npm - @authup/server-core - Versions diffs - 1.0.0-beta.52 → 1.0.0-beta.54 - Mend

@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1541) hide show

package/dist/adapters/database/migrations/postgres/1783769340000-Default.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"1783769340000-Default.mjs","names":["Default1783769340000","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/postgres/1783769340000-Default.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Security event log (plan 057), MFA — authenticator devices (plan 049) +\n * auth-method claims (plan 050), application access policy (plan 052) +\n * persisted consent (plan 055), realm key store (plans 069 + 071) and\n * RFC 8705 client authentication (plan 072).\n *\n * - Adds auth_events: append-only, PII-stripped security audit log. No FKs\n * by design: a row must survive deletion of the realm/actor/client it\n * references. Retention is per-row (`expires_at`, stamped at write from\n * `eventLogRetentionDays`; NULL = keep forever) and swept by the\n * event-cleaner component (plan 057).\n * - Adds auth_user_authenticators: polymorphic second-factor device rows\n * (kind: totp/recovery/email/webauthn) hanging off a user. The TOTP seed\n * (secret) is symmetrically encrypted at rest; recovery codes are hashed.\n * FKs to auth_users / auth_realms (ON DELETE CASCADE).\n * - Adds auth_sessions.mfa_at: instant the subject last passed a\n * second-factor challenge for the session (plan 049).\n * - Adds auth_sessions.auth_method: how the subject authenticated\n * (pwd/ldap/ext/client/robot — plan 050); NULL for pre-existing sessions.\n * - Adds auth_clients.access_policy_id: nullable FK to auth_policies\n * (ON DELETE SET NULL) — the policy that must pass for an identity to\n * authorize against the client (null = default-allow; plan 052).\n * - Adds auth_consents: one row per (client_id, sub, sub_kind, scope token)\n * a subject has approved at POST /authorize. Union/keep (missing tokens\n * only, never deleted on re-approval); built_in clients keep zero rows;\n * expires_at is dormant (always null in Stage 1) but honored by the\n * covering check. FKs to auth_clients / auth_realms and a nullable user_id\n * FK (all ON DELETE CASCADE, so a user deletion drops its consents;\n * plan 055).\n * - Adds auth_keys.use: JWK-use discriminator (sig | enc, RFC 7517 §4.2) —\n * generalizes auth_keys into the per-realm key store. enc rows hold the\n * realm's auto-generated symmetric at-rest encryption key (oct) that the\n * MFA seed cipher rides; existing rows default to sig (plan 069).\n * - Adds auth_keys.name (canonical identifier, backfilled from id),\n * auth_keys.status (lifecycle: active/passive/disabled) and the dormant\n * auth_keys.certificate (PEM chain, Stage B) — key management API\n * (plan 071 Stage A).\n * - Adds auth_trust_anchors: realm-scoped public CA certificates used by\n * RFC 8705 PKI client authentication (plan 071 Stage C).\n * - Replaces auth_clients.is_confidential with auth_method\n * (none/secret/tls) and adds token_binding_method (none/tls) for RFC 8705\n * client authentication and sender-constrained tokens (plan 072).\n */\nexport class Default1783769340000 implements MigrationInterface {\n name = 'Default1783769340000';\n\n public async up(queryRunner: QueryRunner): Promise<void> {\n // security event log (plan 057)\n await queryRunner.query(`\n CREATE TABLE \"auth_events\" (\n \"id\" uuid NOT NULL,\n \"scope\" character varying(64) NOT NULL,\n \"name\" character varying(64) NOT NULL,\n \"ref_type\" character varying(64),\n \"ref_id\" character varying(64),\n \"client_id\" uuid,\n \"actor_type\" character varying(16),\n \"actor_id\" uuid,\n \"actor_name\" character varying(128),\n \"request_path\" character varying(256),\n \"request_method\" character varying(10),\n \"request_ip_address\" character varying(45),\n \"request_user_agent\" character varying(512),\n \"realm_id\" uuid,\n \"data\" text,\n \"expiring\" boolean NOT NULL DEFAULT false,\n \"expires_at\" character varying(28),\n \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n CONSTRAINT \"PK_auth_events\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query('CREATE INDEX \"IDX_auth_events_name_scope\" ON \"auth_events\" (\"name\", \"scope\")');\n await queryRunner.query('CREATE INDEX \"IDX_auth_events_ref_type_ref_id\" ON \"auth_events\" (\"ref_type\", \"ref_id\")');\n await queryRunner.query('CREATE INDEX \"IDX_auth_events_client_id\" ON \"auth_events\" (\"client_id\")');\n await queryRunner.query('CREATE INDEX \"IDX_auth_events_actor_id\" ON \"auth_events\" (\"actor_id\")');\n await queryRunner.query('CREATE INDEX \"IDX_auth_events_actor_name\" ON \"auth_events\" (\"actor_name\")');\n await queryRunner.query('CREATE INDEX \"IDX_auth_events_request_ip_address\" ON \"auth_events\" (\"request_ip_address\")');\n await queryRunner.query('CREATE INDEX \"IDX_auth_events_realm_id\" ON \"auth_events\" (\"realm_id\")');\n await queryRunner.query('CREATE INDEX \"IDX_auth_events_expiring\" ON \"auth_events\" (\"expiring\")');\n await queryRunner.query('CREATE INDEX \"IDX_auth_events_expires_at\" ON \"auth_events\" (\"expires_at\")');\n await queryRunner.query('CREATE INDEX \"IDX_auth_events_created_at\" ON \"auth_events\" (\"created_at\")');\n\n // MFA authenticator devices (plan 049)\n await queryRunner.query(`\n CREATE TABLE \"auth_user_authenticators\" (\n \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n \"kind\" character varying(16) NOT NULL,\n \"name\" character varying(128),\n \"secret\" text,\n \"parameters\" text,\n \"codes\" text,\n \"confirmed\" boolean NOT NULL DEFAULT false,\n \"last_used_at\" character varying(28),\n \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"user_id\" uuid NOT NULL,\n \"realm_id\" uuid NOT NULL,\n CONSTRAINT \"PK_auth_user_authenticators\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query('CREATE INDEX \"IDX_auth_user_authenticators_kind\" ON \"auth_user_authenticators\" (\"kind\")');\n await queryRunner.query('CREATE INDEX \"IDX_auth_user_authenticators_user_id\" ON \"auth_user_authenticators\" (\"user_id\")');\n\n await queryRunner.query(`\n ALTER TABLE \"auth_user_authenticators\"\n ADD CONSTRAINT \"FK_auth_user_authenticators_user_id\" FOREIGN KEY (\"user_id\") REFERENCES \"auth_users\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_user_authenticators\"\n ADD CONSTRAINT \"FK_auth_user_authenticators_realm_id\" FOREIGN KEY (\"realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n\n await queryRunner.query(`\n ALTER TABLE \"auth_sessions\" ADD \"mfa_at\" character varying(28)\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_sessions\" ADD \"auth_method\" character varying(16)\n `);\n\n // application access policy (plan 052)\n await queryRunner.query(`\n ALTER TABLE \"auth_clients\" ADD \"access_policy_id\" uuid\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_clients\"\n ADD CONSTRAINT \"FK_auth_clients_access_policy_id\" FOREIGN KEY (\"access_policy_id\") REFERENCES \"auth_policies\"(\"id\") ON DELETE SET NULL ON UPDATE NO ACTION\n `);\n\n // persisted per-scope consent (plan 055)\n await queryRunner.query(`\n CREATE TABLE \"auth_consents\" (\n \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n \"sub\" character varying(64) NOT NULL,\n \"sub_kind\" character varying(64) NOT NULL,\n \"scope\" character varying(128) NOT NULL,\n \"expires_at\" character varying(28),\n \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"client_id\" uuid NOT NULL,\n \"realm_id\" uuid NOT NULL,\n \"user_id\" uuid,\n CONSTRAINT \"UQ_auth_consents_subject_scope\" UNIQUE (\"client_id\", \"sub\", \"sub_kind\", \"scope\"),\n CONSTRAINT \"PK_auth_consents\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query('CREATE INDEX \"IDX_auth_consents_sub\" ON \"auth_consents\" (\"sub\")');\n await queryRunner.query('CREATE INDEX \"IDX_auth_consents_client_id\" ON \"auth_consents\" (\"client_id\")');\n await queryRunner.query('CREATE INDEX \"IDX_auth_consents_realm_id\" ON \"auth_consents\" (\"realm_id\")');\n await queryRunner.query('CREATE INDEX \"IDX_auth_consents_user_id\" ON \"auth_consents\" (\"user_id\")');\n\n await queryRunner.query(`\n ALTER TABLE \"auth_consents\"\n ADD CONSTRAINT \"FK_auth_consents_client_id\" FOREIGN KEY (\"client_id\") REFERENCES \"auth_clients\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_consents\"\n ADD CONSTRAINT \"FK_auth_consents_realm_id\" FOREIGN KEY (\"realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_consents\"\n ADD CONSTRAINT \"FK_auth_consents_user_id\" FOREIGN KEY (\"user_id\") REFERENCES \"auth_users\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n\n // realm key store use discriminator (plan 069)\n await queryRunner.query(`\n ALTER TABLE \"auth_keys\" ADD \"use\" character varying(64) NOT NULL DEFAULT 'sig'\n `);\n\n // key management API (plan 071 Stage A)\n await queryRunner.query(`\n ALTER TABLE \"auth_keys\" ADD \"name\" character varying(128)\n `);\n await queryRunner.query(`\n UPDATE \"auth_keys\" SET \"name\" = \"id\"::text\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_keys\" ALTER COLUMN \"name\" SET NOT NULL\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_keys\"\n ADD CONSTRAINT \"UQ_auth_keys_name_realm_id\" UNIQUE (\"name\", \"realm_id\")\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_keys\" ADD \"status\" character varying(64) NOT NULL DEFAULT 'active'\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_keys\" ADD \"certificate\" text\n `);\n // Widen the key-material columns: an imported RSA-4096 private key\n // wrapped under a SECRETS_ENCRYPTION_KEY exceeds character varying(4096).\n await queryRunner.query(`\n ALTER TABLE \"auth_keys\" ALTER COLUMN \"decryption_key\" TYPE text\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_keys\" ALTER COLUMN \"encryption_key\" TYPE text\n `);\n\n // RFC 8705 realm trust anchors (plan 071 Stage C)\n await queryRunner.query(`\n CREATE TABLE \"auth_trust_anchors\" (\n \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n \"name\" character varying(128) NOT NULL,\n \"certificate\" text NOT NULL,\n \"enabled\" boolean NOT NULL DEFAULT true,\n \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"realm_id\" uuid NOT NULL,\n CONSTRAINT \"UQ_auth_trust_anchors_name_realm_id\" UNIQUE (\"name\", \"realm_id\"),\n CONSTRAINT \"PK_auth_trust_anchors\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query('CREATE INDEX \"IDX_auth_trust_anchors_realm_id\" ON \"auth_trust_anchors\" (\"realm_id\")');\n await queryRunner.query(`\n ALTER TABLE \"auth_trust_anchors\"\n ADD CONSTRAINT \"FK_auth_trust_anchors_realm_id\" FOREIGN KEY (\"realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n\n // RFC 8705 client authentication and token binding (plan 072)\n await queryRunner.query(`\n ALTER TABLE \"auth_clients\" ADD \"auth_method\" character varying(16) NOT NULL DEFAULT 'none'\n `);\n await queryRunner.query(`\n UPDATE \"auth_clients\" SET \"auth_method\" = 'secret' WHERE \"is_confidential\" = true\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_clients\" ADD \"token_binding_method\" character varying(16) NOT NULL DEFAULT 'none'\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_clients\" DROP COLUMN \"is_confidential\"\n `);\n }\n\n public async down(queryRunner: QueryRunner): Promise<void> {\n // RFC 8705 client authentication and token binding (plan 072)\n await queryRunner.query(`\n ALTER TABLE \"auth_clients\" ADD \"is_confidential\" boolean NOT NULL DEFAULT false\n `);\n await queryRunner.query(`\n UPDATE \"auth_clients\" SET \"is_confidential\" = true WHERE \"auth_method\" <> 'none'\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_clients\" DROP COLUMN \"token_binding_method\"\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_clients\" DROP COLUMN \"auth_method\"\n `);\n\n // RFC 8705 realm trust anchors (plan 071 Stage C)\n await queryRunner.query(`\n ALTER TABLE \"auth_trust_anchors\" DROP CONSTRAINT \"FK_auth_trust_anchors_realm_id\"\n `);\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_trust_anchors_realm_id\"');\n await queryRunner.query(`\n DROP TABLE \"auth_trust_anchors\"\n `);\n\n // key management API (plan 071 Stage A) — reverse last-in-first-out\n await queryRunner.query(`\n ALTER TABLE \"auth_keys\" ALTER COLUMN \"encryption_key\" TYPE character varying(4096)\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_keys\" ALTER COLUMN \"decryption_key\" TYPE character varying(4096)\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_keys\" DROP COLUMN \"certificate\"\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_keys\" DROP COLUMN \"status\"\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_keys\" DROP CONSTRAINT \"UQ_auth_keys_name_realm_id\"\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_keys\" DROP COLUMN \"name\"\n `);\n\n // realm key store use discriminator (plan 069)\n await queryRunner.query(`\n ALTER TABLE \"auth_keys\" DROP COLUMN \"use\"\n `);\n\n // persisted per-scope consent (plan 055)\n await queryRunner.query(`\n ALTER TABLE \"auth_consents\" DROP CONSTRAINT \"FK_auth_consents_user_id\"\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_consents\" DROP CONSTRAINT \"FK_auth_consents_realm_id\"\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_consents\" DROP CONSTRAINT \"FK_auth_consents_client_id\"\n `);\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_consents_user_id\"');\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_consents_realm_id\"');\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_consents_client_id\"');\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_consents_sub\"');\n await queryRunner.query(`\n DROP TABLE \"auth_consents\"\n `);\n\n // application access policy (plan 052)\n await queryRunner.query(`\n ALTER TABLE \"auth_clients\" DROP CONSTRAINT \"FK_auth_clients_access_policy_id\"\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_clients\" DROP COLUMN \"access_policy_id\"\n `);\n\n await queryRunner.query(`\n ALTER TABLE \"auth_sessions\" DROP COLUMN \"auth_method\"\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_sessions\" DROP COLUMN \"mfa_at\"\n `);\n\n await queryRunner.query(`\n ALTER TABLE \"auth_user_authenticators\" DROP CONSTRAINT \"FK_auth_user_authenticators_realm_id\"\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_user_authenticators\" DROP CONSTRAINT \"FK_auth_user_authenticators_user_id\"\n `);\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_user_authenticators_user_id\"');\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_user_authenticators_kind\"');\n await queryRunner.query(`\n DROP TABLE \"auth_user_authenticators\"\n `);\n\n // security event log (plan 057)\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_created_at\"');\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_expires_at\"');\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_expiring\"');\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_realm_id\"');\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_request_ip_address\"');\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_actor_name\"');\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_actor_id\"');\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_client_id\"');\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_ref_type_ref_id\"');\n await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_events_name_scope\"');\n await queryRunner.query('DROP TABLE \"auth_events\"');\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDA,IAAaA,uBAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EAErD,MAAMA,YAAYC,MAAM;;;;;;;;;;;;;;;;;;;;;;SAsBvB;EACD,MAAMD,YAAYC,MAAM,sFAAA;EACxB,MAAMD,YAAYC,MAAM,gGAAA;EACxB,MAAMD,YAAYC,MAAM,+EAAA;EACxB,MAAMD,YAAYC,MAAM,6EAAA;EACxB,MAAMD,YAAYC,MAAM,iFAAA;EACxB,MAAMD,YAAYC,MAAM,iGAAA;EACxB,MAAMD,YAAYC,MAAM,6EAAA;EACxB,MAAMD,YAAYC,MAAM,6EAAA;EACxB,MAAMD,YAAYC,MAAM,iFAAA;EACxB,MAAMD,YAAYC,MAAM,iFAAA;EAGxB,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;;;SAgBvB;EACD,MAAMD,YAAYC,MAAM,+FAAA;EACxB,MAAMD,YAAYC,MAAM,qGAAA;EAExB,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAGD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;;SAevB;EACD,MAAMD,YAAYC,MAAM,uEAAA;EACxB,MAAMD,YAAYC,MAAM,mFAAA;EACxB,MAAMD,YAAYC,MAAM,iFAAA;EACxB,MAAMD,YAAYC,MAAM,+EAAA;EAExB,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;SAYvB;EACD,MAAMD,YAAYC,MAAM,2FAAA;EACxB,MAAMD,YAAYC,MAAM;;;SAGvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;CACL;CAEA,MAAaC,KAAKF,aAAyC;EAEvD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM,2DAAA;EACxB,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM,qDAAA;EACxB,MAAMD,YAAYC,MAAM,sDAAA;EACxB,MAAMD,YAAYC,MAAM,uDAAA;EACxB,MAAMD,YAAYC,MAAM,iDAAA;EACxB,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM,gEAAA;EACxB,MAAMD,YAAYC,MAAM,6DAAA;EACxB,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM,sDAAA;EACxB,MAAMD,YAAYC,MAAM,sDAAA;EACxB,MAAMD,YAAYC,MAAM,oDAAA;EACxB,MAAMD,YAAYC,MAAM,oDAAA;EACxB,MAAMD,YAAYC,MAAM,8DAAA;EACxB,MAAMD,YAAYC,MAAM,sDAAA;EACxB,MAAMD,YAAYC,MAAM,oDAAA;EACxB,MAAMD,YAAYC,MAAM,qDAAA;EACxB,MAAMD,YAAYC,MAAM,2DAAA;EACxB,MAAMD,YAAYC,MAAM,sDAAA;EACxB,MAAMD,YAAYC,MAAM,4BAAA;CAC5B;AACJ"}

package/dist/adapters/database/migrations/postgres/1784289540000-CamelCaseAttributes.d.ts ADDED Viewed

@@ -0,0 +1,12 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+/**
+ * Plan 073 data migration. Database identifiers remain snake_case; values which
+ * encode management/entity property names move to camelCase. Built-in policy
+ * data is intentionally excluded — the provisioner overwrites it on every boot.
+ */
+export declare class CamelCaseAttributes1784289540000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1784289540000-CamelCaseAttributes.d.ts.map

package/dist/adapters/database/migrations/postgres/1784289540000-CamelCaseAttributes.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"1784289540000-CamelCaseAttributes.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/postgres/1784289540000-CamelCaseAttributes.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAyC/D;;;;GAIG;AACH,qBAAa,gCAAiC,YAAW,kBAAkB;IACvE,IAAI,SAAsC;IAE7B,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAM3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAK7D"}

package/dist/adapters/database/migrations/postgres/1784289540000-CamelCaseAttributes.mjs ADDED Viewed

@@ -0,0 +1,42 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { camelCase, snakeCase } from "change-case";
+//#region src/adapters/database/migrations/postgres/1784289540000-CamelCaseAttributes.ts
+/**
+* Rewrite every distinct property-name key in `valueColumn` through `transform`.
+* These columns hold entity property names set by authup (identity-provider
+* attribute keys / targets, user-attribute names), so a blanket transform is
+* correct. The unique `(owner, value)` index means a rename can collide with an
+* already-migrated row; the source duplicate is removed first to keep the
+* update constraint-safe.
+*/ async function renameKeys(queryRunner, table, ownerColumn, valueColumn, transform) {
+	const rows = await queryRunner.query(`SELECT DISTINCT "${valueColumn}" AS "value" FROM "${table}" WHERE "${valueColumn}" IS NOT NULL`);
+	for (const { value } of rows) {
+		const next = transform(value);
+		if (next === value) continue;
+		await queryRunner.query(`DELETE FROM "${table}" AS "source" USING "${table}" AS "target" WHERE "source"."${ownerColumn}" = "target"."${ownerColumn}" AND "source"."${valueColumn}" = $1 AND "target"."${valueColumn}" = $2`, [value, next]);
+		await queryRunner.query(`UPDATE "${table}" SET "${valueColumn}" = $1 WHERE "${valueColumn}" = $2`, [next, value]);
+	}
+}
+/**
+* Plan 073 data migration. Database identifiers remain snake_case; values which
+* encode management/entity property names move to camelCase. Built-in policy
+* data is intentionally excluded — the provisioner overwrites it on every boot.
+*/ var CamelCaseAttributes1784289540000 = class {
+	name = "CamelCaseAttributes1784289540000";
+	async up(queryRunner) {
+		await renameKeys(queryRunner, "auth_identity_provider_attributes", "provider_id", "name", camelCase);
+		await renameKeys(queryRunner, "auth_identity_provider_attribute_mappings", "provider_id", "target_name", camelCase);
+		await renameKeys(queryRunner, "auth_user_attributes", "user_id", "name", camelCase);
+	}
+	async down(queryRunner) {
+		await renameKeys(queryRunner, "auth_user_attributes", "user_id", "name", snakeCase);
+		await renameKeys(queryRunner, "auth_identity_provider_attribute_mappings", "provider_id", "target_name", snakeCase);
+		await renameKeys(queryRunner, "auth_identity_provider_attributes", "provider_id", "name", snakeCase);
+	}
+};
+//#endregion
+export { CamelCaseAttributes1784289540000 };
+//# sourceMappingURL=1784289540000-CamelCaseAttributes.mjs.map

package/dist/adapters/database/migrations/postgres/1784289540000-CamelCaseAttributes.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"1784289540000-CamelCaseAttributes.mjs","names":["camelCase","snakeCase","renameKeys","queryRunner","table","ownerColumn","valueColumn","transform","rows","query","value","next","CamelCaseAttributes1784289540000","name","up","down"],"sources":["../../../../../src/adapters/database/migrations/postgres/1784289540000-CamelCaseAttributes.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { camelCase, snakeCase } from 'change-case';\nimport type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Rewrite every distinct property-name key in `valueColumn` through `transform`.\n * These columns hold entity property names set by authup (identity-provider\n * attribute keys / targets, user-attribute names), so a blanket transform is\n * correct. The unique `(owner, value)` index means a rename can collide with an\n * already-migrated row; the source duplicate is removed first to keep the\n * update constraint-safe.\n */\nasync function renameKeys(\n queryRunner: QueryRunner,\n table: string,\n ownerColumn: string,\n valueColumn: string,\n transform: (value: string) => string,\n): Promise<void> {\n const rows: { value: string }[] = await queryRunner.query(\n `SELECT DISTINCT \"${valueColumn}\" AS \"value\" FROM \"${table}\" WHERE \"${valueColumn}\" IS NOT NULL`,\n );\n\n for (const { value } of rows) {\n const next = transform(value);\n if (next === value) {\n continue;\n }\n\n await queryRunner.query(\n `DELETE FROM \"${table}\" AS \"source\" USING \"${table}\" AS \"target\" ` +\n `WHERE \"source\".\"${ownerColumn}\" = \"target\".\"${ownerColumn}\" ` +\n `AND \"source\".\"${valueColumn}\" = $1 AND \"target\".\"${valueColumn}\" = $2`,\n [value, next],\n );\n\n await queryRunner.query(\n `UPDATE \"${table}\" SET \"${valueColumn}\" = $1 WHERE \"${valueColumn}\" = $2`,\n [next, value],\n );\n }\n}\n\n/**\n * Plan 073 data migration. Database identifiers remain snake_case; values which\n * encode management/entity property names move to camelCase. Built-in policy\n * data is intentionally excluded — the provisioner overwrites it on every boot.\n */\nexport class CamelCaseAttributes1784289540000 implements MigrationInterface {\n name = 'CamelCaseAttributes1784289540000';\n\n public async up(queryRunner: QueryRunner): Promise<void> {\n await renameKeys(queryRunner, 'auth_identity_provider_attributes', 'provider_id', 'name', camelCase);\n await renameKeys(queryRunner, 'auth_identity_provider_attribute_mappings', 'provider_id', 'target_name', camelCase);\n await renameKeys(queryRunner, 'auth_user_attributes', 'user_id', 'name', camelCase);\n }\n\n public async down(queryRunner: QueryRunner): Promise<void> {\n await renameKeys(queryRunner, 'auth_user_attributes', 'user_id', 'name', snakeCase);\n await renameKeys(queryRunner, 'auth_identity_provider_attribute_mappings', 'provider_id', 'target_name', snakeCase);\n await renameKeys(queryRunner, 'auth_identity_provider_attributes', 'provider_id', 'name', snakeCase);\n }\n}\n"],"mappings":";;;;;;;;;;;;GAkBA,eAAeE,WACXC,aACAC,OACAC,aACAC,aACAC,WAAoC;CAEpC,MAAMC,OAA4B,MAAML,YAAYM,MAChD,oBAAoBH,YAAY,qBAAqBF,MAAM,WAAWE,YAAY,cAAc;CAGpG,KAAK,MAAM,EAAEI,WAAWF,MAAM;EAC1B,MAAMG,OAAOJ,UAAUG,KAAAA;EACvB,IAAIC,SAASD,OACT;EAGJ,MAAMP,YAAYM,MACd,gBAAgBL,MAAM,uBAAuBA,MAAM,gCAChCC,YAAY,gBAAgBA,YAAY,kBAC1CC,YAAY,uBAAuBA,YAAY,SAChE,CAACI,OAAOC,IAAAA,CAAK;EAGjB,MAAMR,YAAYM,MACd,WAAWL,MAAM,SAASE,YAAY,gBAAgBA,YAAY,SAClE,CAACK,MAAMD,KAAAA,CAAM;CAErB;AACJ;;;;;GAOA,IAAaE,mCAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGX,aAAyC;EACrD,MAAMD,WAAWC,aAAa,qCAAqC,eAAe,QAAQH,SAAAA;EAC1F,MAAME,WAAWC,aAAa,6CAA6C,eAAe,eAAeH,SAAAA;EACzG,MAAME,WAAWC,aAAa,wBAAwB,WAAW,QAAQH,SAAAA;CAC7E;CAEA,MAAae,KAAKZ,aAAyC;EACvD,MAAMD,WAAWC,aAAa,wBAAwB,WAAW,QAAQF,SAAAA;EACzE,MAAMC,WAAWC,aAAa,6CAA6C,eAAe,eAAeF,SAAAA;EACzG,MAAMC,WAAWC,aAAa,qCAAqC,eAAe,QAAQF,SAAAA;CAC9F;AACJ"}

package/dist/adapters/database/migrations/postgres/1784460916000-RemoveRobots.d.ts ADDED Viewed

@@ -0,0 +1,18 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+/**
+ * Drops the robot entity: auth_robots, auth_robot_roles,
+ * auth_robot_permissions, auth_sessions.robot_id and the dangling robot
+ * FKs on the legacy auth_refresh_tokens / auth_authorization_codes
+ * tables. Robots are superseded by clients (client_credentials grant);
+ * robot rows and their role/permission bindings are NOT migrated onto
+ * clients — recreate machine identities as clients by hand.
+ *
+ * down() recreates the pre-removal schema shape, constraint names
+ * included, so the older migrations' down() paths keep working.
+ */
+export declare class RemoveRobots1784460916000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1784460916000-RemoveRobots.d.ts.map

package/dist/adapters/database/migrations/postgres/1784460916000-RemoveRobots.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"1784460916000-RemoveRobots.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/postgres/1784460916000-RemoveRobots.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;IAChE,IAAI,SAA+B;IAEtB,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CA2H7D"}

package/dist/adapters/database/migrations/postgres/1784460916000-RemoveRobots.mjs ADDED Viewed

@@ -0,0 +1,167 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/postgres/1784460916000-RemoveRobots.ts
+/**
+* Drops the robot entity: auth_robots, auth_robot_roles,
+* auth_robot_permissions, auth_sessions.robot_id and the dangling robot
+* FKs on the legacy auth_refresh_tokens / auth_authorization_codes
+* tables. Robots are superseded by clients (client_credentials grant);
+* robot rows and their role/permission bindings are NOT migrated onto
+* clients — recreate machine identities as clients by hand.
+*
+* down() recreates the pre-removal schema shape, constraint names
+* included, so the older migrations' down() paths keep working.
+*/ var RemoveRobots1784460916000 = class {
+	name = "RemoveRobots1784460916000";
+	async up(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions" DROP CONSTRAINT "FK_46b30e5d8e5d5de58d454f53f8c"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions" DROP COLUMN "robot_id"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_refresh_tokens" DROP CONSTRAINT "FK_6be38b6dbd4ce86ca3d17494ca9"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_authorization_codes" DROP CONSTRAINT "FK_32619f36922f433e27affc169e4"
+        `);
+		await queryRunner.query(`
+            DROP TABLE "auth_robot_permissions"
+        `);
+		await queryRunner.query(`
+            DROP TABLE "auth_robot_roles"
+        `);
+		await queryRunner.query(`
+            DROP TABLE "auth_robots"
+        `);
+	}
+	async down(queryRunner) {
+		await queryRunner.query(`
+            CREATE TABLE "auth_robots" (
+                "id" uuid NOT NULL DEFAULT uuid_generate_v4(),
+                "secret" character varying(256) NOT NULL,
+                "name" character varying(128) NOT NULL,
+                "description" text,
+                "active" boolean NOT NULL DEFAULT true,
+                "created_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "updated_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "user_id" uuid,
+                "realm_id" uuid NOT NULL,
+                "display_name" character varying(256),
+                "client_id" uuid,
+                CONSTRAINT "UQ_f89cc2abf1d7e284a7d6cd59c12" UNIQUE ("name", "realm_id"),
+                CONSTRAINT "PK_0417c432636b2b07e36aedd9804" PRIMARY KEY ("id")
+            )
+        `);
+		await queryRunner.query(`
+            CREATE INDEX "IDX_9c99802f3f360718344180c3f6" ON "auth_robots" ("realm_id")
+        `);
+		await queryRunner.query(`
+            CREATE INDEX "IDX_91942a5962da3b91175eeaa2db" ON "auth_robots" ("client_id")
+        `);
+		await queryRunner.query(`
+            CREATE TABLE "auth_robot_roles" (
+                "id" uuid NOT NULL DEFAULT uuid_generate_v4(),
+                "role_id" uuid NOT NULL,
+                "role_realm_id" uuid,
+                "robot_id" character varying NOT NULL,
+                "robot_realm_id" uuid,
+                "created_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "updated_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "client_id" uuid,
+                CONSTRAINT "PK_6d175a60a9ac83747b28fa8bc6f" PRIMARY KEY ("id")
+            )
+        `);
+		await queryRunner.query(`
+            CREATE UNIQUE INDEX "IDX_515b3dc84ba9bec42bd0e92cbd" ON "auth_robot_roles" ("role_id", "robot_id")
+        `);
+		await queryRunner.query(`
+            CREATE TABLE "auth_robot_permissions" (
+                "id" uuid NOT NULL DEFAULT uuid_generate_v4(),
+                "robot_id" uuid NOT NULL,
+                "robot_realm_id" uuid,
+                "permission_id" uuid NOT NULL,
+                "permission_realm_id" uuid,
+                "created_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "updated_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "policy_id" uuid,
+                "realm_scope" character varying(50) NOT NULL DEFAULT 'own',
+                CONSTRAINT "PK_df48d512c182954136955472327" PRIMARY KEY ("id")
+            )
+        `);
+		await queryRunner.query(`
+            CREATE UNIQUE INDEX "IDX_0c2284272043ed8aba6689306b" ON "auth_robot_permissions" ("permission_id", "robot_id")
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robots"
+            ADD CONSTRAINT "FK_b6d73e3026e15c0af6c41ef8139" FOREIGN KEY ("user_id") REFERENCES "auth_users"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robots"
+            ADD CONSTRAINT "FK_9c99802f3f360718344180c3f68" FOREIGN KEY ("realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robots"
+            ADD CONSTRAINT "FK_91942a5962da3b91175eeaa2db1" FOREIGN KEY ("client_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_roles"
+            ADD CONSTRAINT "FK_2256b04cbdb1e16e5144e14750b" FOREIGN KEY ("role_id") REFERENCES "auth_roles"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_roles"
+            ADD CONSTRAINT "FK_28146c7babddcad18116dabfa9e" FOREIGN KEY ("role_realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_roles"
+            ADD CONSTRAINT "FK_a4904e9c921294c80f75a0c3e02" FOREIGN KEY ("client_id") REFERENCES "auth_robots"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_roles"
+            ADD CONSTRAINT "FK_21994ec834c710276cce38c779d" FOREIGN KEY ("robot_realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_permissions"
+            ADD CONSTRAINT "FK_5af2884572a617e2532410f8221" FOREIGN KEY ("robot_id") REFERENCES "auth_robots"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_permissions"
+            ADD CONSTRAINT "FK_d52ab826ee04e008624df74cdc8" FOREIGN KEY ("robot_realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_permissions"
+            ADD CONSTRAINT "FK_b29fe901137f6944ecaf98fcb5a" FOREIGN KEY ("permission_id") REFERENCES "auth_permissions"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_permissions"
+            ADD CONSTRAINT "FK_1cacb8af1791a5303d30cbf8590" FOREIGN KEY ("permission_realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_robot_permissions"
+            ADD CONSTRAINT "FK_0786e0bee54b581c62d79a8cec7" FOREIGN KEY ("policy_id") REFERENCES "auth_policies"("id") ON DELETE
+            SET NULL ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions"
+            ADD "robot_id" uuid
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions"
+            ADD CONSTRAINT "FK_46b30e5d8e5d5de58d454f53f8c" FOREIGN KEY ("robot_id") REFERENCES "auth_robots"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_refresh_tokens"
+            ADD CONSTRAINT "FK_6be38b6dbd4ce86ca3d17494ca9" FOREIGN KEY ("robot_id") REFERENCES "auth_robots"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_authorization_codes"
+            ADD CONSTRAINT "FK_32619f36922f433e27affc169e4" FOREIGN KEY ("robot_id") REFERENCES "auth_robots"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+	}
+};
+//#endregion
+export { RemoveRobots1784460916000 };
+//# sourceMappingURL=1784460916000-RemoveRobots.mjs.map

package/dist/adapters/database/migrations/postgres/1784460916000-RemoveRobots.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"1784460916000-RemoveRobots.mjs","names":["RemoveRobots1784460916000","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/postgres/1784460916000-RemoveRobots.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Drops the robot entity: auth_robots, auth_robot_roles,\n * auth_robot_permissions, auth_sessions.robot_id and the dangling robot\n * FKs on the legacy auth_refresh_tokens / auth_authorization_codes\n * tables. Robots are superseded by clients (client_credentials grant);\n * robot rows and their role/permission bindings are NOT migrated onto\n * clients — recreate machine identities as clients by hand.\n *\n * down() recreates the pre-removal schema shape, constraint names\n * included, so the older migrations' down() paths keep working.\n */\nexport class RemoveRobots1784460916000 implements MigrationInterface {\n name = 'RemoveRobots1784460916000';\n\n public async up(queryRunner: QueryRunner): Promise<void> {\n await queryRunner.query(`\n ALTER TABLE \"auth_sessions\" DROP CONSTRAINT \"FK_46b30e5d8e5d5de58d454f53f8c\"\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_sessions\" DROP COLUMN \"robot_id\"\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_refresh_tokens\" DROP CONSTRAINT \"FK_6be38b6dbd4ce86ca3d17494ca9\"\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_authorization_codes\" DROP CONSTRAINT \"FK_32619f36922f433e27affc169e4\"\n `);\n await queryRunner.query(`\n DROP TABLE \"auth_robot_permissions\"\n `);\n await queryRunner.query(`\n DROP TABLE \"auth_robot_roles\"\n `);\n await queryRunner.query(`\n DROP TABLE \"auth_robots\"\n `);\n }\n\n public async down(queryRunner: QueryRunner): Promise<void> {\n await queryRunner.query(`\n CREATE TABLE \"auth_robots\" (\n \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n \"secret\" character varying(256) NOT NULL,\n \"name\" character varying(128) NOT NULL,\n \"description\" text,\n \"active\" boolean NOT NULL DEFAULT true,\n \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"user_id\" uuid,\n \"realm_id\" uuid NOT NULL,\n \"display_name\" character varying(256),\n \"client_id\" uuid,\n CONSTRAINT \"UQ_f89cc2abf1d7e284a7d6cd59c12\" UNIQUE (\"name\", \"realm_id\"),\n CONSTRAINT \"PK_0417c432636b2b07e36aedd9804\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9c99802f3f360718344180c3f6\" ON \"auth_robots\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_91942a5962da3b91175eeaa2db\" ON \"auth_robots\" (\"client_id\")\n `);\n await queryRunner.query(`\n CREATE TABLE \"auth_robot_roles\" (\n \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n \"role_id\" uuid NOT NULL,\n \"role_realm_id\" uuid,\n \"robot_id\" character varying NOT NULL,\n \"robot_realm_id\" uuid,\n \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"client_id\" uuid,\n CONSTRAINT \"PK_6d175a60a9ac83747b28fa8bc6f\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query(`\n CREATE UNIQUE INDEX \"IDX_515b3dc84ba9bec42bd0e92cbd\" ON \"auth_robot_roles\" (\"role_id\", \"robot_id\")\n `);\n await queryRunner.query(`\n CREATE TABLE \"auth_robot_permissions\" (\n \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n \"robot_id\" uuid NOT NULL,\n \"robot_realm_id\" uuid,\n \"permission_id\" uuid NOT NULL,\n \"permission_realm_id\" uuid,\n \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"policy_id\" uuid,\n \"realm_scope\" character varying(50) NOT NULL DEFAULT 'own',\n CONSTRAINT \"PK_df48d512c182954136955472327\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query(`\n CREATE UNIQUE INDEX \"IDX_0c2284272043ed8aba6689306b\" ON \"auth_robot_permissions\" (\"permission_id\", \"robot_id\")\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robots\"\n ADD CONSTRAINT \"FK_b6d73e3026e15c0af6c41ef8139\" FOREIGN KEY (\"user_id\") REFERENCES \"auth_users\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robots\"\n ADD CONSTRAINT \"FK_9c99802f3f360718344180c3f68\" FOREIGN KEY (\"realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robots\"\n ADD CONSTRAINT \"FK_91942a5962da3b91175eeaa2db1\" FOREIGN KEY (\"client_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_roles\"\n ADD CONSTRAINT \"FK_2256b04cbdb1e16e5144e14750b\" FOREIGN KEY (\"role_id\") REFERENCES \"auth_roles\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_roles\"\n ADD CONSTRAINT \"FK_28146c7babddcad18116dabfa9e\" FOREIGN KEY (\"role_realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_roles\"\n ADD CONSTRAINT \"FK_a4904e9c921294c80f75a0c3e02\" FOREIGN KEY (\"client_id\") REFERENCES \"auth_robots\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_roles\"\n ADD CONSTRAINT \"FK_21994ec834c710276cce38c779d\" FOREIGN KEY (\"robot_realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_permissions\"\n ADD CONSTRAINT \"FK_5af2884572a617e2532410f8221\" FOREIGN KEY (\"robot_id\") REFERENCES \"auth_robots\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_permissions\"\n ADD CONSTRAINT \"FK_d52ab826ee04e008624df74cdc8\" FOREIGN KEY (\"robot_realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_permissions\"\n ADD CONSTRAINT \"FK_b29fe901137f6944ecaf98fcb5a\" FOREIGN KEY (\"permission_id\") REFERENCES \"auth_permissions\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_permissions\"\n ADD CONSTRAINT \"FK_1cacb8af1791a5303d30cbf8590\" FOREIGN KEY (\"permission_realm_id\") REFERENCES \"auth_realms\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_robot_permissions\"\n ADD CONSTRAINT \"FK_0786e0bee54b581c62d79a8cec7\" FOREIGN KEY (\"policy_id\") REFERENCES \"auth_policies\"(\"id\") ON DELETE\n SET NULL ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_sessions\"\n ADD \"robot_id\" uuid\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_sessions\"\n ADD CONSTRAINT \"FK_46b30e5d8e5d5de58d454f53f8c\" FOREIGN KEY (\"robot_id\") REFERENCES \"auth_robots\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_refresh_tokens\"\n ADD CONSTRAINT \"FK_6be38b6dbd4ce86ca3d17494ca9\" FOREIGN KEY (\"robot_id\") REFERENCES \"auth_robots\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_authorization_codes\"\n ADD CONSTRAINT \"FK_32619f36922f433e27affc169e4\" FOREIGN KEY (\"robot_id\") REFERENCES \"auth_robots\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n }\n}\n"],"mappings":";;;;;;;;;;;;;;GAoBA,IAAaA,4BAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EACrD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;CACL;CAEA,MAAaC,KAAKF,aAAyC;EACvD,MAAMA,YAAYC,MAAM;;;;;;;;;;;;;;;;SAgBvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;SAYvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;SAavB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;;SAIvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;CACL;AACJ"}

package/dist/adapters/database/subscriber/module.d.ts CHANGED Viewed

@@ -14,6 +14,6 @@ export declare class EntitySubscriber<T extends ObjectLiteral> implements Entity
     afterUpdate(event: UpdateEvent<T>): Promise<any>;
     afterRemove(event: RemoveEvent<T>): Promise<any>;
     protected dropCacheKeys(connection: DataSource, data: T): Promise<void>;
-    protected publish(event: `${EntityDefaultEventName}`, data: T): Promise<void>;
+    protected publish(event: `${EntityDefaultEventName}`, data: T, dataPrevious?: T): Promise<void>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/database/subscriber/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/adapters/database/subscriber/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACH,sBAAsB,EAGzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,KAAK,EACR,UAAU,EACV,yBAAyB,EACzB,WAAW,EACX,aAAa,EACb,WAAW,EACX,WAAW,EACd,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,aAAa,EAC3D,IAAI,EAAE,GAAG,UAAU,EAAE,EACrB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,GACrD,CAAC,IAAI,EAAE,CAAC,KAAK,uBAAuB,CAsBvC;AAED,qBAAa,gBAAgB,CAAC,CAAC,SAAS,aAAa,CAAE,YAAW,yBAAyB,CAAC,CAAC,CAAC;IAC1F,SAAS,CAAC,GAAG,EAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAE3C,SAAS,CAAC,SAAS,CAAC,EAAG,qBAAqB,CAAC;gBAEjC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAK3C,YAAY,CAAC,SAAS,EAAE,qBAAqB,GAAI,IAAI;IAKrD,QAAQ,IAAK,QAAQ,GAAG,MAAM;IAIxB,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAYhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAUhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;cActC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAI,OAAO,CAAC,IAAI,CAAC;cAQ9D,OAAO,~~CAAC~~,KAAK,EAAE,GAAG,sBAAsB,EAAE,~~EAAE~~,IAAI,EAAE,CAAC,~~GAAI~~,OAAO,CAAC,IAAI,CAAC;~~CAcvF~~"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/adapters/database/subscriber/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACH,sBAAsB,EAGzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,KAAK,EACR,UAAU,EACV,yBAAyB,EACzB,WAAW,EACX,aAAa,EACb,WAAW,EACX,WAAW,EACd,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,aAAa,EAC3D,IAAI,EAAE,GAAG,UAAU,EAAE,EACrB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,GACrD,CAAC,IAAI,EAAE,CAAC,KAAK,uBAAuB,CAsBvC;AAED,qBAAa,gBAAgB,CAAC,CAAC,SAAS,aAAa,CAAE,YAAW,yBAAyB,CAAC,CAAC,CAAC;IAC1F,SAAS,CAAC,GAAG,EAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAE3C,SAAS,CAAC,SAAS,CAAC,EAAG,qBAAqB,CAAC;gBAEjC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAK3C,YAAY,CAAC,SAAS,EAAE,qBAAqB,GAAI,IAAI;IAKrD,QAAQ,IAAK,QAAQ,GAAG,MAAM;IAIxB,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAYhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAUhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;cActC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAI,OAAO,CAAC,IAAI,CAAC;cAQ9D,OAAO,CACnB,KAAK,EAAE,GAAG,sBAAsB,EAAE,EAClC,IAAI,EAAE,CAAC,EACP,YAAY,CAAC,EAAE,CAAC,GAChB,OAAO,CAAC,IAAI,CAAC;CAepB"}

package/dist/adapters/database/subscriber/module.mjs CHANGED Viewed

@@ -41,7 +41,7 @@ var EntitySubscriber = class {
 	async afterUpdate(event) {
 		if (!event.entity) return;
 		await this.dropCacheKeys(event.connection, event.entity);
-		await this.publish(EntityDefaultEventName.UPDATED, event.entity);
+		await this.publish(EntityDefaultEventName.UPDATED, event.entity, event.databaseEntity);
 	}
 	async afterRemove(event) {
 		const entity = event.databaseEntity ?? event.entity;
@@ -53,7 +53,7 @@ var EntitySubscriber = class {
 		if (!this.ctx.cache || !connection.queryResultCache) return;
 		await connection.queryResultCache.remove(this.ctx.cache.keys(data));
 	}
-	async publish(event, data) {
+	async publish(event, data, dataPrevious) {
 		if (!this.publisher) return;
 		await this.publisher.safePublish({
 			content: {
@@ -61,7 +61,8 @@ var EntitySubscriber = class {
 				event,
 				data
 			},
-			destinations: this.ctx.destinations(data)
+			destinations: this.ctx.destinations(data),
+			...dataPrevious ? { dataPrevious } : {}
 		});
 	}
 };

package/dist/adapters/database/subscriber/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["EntityDefaultEventName","buildEntityChannelName","buildEntityNamespaceName","buildEntityDestinations","type","realmIds","data","destinations","channel","id","items","seen","Set","realmId","has","add","push","namespace","EntitySubscriber","ctx","publisher","setPublisher","listenTo","target","afterInsert","event","entity","cache","onInsert","dropCacheKeys","connection","publish","CREATED","afterUpdate","UPDATED","~~afterRemove~~","~~databaseEntity~~","DELETED","queryResultCache","remove","keys","safePublish","content"],"sources":["../../../../src/adapters/database/subscriber/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { EntityType } from '@authup/core-kit';\nimport {\n EntityDefaultEventName,\n buildEntityChannelName,\n buildEntityNamespaceName,\n} from '@authup/core-kit';\nimport type { DomainEventDestinations, IDomainEventPublisher } from '@authup/server-kit';\nimport type {\n DataSource,\n EntitySubscriberInterface,\n InsertEvent,\n ObjectLiteral,\n RemoveEvent,\n UpdateEvent,\n} from 'typeorm';\nimport type { EntitySubscriberContext } from './types.ts';\n\nexport function buildEntityDestinations<T extends ObjectLiteral>(\n type: `${EntityType}`,\n realmIds?: (data: T) => (string \| null \| undefined)[],\n) : (data: T) => DomainEventDestinations {\n return (data) => {\n const destinations : DomainEventDestinations = [\n { channel: (id) => buildEntityChannelName(type, id) },\n ];\n\n if (realmIds) {\n const items = realmIds(data);\n const seen = new Set<string>();\n for (const realmId of items) {\n if (realmId && !seen.has(realmId)) {\n seen.add(realmId);\n destinations.push({\n channel: (id) => buildEntityChannelName(type, id),\n namespace: buildEntityNamespaceName(realmId),\n });\n }\n }\n }\n\n return destinations;\n };\n}\n\nexport class EntitySubscriber<T extends ObjectLiteral> implements EntitySubscriberInterface<T> {\n protected ctx : EntitySubscriberContext<T>;\n\n protected publisher? : IDomainEventPublisher;\n\n constructor(ctx: EntitySubscriberContext<T>) {\n this.ctx = ctx;\n this.publisher = ctx.publisher;\n }\n\n setPublisher(publisher: IDomainEventPublisher) : void {\n this.publisher = publisher;\n }\n\n // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type\n listenTo() : Function \| string {\n return this.ctx.target;\n }\n\n async afterInsert(event: InsertEvent<T>): Promise<any> {\n if (!event.entity) {\n return;\n }\n\n if (this.ctx.cache && this.ctx.cache.onInsert) {\n await this.dropCacheKeys(event.connection, event.entity);\n }\n\n await this.publish(EntityDefaultEventName.CREATED, event.entity);\n }\n\n async afterUpdate(event: UpdateEvent<T>): Promise<any> {\n if (!event.entity) {\n return;\n }\n\n await this.dropCacheKeys(event.connection, event.entity as T);\n\n await this.publish(EntityDefaultEventName.UPDATED, event.entity as T);\n }\n\n async afterRemove(event: RemoveEvent<T>): Promise<any> {\n // remove() strips the primary key from event.entity before the\n // subscriber runs — databaseEntity is the pre-removal row and keeps\n // the id-keyed cache invalidation (and the DELETED payload) intact.\n const entity = event.databaseEntity ?? event.entity;\n if (!entity) {\n return;\n }\n\n await this.dropCacheKeys(event.connection, entity);\n\n await this.publish(EntityDefaultEventName.DELETED, entity);\n }\n\n protected async dropCacheKeys(connection: DataSource, data: T) : Promise<void> {\n if (!this.ctx.cache \|\| !connection.queryResultCache) {\n return;\n }\n\n await connection.queryResultCache.remove(this.ctx.cache.keys(data));\n }\n\n protected async publish(event: `${EntityDefaultEventName}`, data: T) : Promise<void> {\n if (!this.publisher) {\n return;\n }\n\n await this.publisher.safePublish({\n content: {\n type: this.ctx.type,\n event,\n data,\n },\n destinations: this.ctx.destinations(data),\n });\n }\n}\n"],"mappings":";;;;;AAwBA,SAAgBG,wBACZC,MACAC,UAAqD;CAErD,QAAQC,SAAAA;EACJ,MAAMC,eAAyC,CAC3C,EAAEC,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA,EAAI,CAAA;EAGxD,IAAIJ,UAAU;GACV,MAAMK,QAAQL,SAASC,IAAAA;GACvB,MAAMK,uBAAO,IAAIC,IAAAA;GACjB,KAAK,MAAMC,WAAWH,OAClB,IAAIG,WAAW,CAACF,KAAKG,IAAID,OAAAA,GAAU;IAC/BF,KAAKI,IAAIF,OAAAA;IACTN,aAAaS,KAAK;KACdR,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA;KAC9CQ,WAAWf,yBAAyBW,OAAAA;IACxC,CAAA;GACJ;EAER;EAEA,OAAON;CACX;AACJ;AAEA,IAAaW,mBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,KAAiC;EACzC,KAAKA,MAAMA;EACX,KAAKC,YAAYD,IAAIC;CACzB;CAEAC,aAAaD,WAAyC;EAClD,KAAKA,YAAYA;CACrB;CAGAE,WAA+B;EAC3B,OAAO,KAAKH,IAAII;CACpB;CAEA,MAAMC,YAAYC,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,IAAI,KAAKP,IAAIQ,SAAS,KAAKR,IAAIQ,MAAMC,UACjC,MAAM,KAAKC,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAG3D,MAAM,KAAKK,QAAQ/B,uBAAuBgC,SAASP,MAAMC,MAAM;CACnE;CAEA,MAAMO,YAAYR,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAEvD,MAAM,KAAKK,QAAQ/B,uBAAuBkC,SAAST,MAAMC,~~MAAM~~;~~CACnE~~;CAEA,~~MAAMS~~,~~YAAYV~~,OAAqC;EAInD,MAAMC,SAASD,~~MAAMW~~,~~kBAAkBX~~,MAAMC;EAC7C,IAAI,CAACA,QACD;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYJ,MAAAA;EAE3C,MAAM,KAAKK,QAAQ/B,uBAAuBqC,SAASX,MAAAA;CACvD;CAEA,MAAgBG,cAAcC,YAAwBxB,MAAyB;EAC3E,IAAI,CAAC,KAAKa,IAAIQ,SAAS,CAACG,WAAWQ,kBAC/B;EAGJ,MAAMR,WAAWQ,iBAAiBC,OAAO,KAAKpB,IAAIQ,MAAMa,KAAKlC,IAAAA,CAAAA;CACjE;CAEA,MAAgByB,~~QAAQN~~,~~OAAoCnB~~,~~MAAyB~~;~~EACjF~~,IAAI,CAAC,~~KAAKc~~,WACN;EAGJ,MAAM,KAAKA,~~UAAUqB~~,YAAY;GAC7BC,SAAS;~~IACLtC~~,MAAM,KAAKe,IAAIf;IACfqB;IACAnB;GACJ;GACAC,cAAc,KAAKY,IAAIZ,aAAaD,IAAAA;~~EACxC~~,CAAA;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["EntityDefaultEventName","buildEntityChannelName","buildEntityNamespaceName","buildEntityDestinations","type","realmIds","data","destinations","channel","id","items","seen","Set","realmId","has","add","push","namespace","EntitySubscriber","ctx","publisher","setPublisher","listenTo","target","afterInsert","event","entity","cache","onInsert","dropCacheKeys","connection","publish","CREATED","afterUpdate","UPDATED","databaseEntity","afterRemove","DELETED","queryResultCache","remove","keys","dataPrevious","safePublish","content"],"sources":["../../../../src/adapters/database/subscriber/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { EntityType } from '@authup/core-kit';\nimport {\n EntityDefaultEventName,\n buildEntityChannelName,\n buildEntityNamespaceName,\n} from '@authup/core-kit';\nimport type { DomainEventDestinations, IDomainEventPublisher } from '@authup/server-kit';\nimport type {\n DataSource,\n EntitySubscriberInterface,\n InsertEvent,\n ObjectLiteral,\n RemoveEvent,\n UpdateEvent,\n} from 'typeorm';\nimport type { EntitySubscriberContext } from './types.ts';\n\nexport function buildEntityDestinations<T extends ObjectLiteral>(\n type: `${EntityType}`,\n realmIds?: (data: T) => (string \| null \| undefined)[],\n) : (data: T) => DomainEventDestinations {\n return (data) => {\n const destinations : DomainEventDestinations = [\n { channel: (id) => buildEntityChannelName(type, id) },\n ];\n\n if (realmIds) {\n const items = realmIds(data);\n const seen = new Set<string>();\n for (const realmId of items) {\n if (realmId && !seen.has(realmId)) {\n seen.add(realmId);\n destinations.push({\n channel: (id) => buildEntityChannelName(type, id),\n namespace: buildEntityNamespaceName(realmId),\n });\n }\n }\n }\n\n return destinations;\n };\n}\n\nexport class EntitySubscriber<T extends ObjectLiteral> implements EntitySubscriberInterface<T> {\n protected ctx : EntitySubscriberContext<T>;\n\n protected publisher? : IDomainEventPublisher;\n\n constructor(ctx: EntitySubscriberContext<T>) {\n this.ctx = ctx;\n this.publisher = ctx.publisher;\n }\n\n setPublisher(publisher: IDomainEventPublisher) : void {\n this.publisher = publisher;\n }\n\n // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type\n listenTo() : Function \| string {\n return this.ctx.target;\n }\n\n async afterInsert(event: InsertEvent<T>): Promise<any> {\n if (!event.entity) {\n return;\n }\n\n if (this.ctx.cache && this.ctx.cache.onInsert) {\n await this.dropCacheKeys(event.connection, event.entity);\n }\n\n await this.publish(EntityDefaultEventName.CREATED, event.entity);\n }\n\n async afterUpdate(event: UpdateEvent<T>): Promise<any> {\n if (!event.entity) {\n return;\n }\n\n await this.dropCacheKeys(event.connection, event.entity as T);\n\n await this.publish(EntityDefaultEventName.UPDATED, event.entity as T, event.databaseEntity);\n }\n\n async afterRemove(event: RemoveEvent<T>): Promise<any> {\n // remove() strips the primary key from event.entity before the\n // subscriber runs — databaseEntity is the pre-removal row and keeps\n // the id-keyed cache invalidation (and the DELETED payload) intact.\n const entity = event.databaseEntity ?? event.entity;\n if (!entity) {\n return;\n }\n\n await this.dropCacheKeys(event.connection, entity);\n\n await this.publish(EntityDefaultEventName.DELETED, entity);\n }\n\n protected async dropCacheKeys(connection: DataSource, data: T) : Promise<void> {\n if (!this.ctx.cache \|\| !connection.queryResultCache) {\n return;\n }\n\n await connection.queryResultCache.remove(this.ctx.cache.keys(data));\n }\n\n protected async publish(\n event: `${EntityDefaultEventName}`,\n data: T,\n dataPrevious?: T,\n ) : Promise<void> {\n if (!this.publisher) {\n return;\n }\n\n await this.publisher.safePublish({\n content: {\n type: this.ctx.type,\n event,\n data,\n },\n destinations: this.ctx.destinations(data),\n ...(dataPrevious ? { dataPrevious } : {}),\n });\n }\n}\n"],"mappings":";;;;;AAwBA,SAAgBG,wBACZC,MACAC,UAAqD;CAErD,QAAQC,SAAAA;EACJ,MAAMC,eAAyC,CAC3C,EAAEC,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA,EAAI,CAAA;EAGxD,IAAIJ,UAAU;GACV,MAAMK,QAAQL,SAASC,IAAAA;GACvB,MAAMK,uBAAO,IAAIC,IAAAA;GACjB,KAAK,MAAMC,WAAWH,OAClB,IAAIG,WAAW,CAACF,KAAKG,IAAID,OAAAA,GAAU;IAC/BF,KAAKI,IAAIF,OAAAA;IACTN,aAAaS,KAAK;KACdR,UAAUC,OAAOR,uBAAuBG,MAAMK,EAAAA;KAC9CQ,WAAWf,yBAAyBW,OAAAA;IACxC,CAAA;GACJ;EAER;EAEA,OAAON;CACX;AACJ;AAEA,IAAaW,mBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,KAAiC;EACzC,KAAKA,MAAMA;EACX,KAAKC,YAAYD,IAAIC;CACzB;CAEAC,aAAaD,WAAyC;EAClD,KAAKA,YAAYA;CACrB;CAGAE,WAA+B;EAC3B,OAAO,KAAKH,IAAII;CACpB;CAEA,MAAMC,YAAYC,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,IAAI,KAAKP,IAAIQ,SAAS,KAAKR,IAAIQ,MAAMC,UACjC,MAAM,KAAKC,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAG3D,MAAM,KAAKK,QAAQ/B,uBAAuBgC,SAASP,MAAMC,MAAM;CACnE;CAEA,MAAMO,YAAYR,OAAqC;EACnD,IAAI,CAACA,MAAMC,QACP;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYL,MAAMC,MAAM;EAEvD,MAAM,KAAKK,QAAQ/B,uBAAuBkC,SAAST,MAAMC,QAAaD,MAAMU,cAAc;CAC9F;CAEA,MAAMC,YAAYX,OAAqC;EAInD,MAAMC,SAASD,MAAMU,kBAAkBV,MAAMC;EAC7C,IAAI,CAACA,QACD;EAGJ,MAAM,KAAKG,cAAcJ,MAAMK,YAAYJ,MAAAA;EAE3C,MAAM,KAAKK,QAAQ/B,uBAAuBqC,SAASX,MAAAA;CACvD;CAEA,MAAgBG,cAAcC,YAAwBxB,MAAyB;EAC3E,IAAI,CAAC,KAAKa,IAAIQ,SAAS,CAACG,WAAWQ,kBAC/B;EAGJ,MAAMR,WAAWQ,iBAAiBC,OAAO,KAAKpB,IAAIQ,MAAMa,KAAKlC,IAAAA,CAAAA;CACjE;CAEA,MAAgByB,QACZN,OACAnB,MACAmC,cACc;EACd,IAAI,CAAC,KAAKrB,WACN;EAGJ,MAAM,KAAKA,UAAUsB,YAAY;GAC7BC,SAAS;IACLvC,MAAM,KAAKe,IAAIf;IACfqB;IACAnB;GACJ;GACAC,cAAc,KAAKY,IAAIZ,aAAaD,IAAAA;GACpC,GAAImC,eAAe,EAAEA,aAAa,IAAI,CAAC;EAC3C,CAAA;CACJ;AACJ"}

package/dist/adapters/http/adapters/index.mjs CHANGED Viewed

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { HTTPOAuth2Authorizer } from "./oauth2/authorization/module.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./oauth2/grant-types/utils/certificate.mjs";
 import { extractClientCredentialsFromRequest, readStringField } from "./oauth2/grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./oauth2/grant-types/utils/guess.mjs";
 import { readRealmHint } from "./oauth2/grant-types/utils/realm.mjs";
@@ -10,6 +11,5 @@ import { HTTPClientCredentialsGrant } from "./oauth2/grant-types/client-credenti
 import { HTTPOAuth2IdentityGrantType } from "./oauth2/grant-types/identity.mjs";
 import { HTTPPasswordGrant } from "./oauth2/grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./oauth2/grant-types/refresh_token.mjs";
-import { HTTPRobotCredentialsGrant } from "./oauth2/grant-types/robot-credentials.mjs";
 import "./oauth2/index.mjs";
-export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, guessOauth2GrantTypeByRequest, readRealmHint, readStringField };

package/dist/adapters/http/adapters/oauth2/authorization/module.d.ts CHANGED Viewed

@@ -1,11 +1,14 @@
 import type { IAppEvent } from 'routup';
+import type { Logger } from '@authup/server-kit';
 import type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
-import type { IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';
+import type { IConsentService, IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';
 import { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';
 import type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';
 export declare class HTTPOAuth2Authorizer extends OAuth2Authorization {
     protected codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
     protected requestValidator: OAuth2AuthorizationCodeRequestValidator;
+    protected consentService?: IConsentService;
+    protected logger?: Logger;
     constructor(ctx: HTTPOAuth2AuthorizationManagerContext);
     authorizeWithRequest(event: IAppEvent): Promise<OAuth2AuthorizationResult>;
     /**

package/dist/adapters/http/adapters/oauth2/authorization/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,uCAAuC,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;~~AACvH~~,OAAO,EAAE,mBAAmB,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAE5G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,oBAAqB,SAAQ,mBAAmB;IACzD,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,gBAAgB,EAAG,uCAAuC,CAAC;~~gBAEzD~~,GAAG,EAAE,qCAAqC;~~IAQhD~~,oBAAoB,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,yBAAyB,CAAC;~~IAUjF~~;;;;OAIG;IACG,mBAAmB,CACrB,KAAK,EAAE,SAAS,GAChB,OAAO,CAAC,8BAA8B,CAAC;CAI9C"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,uCAAuC,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACxI,OAAO,EAAE,mBAAmB,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAE5G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,oBAAqB,SAAQ,mBAAmB;IACzD,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,gBAAgB,EAAG,uCAAuC,CAAC;IAErE,SAAS,CAAC,cAAc,CAAC,EAAG,eAAe,CAAC;IAE5C,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAEf,GAAG,EAAE,qCAAqC;IAUhD,oBAAoB,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,yBAAyB,CAAC;IA6CjF;;;;OAIG;IACG,mBAAmB,CACrB,KAAK,EAAE,SAAS,GAChB,OAAO,CAAC,8BAA8B,CAAC;CAI9C"}

package/dist/adapters/http/adapters/oauth2/authorization/module.mjs CHANGED Viewed

@@ -12,16 +12,41 @@ import "../../../request/index.mjs";
 var HTTPOAuth2Authorizer = class extends OAuth2Authorization {
 	codeRequestVerifier;
 	requestValidator;
+	consentService;
+	logger;
 	constructor(ctx) {
 		super(ctx);
 		this.codeRequestVerifier = ctx.codeRequestVerifier;
+		this.consentService = ctx.consentService;
+		this.logger = ctx.logger;
 		this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();
 	}
 	async authorizeWithRequest(event) {
 		const codeRequestValidated = await this.validateWithRequest(event);
-		const { data } = await this.codeRequestVerifier.verify(codeRequestValidated);
+		const { data, client, redirectUriVerified } = await this.codeRequestVerifier.verify(codeRequestValidated);
 		const identity = useRequestIdentityOrFail(event);
-		return this.authorize(data, identity.raw, { sessionId: useRequestSessionId(event) });
+		const result = await this.authorize(data, identity.raw, {
+			sessionId: useRequestSessionId(event),
+			client,
+			redirectUriVerified
+		});
+		if (this.consentService && client && !client.builtIn) try {
+			await this.consentService.record({
+				clientId: client.id,
+				realmId: client.realmId,
+				owner: {
+					sub: identity.raw.data.id,
+					subKind: identity.raw.type
+				},
+				scope: data.scope ?? null
+			});
+		} catch (e) {
+			this.logger?.warn("Recording the OAuth2 consent grant failed.", {
+				clientId: client.id,
+				error: e
+			});
+		}
+		return result;
 	}
 	/**
 	* Validate authorization request.

package/dist/adapters/http/adapters/oauth2/authorization/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["OAuth2Authorization","OAuth2AuthorizationCodeRequestValidator","readFromLocations","useRequestIdentityOrFail","useRequestSessionId","HTTPOAuth2Authorizer","codeRequestVerifier","requestValidator","ctx","authorizeWithRequest","event","codeRequestValidated","validateWithRequest","data","verify","identity","authorize","raw","sessionId","run"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { IAppEvent } from 'routup';\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';\nimport { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations, useRequestIdentityOrFail, useRequestSessionId } from '../../../request/index.ts';\nimport type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';\n\nexport class HTTPOAuth2Authorizer extends OAuth2Authorization {\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected requestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n constructor(ctx: HTTPOAuth2AuthorizationManagerContext) {\n super(ctx);\n\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();\n }\n\n async authorizeWithRequest(event: IAppEvent) : Promise<OAuth2AuthorizationResult> {\n const codeRequestValidated = await this.validateWithRequest(event);\n\n const { data } = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n const identity = useRequestIdentityOrFail(event);\n\n ~~return~~ this.authorize(data, identity.raw, { sessionId: useRequestSessionId(event) });\n }\n\n /\n Validate authorization request.\n \n @throws OAuth2Error\n */\n async validateWithRequest(\n event: IAppEvent,\n ) : Promise<OAuth2AuthorizationCodeRequest> {\n const data = await readFromLocations(event, ['body', 'query']);\n return this.requestValidator.run(data);\n }\n}\n"],"mappings":";;;;;;;;;;;~~AAcA~~,IAAaK,uBAAb,cAA0CL,oBAAAA;CAC5BM;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAMA,GAAAA;EAEN,~~KAAKF~~,~~sBAAsBE~~,~~IAAIF~~;~~EAE~~/B,KAAKC,mBAAmB,IAAIN,wCAAAA;CAChC;CAEA,~~MAAMQ~~,qBAAqBC,OAAuD;EAC9E,MAAMC,uBAAuB,MAAM,KAAKC,oBAAoBF,KAAAA;EAE5D,MAAM,~~EAAEG~~,~~SAAS~~,MAAM,~~KAAKP~~,~~oBAAoBQ~~,~~OAAOH~~,oBAAAA;~~EAEvD~~,~~MAAMI~~,~~WAAWZ~~,~~yBAAyBO~~,KAAAA;EAE1C,~~OAAO~~,~~KAAKM~~,~~UAAUH~~,~~MAAME~~,~~SAASE~~,KAAK,~~EAAEC~~,~~WAAWd~~,~~oBAAoBM,~~KAAAA,~~EAAO~~,CAAA;~~CACtF~~;;;;;IAOA,~~MAAME~~,oBACFF,OACwC;EACxC,MAAMG,OAAO,~~MAAMX~~,~~kBAAkBQ~~,OAAO,CAAC,QAAQ,OAAA,CAAQ;EAC7D,OAAO,~~KAAKH~~,~~iBAAiBY~~,~~IAAIN~~,IAAAA;CACrC;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["OAuth2Authorization","OAuth2AuthorizationCodeRequestValidator","readFromLocations","useRequestIdentityOrFail","useRequestSessionId","HTTPOAuth2Authorizer","codeRequestVerifier","requestValidator","consentService","logger","ctx","authorizeWithRequest","event","codeRequestValidated","validateWithRequest","data","client","redirectUriVerified","verify","identity","result","authorize","raw","sessionId","builtIn","record","clientId","id","realmId","owner","sub","subKind","type","scope","e","warn","error","run"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { IAppEvent } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IConsentService, IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationResult } from '../../../../../core/index.ts';\nimport { OAuth2Authorization, OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations, useRequestIdentityOrFail, useRequestSessionId } from '../../../request/index.ts';\nimport type { HTTPOAuth2AuthorizationManagerContext } from './types.ts';\n\nexport class HTTPOAuth2Authorizer extends OAuth2Authorization {\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected requestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n protected consentService? : IConsentService;\n\n protected logger? : Logger;\n\n constructor(ctx: HTTPOAuth2AuthorizationManagerContext) {\n super(ctx);\n\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n this.consentService = ctx.consentService;\n this.logger = ctx.logger;\n\n this.requestValidator = new OAuth2AuthorizationCodeRequestValidator();\n }\n\n async authorizeWithRequest(event: IAppEvent) : Promise<OAuth2AuthorizationResult> {\n const codeRequestValidated = await this.validateWithRequest(event);\n\n const {\n data,\n client,\n redirectUriVerified,\n } = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n const identity = useRequestIdentityOrFail(event);\n\n const result = await this.authorize(data, identity.raw, {\n sessionId: useRequestSessionId(event),\n client,\n redirectUriVerified,\n });\n\n // Persisted per-scope consent (plan 055): recorded only after a\n // successful approval — an access-policy denial throws inside\n // authorize() above, so a denied identity never writes a row.\n // built_in clients keep zero rows (locked); insert-missing makes\n // re-recording idempotent (union/keep).\n if (this.consentService && client && !client.builtIn) {\n try {\n await this.consentService.record({\n clientId: client.id,\n realmId: client.realmId,\n owner: {\n sub: identity.raw.data.id,\n subKind: identity.raw.type,\n },\n scope: data.scope ?? null,\n });\n } catch (e) {\n // never fail an issued code over a consent-write failure\n this.logger?.warn('Recording the OAuth2 consent grant failed.', {\n clientId: client.id,\n error: e,\n });\n }\n }\n\n return result;\n }\n\n /\n Validate authorization request.\n \n @throws OAuth2Error\n */\n async validateWithRequest(\n event: IAppEvent,\n ) : Promise<OAuth2AuthorizationCodeRequest> {\n const data = await readFromLocations(event, ['body', 'query']);\n return this.requestValidator.run(data);\n }\n}\n"],"mappings":";;;;;;;;;;;AAeA,IAAaK,uBAAb,cAA0CL,oBAAAA;CAC5BM;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAMA,GAAAA;EAEN,KAAKJ,sBAAsBI,IAAIJ;EAC/B,KAAKE,iBAAiBE,IAAIF;EAC1B,KAAKC,SAASC,IAAID;EAElB,KAAKF,mBAAmB,IAAIN,wCAAAA;CAChC;CAEA,MAAMU,qBAAqBC,OAAuD;EAC9E,MAAMC,uBAAuB,MAAM,KAAKC,oBAAoBF,KAAAA;EAE5D,MAAM,EACFG,MACAC,QACAC,wBACA,MAAM,KAAKX,oBAAoBY,OAAOL,oBAAAA;EAE1C,MAAMM,WAAWhB,yBAAyBS,KAAAA;EAE1C,MAAMQ,SAAS,MAAM,KAAKC,UAAUN,MAAMI,SAASG,KAAK;GACpDC,WAAWnB,oBAAoBQ,KAAAA;GAC/BI;GACAC;EACJ,CAAA;EAOA,IAAI,KAAKT,kBAAkBQ,UAAU,CAACA,OAAOQ,SACzC,IAAI;GACA,MAAM,KAAKhB,eAAeiB,OAAO;IAC7BC,UAAUV,OAAOW;IACjBC,SAASZ,OAAOY;IAChBC,OAAO;KACHC,KAAKX,SAASG,IAAIP,KAAKY;KACvBI,SAASZ,SAASG,IAAIU;IAC1B;IACAC,OAAOlB,KAAKkB,SAAS;GACzB,CAAA;EACJ,SAASC,GAAG;GAER,KAAKzB,QAAQ0B,KAAK,8CAA8C;IAC5DT,UAAUV,OAAOW;IACjBS,OAAOF;GACX,CAAA;EACJ;EAGJ,OAAOd;CACX;;;;;IAOA,MAAMN,oBACFF,OACwC;EACxC,MAAMG,OAAO,MAAMb,kBAAkBU,OAAO,CAAC,QAAQ,OAAA,CAAQ;EAC7D,OAAO,KAAKL,iBAAiB8B,IAAItB,IAAAA;CACrC;AACJ"}

package/dist/adapters/http/adapters/oauth2/authorization/types.d.ts CHANGED Viewed

@@ -1,5 +1,13 @@
-import type { IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationManagerContext } from '../../../../../core/index.ts';
+import type { Logger } from '@authup/server-kit';
+import type { IConsentService, IOAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationManagerContext } from '../../../../../core/index.ts';
 export type HTTPOAuth2AuthorizationManagerContext = OAuth2AuthorizationManagerContext & {
     codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
+    /**
+     * Persisted per-scope consent (plan 055): records the approved scope
+     * tokens after a successful (non-built_in) authorization. Absent =
+     * feature inert.
+     */
+    consentService?: IConsentService;
+    logger?: Logger;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/adapters/oauth2/authorization/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,~~uCAAuC~~,EAAE,iCAAiC,~~EAAE~~,MAAM,8BAA8B,CAAC;~~AAE/H~~,MAAM,MAAM,qCAAqC,GAAG,iCAAiC,GAAG;IACpF,mBAAmB,EAAE,uCAAuC,CAAC;~~CAChE~~,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,eAAe,EACf,uCAAuC,EACvC,iCAAiC,EACpC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,qCAAqC,GAAG,iCAAiC,GAAG;IACpF,mBAAmB,EAAE,uCAAuC,CAAC;IAC7D;;;;OAIG;IACH,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.d.ts CHANGED Viewed

@@ -1,12 +1,15 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
 import type { IAppEvent } from 'routup';
 import { OAuth2AuthorizeGrant } from '../../../../../core/index.ts';
-import type { IOAuth2AuthorizationCodeVerifier, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeVerifier, IRealmRepository, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
 import type { HTTPOAuth2AuthorizeGrantContext, IHTTPOAuth2Grant } from './types.ts';
+import type { CertificateSource } from '../../../request/index.ts';
 export declare class HTTPOAuth2AuthorizeGrant extends OAuth2AuthorizeGrant implements IHTTPOAuth2Grant {
     protected codeVerifier: IOAuth2AuthorizationCodeVerifier;
     protected clientAuthenticator: OAuth2ClientAuthenticator;
     protected realmRepository: IRealmRepository;
+    protected accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    protected certificateSource: CertificateSource;
     constructor(ctx: HTTPOAuth2AuthorizeGrantContext);
     runWithRequest(event: IAppEvent): Promise<OAuth2TokenGrantResponse>;
     protected pickStringParam(body: Record<string, any> | undefined, query: Record<string, any> | undefined, key: string): string | undefined;

package/dist/adapters/http/adapters/oauth2/grant-types/authorize.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;~~AAI9D~~,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAA4B,MAAM,8BAA8B,CAAC;AAC9F,OAAO,KAAK,EACR,gCAAgC,EAChC,gBAAgB,EAChB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;~~AAGpF~~,qBAAa,wBAAyB,SAAQ,oBAAqB,YAAW,gBAAgB;IAC1F,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;~~gBAEjC~~,GAAG,EAAE,+BAA+B;~~IAQ1C~~,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;~~IAgCzE~~,SAAS,CAAC,eAAe,CACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACtC,GAAG,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS;CAIxB"}
1	+ {"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/authorize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAK9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAA4B,MAAM,8BAA8B,CAAC;AAC9F,OAAO,KAAK,EACR,4BAA4B,EAC5B,gCAAgC,EAChC,gBAAgB,EAChB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAOnE,qBAAa,wBAAyB,SAAQ,oBAAqB,YAAW,gBAAgB;IAC1F,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;IAEhE,SAAS,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;gBAEnC,GAAG,EAAE,+BAA+B;IAU1C,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA8DzE,SAAS,CAAC,eAAe,CACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,EACtC,GAAG,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS;CAIxB"}