@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/entities/client-role/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-role/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,mBAAmB,EAAkB,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE5E,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,qBAAqB,CAAC;IAClC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,qBAAsB,YAAW,kBAAkB;IACtF,SAAS,CAAC,QAAQ,CAAC,aAAa,qBAAqB;IAErD,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAE5C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC;gBAE7B,GAAG,EAAE,wBAAwB;IAOnC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAYhD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAiBhB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAuDhB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;CAuBzB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-role/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,mBAAmB,EAAkB,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAI5E,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,qBAAqB,CAAC;IAClC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,qBAAsB,YAAW,kBAAkB;IACtF,SAAS,CAAC,QAAQ,CAAC,aAAa,mBAAmB;IAEnD,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAE5C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC;gBAE7B,GAAG,EAAE,wBAAwB;IAOnC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAYhD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAiBhB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;IAuDhB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC;CAuBzB"}

package/dist/core/entities/client-role/service.mjs

@@ -1,6 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { clientRoleSchema } from "./schema.mjs";
+import { decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { ValidatorGroup } from "@authup/kit";
 import { ClientRoleValidator, PermissionName } from "@authup/core-kit";
 import { JunctionEntityService } from "@authup/server-kit";
@@ -8,7 +11,7 @@ import { BuiltInPolicyType, PermissionError, definePolicyData } from "@authup/ac
 import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/client-role/service.ts
 var ClientRoleService = class extends JunctionEntityService {
-	ownerRealmKey = "client_realm_id";
+	ownerRealmKey = "clientRealmId";
 	repository;
 	identityPermissionProvider;
 	validator;
@@ -24,7 +27,10 @@ var ClientRoleService = class extends JunctionEntityService {
 			PermissionName.CLIENT_ROLE_UPDATE,
 			PermissionName.CLIENT_ROLE_DELETE
 		] });
-		return this.repository.findMany(query);
+		return this.repository.findMany(await decodeQuery(query, {
+			schema: clientRoleSchema,
+			actor
+		}));
 	}
 	async getOne(id, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -41,19 +47,19 @@ var ClientRoleService = class extends JunctionEntityService {
 		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
 		await this.repository.validateJoinColumns(validated);
 		if (await this.repository.findOneBy({
-			role_id: validated.role_id,
-			client_id: validated.client_id
+			roleId: validated.roleId,
+			clientId: validated.clientId
 		})) throw new EntityConflictError({ entity: "client-role" });
-		if (validated.role) validated.role_realm_id = validated.role.realm_id;
-		if (validated.client) validated.client_realm_id = validated.client.realm_id;
+		if (validated.role) validated.roleRealmId = validated.role.realmId;
+		if (validated.client) validated.clientRealmId = validated.client.realmId;
 		if (validated.role && actor.identity) {
 			if (!await this.identityPermissionProvider.isSuperset({
 				type: actor.identity.type,
 				id: actor.identity.data.id
 			}, {
 				type: "role",
-				id: validated.role_id,
-				clientId: validated.role.client_id
+				id: validated.roleId,
+				clientId: validated.role.clientId
 			})) throw new PermissionError({ message: "You don't own the required permissions." });
 		}
 		await actor.permissionEvaluator.evaluate({

package/dist/core/entities/client-role/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientRoleValidator","PermissionName","JunctionEntityService","ClientRoleService","ownerRealmKey","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_ROLE_READ","CLIENT_ROLE_UPDATE","CLIENT_ROLE_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_ROLE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","role_id","client_id","role","role_realm_id","realm_id","client","client_realm_id","identity","hasPermissions","isSuperset","type","clientId","message","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientRoleValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientRole } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IClientRoleRepository, IClientRoleService } from './types.ts';\n\nexport type ClientRoleServiceContext = {\n    repository: IClientRoleRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientRoleService extends JunctionEntityService implements IClientRoleService {\n    protected readonly ownerRealmKey = 'client_realm_id';\n\n    protected repository: IClientRoleRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: ClientRoleValidator;\n\n    constructor(ctx: ClientRoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new ClientRoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<ClientRole>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_ROLE_READ,\n                PermissionName.CLIENT_ROLE_UPDATE,\n                PermissionName.CLIENT_ROLE_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientRole> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_ROLE_READ,\n                PermissionName.CLIENT_ROLE_UPDATE,\n                PermissionName.CLIENT_ROLE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            role_id: validated.role_id,\n            client_id: validated.client_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'client-role' });\n        }\n\n        if (validated.role) {\n            validated.role_realm_id = validated.role.realm_id;\n        }\n\n        if (validated.client) {\n            validated.client_realm_id = validated.client.realm_id;\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.role_id,\n                    clientId: validated.role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n            }\n        }\n\n        // Stamp the owner (client) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_ROLE_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (client) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_ROLE_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAsBA,IAAaS,oBAAb,cAAuCD,sBAAAA;CAChBE,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIP,oBAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,IACAT,OACmB;EACnB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,OAAOuB;CACX;CAEA,MAAME,OACFC,MACAb,OACmB;EACnB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMb,eAAeyB,mBAAmB,CAAA;EAEtF,MAAMC,YAAY,MAAM,KAAKpB,UAAUqB,IAAIJ,MAAM,EAAEK,OAAO9B,eAAe+B,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWiB,UAAU;GAC7CW,SAASN,UAAUM;GACnBC,WAAWP,UAAUO;EACzB,CAAA,GAEI,MAAM,IAAIrC,oBAAoB,EAAEwB,QAAQ,cAAc,CAAA;EAG1D,IAAIM,UAAUQ,MACVR,UAAUS,gBAAgBT,UAAUQ,KAAKE;EAG7C,IAAIV,UAAUW,QACVX,UAAUY,kBAAkBZ,UAAUW,OAAOD;EAGjD,IAAIV,UAAUQ,QAAQxB,MAAM6B;OAYpB,CAACC,MAXwB,KAAKnC,2BAA2BoC,WACzD;IACIC,MAAMhC,MAAM6B,SAASG;IACrBvB,IAAIT,MAAM6B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIO,UAAUM;IACdW,UAAUjB,UAAUQ,KAAKD;GAC7B,CAAA,GAGA,MAAM,IAAIvC,gBAAgB,EAAEkD,SAAS,0CAA2C,CAAA;EAAA;EAKxF,MAAMlC,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMb,eAAeyB;GACrBF,MAAM5B,iBAAiB;KAClBF,kBAAkBqD,aAAa,KAAKC,mBAAmBrB,SAAAA;KACvDjC,kBAAkBuD,cAAc,KAAKC,sBAAsBvB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKhB,WAAWkB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKhB,WAAW8C,KAAK9B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM+B,OACFhC,IACAT,OACmB;EACnB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMb,eAAegB,mBAAmB,CAAA;EAEtF,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAId,MAAMa,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMb,eAAegB;GACrBO,MAAM5B,iBAAiB;KAClBF,kBAAkBqD,aAAa,KAAKC,mBAAmB3B,MAAAA;KACvD3B,kBAAkBuD,cAAc,KAAKC,sBAAsB7B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIiC,aAAahC;EACzB,MAAM,KAAKhB,WAAWiD,OAAOjC,MAAAA;EAC7BA,OAAOD,KAAKiC;EAEZ,OAAOhC;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientRoleValidator","PermissionName","JunctionEntityService","decodeQuery","clientRoleSchema","ClientRoleService","ownerRealmKey","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_ROLE_READ","CLIENT_ROLE_UPDATE","CLIENT_ROLE_DELETE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_ROLE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","roleId","clientId","role","roleRealmId","realmId","client","clientRealmId","identity","hasPermissions","isSuperset","type","message","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientRoleValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientRole } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IClientRoleRepository, IClientRoleService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientRoleSchema } from './schema.ts';\n\nexport type ClientRoleServiceContext = {\n    repository: IClientRoleRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientRoleService extends JunctionEntityService implements IClientRoleService {\n    protected readonly ownerRealmKey = 'clientRealmId';\n\n    protected repository: IClientRoleRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: ClientRoleValidator;\n\n    constructor(ctx: ClientRoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new ClientRoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<ClientRole>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_ROLE_READ,\n                PermissionName.CLIENT_ROLE_UPDATE,\n                PermissionName.CLIENT_ROLE_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: clientRoleSchema, actor }));\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientRole> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_ROLE_READ,\n                PermissionName.CLIENT_ROLE_UPDATE,\n                PermissionName.CLIENT_ROLE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            roleId: validated.roleId,\n            clientId: validated.clientId,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'client-role' });\n        }\n\n        if (validated.role) {\n            validated.roleRealmId = validated.role.realmId;\n        }\n\n        if (validated.client) {\n            validated.clientRealmId = validated.client.realmId;\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.roleId,\n                    clientId: validated.role.clientId,\n                },\n            );\n            if (!hasPermissions) {\n                throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n            }\n        }\n\n        // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_ROLE_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_ROLE_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAwBA,IAAaW,oBAAb,cAAuCH,sBAAAA;CAChBI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIT,oBAAAA;CACzB;CAEA,MAAMW,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYS,OAAO;GAAES,QAAQjB;GAAkBS;EAAM,CAAA,CAAA;CAC/F;CAEA,MAAMS,OACFC,IACAV,OACmB;EACnB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAd,OACmB;EACnB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMf,eAAe4B,mBAAmB,CAAA;EAEtF,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAOjC,eAAekC,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,QAAQN,UAAUM;GAClBC,UAAUP,UAAUO;EACxB,CAAA,GAEI,MAAM,IAAIxC,oBAAoB,EAAE2B,QAAQ,cAAc,CAAA;EAG1D,IAAIM,UAAUQ,MACVR,UAAUS,cAAcT,UAAUQ,KAAKE;EAG3C,IAAIV,UAAUW,QACVX,UAAUY,gBAAgBZ,UAAUW,OAAOD;EAG/C,IAAIV,UAAUQ,QAAQzB,MAAM8B;OAYpB,CAACC,MAXwB,KAAKpC,2BAA2BqC,WACzD;IACIC,MAAMjC,MAAM8B,SAASG;IACrBvB,IAAIV,MAAM8B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIO,UAAUM;IACdC,UAAUP,UAAUQ,KAAKD;GAC7B,CAAA,GAGA,MAAM,IAAI1C,gBAAgB,EAAEoD,SAAS,0CAA2C,CAAA;EAAA;EAKxF,MAAMlC,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMf,eAAe4B;GACrBF,MAAM/B,iBAAiB;KAClBF,kBAAkBuD,aAAa,KAAKC,mBAAmBpB,SAAAA;KACvDpC,kBAAkByD,cAAc,KAAKC,sBAAsBtB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAW8C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAV,OACmB;EACnB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMf,eAAekB,mBAAmB,CAAA;EAEtF,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAId,MAAMe,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMf,eAAekB;GACrBQ,MAAM/B,iBAAiB;KAClBF,kBAAkBuD,aAAa,KAAKC,mBAAmB1B,MAAAA;KACvD9B,kBAAkByD,cAAc,KAAKC,sBAAsB5B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIgC,aAAa/B;EACzB,MAAM,KAAKjB,WAAWiD,OAAOhC,MAAAA;EAC7BA,OAAOD,KAAKgC;EAEZ,OAAO/B;CACX;AACJ"}

package/dist/core/entities/client-scope/index.d.ts

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/client-scope/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/client-scope/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { clientScopeSchema } from "./schema.mjs";
 import { ClientScopeService } from "./service.mjs";
-export { ClientScopeService };
+export { ClientScopeService, clientScopeSchema };

package/dist/core/entities/client-scope/schema.d.ts

@@ -0,0 +1,3 @@
+import type { ClientScope } from '@authup/core-kit';
+export declare const clientScopeSchema: import("@rapiq/core").Schema<ClientScope, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/client-scope/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,eAAO,MAAM,iBAAiB,gDAiB5B,CAAC"}

package/dist/core/entities/client-scope/schema.mjs

@@ -0,0 +1,37 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/client-scope/schema.ts
+const schemaMapping = {
+	client: EntityType.CLIENT,
+	scope: EntityType.SCOPE
+};
+const clientScopeSchema = defineSchema({
+	name: EntityType.CLIENT_SCOPE,
+	fields: { default: [
+		"id",
+		"default",
+		"clientId",
+		"clientRealmId",
+		"scopeId",
+		"scopeRealmId"
+	] },
+	filters: { allowed: [
+		"clientId",
+		"scopeId",
+		"default"
+	] },
+	relations: {
+		allowed: ["client", "scope"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { clientScopeSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/client-scope/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","scope","SCOPE","clientScopeSchema","name","CLIENT_SCOPE","fields","default","filters","allowed","relations","validate","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-scope/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientScope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, scope: EntityType.SCOPE };\n\nexport const clientScopeSchema = defineSchema<ClientScope>({\n    name: EntityType.CLIENT_SCOPE,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'default',\n            'clientId',\n            'clientRealmId',\n            'scopeId',\n            'scopeRealmId',\n        ],\n    },\n    filters: { allowed: ['clientId', 'scopeId', 'default'] },\n    relations: { allowed: ['client', 'scope'], validate: createRelationsReadGate(schemaMapping) },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,OAAOL,WAAWM;AAAM;AAE3E,MAAaC,oBAAoBR,aAA0B;CACvDS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAY;EAAW;GAAW;CACvDC,WAAW;EAAED,SAAS,CAAC,UAAU,OAAA;EAAUE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC5Fc,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}

package/dist/core/entities/client-scope/service.d.ts

@@ -7,7 +7,7 @@ export type ClientScopeServiceContext = {
     repository: IClientScopeRepository;
 };
 export declare class ClientScopeService extends JunctionEntityService implements IClientScopeService {
-    protected readonly ownerRealmKey = "client_realm_id";
+    protected readonly ownerRealmKey = "clientRealmId";
     protected repository: IClientScopeRepository;
     protected validator: ClientScopeValidator;
     constructor(ctx: ClientScopeServiceContext);

package/dist/core/entities/client-scope/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,oBAAoB,EAAkB,MAAM,kBAAkB,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,MAAM,yBAAyB,GAAG;IACpC,UAAU,EAAE,sBAAsB,CAAC;CACtC,CAAC;AAEF,qBAAa,kBAAmB,SAAQ,qBAAsB,YAAW,mBAAmB;IACxF,SAAS,CAAC,QAAQ,CAAC,aAAa,qBAAqB;IAErD,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,GAAG,EAAE,yBAAyB;IAMpC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAajD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IAkBjB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IAsCjB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;CAuB1B"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,oBAAoB,EAAkB,MAAM,kBAAkB,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAI9E,MAAM,MAAM,yBAAyB,GAAG;IACpC,UAAU,EAAE,sBAAsB,CAAC;CACtC,CAAC;AAEF,qBAAa,kBAAmB,SAAQ,qBAAsB,YAAW,mBAAmB;IACxF,SAAS,CAAC,QAAQ,CAAC,aAAa,mBAAmB;IAEnD,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,GAAG,EAAE,yBAAyB;IAMpC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAajD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IAkBjB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IAsCjB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;CAuB1B"}

package/dist/core/entities/client-scope/service.mjs

@@ -1,6 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { clientScopeSchema } from "./schema.mjs";
+import { decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { ValidatorGroup } from "@authup/kit";
 import { ClientScopeValidator, PermissionName } from "@authup/core-kit";
 import { JunctionEntityService } from "@authup/server-kit";
@@ -8,7 +11,7 @@ import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/client-scope/service.ts
 var ClientScopeService = class extends JunctionEntityService {
-	ownerRealmKey = "client_realm_id";
+	ownerRealmKey = "clientRealmId";
 	repository;
 	validator;
 	constructor(ctx) {
@@ -23,7 +26,10 @@ var ClientScopeService = class extends JunctionEntityService {
 			PermissionName.CLIENT_UPDATE,
 			PermissionName.CLIENT_DELETE
 		] });
-		return this.repository.findMany(query);
+		return this.repository.findMany(await decodeQuery(query, {
+			schema: clientScopeSchema,
+			actor
+		}));
 	}
 	async getOne(id, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -41,11 +47,11 @@ var ClientScopeService = class extends JunctionEntityService {
 		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
 		await this.repository.validateJoinColumns(validated);
 		if (await this.repository.findOneBy({
-			client_id: validated.client_id,
-			scope_id: validated.scope_id
+			clientId: validated.clientId,
+			scopeId: validated.scopeId
 		})) throw new EntityConflictError({ entity: "client-scope" });
-		if (validated.client) validated.client_realm_id = validated.client.realm_id;
-		if (validated.scope) validated.scope_realm_id = validated.scope.realm_id;
+		if (validated.client) validated.clientRealmId = validated.client.realmId;
+		if (validated.scope) validated.scopeRealmId = validated.scope.realmId;
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.CLIENT_SCOPE_CREATE,
 			data: definePolicyData({

package/dist/core/entities/client-scope/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientScopeValidator","PermissionName","JunctionEntityService","ClientScopeService","ownerRealmKey","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_SCOPE_READ","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_SCOPE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","client_id","scope_id","client","client_realm_id","realm_id","scope","scope_realm_id","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","CLIENT_SCOPE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/client-scope/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientScopeValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientScope } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IClientScopeRepository, IClientScopeService } from './types.ts';\n\nexport type ClientScopeServiceContext = {\n    repository: IClientScopeRepository;\n};\n\nexport class ClientScopeService extends JunctionEntityService implements IClientScopeService {\n    protected readonly ownerRealmKey = 'client_realm_id';\n\n    protected repository: IClientScopeRepository;\n\n    protected validator: ClientScopeValidator;\n\n    constructor(ctx: ClientScopeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new ClientScopeValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<ClientScope>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_SCOPE_READ,\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_SCOPE_READ,\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            client_id: validated.client_id,\n            scope_id: validated.scope_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'client-scope' });\n        }\n\n        if (validated.client) {\n            validated.client_realm_id = validated.client.realm_id;\n        }\n\n        if (validated.scope) {\n            validated.scope_realm_id = validated.scope.realm_id;\n        }\n\n        // Stamp the owner (client) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_SCOPE_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (client) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_SCOPE_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaQ,qBAAb,cAAwCD,sBAAAA;CACjBE,gBAAgB;CAEzBC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIN,qBAAAA;CACzB;CAEA,MAAMQ,QACFC,OACAC,OACoD;EACpD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAST,KAAAA;CACpC;CAEA,MAAMU,OACFC,IACAV,OACoB;EACpB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,OAAOuB;CACX;CAEA,MAAME,OACFC,MACAd,OACoB;EACpB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAeyB,oBAAoB,CAAA;EAEvF,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO9B,eAAe+B,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWiB,UAAU;GAC7CW,WAAWN,UAAUM;GACrBC,UAAUP,UAAUO;EACxB,CAAA,GAEI,MAAM,IAAIrC,oBAAoB,EAAEwB,QAAQ,eAAe,CAAA;EAG3D,IAAIM,UAAUQ,QACVR,UAAUS,kBAAkBT,UAAUQ,OAAOE;EAGjD,IAAIV,UAAUW,OACVX,UAAUY,iBAAiBZ,UAAUW,MAAMD;EAI/C,MAAM3B,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMZ,eAAeyB;GACrBF,MAAM5B,iBAAiB;KAClBD,kBAAkB8C,aAAa,KAAKC,mBAAmBf,SAAAA;KACvDhC,kBAAkBgD,cAAc,KAAKC,sBAAsBjB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKhB,WAAWkB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKhB,WAAWwC,KAAKxB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMyB,OACF1B,IACAV,OACoB;EACpB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAe8C,oBAAoB,CAAA;EAEvF,MAAM1B,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAId,MAAMY,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMZ,eAAe8C;GACrBvB,MAAM5B,iBAAiB;KAClBD,kBAAkB8C,aAAa,KAAKC,mBAAmBrB,MAAAA;KACvD1B,kBAAkBgD,cAAc,KAAKC,sBAAsBvB,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI4B,aAAa3B;EACzB,MAAM,KAAKhB,WAAW4C,OAAO5B,MAAAA;EAC7BA,OAAOD,KAAK4B;EAEZ,OAAO3B;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientScopeValidator","PermissionName","JunctionEntityService","decodeQuery","clientScopeSchema","ClientScopeService","ownerRealmKey","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_SCOPE_READ","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_SCOPE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","clientId","scopeId","client","clientRealmId","realmId","scope","scopeRealmId","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","CLIENT_SCOPE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/client-scope/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientScopeValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientScope } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IClientScopeRepository, IClientScopeService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientScopeSchema } from './schema.ts';\n\nexport type ClientScopeServiceContext = {\n    repository: IClientScopeRepository;\n};\n\nexport class ClientScopeService extends JunctionEntityService implements IClientScopeService {\n    protected readonly ownerRealmKey = 'clientRealmId';\n\n    protected repository: IClientScopeRepository;\n\n    protected validator: ClientScopeValidator;\n\n    constructor(ctx: ClientScopeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new ClientScopeValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<ClientScope>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_SCOPE_READ,\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: clientScopeSchema, actor }));\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_SCOPE_READ,\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            clientId: validated.clientId,\n            scopeId: validated.scopeId,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'client-scope' });\n        }\n\n        if (validated.client) {\n            validated.clientRealmId = validated.client.realmId;\n        }\n\n        if (validated.scope) {\n            validated.scopeRealmId = validated.scope.realmId;\n        }\n\n        // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_SCOPE_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_SCOPE_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAsBA,IAAaU,qBAAb,cAAwCH,sBAAAA;CACjBI,gBAAgB;CAEzBC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIR,qBAAAA;CACzB;CAEA,MAAMU,QACFC,OACAC,OACoD;EACpD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYQ,OAAO;GAAEU,QAAQjB;GAAmBQ;EAAM,CAAA,CAAA;CAChG;CAEA,MAAMU,OACFC,IACAX,OACoB;EACpB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAf,OACoB;EACpB,MAAMA,MAAMC,oBAAoBe,YAAY,EAAEb,MAAMd,eAAe4B,oBAAoB,CAAA;EAEvF,MAAMC,YAAY,MAAM,KAAKtB,UAAUuB,IAAIJ,MAAM,EAAEK,OAAOjC,eAAekC,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,UAAUN,UAAUM;GACpBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIxC,oBAAoB,EAAE2B,QAAQ,eAAe,CAAA;EAG3D,IAAIM,UAAUQ,QACVR,UAAUS,gBAAgBT,UAAUQ,OAAOE;EAG/C,IAAIV,UAAUW,OACVX,UAAUY,eAAeZ,UAAUW,MAAMD;EAI7C,MAAM5B,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMd,eAAe4B;GACrBF,MAAM/B,iBAAiB;KAClBD,kBAAkBiD,aAAa,KAAKC,mBAAmBf,SAAAA;KACvDnC,kBAAkBmD,cAAc,KAAKC,sBAAsBjB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMyB,OACF1B,IACAX,OACoB;EACpB,MAAMA,MAAMC,oBAAoBe,YAAY,EAAEb,MAAMd,eAAeiD,oBAAoB,CAAA;EAEvF,MAAM1B,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAId,MAAMc,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMd,eAAeiD;GACrBvB,MAAM/B,iBAAiB;KAClBD,kBAAkBiD,aAAa,KAAKC,mBAAmBrB,MAAAA;KACvD7B,kBAAkBmD,cAAc,KAAKC,sBAAsBvB,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI4B,aAAa3B;EACzB,MAAM,KAAKjB,WAAW6C,OAAO5B,MAAAA;EAC7BA,OAAOD,KAAK4B;EAEZ,OAAO3B;CACX;AACJ"}

package/dist/core/entities/consent/index.d.ts

@@ -0,0 +1,4 @@
+export * from './service.ts';
+export * from './types.ts';
+export * from './schema.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/consent/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/consent/index.mjs

@@ -0,0 +1,7 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH } from "./types.mjs";
+import { consentSchema } from "./schema.mjs";
+import { ConsentService } from "./service.mjs";
+export { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ConsentService, consentSchema };

package/dist/core/entities/consent/schema.d.ts

@@ -0,0 +1,3 @@
+import type { Consent } from '@authup/core-kit';
+export declare const consentSchema: import("@rapiq/core").Schema<Consent, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/consent/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAOhD,eAAO,MAAM,aAAa,4CA2BxB,CAAC"}

package/dist/core/entities/consent/schema.mjs

@@ -0,0 +1,40 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { CONSENT_FILTER_KEYS } from "./types.mjs";
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/consent/schema.ts
+const schemaMapping = { realm: EntityType.REALM };
+const consentSchema = defineSchema({
+	name: EntityType.CONSENT,
+	fields: { default: [
+		"id",
+		"clientId",
+		"realmId",
+		"userId",
+		"sub",
+		"subKind",
+		"scope",
+		"expiresAt",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: [...CONSENT_FILTER_KEYS] },
+	relations: {
+		allowed: ["realm"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"createdAt",
+		"updatedAt",
+		"scope"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { consentSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/consent/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","CONSENT_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","consentSchema","name","CONSENT","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/consent/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Consent } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { CONSENT_FILTER_KEYS } from './types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const consentSchema = defineSchema<Consent>({\n    name: EntityType.CONSENT,\n    fields: {\n        // `default` (not just `allowed`) so the adapter adds an explicit\n        // per-column SELECT: it populates expressionMap.selects, which\n        // applyRealmScopeSelect dedupes against. Without it the default\n        // \"select all\" is implicit (empty selects) and the force-select\n        // re-adds consent.sub — a duplicate `consent_sub` alias that\n        // mysql rejects under the client join (see helpers.ts).\n        default: [\n            'id',\n            'clientId',\n            'realmId',\n            'userId',\n            'sub',\n            'subKind',\n            'scope',\n            'expiresAt',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: [...CONSENT_FILTER_KEYS] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['createdAt', 'updatedAt', 'scope'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,QAAQ,EAOJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAEC,SAAS,CAAA,GAAIX,mBAAAA,EAAqB;CAC7CY,WAAW;EAAED,SAAS,CAAC,OAAA;EAAUE,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EAAEH,SAAS;EAAC;EAAa;EAAa;GAAS;CACrDI,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}

package/dist/core/entities/consent/service.d.ts

@@ -0,0 +1,19 @@
+import type { Consent } from '@authup/core-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { ConsentCoveringInput, ConsentRecordInput, ConsentServiceReadOptions, IConsentRepository, IConsentService } from './types.ts';
+export type ConsentServiceContext = {
+    repository: IConsentRepository;
+};
+export declare class ConsentService extends AbstractEntityService implements IConsentService {
+    protected repository: IConsentRepository;
+    constructor(ctx: ConsentServiceContext);
+    protected isOwnedBy(consent: Consent, actor: ActorContext): boolean;
+    protected normalizeScopeTokens(scope: string | string[] | null): string[];
+    getMany(query: Record<string, any>, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<EntityRepositoryFindManyResult<Consent>>;
+    getOne(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;
+    delete(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;
+    record(input: ConsentRecordInput): Promise<void>;
+    isCovering(input: ConsentCoveringInput): Promise<boolean>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/consent/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/service.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAIvF,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,eAAe,EAClB,MAAM,YAAY,CAAC;AAIpB,MAAM,MAAM,qBAAqB,GAAG;IAChC,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,qBAAa,cAAe,SAAQ,qBAAsB,YAAW,eAAe;IAChF,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAE7B,GAAG,EAAE,qBAAqB;IAKtC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAMnE,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,GAAG,MAAM,EAAE;IAYnE,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,yBAA8B,GACxC,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAiF7C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,yBAA8B,GAAG,OAAO,CAAC,OAAO,CAAC;IAsBlG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,yBAA8B,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBlG,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAchD,UAAU,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;CAclE"}

package/dist/core/entities/consent/service.mjs

@@ -0,0 +1,138 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import "./types.mjs";
+import { consentSchema } from "./schema.mjs";
+import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
+import { PermissionName } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { EntityNotFoundError } from "@authup/errors";
+import { unwrapOAuth2Scope } from "@authup/specs";
+import { and, eq, inArray, or } from "@rapiq/core";
+//#region src/core/entities/consent/service.ts
+var ConsentService = class extends AbstractEntityService {
+	repository;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+	}
+	isOwnedBy(consent, actor) {
+		return !!actor.identity && consent.sub === actor.identity.data.id && consent.subKind === actor.identity.type;
+	}
+	normalizeScopeTokens(scope) {
+		const tokens = unwrapOAuth2Scope(scope ?? []).filter((token) => token.length > 0 && token.length <= 128);
+		return Array.from(new Set(tokens));
+	}
+	async getMany(query, actor, options = {}) {
+		const parsed = await decodeQuery(query, {
+			schema: consentSchema,
+			actor
+		});
+		let canReadAll = true;
+		try {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });
+		} catch (e) {
+			if (!actor.identity) throw e;
+			canReadAll = false;
+		}
+		if (!canReadAll) return this.repository.findMany(parsed, {
+			owner: {
+				sub: actor.identity.data.id,
+				subKind: actor.identity.type
+			},
+			...options.realmId ? { realmId: options.realmId } : {}
+		});
+		const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.CONSENT_READ });
+		if (compiled.verdict !== "post") {
+			const ownership = actor.identity ? and(eq("sub", actor.identity.data.id), eq("subKind", actor.identity.type)) : null;
+			let scoped = parsed;
+			if (compiled.verdict === "deny") scoped = appendQueryConditions(parsed, ownership ?? inArray("id", []));
+			else if (compiled.verdict === "conditional") scoped = appendQueryConditions(parsed, ownership ? or(ownership, compiled.condition) : compiled.condition);
+			return this.repository.findMany(scoped, { ...options.realmId ? { realmId: options.realmId } : {} });
+		}
+		const { data: entities, meta } = await this.repository.findMany(parsed, { ...options.realmId ? { realmId: options.realmId } : {} });
+		const data = [];
+		let { total } = meta;
+		for (const entity of entities) {
+			if (this.isOwnedBy(entity, actor)) {
+				data.push(entity);
+				continue;
+			}
+			try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.CONSENT_READ,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: entity,
+						...this.resourceRealmMatch(entity)
+					})
+				});
+				data.push(entity);
+			} catch {
+				total -= 1;
+			}
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(id, actor, options = {}) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity || options.realmId && entity.realmId !== options.realmId) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.CONSENT_READ,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		return entity;
+	}
+	async delete(id, actor, options = {}) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity || options.realmId && entity.realmId !== options.realmId) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_DELETE });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.CONSENT_DELETE,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		const { id: entityId } = entity;
+		await this.repository.remove(entity);
+		entity.id = entityId;
+		return entity;
+	}
+	async record(input) {
+		const tokens = this.normalizeScopeTokens(input.scope);
+		if (tokens.length === 0) return;
+		await this.repository.insertMissing({
+			clientId: input.clientId,
+			realmId: input.realmId,
+			owner: input.owner,
+			scopes: tokens
+		});
+	}
+	async isCovering(input) {
+		const tokens = this.normalizeScopeTokens(input.scope);
+		if (tokens.length === 0) return true;
+		const rows = await this.repository.findAllBySubjectClient(input.clientId, input.owner);
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		return tokens.every((token) => rows.some((row) => row.scope === token && (row.expiresAt === null || row.expiresAt > now)));
+	}
+};
+//#endregion
+export { ConsentService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/consent/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","and","eq","inArray","or","EntityNotFoundError","PermissionName","unwrapOAuth2Scope","AbstractEntityService","CONSENT_SCOPE_MAX_LENGTH","appendQueryConditions","decodeQuery","consentSchema","ConsentService","repository","ctx","isOwnedBy","consent","actor","identity","sub","data","id","subKind","type","normalizeScopeTokens","scope","tokens","filter","token","length","Array","from","Set","getMany","query","options","parsed","schema","canReadAll","permissionEvaluator","preEvaluate","name","CONSENT_READ","e","findMany","owner","realmId","compiled","compile","verdict","ownership","scoped","condition","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","delete","CONSENT_DELETE","entityId","remove","record","input","insertMissing","clientId","scopes","isCovering","rows","findAllBySubjectClient","now","Date","toISOString","every","some","row","expiresAt"],"sources":["../../../../src/core/entities/consent/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    and, \n    eq, \n    inArray, \n    or,\n} from '@rapiq/core';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Consent } from '@authup/core-kit';\nimport { unwrapOAuth2Scope } from '@authup/specs';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport {\n    CONSENT_SCOPE_MAX_LENGTH,\n} from './types.ts';\nimport type {\n    ConsentCoveringInput,\n    ConsentRecordInput,\n    ConsentServiceReadOptions,\n    IConsentRepository,\n    IConsentService,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { consentSchema } from './schema.ts';\n\nexport type ConsentServiceContext = {\n    repository: IConsentRepository,\n};\n\nexport class ConsentService extends AbstractEntityService implements IConsentService {\n    protected repository: IConsentRepository;\n\n    constructor(ctx: ConsentServiceContext) {\n        super();\n        this.repository = ctx.repository;\n    }\n\n    protected isOwnedBy(consent: Consent, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            consent.sub === actor.identity.data.id &&\n            consent.subKind === actor.identity.type;\n    }\n\n    protected normalizeScopeTokens(scope: string | string[] | null): string[] {\n        const tokens = unwrapOAuth2Scope(scope ?? [])\n            // Drop empty tokens and any token that does not fit the scope\n            // column (varchar 128). An over-long token — only reachable via a\n            // non-standard scope riding the `global` verifier bypass — is\n            // simply not persisted (never remembered), rather than aborting\n            // the whole write and losing the sibling tokens ordered after it.\n            .filter((token) => token.length > 0 && token.length <= CONSENT_SCOPE_MAX_LENGTH);\n\n        return Array.from(new Set(tokens));\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: ConsentServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Consent>> {\n        const parsed = await decodeQuery(query, { schema: consentSchema, actor });\n\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own consents\n            return this.repository.findMany(parsed, {\n                owner: {\n                    sub: actor.identity!.data.id,\n                    subKind: actor.identity!.type,\n                },\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        // Compile CONSENT_READ into a row condition (#3286 phase 3). Own rows are\n        // always readable, so ownership composes as an OR-alternative — the whole\n        // gate runs as WHERE and pagination/totals stay exact. A non-expressible\n        // policy falls back to the per-row loop below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.CONSENT_READ });\n        if (compiled.verdict !== 'post') {\n            const ownership = actor.identity ?\n                and(eq('sub', actor.identity.data.id), eq('subKind', actor.identity.type)) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, ownership ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    ownership ? or(ownership, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(parsed, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n\n        const data: Consent[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CONSENT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext, options: ConsentServiceReadOptions = {}): Promise<Consent> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realmId !== options.realmId)) {\n            // A realm mismatch on the nested mount fails as not-found (no\n            // cross-realm existence oracle).\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.CONSENT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n\n    async delete(id: string, actor: ActorContext, options: ConsentServiceReadOptions = {}): Promise<Consent> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realmId !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_DELETE });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.CONSENT_DELETE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    async record(input: ConsentRecordInput): Promise<void> {\n        const tokens = this.normalizeScopeTokens(input.scope);\n        if (tokens.length === 0) {\n            return;\n        }\n\n        await this.repository.insertMissing({\n            clientId: input.clientId,\n            realmId: input.realmId,\n            owner: input.owner,\n            scopes: tokens,\n        });\n    }\n\n    async isCovering(input: ConsentCoveringInput): Promise<boolean> {\n        const tokens = this.normalizeScopeTokens(input.scope);\n        if (tokens.length === 0) {\n            return true;\n        }\n\n        const rows = await this.repository.findAllBySubjectClient(input.clientId, input.owner);\n        const now = new Date().toISOString();\n\n        return tokens.every((token) => rows.some(\n            (row) => row.scope === token &&\n                (row.expiresAt === null || row.expiresAt > now),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AAqCA,IAAac,iBAAb,cAAoCL,sBAAAA;CACtBM;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,YAAYL,MAAMC,SAASK;CAC3C;CAEUC,qBAAqBC,OAA2C;EACtE,MAAMC,SAASpB,kBAAkBmB,SAAS,CAAA,CAAE,CACxC,CAKCE,QAAQC,UAAUA,MAAMC,SAAS,KAAKD,MAAMC,UAAAA,GAAUrB;EAE3D,OAAOsB,MAAMC,KAAK,IAAIC,IAAIN,MAAAA,CAAAA;CAC9B;CAEA,MAAMO,QACFC,OACAjB,OACAkB,UAAqC,CAAC,GACU;EAChD,MAAMC,SAAS,MAAM1B,YAAYwB,OAAO;GAAEG,QAAQ1B;GAAeM;EAAM,CAAA;EAEvE,IAAIqB,aAAa;EACjB,IAAI;GACA,MAAMrB,MAAMsB,oBAAoBC,YAAY,EAAEC,MAAMpC,eAAeqC,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAAC1B,MAAMC,UACP,MAAMyB;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKzB,WAAW+B,SAASR,QAAQ;GACpCS,OAAO;IACH1B,KAAKF,MAAMC,SAAUE,KAAKC;IAC1BC,SAASL,MAAMC,SAAUK;GAC7B;GACA,GAAIY,QAAQW,UAAU,EAAEA,SAASX,QAAQW,QAAQ,IAAI,CAAC;EAC1D,CAAA;EAOJ,MAAMC,WAAW,MAAM9B,MAAMsB,oBAAoBS,QAAQ,EAAEP,MAAMpC,eAAeqC,aAAa,CAAA;EAC7F,IAAIK,SAASE,YAAY,QAAQ;GAC7B,MAAMC,YAAYjC,MAAMC,WACpBlB,IAAIC,GAAG,OAAOgB,MAAMC,SAASE,KAAKC,EAAE,GAAGpB,GAAG,WAAWgB,MAAMC,SAASK,IAAI,CAAA,IACxE;GAEJ,IAAI4B,SAASf;GACb,IAAIW,SAASE,YAAY,QACrBE,SAAS1C,sBAAsB2B,QAAQc,aAAahD,QAAQ,MAAM,CAAA,CAAE,CAAA;QACjE,IAAI6C,SAASE,YAAY,eAC5BE,SAAS1C,sBACL2B,QACAc,YAAY/C,GAAG+C,WAAWH,SAASK,SAAS,IAAIL,SAASK,SAAS;GAI1E,OAAO,KAAKvC,WAAW+B,SAASO,QAAQ,EAAE,GAAIhB,QAAQW,UAAU,EAAEA,SAASX,QAAQW,QAAQ,IAAI,CAAC,EAAG,CAAA;EACvG;EAEA,MAAM,EAAE1B,MAAMiC,UAAUC,SAAS,MAAM,KAAKzC,WAAW+B,SAASR,QAAQ,EAAE,GAAID,QAAQW,UAAU,EAAEA,SAASX,QAAQW,QAAQ,IAAI,CAAC,EAAG,CAAA;EAEnI,MAAM1B,OAAkB,CAAA;EACxB,IAAI,EAAEmC,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAKtC,UAAUyC,QAAQvC,KAAAA,GAAQ;IAC/BG,KAAKqC,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMvC,MAAMsB,oBAAoBmB,SAAS;KACrCjB,MAAMpC,eAAeqC;KACrBtB,MAAMrB,iBAAiB;OAClBD,kBAAkB6D,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACApC,KAAKqC,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHnC;GACAkC,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAOxC,IAAYJ,OAAqBkB,UAAqC,CAAC,GAAqB;EACrG,MAAMqB,SAAS,MAAM,KAAK3C,WAAWiD,YAAYzC,EAAAA;EACjD,IAAI,CAACmC,UAAWrB,QAAQW,WAAWU,OAAOV,YAAYX,QAAQW,SAG1D,MAAM,IAAI1C,oBAAAA;EAGd,IAAI,CAAC,KAAKW,UAAUyC,QAAQvC,KAAAA,GAAQ;GAChC,MAAMA,MAAMsB,oBAAoBC,YAAY,EAAEC,MAAMpC,eAAeqC,aAAa,CAAA;GAChF,MAAMzB,MAAMsB,oBAAoBmB,SAAS;IACrCjB,MAAMpC,eAAeqC;IACrBtB,MAAMrB,iBAAiB;MAClBD,kBAAkB6D,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMO,OAAO1C,IAAYJ,OAAqBkB,UAAqC,CAAC,GAAqB;EACrG,MAAMqB,SAAS,MAAM,KAAK3C,WAAWiD,YAAYzC,EAAAA;EACjD,IAAI,CAACmC,UAAWrB,QAAQW,WAAWU,OAAOV,YAAYX,QAAQW,SAC1D,MAAM,IAAI1C,oBAAAA;EAGd,IAAI,CAAC,KAAKW,UAAUyC,QAAQvC,KAAAA,GAAQ;GAChC,MAAMA,MAAMsB,oBAAoBC,YAAY,EAAEC,MAAMpC,eAAe2D,eAAe,CAAA;GAClF,MAAM/C,MAAMsB,oBAAoBmB,SAAS;IACrCjB,MAAMpC,eAAe2D;IACrB5C,MAAMrB,iBAAiB;MAClBD,kBAAkB6D,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAEnC,IAAI4C,aAAaT;EACzB,MAAM,KAAK3C,WAAWqD,OAAOV,MAAAA;EAC7BA,OAAOnC,KAAK4C;EAEZ,OAAOT;CACX;CAEA,MAAMW,OAAOC,OAA0C;EACnD,MAAM1C,SAAS,KAAKF,qBAAqB4C,MAAM3C,KAAK;EACpD,IAAIC,OAAOG,WAAW,GAClB;EAGJ,MAAM,KAAKhB,WAAWwD,cAAc;GAChCC,UAAUF,MAAME;GAChBxB,SAASsB,MAAMtB;GACfD,OAAOuB,MAAMvB;GACb0B,QAAQ7C;EACZ,CAAA;CACJ;CAEA,MAAM8C,WAAWJ,OAA+C;EAC5D,MAAM1C,SAAS,KAAKF,qBAAqB4C,MAAM3C,KAAK;EACpD,IAAIC,OAAOG,WAAW,GAClB,OAAO;EAGX,MAAM4C,OAAO,MAAM,KAAK5D,WAAW6D,uBAAuBN,MAAME,UAAUF,MAAMvB,KAAK;EACrF,MAAM8B,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAElC,OAAOnD,OAAOoD,OAAOlD,UAAU6C,KAAKM,MAC/BC,QAAQA,IAAIvD,UAAUG,UAClBoD,IAAIC,cAAc,QAAQD,IAAIC,YAAYN,IAAE,CAAA;CAEzD;AACJ"}