexport const USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX = 'mfaAttempt';\nexport const USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX = 'mfaThrottle';\n\n// Per-user renewable lock serializing concurrent verify critical sections so a\n// factor (recovery code / TOTP step) is consumed exactly once. The TTL bounds a\n// crashed request; the active owner renews its lease while verification runs.\nexport const USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX = 'mfaVerifyLock';\nexport const USER_AUTHENTICATOR_VERIFY_LOCK_TTL = 10_000;\nexport const USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL = Math.floor(\n USER_AUTHENTICATOR_VERIFY_LOCK_TTL / 3,\n);\n\n/**\n * Per-account exponential backoff for failed challenge codes:\n * lock = min(MAX, FACTOR * 2^(n-1)) seconds after the n-th failure,\n * reset on success. The counter itself expires after the window.\n */\nexport const USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR = 1;\nexport const USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX = 300;\nexport const USER_AUTHENTICATOR_ATTEMPT_WINDOW = 3_600;\n\nexport const USER_AUTHENTICATOR_TOTP_ALGORITHM = 'SHA1';\nexport const USER_AUTHENTICATOR_TOTP_DIGITS = 6;\nexport const USER_AUTHENTICATOR_TOTP_PERIOD = 30;\n\nexport const USER_AUTHENTICATOR_RECOVERY_CODE_COUNT = 10;\n\nexport const USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX = 'mfaEmailCode';\nexport const USER_AUTHENTICATOR_EMAIL_CODE_LENGTH = 6;\nexport const USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES = 10;\n\n// Per-user cooldown between challenge-code emails (seconds). Bounds mail-capacity\n// abuse — an authenticated caller cannot spray unlimited OTP mails. Separate from\n// the verification backoff (which only tracks failed verifies, not sends).\nexport const USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX = 'mfaEmailSend';\nexport const USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN = 60;\n\nexport const USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX = 'mfaWebauthnReg';\nexport const USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX = 'mfaWebauthnAuth';\nexport const USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW = 300;\n"],"mappings":";;;;AAUA,MAAaA,0CAA0C;AACvD,MAAaC,2CAA2C;AAKxD,MAAaC,8CAA8C;AAC3D,MAAaC,qCAAqC;AAClD,MAAaC,gDAAgDC,KAAKC,MAC9DH,qCAAqC,CAAA;;;;;GAQzC,MAAaI,yCAAyC;AACtD,MAAaC,sCAAsC;AACnD,MAAaC,oCAAoC;AAEjD,MAAaC,oCAAoC;AACjD,MAAaC,iCAAiC;AAC9C,MAAaC,iCAAiC;AAE9C,MAAaC,yCAAyC;AAEtD,MAAaC,6CAA6C;AAC1D,MAAaC,uCAAuC;AACpD,MAAaC,mDAAmD;AAKhE,MAAaC,6CAA6C;AAC1D,MAAaC,yCAAyC;AAEtD,MAAaC,+CAA+C;AAC5D,MAAaC,gDAAgD;AAC7D,MAAaC,+CAA+C"}

package/dist/core/entities/user-authenticator/helpers.d.ts ADDED Viewed

@@ -0,0 +1,10 @@
+import { UserAuthenticatorKind } from '@authup/core-kit';
+export declare function generateRecoveryCode(): string;
+/**
+ * Classify a bare one-time code by shape: an all-digit token is a TOTP
+ * code, anything else (xxxxx-xxxxx) a recovery code. Used by the token
+ * endpoint's `otp` parameter, which carries no explicit kind.
+ */
+export declare function guessUserAuthenticatorKindByResponse(response: string): `${UserAuthenticatorKind}`;
+export declare function generateNumericCode(length: number): string;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/core/entities/user-authenticator/helpers.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-authenticator/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAOzD,wBAAgB,oBAAoB,IAAI,MAAM,CAa7C;AAED;;;;GAIG;AACH,wBAAgB,oCAAoC,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAIjG;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAS1D"}

package/dist/core/entities/user-authenticator/helpers.mjs ADDED Viewed

@@ -0,0 +1,35 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { UserAuthenticatorKind } from "@authup/core-kit";
+import { getRandomValues } from "uncrypto";
+//#region src/core/entities/user-authenticator/helpers.ts
+const RECOVERY_CODE_ALPHABET = "23456789abcdefghjkmnpqrstuvwxyz";
+const RECOVERY_CODE_GROUP_LENGTH = 5;
+function generateRecoveryCode() {
+	const size = RECOVERY_CODE_GROUP_LENGTH * 2;
+	const bytes = getRandomValues(new Uint8Array(size));
+	let output = "";
+	for (let i = 0; i < size; i++) {
+		if (i === RECOVERY_CODE_GROUP_LENGTH) output += "-";
+		output += RECOVERY_CODE_ALPHABET[bytes[i] % 31];
+	}
+	return output;
+}
+/**
+* Classify a bare one-time code by shape: an all-digit token is a TOTP
+* code, anything else (xxxxx-xxxxx) a recovery code. Used by the token
+* endpoint's `otp` parameter, which carries no explicit kind.
+*/ function guessUserAuthenticatorKindByResponse(response) {
+	return /^[0-9]{4,10}$/.test(response.trim()) ? UserAuthenticatorKind.TOTP : UserAuthenticatorKind.RECOVERY;
+}
+function generateNumericCode(length) {
+	const bytes = getRandomValues(new Uint8Array(length));
+	let output = "";
+	for (let i = 0; i < length; i++) output += String(bytes[i] % 10);
+	return output;
+}
+//#endregion
+export { generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse };
+//# sourceMappingURL=helpers.mjs.map

package/dist/core/entities/user-authenticator/helpers.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"helpers.mjs","names":["UserAuthenticatorKind","getRandomValues","RECOVERY_CODE_ALPHABET","RECOVERY_CODE_GROUP_LENGTH","generateRecoveryCode","size","bytes","Uint8Array","output","i","length","guessUserAuthenticatorKindByResponse","response","test","trim","TOTP","RECOVERY","generateNumericCode","String"],"sources":["../../../../src/core/entities/user-authenticator/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserAuthenticatorKind } from '@authup/core-kit';\nimport { getRandomValues } from 'uncrypto';\n\n// no ambiguous characters (0/o, 1/l/i) — codes get typed by hand\nconst RECOVERY_CODE_ALPHABET = '23456789abcdefghjkmnpqrstuvwxyz';\nconst RECOVERY_CODE_GROUP_LENGTH = 5;\n\nexport function generateRecoveryCode(): string {\n const size = RECOVERY_CODE_GROUP_LENGTH * 2;\n const bytes = getRandomValues(new Uint8Array(size));\n\n let output = '';\n for (let i = 0; i < size; i++) {\n if (i === RECOVERY_CODE_GROUP_LENGTH) {\n output += '-';\n }\n output += RECOVERY_CODE_ALPHABET[bytes[i] % RECOVERY_CODE_ALPHABET.length];\n }\n\n return output;\n}\n\n/**\n * Classify a bare one-time code by shape: an all-digit token is a TOTP\n * code, anything else (xxxxx-xxxxx) a recovery code. Used by the token\n * endpoint's `otp` parameter, which carries no explicit kind.\n */\nexport function guessUserAuthenticatorKindByResponse(response: string): `${UserAuthenticatorKind}` {\n return /^[0-9]{4,10}$/.test(response.trim()) ?\n UserAuthenticatorKind.TOTP :\n UserAuthenticatorKind.RECOVERY;\n}\n\nexport function generateNumericCode(length: number): string {\n const bytes = getRandomValues(new Uint8Array(length));\n\n let output = '';\n for (let i = 0; i < length; i++) {\n output += String(bytes[i] % 10);\n }\n\n return output;\n}\n"],"mappings":";;;;;;AAWA,MAAME,yBAAyB;AAC/B,MAAMC,6BAA6B;AAEnC,SAAgBC,uBAAAA;CACZ,MAAMC,OAAOF,6BAA6B;CAC1C,MAAMG,QAAQL,gBAAgB,IAAIM,WAAWF,IAAAA,CAAAA;CAE7C,IAAIG,SAAS;CACb,KAAK,IAAIC,IAAI,GAAGA,IAAIJ,MAAMI,KAAK;EAC3B,IAAIA,MAAMN,4BACNK,UAAU;EAEdA,UAAUN,uBAAuBI,MAAMG,KAAKP;CAChD;CAEA,OAAOM;AACX;;;;;GAOA,SAAgBG,qCAAqCC,UAAgB;CACjE,OAAO,gBAAgBC,KAAKD,SAASE,KAAI,CAAA,IACrCd,sBAAsBe,OACtBf,sBAAsBgB;AAC9B;AAEA,SAAgBC,oBAAoBP,QAAc;CAC9C,MAAMJ,QAAQL,gBAAgB,IAAIM,WAAWG,MAAAA,CAAAA;CAE7C,IAAIF,SAAS;CACb,KAAK,IAAIC,IAAI,GAAGA,IAAIC,QAAQD,KACxBD,UAAUU,OAAOZ,MAAMG,KAAK,EAAA;CAGhC,OAAOD;AACX"}

package/dist/core/entities/user-authenticator/index.d.ts ADDED Viewed

@@ -0,0 +1,6 @@
+export * from './constants.ts';
+export * from './helpers.ts';
+export * from './service.ts';
+export * from './types.ts';
+export * from './webauthn.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/user-authenticator/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-authenticator/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC"}

package/dist/core/entities/user-authenticator/index.mjs ADDED Viewed

@@ -0,0 +1,9 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX } from "./constants.mjs";
+import { generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse } from "./helpers.mjs";
+import { buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, verifyWebauthnAuthentication, verifyWebauthnRegistration } from "./webauthn.mjs";
+import { UserAuthenticatorService } from "./service.mjs";
+import { USER_AUTHENTICATOR_FILTER_KEYS } from "./types.mjs";
+export { USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAuthenticatorService, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse, verifyWebauthnAuthentication, verifyWebauthnRegistration };