@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/entities/client/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","BadRequestError","EntityNotFoundError","CLIENT_RESERVED_NAMES","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","data","entities","meta","findMany","total","entity","secret","secret_encrypted","secret_hashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","realmId","permissionNames","isMe","identity","type","id","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","built_in","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","is_confidential","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    CLIENT_RESERVED_NAMES,\n    ClientValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\n\nexport type ClientServiceContext = {\n    repository: IClientRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n    protected repository: IClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ClientValidator;\n\n    constructor(ctx: ClientServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ClientValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Client>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n        let { total } = meta;\n\n        const data: Client[] = [];\n        for (const entity of entities) {\n            if (\n                entity.secret &&\n                !entity.secret_encrypted &&\n                !entity.secret_hashed\n            ) {\n                try {\n                    await actor.permissionEvaluator.evaluateOneOf({\n                        name: [\n                            PermissionName.CLIENT_READ,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                        ],\n                        data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                    });\n                    data.push(entity);\n                } catch {\n                    total -= 1;\n                }\n\n                continue;\n            }\n\n            data.push(entity);\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<Client> {\n        const permissionNames = [\n            PermissionName.CLIENT_READ,\n            PermissionName.CLIENT_UPDATE,\n            PermissionName.CLIENT_DELETE,\n        ];\n\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'client' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        const entity = await this.repository.findOne(idOrName, query, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        if (\n            !isMe &&\n            entity.secret &&\n            !entity.secret_encrypted &&\n            !entity.secret_hashed\n        ) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: permissionNames,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Client,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Client | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneWithSecret(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'client' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n            }\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        // Reserve the system-provisioned client names (`system`, `web`) so an\n        // API caller can't create or rename a client onto them — that would\n        // collide on unique(name, realm_id) or shadow the built_in client.\n        // Provisioning and runtime hooks bypass this service, so they remain\n        // free to manage the reserved clients. built_in clients are exempt\n        // (they ARE the provisioned ones) but API callers can never produce a\n        // built_in client since the validator strips the flag.\n        if (\n            typeof validated.name === 'string' &&\n            CLIENT_RESERVED_NAMES.includes(validated.name) &&\n            !(entity && entity.built_in && entity.name === validated.name)\n        ) {\n            throw new BadRequestError(`The client name '${validated.name}' is reserved.`);\n        }\n\n        await this.repository.validateJoinColumns(validated);\n        await this.repository.checkUniqueness(validated, entity || undefined);\n\n        const credentialsService = new ClientCredentialsService();\n\n        if (entity) {\n            if (\n                !isSelfEdit &&\n                !validated.realm_id &&\n                !entity.realm_id\n            ) {\n                const actorRealmId = this.getActorRealmId(actor);\n                if (actorRealmId) {\n                    validated.realm_id = actorRealmId;\n                }\n            }\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_UPDATE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n            }\n\n            if (entity.is_confidential) {\n                if (!validated.secret && !entity.secret) {\n                    validated.secret = credentialsService.generateSecret();\n                }\n\n                if (validated.secret) {\n                    entity.secret = await credentialsService.protect(validated.secret, entity);\n                }\n            } else {\n                entity.secret = null;\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realm_id) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realm_id = actorRealmId;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        entity = this.repository.create(validated);\n\n        if (entity.is_confidential) {\n            if (!validated.secret) {\n                validated.secret = credentialsService.generateSecret();\n            }\n\n            entity.secret = await credentialsService.protect(validated.secret, validated);\n        } else {\n            entity.secret = null;\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;AA2BA,IAAaW,gBAAb,cAAmCF,sBAAAA;CACrBG;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,gBAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,KAAAA;EACnC,IAAI,EAAEY,UAAUF;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMK,UAAUJ,UAAU;GAC3B,IACII,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eACV;IACE,IAAI;KACA,MAAMf,MAAMC,oBAAoBe,cAAc;MAC1Cb,MAAM;OACFb,eAAec;OACfd,eAAee;OACff,eAAegB;;MAEnBC,MAAMxB,iBAAiB;QAAGD,kBAAkBmC,aAAaL;OAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;MAAQ,CAAA;KACxG,CAAA;KACAL,KAAKY,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAJ,KAAKY,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHL;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACe;EACf,MAAMC,kBAAkB;GACpBjC,eAAec;GACfd,eAAee;GACff,eAAegB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMyB,YACfzB,MAAMyB,SAASC,SAAS,aAEpB1B,MAAMyB,SAASlB,KAAKoB,OAAON,YAC3BrB,MAAMyB,SAASlB,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKlB,WAAWkC,QAAQP,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAIzB,oBAAAA;EAGd,IAAIqC,QAAQxB,MAAMyB,SAAUlB,KAAKoB,OAAOf,OAAOe,IAAI;GAC/CH,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACC,QACDZ,OAAOC,UACP,CAACD,OAAOE,oBACR,CAACF,OAAOG,eAER,MAAMf,MAAMC,oBAAoBe,cAAc;GAC1Cb,MAAMoB;GACNhB,MAAMxB,iBAAiB;KAAGD,kBAAkBmC,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFtB,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWxB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMoB,OACFX,UACAd,MACAP,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKkB,KAAKT,UAAUd,MAAMP,OAAO,EAAEiC,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAd,MACAP,OACAkC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO7B,KAAK8B,aAAa,WACnC,MAAM,KAAK1C,gBAAgB2C,QAAQ/B,KAAK8B,QAAQ,IAChDN,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMkB,QAA6B,CAAC;GACpC,IAAItD,OAAOoC,QAAAA,GACPkB,MAAMZ,KAAKN;QAEXkB,MAAMpC,OAAOkB;GAGjB,IAAIe,OACAG,MAAMF,WAAWD,MAAMT;GAG3Bf,SAAS,MAAM,KAAKlB,WAAW8C,kBAAkBD,KAAAA;GACjD,IAAI,CAAC3B,UAAUsB,QAAQD,YACnB,MAAM,IAAI9C,oBAAAA;EAElB,OAAO,IAAI+C,QAAQD,YACf,MAAM,IAAI9C,oBAAAA;EAGd,IAAIsD,aAAa;EACjB,IAAI7B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAee,cAAc,CAAA;GACrF,SAASsC,GAAG;IACR,IACI,CAAC3C,MAAMyB,YACPzB,MAAMyB,SAASC,SAAS,YACxB1B,MAAMyB,SAASlB,KAAKoB,OAAOf,OAAOe,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMzC,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAesD,mBAAmB,CAAA;GAC1F;GACAT,QAAQnD,eAAe6D;EAC3B,OAAO;GACH,MAAM7C,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAewD,cAAc,CAAA;GACjFX,QAAQnD,eAAe+D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKpD,UAAUqD,IAAI1C,MAAM,EAAE4B,MAAM,CAAA;EASzD,IACI,OAAOa,UAAU7C,SAAS,YAC1Bf,sBAAsB8D,SAASF,UAAU7C,IAAI,KAC7C,EAAES,UAAUA,OAAOuC,YAAYvC,OAAOT,SAAS6C,UAAU7C,OAEzD,MAAM,IAAIjB,gBAAgB,oBAAoB8D,UAAU7C,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAW0D,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKtD,WAAW2D,gBAAgBL,WAAWpC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI9D,yBAAAA;EAE/B,IAAIoB,QAAQ;GACR,IACI,CAAC6B,cACD,CAACO,UAAUX,YACX,CAACzB,OAAOyB,UACV;IACE,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;IAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;GAE7B;GAEA,IAAId,YACA,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAesD;IACrBrC,MAAMxB,iBAAiB;MAAGD,kBAAkBmC,aAAa+B;KAAW,GAAG,KAAK9B,mBAAmB8B,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJpC,SAAS,KAAKlB,WAAWgE,MAAM9C,QAAQoC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMzC,MAAMC,oBAAoBwD,SAAS;IACrCtD,MAAMb,eAAee;IACrBE,MAAMxB,iBAAiB;MAAGD,kBAAkBmC,aAAaL;KAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAO+C,iBAAiB;IACxB,IAAI,CAACX,UAAUnC,UAAU,CAACD,OAAOC,QAC7BmC,UAAUnC,SAASyC,mBAAmBM,eAAc;IAGxD,IAAIZ,UAAUnC,QACVD,OAAOC,SAAS,MAAMyC,mBAAmBO,QAAQb,UAAUnC,QAAQD,MAAAA;GAE3E,OACIA,OAAOC,SAAS;GAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAkD,SAAS;GACb;EACJ;EAEA,IAAI,CAACd,UAAUX,UAAU;GACrB,MAAMkB,eAAe,KAAKC,gBAAgBxD,KAAAA;GAC1C,IAAIuD,cACAP,UAAUX,WAAWkB;EAE7B;EAEA,MAAMvD,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAewD;GACrBvC,MAAMxB,iBAAiB;KAAGD,kBAAkBmC,aAAa+B;IAAW,GAAG,KAAK9B,mBAAmB8B,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEApC,SAAS,KAAKlB,WAAWmC,OAAOmB,SAAAA;EAEhC,IAAIpC,OAAO+C,iBAAiB;GACxB,IAAI,CAACX,UAAUnC,QACXmC,UAAUnC,SAASyC,mBAAmBM,eAAc;GAGxDhD,OAAOC,SAAS,MAAMyC,mBAAmBO,QAAQb,UAAUnC,QAAQmC,SAAAA;EACvE,OACIpC,OAAOC,SAAS;EAGpB,MAAM,KAAKnB,WAAWoC,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAkD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFpC,IACA3B,OACe;EACf,MAAMA,MAAMC,oBAAoByC,YAAY,EAAEvC,MAAMb,eAAegB,cAAc,CAAA;EAEjF,MAAMM,SAAS,MAAM,KAAKlB,WAAWsE,UAAU,EAAErC,GAAG,CAAA;EACpD,IAAI,CAACf,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAMa,MAAMC,oBAAoBwD,SAAS;GACrCtD,MAAMb,eAAegB;GACrBC,MAAMxB,iBAAiB;KAAGD,kBAAkBmC,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEe,IAAIsC,aAAarD;EACzB,MAAM,KAAKlB,WAAWwE,OAAOtD,MAAAA;EAC7BA,OAAOe,KAAKsC;EAEZ,OAAOrD;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","and","eq","ne","not","or","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","appendQueryConditions","decodeQuery","clientSchema","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionNames","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","secretSelected","fields","value","some","field","operator","compiled","compile","verdict","scoped","plaintextSecret","condition","findMany","data","entities","meta","total","entity","secret","secretEncrypted","secretHashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","realmId","isMe","identity","type","id","findOne","parameters","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","builtIn","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","authMethod","SECRET","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    and, \n    eq, \n    ne, \n    not, \n    or,\n} from '@rapiq/core';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    CLIENT_RESERVED_NAMES,\n    ClientAuthMethod,\n    ClientValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { clientSchema } from './schema.ts';\n\nexport type ClientServiceContext = {\n    repository: IClientRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n    protected repository: IClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ClientValidator;\n\n    constructor(ctx: ClientServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ClientValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Client>> {\n        const permissionNames = [\n            PermissionName.CLIENT_READ,\n            PermissionName.CLIENT_UPDATE,\n            PermissionName.CLIENT_DELETE,\n        ];\n\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n\n        const parsed = await decodeQuery(query, { schema: clientSchema, actor });\n\n        // The per-row gate below only fires for rows exposing a PLAINTEXT secret,\n        // and only when the projection actually selects the (non-default) `secret`\n        // field — everything else lists freely. Compile the gate into WHERE\n        // (#3286 phase 3): a plaintext-secret row is visible iff the compiled\n        // permission condition covers it; rows without a plaintext secret always\n        // are. A non-expressible policy falls back to the per-row loop below.\n        const secretSelected = parsed.fields.value.some(\n            (field) => field.name === 'secret' && field.operator !== '-',\n        );\n        const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });\n        if (compiled.verdict !== 'post') {\n            let scoped = parsed;\n            if (secretSelected && compiled.verdict !== 'allow') {\n                const plaintextSecret = and(\n                    ne('secret', null),\n                    eq('secretHashed', false),\n                    eq('secretEncrypted', false),\n                );\n\n                scoped = appendQueryConditions(\n                    parsed,\n                    compiled.verdict === 'conditional' ?\n                        or(not(plaintextSecret), compiled.condition) :\n                        not(plaintextSecret),\n                );\n            }\n\n            return this.repository.findMany(scoped);\n        }\n\n        const {\n            data: entities,\n            meta,\n        } = await this.repository.findMany(parsed);\n        let { total } = meta;\n\n        const data: Client[] = [];\n        for (const entity of entities) {\n            if (\n                entity.secret &&\n                !entity.secretEncrypted &&\n                !entity.secretHashed\n            ) {\n                try {\n                    await actor.permissionEvaluator.evaluateOneOf({\n                        name: [\n                            PermissionName.CLIENT_READ,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                        ],\n                        data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                    });\n                    data.push(entity);\n                } catch {\n                    total -= 1;\n                }\n\n                continue;\n            }\n\n            data.push(entity);\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<Client> {\n        const permissionNames = [\n            PermissionName.CLIENT_READ,\n            PermissionName.CLIENT_UPDATE,\n            PermissionName.CLIENT_DELETE,\n        ];\n\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'client' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        const entity = await this.repository.findOne(\n            idOrName,\n            await decodeQuery(query, {\n                schema: clientSchema, \n                parameters: ['fields', 'relations'], \n                actor, \n            }),\n            realmId,\n        );\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        if (\n            !isMe &&\n            entity.secret &&\n            !entity.secretEncrypted &&\n            !entity.secretHashed\n        ) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: permissionNames,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Client,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Client | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneWithSecret(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'client' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n            }\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        // Reserve the system-provisioned client names (`system`, `web`) so an\n        // API caller can't create or rename a client onto them — that would\n        // collide on unique(name, realmId) or shadow the builtIn client.\n        // Provisioning and runtime hooks bypass this service, so they remain\n        // free to manage the reserved clients. builtIn clients are exempt\n        // (they ARE the provisioned ones) but API callers can never produce a\n        // builtIn client since the validator strips the flag.\n        if (\n            typeof validated.name === 'string' &&\n            CLIENT_RESERVED_NAMES.includes(validated.name) &&\n            !(entity && entity.builtIn && entity.name === validated.name)\n        ) {\n            throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n        }\n\n        await this.repository.validateJoinColumns(validated);\n        await this.repository.checkUniqueness(validated, entity || undefined);\n\n        const credentialsService = new ClientCredentialsService();\n\n        if (entity) {\n            if (\n                !isSelfEdit &&\n                !validated.realmId &&\n                !entity.realmId\n            ) {\n                const actorRealmId = this.getActorRealmId(actor);\n                if (actorRealmId) {\n                    validated.realmId = actorRealmId;\n                }\n            }\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_UPDATE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n            }\n\n            if (entity.authMethod === ClientAuthMethod.SECRET) {\n                if (!validated.secret && !entity.secret) {\n                    validated.secret = credentialsService.generateSecret();\n                }\n\n                if (validated.secret) {\n                    entity.secret = await credentialsService.protect(validated.secret, entity);\n                }\n            } else {\n                entity.secret = null;\n                entity.secretHashed = false;\n                entity.secretEncrypted = false;\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realmId) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        entity = this.repository.create(validated);\n\n        if (entity.authMethod === ClientAuthMethod.SECRET) {\n            if (!validated.secret) {\n                validated.secret = credentialsService.generateSecret();\n            }\n\n            entity.secret = await credentialsService.protect(validated.secret, validated);\n        } else {\n            entity.secret = null;\n            entity.secretHashed = false;\n            entity.secretEncrypted = false;\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AAqCA,IAAaoB,gBAAb,cAAmCL,sBAAAA;CACrBM;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIV,gBAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OAC+C;EAC/C,MAAMC,kBAAkB;GACpBd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;;EAGnB,MAAMJ,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAEzE,MAAMO,SAAS,MAAMjB,YAAYQ,OAAO;GAAEU,QAAQjB;GAAcQ;EAAM,CAAA;EAQtE,MAAMU,iBAAiBF,OAAOG,OAAOC,MAAMC,MACtCC,UAAUA,MAAMP,SAAS,YAAYO,MAAMC,aAAa,GAAA;EAE7D,MAAMC,WAAW,MAAMhB,MAAMK,oBAAoBY,QAAQ,EAAEV,MAAMN,gBAAgB,CAAA;EACjF,IAAIe,SAASE,YAAY,QAAQ;GAC7B,IAAIC,SAASX;GACb,IAAIE,kBAAkBM,SAASE,YAAY,SAAS;IAChD,MAAME,kBAAkB7C,IACpBE,GAAG,UAAU,IAAA,GACbD,GAAG,gBAAgB,KAAA,GACnBA,GAAG,mBAAmB,KAAA,CAAA;IAG1B2C,SAAS7B,sBACLkB,QACAQ,SAASE,YAAY,gBACjBvC,GAAGD,IAAI0C,eAAAA,GAAkBJ,SAASK,SAAS,IAC3C3C,IAAI0C,eAAAA,CAAAA;GAEhB;GAEA,OAAO,KAAK1B,WAAW4B,SAASH,MAAAA;EACpC;EAEA,MAAM,EACFI,MAAMC,UACNC,SACA,MAAM,KAAK/B,WAAW4B,SAASd,MAAAA;EACnC,IAAI,EAAEkB,UAAUD;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMI,UAAUH,UAAU;GAC3B,IACIG,OAAOC,UACP,CAACD,OAAOE,mBACR,CAACF,OAAOG,cACV;IACE,IAAI;KACA,MAAM9B,MAAMK,oBAAoB0B,cAAc;MAC1CxB,MAAM;OACFpB,eAAee;OACff,eAAegB;OACfhB,eAAeiB;;MAEnBmB,MAAMjD,iBAAiB;QAAGD,kBAAkB2D,aAAaL;OAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;MAAQ,CAAA;KACxG,CAAA;KACAJ,KAAKW,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAH,KAAKW,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACApC,OACAD,OACAsC,SACe;EACf,MAAMpC,kBAAkB;GACpBd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;;EAGnB,IAAIkC,OAAO,CAAC,CAACtC,MAAMuC,YACfvC,MAAMuC,SAASC,SAAS,aAEpBxC,MAAMuC,SAAShB,KAAKkB,OAAOL,YAC3BpC,MAAMuC,SAAShB,KAAKhB,SAAS6B;EAGrC,IAAI,CAACE,MACD,MAAMtC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAG7E,MAAM0B,SAAS,MAAM,KAAKjC,WAAWgD,QACjCN,UACA,MAAM7C,YAAYQ,OAAO;GACrBU,QAAQjB;GACRmD,YAAY,CAAC,UAAU,WAAA;GACvB3C;EACJ,CAAA,GACAqC,OAAAA;EAEJ,IAAI,CAACV,QACD,MAAM,IAAI7C,oBAAAA;EAGd,IAAIwD,QAAQtC,MAAMuC,SAAUhB,KAAKkB,OAAOd,OAAOc,IAAI;GAC/CH,OAAO;GACP,MAAMtC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACqC,QACDX,OAAOC,UACP,CAACD,OAAOE,mBACR,CAACF,OAAOG,cAER,MAAM9B,MAAMK,oBAAoB0B,cAAc;GAC1CxB,MAAMN;GACNsB,MAAMjD,iBAAiB;KAAGD,kBAAkB2D,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFrB,MACAvB,OACe;EACf,MAAM,EAAE2B,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWvB,MAAMvB,KAAAA;EACpD,OAAO2B;CACX;CAEA,MAAMoB,OACFX,UACAb,MACAvB,OACe;EACf,MAAM,EAAE2B,WAAW,MAAM,KAAKkB,KAAKT,UAAUb,MAAMvB,OAAO,EAAEgD,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAb,MACAvB,OACAiD,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO5B,KAAKc,YAAY,WAClC,MAAM,KAAK1C,gBAAgByD,QAAQ7B,KAAKc,OAAO,IAC/CS,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMiB,QAA6B,CAAC;GACpC,IAAIxE,OAAOuD,QAAAA,GACPiB,MAAMZ,KAAKL;QAEXiB,MAAM9C,OAAO6B;GAGjB,IAAIe,OACAE,MAAMhB,UAAUc,MAAMV;GAG1Bd,SAAS,MAAM,KAAKjC,WAAW4D,kBAAkBD,KAAAA;GACjD,IAAI,CAAC1B,UAAUsB,QAAQD,YACnB,MAAM,IAAIlE,oBAAAA;EAElB,OAAO,IAAImE,QAAQD,YACf,MAAM,IAAIlE,oBAAAA;EAGd,IAAIyE,aAAa;EACjB,IAAI5B,QAAQ;GACR,IAAI;IACA,MAAM3B,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAegB,cAAc,CAAA;GACrF,SAASsD,GAAG;IACR,IACI,CAACzD,MAAMuC,YACPvC,MAAMuC,SAASC,SAAS,YACxBxC,MAAMuC,SAAShB,KAAKkB,OAAOd,OAAOc,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMvD,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAeuE,mBAAmB,CAAA;GAC1F;GACAR,QAAQtE,eAAe+E;EAC3B,OAAO;GACH,MAAM3D,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAeyE,cAAc,CAAA;GACjFV,QAAQtE,eAAeiF;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKlE,UAAUmE,IAAIxC,MAAM,EAAE2B,MAAM,CAAA;EASzD,IACI,OAAOY,UAAUvD,SAAS,YAC1BvB,sBAAsBgF,SAASF,UAAUvD,IAAI,KAC7C,EAAEoB,UAAUA,OAAOsC,WAAWtC,OAAOpB,SAASuD,UAAUvD,OAExD,MAAM,IAAIxB,gBAAgB,oBAAoB+E,UAAUvD,KAAK,eAAe;EAGhF,MAAM,KAAKb,WAAWwE,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKpE,WAAWyE,gBAAgBL,WAAWnC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMsB,qBAAqB,IAAI/E,yBAAAA;EAE/B,IAAIsC,QAAQ;GACR,IACI,CAAC4B,cACD,CAACO,UAAUzB,WACX,CAACV,OAAOU,SACV;IACE,MAAMgC,eAAe,KAAKC,gBAAgBtE,KAAAA;IAC1C,IAAIqE,cACAP,UAAUzB,UAAUgC;GAE5B;GAEA,IAAId,YACA,MAAMvD,MAAMK,oBAAoBkE,SAAS;IACrChE,MAAMpB,eAAeuE;IACrBnC,MAAMjD,iBAAiB;MAAGD,kBAAkB2D,aAAa8B;KAAW,GAAG,KAAK7B,mBAAmB6B,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJnC,SAAS,KAAKjC,WAAW8E,MAAM7C,QAAQmC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMvD,MAAMK,oBAAoBkE,SAAS;IACrChE,MAAMpB,eAAegB;IACrBoB,MAAMjD,iBAAiB;MAAGD,kBAAkB2D,aAAaL;KAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAO8C,eAAexF,iBAAiByF,QAAQ;IAC/C,IAAI,CAACZ,UAAUlC,UAAU,CAACD,OAAOC,QAC7BkC,UAAUlC,SAASwC,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUlC,QACVD,OAAOC,SAAS,MAAMwC,mBAAmBQ,QAAQd,UAAUlC,QAAQD,MAAAA;GAE3E,OAAO;IACHA,OAAOC,SAAS;IAChBD,OAAOG,eAAe;IACtBH,OAAOE,kBAAkB;GAC7B;GAEA,MAAM,KAAKnC,WAAWmD,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAkD,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUzB,SAAS;GACpB,MAAMgC,eAAe,KAAKC,gBAAgBtE,KAAAA;GAC1C,IAAIqE,cACAP,UAAUzB,UAAUgC;EAE5B;EAEA,MAAMrE,MAAMK,oBAAoBkE,SAAS;GACrChE,MAAMpB,eAAeyE;GACrBrC,MAAMjD,iBAAiB;KAAGD,kBAAkB2D,aAAa8B;IAAW,GAAG,KAAK7B,mBAAmB6B,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEAnC,SAAS,KAAKjC,WAAWkD,OAAOkB,SAAAA;EAEhC,IAAInC,OAAO8C,eAAexF,iBAAiByF,QAAQ;GAC/C,IAAI,CAACZ,UAAUlC,QACXkC,UAAUlC,SAASwC,mBAAmBO,eAAc;GAGxDhD,OAAOC,SAAS,MAAMwC,mBAAmBQ,QAAQd,UAAUlC,QAAQkC,SAAAA;EACvE,OAAO;GACHnC,OAAOC,SAAS;GAChBD,OAAOG,eAAe;GACtBH,OAAOE,kBAAkB;EAC7B;EAEA,MAAM,KAAKnC,WAAWmD,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAkD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFrC,IACAzC,OACe;EACf,MAAMA,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAeiB,cAAc,CAAA;EAEjF,MAAMuB,SAAS,MAAM,KAAKjC,WAAWqF,UAAU,EAAEtC,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAI7C,oBAAAA;EAGd,MAAMkB,MAAMK,oBAAoBkE,SAAS;GACrChE,MAAMpB,eAAeiB;GACrBmB,MAAMjD,iBAAiB;KAAGD,kBAAkB2D,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAIuC,aAAarD;EACzB,MAAM,KAAKjC,WAAWuF,OAAOtD,MAAAA;EAC7BA,OAAOc,KAAKuC;EAEZ,OAAOrD;CACX;AACJ"}

package/dist/core/entities/client/types.d.ts

@@ -1,4 +1,5 @@
 import type { Client, Realm, Role } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
 import type { PermissionPolicyBinding } from '@authup/access';
 import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
 /**
@@ -13,7 +14,7 @@ export interface IWebClientProvisioner {
 }
 export interface IClientRepository extends IEntityRepository<Client> {
     checkUniqueness(data: Partial<Client>, existing?: Client): Promise<void>;
-    findOne(id: string, query?: Record<string, any>, realm?: string): Promise<Client | null>;
+    findOne(id: string, query?: IQuery, realm?: string): Promise<Client | null>;
     findOneWithSecret(where: Record<string, any>): Promise<Client | null>;
     getBoundRoles(entity: string | Client): Promise<Role[]>;
     getBoundPermissions(entity: string | Client): Promise<PermissionPolicyBinding[]>;

package/dist/core/entities/client/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IAClC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB,CAAC,MAAM,CAAC;IAChE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEzF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,CACF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IAClC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB,CAAC,MAAM,CAAC;IAChE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE5E,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,CACF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}

package/dist/core/entities/client/web-client.d.ts

@@ -10,15 +10,15 @@ export type WebClientProvisionerContext = {
  * Build the attribute set for a realm's public `web` client.
  *
  * Public (PKCE) client used by authup's own client-web and any downstream
- * UI embedding client-web-kit. `built_in` makes it auto-consent in the
+ * UI embedding client-web-kit. `builtIn` makes it auto-consent in the
  * /authorize flow and protects it from the API reserved-name guard. The
  * `global` scope lets the issued token drive the management API (parity
  * with the legacy password-grant admin login); `openid` for the id-token.
  *
- * `grant_types` is an enforced allowlist (`assertClientGrantAllowed` at the
+ * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the
  * /token grants and the /authorize code-request verifier; null = allow-all),
- * so it must list every flow the client uses. `redirect_uri` and
- * `post_logout_redirect_uri` are each one `<origin>/**` wildcard per trusted
+ * so it must list every flow the client uses. `redirectUri` and
+ * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted
  * origin (matched by isSimpleMatch).
  */
 export declare function buildWebClientAttributes(realm: Realm | {

package/dist/core/entities/client/web-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAMtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAsCrE"}
+{"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAMtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAsCrE"}

package/dist/core/entities/client/web-client.mjs

@@ -1,34 +1,35 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { CLIENT_WEB_NAME, ScopeName } from "@authup/core-kit";
+import { CLIENT_WEB_NAME, ClientAuthMethod, ClientTokenBindingMethod, ScopeName } from "@authup/core-kit";
 //#region src/core/entities/client/web-client.ts
 /**
 * Build the attribute set for a realm's public `web` client.
 *
 * Public (PKCE) client used by authup's own client-web and any downstream
-* UI embedding client-web-kit. `built_in` makes it auto-consent in the
+* UI embedding client-web-kit. `builtIn` makes it auto-consent in the
 * /authorize flow and protects it from the API reserved-name guard. The
 * `global` scope lets the issued token drive the management API (parity
 * with the legacy password-grant admin login); `openid` for the id-token.
 *
-* `grant_types` is an enforced allowlist (`assertClientGrantAllowed` at the
+* `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the
 * /token grants and the /authorize code-request verifier; null = allow-all),
-* so it must list every flow the client uses. `redirect_uri` and
-* `post_logout_redirect_uri` are each one `<origin>/**` wildcard per trusted
+* so it must list every flow the client uses. `redirectUri` and
+* `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted
 * origin (matched by isSimpleMatch).
 */ function buildWebClientAttributes(realm, appOrigins) {
 	const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(",");
 	return {
 		name: CLIENT_WEB_NAME,
-		realm_id: realm.id,
-		is_confidential: false,
-		built_in: true,
+		realmId: realm.id,
+		authMethod: ClientAuthMethod.NONE,
+		tokenBindingMethod: ClientTokenBindingMethod.NONE,
+		builtIn: true,
 		active: true,
-		grant_types: "authorization_code refresh_token",
+		grantTypes: "authorization_code refresh_token",
 		scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,
-		redirect_uri: originPatterns,
-		post_logout_redirect_uri: originPatterns
+		redirectUri: originPatterns,
+		postLogoutRedirectUri: originPatterns
 	};
 }
 var WebClientProvisioner = class {
@@ -44,10 +45,10 @@ var WebClientProvisioner = class {
 		const attributes = buildWebClientAttributes(realm, this.appOrigins);
 		const existing = await this.clientRepository.findOneBy({
 			name: CLIENT_WEB_NAME,
-			realm_id: realm.id
+			realmId: realm.id
 		});
 		if (existing) {
-			if (!existing.built_in) {
+			if (!existing.builtIn) {
 				if (this.logger) this.logger.warn(`Skipping web client provisioning for realm ${realm.id}: a non-built-in client named '${CLIENT_WEB_NAME}' already exists.`);
 				return;
 			}

package/dist/core/entities/client/web-client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"web-client.mjs","names":["CLIENT_WEB_NAME","ScopeName","buildWebClientAttributes","realm","appOrigins","originPatterns","map","origin","join","name","realm_id","id","is_confidential","built_in","active","grant_types","scope","GLOBAL","OPEN_ID","redirect_uri","post_logout_redirect_uri","WebClientProvisioner","clientRepository","logger","ctx","ensureForRealm","attributes","existing","findOneBy","warn","isDirty","Object","keys","some","key","merged","merge","save","entity","create"],"sources":["../../../../src/core/entities/client/web-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { CLIENT_WEB_NAME, ScopeName  } from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientRepository, IWebClientProvisioner } from './types.ts';\n\nexport type WebClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * Build the attribute set for a realm's public `web` client.\n *\n * Public (PKCE) client used by authup's own client-web and any downstream\n * UI embedding client-web-kit. `built_in` makes it auto-consent in the\n * /authorize flow and protects it from the API reserved-name guard. The\n * `global` scope lets the issued token drive the management API (parity\n * with the legacy password-grant admin login); `openid` for the id-token.\n *\n * `grant_types` is an enforced allowlist (`assertClientGrantAllowed` at the\n * /token grants and the /authorize code-request verifier; null = allow-all),\n * so it must list every flow the client uses. `redirect_uri` and\n * `post_logout_redirect_uri` are each one `<origin>/**` wildcard per trusted\n * origin (matched by isSimpleMatch).\n */\nexport function buildWebClientAttributes(\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(',');\n\n    return {\n        name: CLIENT_WEB_NAME,\n        realm_id: realm.id,\n        is_confidential: false,\n        built_in: true,\n        active: true,\n        grant_types: 'authorization_code refresh_token',\n        scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,\n        redirect_uri: originPatterns,\n        post_logout_redirect_uri: originPatterns,\n    };\n}\n\nexport class WebClientProvisioner implements IWebClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: WebClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const attributes = buildWebClientAttributes(realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: CLIENT_WEB_NAME,\n            realm_id: realm.id,\n        });\n\n        if (existing) {\n            // Never overwrite a non-built_in client that happens to be named\n            // `web` — that would be a user-owned client. Skip and warn.\n            if (!existing.built_in) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping web client provisioning for realm ${realm.id}: a non-built-in client named '${CLIENT_WEB_NAME}' already exists.`,\n                    );\n                }\n                return;\n            }\n\n            // MERGE: refresh attributes (e.g. redirect_uri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updated_at) per realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return;\n            }\n\n            const merged = this.clientRepository.merge(existing, attributes);\n            await this.clientRepository.save(merged);\n            return;\n        }\n\n        const entity = this.clientRepository.create(attributes);\n        await this.clientRepository.save(entity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;GAiCA,SAAgBE,yBACZC,OACAC,YAAoB;CAEpB,MAAMC,iBAAiBD,WAAWE,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAEvE,OAAO;EACHC,MAAMT;EACNU,UAAUP,MAAMQ;EAChBC,iBAAiB;EACjBC,UAAU;EACVC,QAAQ;EACRC,aAAa;EACbC,OAAO,GAAGf,UAAUgB,OAAO,GAAGhB,UAAUiB;EACxCC,cAAcd;EACde,0BAA0Bf;CAC9B;AACJ;AAEA,IAAagB,uBAAb,MAAaA;CACCC;CAEAlB;CAEAmB;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKlB,aAAaoB,IAAIpB;EACtB,KAAKmB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAetB,OAA8C;EAC/D,MAAMuB,aAAaxB,yBAAyBC,OAAO,KAAKC,UAAU;EAElE,MAAMuB,WAAW,MAAM,KAAKL,iBAAiBM,UAAU;GACnDnB,MAAMT;GACNU,UAAUP,MAAMQ;EACpB,CAAA;EAEA,IAAIgB,UAAU;GAGV,IAAI,CAACA,SAASd,UAAU;IACpB,IAAI,KAAKU,QACL,KAAKA,OAAOM,KACR,8CAA8C1B,MAAMQ,GAAG,iCAAiCX,gBAAgB,kBAAkB;IAGlI;GACJ;GAQA,IAAI,CAFY,OAAQgC,KAAKN,UAAAA,CAAAA,CACxBO,MAAMC,QAAQP,SAASO,SAASR,WAAWQ,IAC3CJ,GACD;GAGJ,MAAMK,SAAS,KAAKb,iBAAiBc,MAAMT,UAAUD,UAAAA;GACrD,MAAM,KAAKJ,iBAAiBe,KAAKF,MAAAA;GACjC;EACJ;EAEA,MAAMG,SAAS,KAAKhB,iBAAiBiB,OAAOb,UAAAA;EAC5C,MAAM,KAAKJ,iBAAiBe,KAAKC,MAAAA;CACrC;AACJ"}
+{"version":3,"file":"web-client.mjs","names":["CLIENT_WEB_NAME","ClientAuthMethod","ClientTokenBindingMethod","ScopeName","buildWebClientAttributes","realm","appOrigins","originPatterns","map","origin","join","name","realmId","id","authMethod","NONE","tokenBindingMethod","builtIn","active","grantTypes","scope","GLOBAL","OPEN_ID","redirectUri","postLogoutRedirectUri","WebClientProvisioner","clientRepository","logger","ctx","ensureForRealm","attributes","existing","findOneBy","warn","isDirty","Object","keys","some","key","merged","merge","save","entity","create"],"sources":["../../../../src/core/entities/client/web-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    CLIENT_WEB_NAME,\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    ScopeName,\n} from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientRepository, IWebClientProvisioner } from './types.ts';\n\nexport type WebClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * Build the attribute set for a realm's public `web` client.\n *\n * Public (PKCE) client used by authup's own client-web and any downstream\n * UI embedding client-web-kit. `builtIn` makes it auto-consent in the\n * /authorize flow and protects it from the API reserved-name guard. The\n * `global` scope lets the issued token drive the management API (parity\n * with the legacy password-grant admin login); `openid` for the id-token.\n *\n * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the\n * /token grants and the /authorize code-request verifier; null = allow-all),\n * so it must list every flow the client uses. `redirectUri` and\n * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted\n * origin (matched by isSimpleMatch).\n */\nexport function buildWebClientAttributes(\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(',');\n\n    return {\n        name: CLIENT_WEB_NAME,\n        realmId: realm.id,\n        authMethod: ClientAuthMethod.NONE,\n        tokenBindingMethod: ClientTokenBindingMethod.NONE,\n        builtIn: true,\n        active: true,\n        grantTypes: 'authorization_code refresh_token',\n        scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,\n        redirectUri: originPatterns,\n        postLogoutRedirectUri: originPatterns,\n    };\n}\n\nexport class WebClientProvisioner implements IWebClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: WebClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const attributes = buildWebClientAttributes(realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: CLIENT_WEB_NAME,\n            realmId: realm.id,\n        });\n\n        if (existing) {\n            // Never overwrite a non-builtIn client that happens to be named\n            // `web` — that would be a user-owned client. Skip and warn.\n            if (!existing.builtIn) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping web client provisioning for realm ${realm.id}: a non-built-in client named '${CLIENT_WEB_NAME}' already exists.`,\n                    );\n                }\n                return;\n            }\n\n            // MERGE: refresh attributes (e.g. redirectUri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updatedAt) per realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return;\n            }\n\n            const merged = this.clientRepository.merge(existing, attributes);\n            await this.clientRepository.save(merged);\n            return;\n        }\n\n        const entity = this.clientRepository.create(attributes);\n        await this.clientRepository.save(entity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;GAsCA,SAAgBI,yBACZC,OACAC,YAAoB;CAEpB,MAAMC,iBAAiBD,WAAWE,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAEvE,OAAO;EACHC,MAAMX;EACNY,SAASP,MAAMQ;EACfC,YAAYb,iBAAiBc;EAC7BC,oBAAoBd,yBAAyBa;EAC7CE,SAAS;EACTC,QAAQ;EACRC,YAAY;EACZC,OAAO,GAAGjB,UAAUkB,OAAO,GAAGlB,UAAUmB;EACxCC,aAAahB;EACbiB,uBAAuBjB;CAC3B;AACJ;AAEA,IAAakB,uBAAb,MAAaA;CACCC;CAEApB;CAEAqB;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKpB,aAAasB,IAAItB;EACtB,KAAKqB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAexB,OAA8C;EAC/D,MAAMyB,aAAa1B,yBAAyBC,OAAO,KAAKC,UAAU;EAElE,MAAMyB,WAAW,MAAM,KAAKL,iBAAiBM,UAAU;GACnDrB,MAAMX;GACNY,SAASP,MAAMQ;EACnB,CAAA;EAEA,IAAIkB,UAAU;GAGV,IAAI,CAACA,SAASd,SAAS;IACnB,IAAI,KAAKU,QACL,KAAKA,OAAOM,KACR,8CAA8C5B,MAAMQ,GAAG,iCAAiCb,gBAAgB,kBAAkB;IAGlI;GACJ;GAQA,IAAI,CAFY,OAAQoC,KAAKN,UAAAA,CAAAA,CACxBO,MAAMC,QAAQP,SAASO,SAASR,WAAWQ,IAC3CJ,GACD;GAGJ,MAAMK,SAAS,KAAKb,iBAAiBc,MAAMT,UAAUD,UAAAA;GACrD,MAAM,KAAKJ,iBAAiBe,KAAKF,MAAAA;GACjC;EACJ;EAEA,MAAMG,SAAS,KAAKhB,iBAAiBiB,OAAOb,UAAAA;EAC5C,MAAM,KAAKJ,iBAAiBe,KAAKC,MAAAA;CACrC;AACJ"}

package/dist/core/entities/client-permission/index.d.ts

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/client-permission/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-permission/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-permission/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/client-permission/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { clientPermissionSchema } from "./schema.mjs";
 import { ClientPermissionService } from "./service.mjs";
-export { ClientPermissionService };
+export { ClientPermissionService, clientPermissionSchema };

package/dist/core/entities/client-permission/schema.d.ts

@@ -0,0 +1,3 @@
+import type { ClientPermission } from '@authup/core-kit';
+export declare const clientPermissionSchema: import("@rapiq/core").Schema<ClientPermission, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/client-permission/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-permission/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAMzD,eAAO,MAAM,sBAAsB,qDAqBjC,CAAC"}

package/dist/core/entities/client-permission/schema.mjs

@@ -0,0 +1,41 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/client-permission/schema.ts
+const schemaMapping = {
+	client: EntityType.CLIENT,
+	permission: EntityType.PERMISSION
+};
+const clientPermissionSchema = defineSchema({
+	name: EntityType.CLIENT_PERMISSION,
+	fields: { default: [
+		"id",
+		"policyId",
+		"realmScope",
+		"permissionId",
+		"permissionRealmId",
+		"clientId",
+		"clientRealmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: ["clientId", "permissionId"] },
+	relations: {
+		allowed: ["client", "permission"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"id",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { clientPermissionSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/client-permission/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","permission","PERMISSION","clientPermissionSchema","name","CLIENT_PERMISSION","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-permission/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientPermission } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, permission: EntityType.PERMISSION };\n\nexport const clientPermissionSchema = defineSchema<ClientPermission>({\n    name: EntityType.CLIENT_PERMISSION,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'policyId',\n            'realmScope',\n            'permissionId',\n            'permissionRealmId',\n            'clientId',\n            'clientRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['clientId', 'permissionId'] },\n    relations: { allowed: ['client', 'permission'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,YAAYL,WAAWM;AAAW;AAErF,MAAaC,yBAAyBR,aAA+B;CACjES,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAEC,SAAS,CAAC,YAAY,cAAA,EAAgB;CACjDC,WAAW;EAAED,SAAS,CAAC,UAAU,YAAA;EAAeE,UAAUd,wBAAwBC,aAAAA;CAAe;CACjGc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;GAAa;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/client-permission/service.d.ts

@@ -10,7 +10,7 @@ export type ClientPermissionServiceContext = {
     identityPermissionProvider: IIdentityPermissionProvider;
 };
 export declare class ClientPermissionService extends JunctionEntityService implements IClientPermissionService {
-    protected readonly ownerRealmKey = "client_realm_id";
+    protected readonly ownerRealmKey = "clientRealmId";
     protected repository: IClientPermissionRepository;
     protected permissionRepository: IEntityRepository<Permission>;
     protected identityPermissionProvider: IIdentityPermissionProvider;

package/dist/core/entities/client-permission/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-permission/service.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,yBAAyB,EAAkB,MAAM,kBAAkB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,MAAM,8BAA8B,GAAG;IACzC,UAAU,EAAE,2BAA2B,CAAC;IACxC,oBAAoB,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACpD,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,QAAQ,CAAC,aAAa,qBAAqB;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE9D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,yBAAyB,CAAC;gBAEnC,GAAG,EAAE,8BAA8B;IAQzC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IAWtD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAgBtB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IA4DtB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAgEtB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;CAsB/B"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-permission/service.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,yBAAyB,EAAkB,MAAM,kBAAkB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAIxF,MAAM,MAAM,8BAA8B,GAAG;IACzC,UAAU,EAAE,2BAA2B,CAAC;IACxC,oBAAoB,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACpD,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,QAAQ,CAAC,aAAa,mBAAmB;IAEnD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE9D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,yBAAyB,CAAC;gBAEnC,GAAG,EAAE,8BAA8B;IAQzC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IAWtD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAgBtB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IA4DtB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAgEtB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;CAsB/B"}

package/dist/core/entities/client-permission/service.mjs

@@ -1,6 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { clientPermissionSchema } from "./schema.mjs";
+import { decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { applyJunctionCreateGrant, buildJunctionUpdateData } from "../../identity/permission/junction-grant.mjs";
 import { ValidatorGroup } from "@authup/kit";
 import { ClientPermissionValidator, PermissionName } from "@authup/core-kit";
@@ -9,7 +12,7 @@ import { BuiltInPolicyType, RealmScope, definePolicyData } from "@authup/access"
 import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/client-permission/service.ts
 var ClientPermissionService = class extends JunctionEntityService {
-	ownerRealmKey = "client_realm_id";
+	ownerRealmKey = "clientRealmId";
 	repository;
 	permissionRepository;
 	identityPermissionProvider;
@@ -23,7 +26,10 @@ var ClientPermissionService = class extends JunctionEntityService {
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.CLIENT_PERMISSION_CREATE, PermissionName.CLIENT_PERMISSION_DELETE] });
-		return this.repository.findMany(query);
+		return this.repository.findMany(await decodeQuery(query, {
+			schema: clientPermissionSchema,
+			actor
+		}));
 	}
 	async getOne(id, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.CLIENT_PERMISSION_CREATE, PermissionName.CLIENT_PERMISSION_DELETE] });
@@ -36,26 +42,26 @@ var ClientPermissionService = class extends JunctionEntityService {
 		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
 		await this.repository.validateJoinColumns(validated);
 		if (await this.repository.findOneBy({
-			client_id: validated.client_id,
-			permission_id: validated.permission_id
+			clientId: validated.clientId,
+			permissionId: validated.permissionId
 		})) throw new EntityConflictError({ entity: "client-permission" });
 		if (validated.permission) {
-			validated.permission_realm_id = validated.permission.realm_id;
+			validated.permissionRealmId = validated.permission.realmId;
 			await actor.permissionEvaluator.preEvaluate({
 				name: validated.permission.name,
-				realmId: validated.permission.realm_id,
-				clientId: validated.permission.client_id
+				realmId: validated.permission.realmId,
+				clientId: validated.permission.clientId
 			});
 		}
-		if (validated.client) validated.client_realm_id = validated.client.realm_id;
+		if (validated.client) validated.clientRealmId = validated.client.realmId;
 		if (validated.permission && actor.identity) applyJunctionCreateGrant(validated, await this.identityPermissionProvider.resolveJunctionGrant({
 			type: actor.identity.type,
 			id: actor.identity.data.id
 		}, {
 			name: validated.permission.name,
-			realmId: validated.permission.realm_id,
-			clientId: validated.permission.client_id,
-			realmScope: validated.realm_scope ?? RealmScope.OWN
+			realmId: validated.permission.realmId,
+			clientId: validated.permission.clientId,
+			realmScope: validated.realmScope ?? RealmScope.OWN
 		}));
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.CLIENT_PERMISSION_CREATE,
@@ -73,11 +79,11 @@ var ClientPermissionService = class extends JunctionEntityService {
 		const entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
 		const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });
-		const permission = await this.permissionRepository.findOneById(entity.permission_id);
+		const permission = await this.permissionRepository.findOneById(entity.permissionId);
 		if (permission) await actor.permissionEvaluator.preEvaluate({
 			name: permission.name,
-			realmId: permission.realm_id,
-			clientId: permission.client_id
+			realmId: permission.realmId,
+			clientId: permission.clientId
 		});
 		let actorScope = RealmScope.ANY;
 		let actorPolicyFree = true;
@@ -88,9 +94,9 @@ var ClientPermissionService = class extends JunctionEntityService {
 				id: actor.identity.data.id
 			}, {
 				name: permission.name,
-				realmId: permission.realm_id,
-				clientId: permission.client_id,
-				realmScope: validated.realm_scope ?? entity.realm_scope
+				realmId: permission.realmId,
+				clientId: permission.clientId,
+				realmScope: validated.realmScope ?? entity.realmScope
 			});
 			actorScope = grant.realmScope;
 			actorPolicyFree = !grant.policy;
@@ -98,7 +104,7 @@ var ClientPermissionService = class extends JunctionEntityService {
 		} else if (actor.identity) actorScope = RealmScope.OWN;
 		const updateData = buildJunctionUpdateData({
 			data: validated,
-			existingScope: entity.realm_scope,
+			existingScope: entity.realmScope,
 			actorScope,
 			actorPolicyFree,
 			actorPolicyId

package/dist/core/entities/client-permission/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientPermissionValidator","PermissionName","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","ClientPermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_PERMISSION_CREATE","CLIENT_PERMISSION_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","client_id","permission_id","permission","permission_realm_id","realm_id","realmId","clientId","client","client_realm_id","identity","grant","resolveJunctionGrant","type","realmScope","realm_scope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","CLIENT_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    BuiltInPolicyType,\n    RealmScope,\n    definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientPermissionValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientPermission, Permission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IClientPermissionRepository, IClientPermissionService } from './types.ts';\n\nexport type ClientPermissionServiceContext = {\n    repository: IClientPermissionRepository;\n    permissionRepository: IEntityRepository<Permission>;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientPermissionService extends JunctionEntityService implements IClientPermissionService {\n    protected readonly ownerRealmKey = 'client_realm_id';\n\n    protected repository: IClientPermissionRepository;\n\n    protected permissionRepository: IEntityRepository<Permission>;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: ClientPermissionValidator;\n\n    constructor(ctx: ClientPermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.permissionRepository = ctx.permissionRepository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new ClientPermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<ClientPermission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_PERMISSION_CREATE,\n                PermissionName.CLIENT_PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_PERMISSION_CREATE,\n                PermissionName.CLIENT_PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            client_id: validated.client_id,\n            permission_id: validated.permission_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'client-permission' });\n        }\n\n        if (validated.permission) {\n            validated.permission_realm_id = validated.permission.realm_id;\n\n            await actor.permissionEvaluator.preEvaluate({\n                name: validated.permission.name,\n                realmId: validated.permission.realm_id,\n                clientId: validated.permission.client_id,\n            });\n        }\n\n        if (validated.client) {\n            validated.client_realm_id = validated.client.realm_id;\n        }\n\n        if (validated.permission && actor.identity) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    name: validated.permission.name,\n                    realmId: validated.permission.realm_id,\n                    clientId: validated.permission.client_id,\n                    realmScope: validated.realm_scope ?? RealmScope.OWN,\n                },\n            );\n\n            applyJunctionCreateGrant(validated, grant);\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_PERMISSION_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        const permission = await this.permissionRepository.findOneById(entity.permission_id);\n        if (permission) {\n            // Member-permission gate: an actor may only modify a binding for a permission it\n            // holds (mirrors create()).\n            await actor.permissionEvaluator.preEvaluate({\n                name: permission.name,\n                realmId: permission.realm_id,\n                clientId: permission.client_id,\n            });\n        }\n\n        let actorScope: `${RealmScope}` = RealmScope.ANY;\n        let actorPolicyFree = true;\n        let actorPolicyId: string | null = null;\n        if (actor.identity && permission) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                { type: actor.identity.type, id: actor.identity.data.id },\n                {\n                    name: permission.name,\n                    realmId: permission.realm_id,\n                    clientId: permission.client_id,\n                    realmScope: validated.realm_scope ?? entity.realm_scope,\n                },\n            );\n            actorScope = grant.realmScope;\n            actorPolicyFree = !grant.policy;\n            actorPolicyId = grant.policy ? grant.policy.id : null;\n        } else if (actor.identity) {\n            actorScope = RealmScope.OWN;\n        }\n\n        const updateData = buildJunctionUpdateData({\n            data: validated,\n            existingScope: entity.realm_scope,\n            actorScope,\n            actorPolicyFree,\n            actorPolicyId,\n        });\n\n        await this.repository.validateJoinColumns(updateData);\n\n        const merged = this.repository.merge(entity, updateData);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n            }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_PERMISSION_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;AA4BA,IAAaW,0BAAb,cAA6CD,sBAAAA;CACtBE,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIV,0BAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFhB,eAAeiB,0BACfjB,eAAekB,wBAAAA,EAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASP,KAAAA;CACpC;CAEA,MAAMQ,OACFC,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFhB,eAAeiB,0BACfjB,eAAekB,wBAAAA,EAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIzB,oBAAAA;EAGd,OAAOyB;CACX;CAEA,MAAME,OACFC,MACAZ,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMhB,eAAeiB,yBAAyB,CAAA;EAE5F,MAAMU,YAAY,MAAM,KAAKlB,UAAUmB,IAAIH,MAAM,EAAEI,OAAO/B,eAAegC,OAAO,CAAA;EAEhF,MAAM,KAAKxB,WAAWyB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK1B,WAAWiB,UAAU;GAC7CU,WAAWN,UAAUM;GACrBC,eAAeP,UAAUO;EAC7B,CAAA,GAEI,MAAM,IAAItC,oBAAoB,EAAE0B,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YAAY;GACtBR,UAAUS,sBAAsBT,UAAUQ,WAAWE;GAErD,MAAMxB,MAAMC,oBAAoBY,YAAY;IACxCV,MAAMW,UAAUQ,WAAWnB;IAC3BsB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWF;GACnC,CAAA;EACJ;EAEA,IAAIN,UAAUa,QACVb,UAAUc,kBAAkBd,UAAUa,OAAOH;EAGjD,IAAIV,UAAUQ,cAActB,MAAM6B,UAc9BzC,yBAAyB0B,WAAWgB,MAbhB,KAAKnC,2BAA2BoC,qBAChD;GACIC,MAAMhC,MAAM6B,SAASG;GACrBxB,IAAIR,MAAM6B,SAASjB,KAAKJ;EAC5B,GACA;GACIL,MAAMW,UAAUQ,WAAWnB;GAC3BsB,SAASX,UAAUQ,WAAWE;GAC9BE,UAAUZ,UAAUQ,WAAWF;GAC/Ba,YAAYnB,UAAUoB,eAAerD,WAAWsD;EACpD,CAAA,CAGgCL;EAGxC,MAAM9B,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMhB,eAAeiB;GACrBQ,MAAM9B,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBxB,SAAAA;KACvDlC,kBAAkB2D,cAAc,KAAKC,sBAAsB1B,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKhB,WAAWkB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKhB,WAAWgD,KAAKhC,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMiC,OACFlC,IACAI,MACAZ,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMhB,eAAewD,yBAAyB,CAAA;EAE5F,MAAMlC,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAM8B,YAAY,MAAM,KAAKlB,UAAUmB,IAAIH,MAAM,EAAEI,OAAO/B,eAAe2D,OAAO,CAAA;EAEhF,MAAMtB,aAAa,MAAM,KAAK5B,qBAAqBmD,YAAYpC,OAAOY,aAAa;EACnF,IAAIC,YAGA,MAAMtB,MAAMC,oBAAoBY,YAAY;GACxCV,MAAMmB,WAAWnB;GACjBsB,SAASH,WAAWE;GACpBE,UAAUJ,WAAWF;EACzB,CAAA;EAGJ,IAAI0B,aAA8BjE,WAAWkE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAIjD,MAAM6B,YAAYP,YAAY;GAC9B,MAAMQ,QAAQ,MAAM,KAAKnC,2BAA2BoC,qBAChD;IAAEC,MAAMhC,MAAM6B,SAASG;IAAMxB,IAAIR,MAAM6B,SAASjB,KAAKJ;GAAG,GACxD;IACIL,MAAMmB,WAAWnB;IACjBsB,SAASH,WAAWE;IACpBE,UAAUJ,WAAWF;IACrBa,YAAYnB,UAAUoB,eAAezB,OAAOyB;GAChD,CAAA;GAEJY,aAAahB,MAAMG;GACnBe,kBAAkB,CAAClB,MAAMoB;GACzBD,gBAAgBnB,MAAMoB,SAASpB,MAAMoB,OAAO1C,KAAK;EACrD,OAAO,IAAIR,MAAM6B,UACbiB,aAAajE,WAAWsD;EAG5B,MAAMgB,aAAa9D,wBAAwB;GACvCuB,MAAME;GACNsC,eAAe3C,OAAOyB;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAKxD,WAAWyB,oBAAoBiC,UAAAA;EAE1C,MAAME,SAAS,KAAK5D,WAAW6D,MAAM7C,QAAQ0C,UAAAA;EAE7C,MAAMnD,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMhB,eAAewD;GACrB/B,MAAM9B,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBe,MAAAA;KACvDzE,kBAAkB2D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK5D,WAAWgD,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACF/C,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMhB,eAAekB,yBAAyB,CAAA;EAE5F,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAMgB,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMhB,eAAekB;GACrBO,MAAM9B,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmB7B,MAAAA;KACvD7B,kBAAkB2D,cAAc,KAAKC,sBAAsB/B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIgD,aAAa/C;EACzB,MAAM,KAAKhB,WAAWgE,OAAOhD,MAAAA;EAC7BA,OAAOD,KAAKgD;EAEZ,OAAO/C;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientPermissionValidator","PermissionName","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","decodeQuery","clientPermissionSchema","ClientPermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_PERMISSION_CREATE","CLIENT_PERMISSION_DELETE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","clientId","permissionId","permission","permissionRealmId","realmId","client","clientRealmId","identity","grant","resolveJunctionGrant","type","realmScope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","CLIENT_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    BuiltInPolicyType,\n    RealmScope,\n    definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientPermissionValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientPermission, Permission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IClientPermissionRepository, IClientPermissionService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientPermissionSchema } from './schema.ts';\n\nexport type ClientPermissionServiceContext = {\n    repository: IClientPermissionRepository;\n    permissionRepository: IEntityRepository<Permission>;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientPermissionService extends JunctionEntityService implements IClientPermissionService {\n    protected readonly ownerRealmKey = 'clientRealmId';\n\n    protected repository: IClientPermissionRepository;\n\n    protected permissionRepository: IEntityRepository<Permission>;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: ClientPermissionValidator;\n\n    constructor(ctx: ClientPermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.permissionRepository = ctx.permissionRepository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new ClientPermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<ClientPermission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_PERMISSION_CREATE,\n                PermissionName.CLIENT_PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: clientPermissionSchema, actor }));\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_PERMISSION_CREATE,\n                PermissionName.CLIENT_PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            clientId: validated.clientId,\n            permissionId: validated.permissionId,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'client-permission' });\n        }\n\n        if (validated.permission) {\n            validated.permissionRealmId = validated.permission.realmId;\n\n            await actor.permissionEvaluator.preEvaluate({\n                name: validated.permission.name,\n                realmId: validated.permission.realmId,\n                clientId: validated.permission.clientId,\n            });\n        }\n\n        if (validated.client) {\n            validated.clientRealmId = validated.client.realmId;\n        }\n\n        if (validated.permission && actor.identity) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    name: validated.permission.name,\n                    realmId: validated.permission.realmId,\n                    clientId: validated.permission.clientId,\n                    realmScope: validated.realmScope ?? RealmScope.OWN,\n                },\n            );\n\n            applyJunctionCreateGrant(validated, grant);\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_PERMISSION_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        const permission = await this.permissionRepository.findOneById(entity.permissionId);\n        if (permission) {\n            // Member-permission gate: an actor may only modify a binding for a permission it\n            // holds (mirrors create()).\n            await actor.permissionEvaluator.preEvaluate({\n                name: permission.name,\n                realmId: permission.realmId,\n                clientId: permission.clientId,\n            });\n        }\n\n        let actorScope: `${RealmScope}` = RealmScope.ANY;\n        let actorPolicyFree = true;\n        let actorPolicyId: string | null = null;\n        if (actor.identity && permission) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                { type: actor.identity.type, id: actor.identity.data.id },\n                {\n                    name: permission.name,\n                    realmId: permission.realmId,\n                    clientId: permission.clientId,\n                    realmScope: validated.realmScope ?? entity.realmScope,\n                },\n            );\n            actorScope = grant.realmScope;\n            actorPolicyFree = !grant.policy;\n            actorPolicyId = grant.policy ? grant.policy.id : null;\n        } else if (actor.identity) {\n            actorScope = RealmScope.OWN;\n        }\n\n        const updateData = buildJunctionUpdateData({\n            data: validated,\n            existingScope: entity.realmScope,\n            actorScope,\n            actorPolicyFree,\n            actorPolicyId,\n        });\n\n        await this.repository.validateJoinColumns(updateData);\n\n        const merged = this.repository.merge(entity, updateData);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n            }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_PERMISSION_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AA8BA,IAAaa,0BAAb,cAA6CH,sBAAAA;CACtBI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIZ,0BAAAA;CACzB;CAEA,MAAMc,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFlB,eAAemB,0BACfnB,eAAeoB,wBAAAA,EAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYU,OAAO;GAAEQ,QAAQjB;GAAwBU;EAAM,CAAA,CAAA;CACrG;CAEA,MAAMQ,OACFC,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFlB,eAAemB,0BACfnB,eAAeoB,wBAAAA,EAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,OAAO4B;CACX;CAEA,MAAME,OACFC,MACAb,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMlB,eAAemB,yBAAyB,CAAA;EAE5F,MAAMW,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOlC,eAAemC,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWkB,UAAU;GAC7CU,UAAUN,UAAUM;GACpBC,cAAcP,UAAUO;EAC5B,CAAA,GAEI,MAAM,IAAIzC,oBAAoB,EAAE6B,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YAAY;GACtBR,UAAUS,oBAAoBT,UAAUQ,WAAWE;GAEnD,MAAMzB,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMY,UAAUQ,WAAWpB;IAC3BsB,SAASV,UAAUQ,WAAWE;IAC9BJ,UAAUN,UAAUQ,WAAWF;GACnC,CAAA;EACJ;EAEA,IAAIN,UAAUW,QACVX,UAAUY,gBAAgBZ,UAAUW,OAAOD;EAG/C,IAAIV,UAAUQ,cAAcvB,MAAM4B,UAc9B1C,yBAAyB6B,WAAWc,MAbhB,KAAKlC,2BAA2BmC,qBAChD;GACIC,MAAM/B,MAAM4B,SAASG;GACrBtB,IAAIT,MAAM4B,SAASf,KAAKJ;EAC5B,GACA;GACIN,MAAMY,UAAUQ,WAAWpB;GAC3BsB,SAASV,UAAUQ,WAAWE;GAC9BJ,UAAUN,UAAUQ,WAAWF;GAC/BW,YAAYjB,UAAUiB,cAAcrD,WAAWsD;EACnD,CAAA,CAGgCJ;EAGxC,MAAM7B,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMlB,eAAemB;GACrBS,MAAMjC,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBrB,SAAAA;KACvDrC,kBAAkB2D,cAAc,KAAKC,sBAAsBvB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKjB,WAAWmB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKjB,WAAW8C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAI,MACAb,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMlB,eAAewD,yBAAyB,CAAA;EAE5F,MAAM/B,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMiC,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOlC,eAAe2D,OAAO,CAAA;EAEhF,MAAMnB,aAAa,MAAM,KAAK7B,qBAAqBiD,YAAYjC,OAAOY,YAAY;EAClF,IAAIC,YAGA,MAAMvB,MAAMC,oBAAoBa,YAAY;GACxCX,MAAMoB,WAAWpB;GACjBsB,SAASF,WAAWE;GACpBJ,UAAUE,WAAWF;EACzB,CAAA;EAGJ,IAAIuB,aAA8BjE,WAAWkE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAI/C,MAAM4B,YAAYL,YAAY;GAC9B,MAAMM,QAAQ,MAAM,KAAKlC,2BAA2BmC,qBAChD;IAAEC,MAAM/B,MAAM4B,SAASG;IAAMtB,IAAIT,MAAM4B,SAASf,KAAKJ;GAAG,GACxD;IACIN,MAAMoB,WAAWpB;IACjBsB,SAASF,WAAWE;IACpBJ,UAAUE,WAAWF;IACrBW,YAAYjB,UAAUiB,cAActB,OAAOsB;GAC/C,CAAA;GAEJY,aAAaf,MAAMG;GACnBc,kBAAkB,CAACjB,MAAMmB;GACzBD,gBAAgBlB,MAAMmB,SAASnB,MAAMmB,OAAOvC,KAAK;EACrD,OAAO,IAAIT,MAAM4B,UACbgB,aAAajE,WAAWsD;EAG5B,MAAMgB,aAAa9D,wBAAwB;GACvC0B,MAAME;GACNmC,eAAexC,OAAOsB;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAKtD,WAAW0B,oBAAoB8B,UAAAA;EAE1C,MAAME,SAAS,KAAK1D,WAAW2D,MAAM1C,QAAQuC,UAAAA;EAE7C,MAAMjD,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMlB,eAAewD;GACrB5B,MAAMjC,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBe,MAAAA;KACvDzE,kBAAkB2D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK1D,WAAW8C,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACF5C,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMlB,eAAeoB,yBAAyB,CAAA;EAE5F,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMlB,eAAeoB;GACrBQ,MAAMjC,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmB1B,MAAAA;KACvDhC,kBAAkB2D,cAAc,KAAKC,sBAAsB5B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI6C,aAAa5C;EACzB,MAAM,KAAKjB,WAAW8D,OAAO7C,MAAAA;EAC7BA,OAAOD,KAAK6C;EAEZ,OAAO5C;CACX;AACJ"}

package/dist/core/entities/client-role/index.d.ts

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/client-role/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-role/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-role/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/client-role/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { clientRoleSchema } from "./schema.mjs";
 import { ClientRoleService } from "./service.mjs";
-export { ClientRoleService };
+export { ClientRoleService, clientRoleSchema };

package/dist/core/entities/client-role/schema.d.ts

@@ -0,0 +1,3 @@
+import type { ClientRole } from '@authup/core-kit';
+export declare const clientRoleSchema: import("@rapiq/core").Schema<ClientRole, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/client-role/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-role/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMnD,eAAO,MAAM,gBAAgB,+CAmB3B,CAAC"}

package/dist/core/entities/client-role/schema.mjs

@@ -0,0 +1,39 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/client-role/schema.ts
+const schemaMapping = {
+	client: EntityType.CLIENT,
+	role: EntityType.ROLE
+};
+const clientRoleSchema = defineSchema({
+	name: EntityType.CLIENT_ROLE,
+	fields: { default: [
+		"id",
+		"clientId",
+		"clientRealmId",
+		"roleId",
+		"roleRealmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: ["clientId", "roleId"] },
+	relations: {
+		allowed: ["client", "role"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"id",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { clientRoleSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/client-role/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","role","ROLE","clientRoleSchema","name","CLIENT_ROLE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-role/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientRole } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, role: EntityType.ROLE };\n\nexport const clientRoleSchema = defineSchema<ClientRole>({\n    name: EntityType.CLIENT_ROLE,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'clientId',\n            'clientRealmId',\n            'roleId',\n            'roleRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['clientId', 'roleId'] },\n    relations: { allowed: ['client', 'role'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,MAAML,WAAWM;AAAK;AAEzE,MAAaC,mBAAmBR,aAAyB;CACrDS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAEC,SAAS,CAAC,YAAY,QAAA,EAAU;CAC3CC,WAAW;EAAED,SAAS,CAAC,UAAU,MAAA;EAASE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC3Fc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;GAAa;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/client-role/service.d.ts

@@ -9,7 +9,7 @@ export type ClientRoleServiceContext = {
     identityPermissionProvider: IIdentityPermissionProvider;
 };
 export declare class ClientRoleService extends JunctionEntityService implements IClientRoleService {
-    protected readonly ownerRealmKey = "client_realm_id";
+    protected readonly ownerRealmKey = "clientRealmId";
     protected repository: IClientRoleRepository;
     protected identityPermissionProvider: IIdentityPermissionProvider;
     protected validator: ClientRoleValidator;