@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/entities/event/service.mjs

@@ -0,0 +1,185 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { eventSchema } from "./schema.mjs";
+import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
+import "./constants.mjs";
+import { sanitizeEventData } from "./sanitize.mjs";
+import { PermissionName } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { EntityNotFoundError } from "@authup/errors";
+import { and, eq, inArray, or } from "@rapiq/core";
+import { randomUUID } from "node:crypto";
+//#region src/core/entities/event/service.ts
+const DAY_IN_MS = 864e5;
+var EventService = class extends AbstractEntityService {
+	repository;
+	options;
+	logger;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.options = ctx.options ?? {};
+		this.logger = ctx.logger;
+	}
+	isOwnedBy(entity, actor) {
+		return !!actor.identity && !!entity.actorId && entity.actorId === actor.identity.data.id && entity.actorType === actor.identity.type;
+	}
+	async canReadRealm(actor, realmId) {
+		try {
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.EVENT_READ,
+				data: definePolicyData({ [BuiltInPolicyType.REALM_MATCH]: realmId }),
+				options: { policiesIncluded: [
+					BuiltInPolicyType.COMPOSITE,
+					BuiltInPolicyType.PERMISSION_BINDING,
+					BuiltInPolicyType.REALM_MATCH
+				] }
+			});
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	async resolveReadVisibility(actor) {
+		const actorRealmId = this.getActorRealmId(actor);
+		let foreignRealmId = randomUUID();
+		while (foreignRealmId === actorRealmId) foreignRealmId = randomUUID();
+		if (await this.canReadRealm(actor, foreignRealmId)) return;
+		const realmIds = [];
+		if (actorRealmId && await this.canReadRealm(actor, actorRealmId)) realmIds.push(actorRealmId);
+		if (await this.canReadRealm(actor, null)) realmIds.push(null);
+		return {
+			realmIds,
+			...actor.identity ? { owner: {
+				actorId: actor.identity.data.id,
+				actorType: actor.identity.type
+			} } : {}
+		};
+	}
+	async record(input) {
+		const data = sanitizeEventData(input.data);
+		this.logger?.info(`audit: ${input.scope}.${input.name}`, {
+			scope: input.scope,
+			name: input.name,
+			refType: input.refType ?? null,
+			refId: input.refId ?? null,
+			clientId: input.clientId ?? null,
+			actorType: input.actorType ?? null,
+			actorId: input.actorId ?? null,
+			realmId: input.realmId ?? null,
+			...data ? { data } : {}
+		});
+		if (this.options.enabled === false) return;
+		try {
+			const retentionDays = input.retentionDays ?? this.options.retentionDays ?? 90;
+			const entity = this.repository.create({
+				id: randomUUID(),
+				scope: input.scope,
+				name: input.name,
+				refType: truncate(input.refType, 64),
+				refId: truncate(input.refId, 64),
+				clientId: input.clientId ?? null,
+				actorType: input.actorType ?? null,
+				actorId: input.actorId ?? null,
+				actorName: truncate(input.actorName, 128),
+				requestPath: truncate(input.requestPath, 256),
+				requestMethod: truncate(input.requestMethod, 10),
+				requestIpAddress: truncate(input.requestIpAddress, 45),
+				requestUserAgent: truncate(input.requestUserAgent, 512),
+				realmId: input.realmId ?? null,
+				data,
+				expiring: retentionDays > 0,
+				expiresAt: retentionDays > 0 ? new Date(Date.now() + retentionDays * DAY_IN_MS).toISOString() : null
+			});
+			await this.repository.save(entity);
+		} catch {
+			this.logger?.warn(`Recording the audit event ${input.scope}.${input.name} failed.`);
+		}
+	}
+	async getMany(query, actor, options = {}) {
+		const parsed = await decodeQuery(query, {
+			schema: eventSchema,
+			actor
+		});
+		let canReadAll = true;
+		try {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });
+		} catch (e) {
+			if (!actor.identity) throw e;
+			canReadAll = false;
+		}
+		if (!canReadAll) return this.repository.findMany(parsed, {
+			owner: {
+				actorId: actor.identity.data.id,
+				actorType: actor.identity.type
+			},
+			...options.realmId ? { realmId: options.realmId } : {}
+		});
+		const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.EVENT_READ });
+		if (compiled.verdict !== "post") {
+			const ownership = actor.identity ? and(eq("actorId", actor.identity.data.id), eq("actorType", actor.identity.type)) : null;
+			let scoped = parsed;
+			if (compiled.verdict === "deny") scoped = appendQueryConditions(parsed, ownership ?? inArray("id", []));
+			else if (compiled.verdict === "conditional") scoped = appendQueryConditions(parsed, ownership ? or(ownership, compiled.condition) : compiled.condition);
+			return this.repository.findMany(scoped, { ...options.realmId ? { realmId: options.realmId } : {} });
+		}
+		const visibility = await this.resolveReadVisibility(actor);
+		const { data: entities, meta } = await this.repository.findMany(parsed, {
+			...options.realmId ? { realmId: options.realmId } : {},
+			...visibility ? { visibility } : {}
+		});
+		const data = [];
+		for (const entity of entities) {
+			if (this.isOwnedBy(entity, actor)) {
+				data.push(entity);
+				continue;
+			}
+			try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.EVENT_READ,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: entity,
+						...this.resourceRealmMatch(entity)
+					})
+				});
+				data.push(entity);
+			} catch {
+				continue;
+			}
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total: meta.total - (entities.length - data.length)
+			}
+		};
+	}
+	async getOne(id, actor, options = {}) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity || options.realmId && entity.realmId !== options.realmId) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.EVENT_READ,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		return entity;
+	}
+};
+function truncate(value, maxLength) {
+	if (typeof value !== "string") return null;
+	if (value.length <= maxLength) return value;
+	return value.substring(0, maxLength);
+}
+//#endregion
+export { EventService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/event/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["randomUUID","BuiltInPolicyType","definePolicyData","and","eq","inArray","or","PermissionName","EntityNotFoundError","AbstractEntityService","EVENT_LOG_RETENTION_DAYS_DEFAULT","sanitizeEventData","appendQueryConditions","decodeQuery","eventSchema","DAY_IN_MS","EventService","repository","options","logger","ctx","isOwnedBy","entity","actor","identity","actorId","data","id","actorType","type","canReadRealm","realmId","permissionEvaluator","evaluate","name","EVENT_READ","REALM_MATCH","policiesIncluded","COMPOSITE","PERMISSION_BINDING","resolveReadVisibility","actorRealmId","getActorRealmId","foreignRealmId","undefined","realmIds","push","owner","record","input","info","scope","refType","refId","clientId","enabled","retentionDays","create","truncate","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","expiring","expiresAt","Date","now","toISOString","save","warn","getMany","query","parsed","schema","canReadAll","preEvaluate","e","findMany","compiled","compile","verdict","ownership","scoped","condition","visibility","entities","meta","ATTRIBUTES","resourceRealmMatch","total","length","getOne","findOneById","value","maxLength","substring"],"sources":["../../../../src/core/entities/event/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    and, \n    eq, \n    inArray, \n    or,\n} from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Event } from '@authup/core-kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from './constants.ts';\nimport { sanitizeEventData } from './sanitize.ts';\nimport type {\n    EventReadVisibility,\n    EventRecordInput,\n    EventServiceOptions,\n    EventServiceReadOptions,\n    IEventRepository,\n    IEventService,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { eventSchema } from './schema.ts';\n\nexport type EventServiceContext = {\n    repository: IEventRepository,\n    options?: EventServiceOptions,\n    logger?: Logger,\n};\n\nconst DAY_IN_MS = 86_400_000;\n\nexport class EventService extends AbstractEntityService implements IEventService {\n    protected repository: IEventRepository;\n\n    protected options: EventServiceOptions;\n\n    protected logger?: Logger;\n\n    constructor(ctx: EventServiceContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.options = ctx.options ?? {};\n        this.logger = ctx.logger;\n    }\n\n    protected isOwnedBy(entity: Event, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            !!entity.actorId &&\n            entity.actorId === actor.identity.data.id &&\n            entity.actorType === actor.identity.type;\n    }\n\n    protected async canReadRealm(actor: ActorContext, realmId: string | null): Promise<boolean> {\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({ [BuiltInPolicyType.REALM_MATCH]: realmId }),\n                options: {\n                    policiesIncluded: [\n                        BuiltInPolicyType.COMPOSITE,\n                        BuiltInPolicyType.PERMISSION_BINDING,\n                        BuiltInPolicyType.REALM_MATCH,\n                    ],\n                },\n            });\n            return true;\n        } catch {\n            return false;\n        }\n    }\n\n    protected async resolveReadVisibility(actor: ActorContext): Promise<EventReadVisibility | undefined> {\n        const actorRealmId = this.getActorRealmId(actor);\n        let foreignRealmId = randomUUID();\n        while (foreignRealmId === actorRealmId) {\n            foreignRealmId = randomUUID();\n        }\n\n        if (await this.canReadRealm(actor, foreignRealmId)) {\n            return undefined;\n        }\n\n        const realmIds: Array<string | null> = [];\n        if (actorRealmId && await this.canReadRealm(actor, actorRealmId)) {\n            realmIds.push(actorRealmId);\n        }\n        if (await this.canReadRealm(actor, null)) {\n            realmIds.push(null);\n        }\n\n        return {\n            realmIds,\n            ...(actor.identity ? {\n                owner: {\n                    actorId: actor.identity.data.id,\n                    actorType: actor.identity.type,\n                },\n            } : {}),\n        };\n    }\n\n    async record(input: EventRecordInput): Promise<void> {\n        const data = sanitizeEventData(input.data);\n\n        // complementary structured log line — fires even when persistence is\n        // disabled, so a SIEM/Loki pipeline can pick the events up for free.\n        this.logger?.info(`audit: ${input.scope}.${input.name}`, {\n            scope: input.scope,\n            name: input.name,\n            refType: input.refType ?? null,\n            refId: input.refId ?? null,\n            clientId: input.clientId ?? null,\n            actorType: input.actorType ?? null,\n            actorId: input.actorId ?? null,\n            realmId: input.realmId ?? null,\n            ...(data ? { data } : {}),\n        });\n\n        if (this.options.enabled === false) {\n            return;\n        }\n\n        try {\n            const retentionDays = input.retentionDays ?? this.options.retentionDays ?? EVENT_LOG_RETENTION_DAYS_DEFAULT;\n\n            const entity = this.repository.create({\n                id: randomUUID(),\n                scope: input.scope,\n                name: input.name,\n                refType: truncate(input.refType, 64),\n                refId: truncate(input.refId, 64),\n                clientId: input.clientId ?? null,\n                actorType: input.actorType ?? null,\n                actorId: input.actorId ?? null,\n                actorName: truncate(input.actorName, 128),\n                requestPath: truncate(input.requestPath, 256),\n                requestMethod: truncate(input.requestMethod, 10),\n                requestIpAddress: truncate(input.requestIpAddress, 45),\n                requestUserAgent: truncate(input.requestUserAgent, 512),\n                realmId: input.realmId ?? null,\n                data,\n                expiring: retentionDays > 0,\n                expiresAt: retentionDays > 0 ?\n                    new Date(Date.now() + (retentionDays * DAY_IN_MS)).toISOString() :\n                    null,\n            });\n\n            await this.repository.save(entity);\n        } catch {\n            // an audit write failure must never fail the originating operation\n            this.logger?.warn(`Recording the audit event ${input.scope}.${input.name} failed.`);\n        }\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: EventServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Event>> {\n        const parsed = await decodeQuery(query, { schema: eventSchema, actor });\n\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own rows (\"my sign-in history\")\n            return this.repository.findMany(parsed, {\n                owner: {\n                    actorId: actor.identity!.data.id,\n                    actorType: actor.identity!.type,\n                },\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        // Compile EVENT_READ into a row condition (#3286 phase 3). Own rows are\n        // always readable, so ownership composes as an OR-alternative — the whole\n        // gate runs as WHERE (replacing the probe-based visibility derivation, and\n        // additionally covering junction ATTRIBUTES policies the probe excluded)\n        // and pagination/totals stay exact. A non-expressible policy falls back to\n        // the probe + per-row loop below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.EVENT_READ });\n        if (compiled.verdict !== 'post') {\n            const ownership = actor.identity ?\n                and(eq('actorId', actor.identity.data.id), eq('actorType', actor.identity.type)) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, ownership ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    ownership ? or(ownership, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n        }\n\n        const visibility = await this.resolveReadVisibility(actor);\n        const { data: entities, meta } = await this.repository.findMany(parsed, {\n            ...(options.realmId ? { realmId: options.realmId } : {}),\n            ...(visibility ? { visibility } : {}),\n        });\n\n        const data: Event[] = [];\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.EVENT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                continue;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total: meta.total - (entities.length - data.length),\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext, options: EventServiceReadOptions = {}): Promise<Event> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realmId !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n}\n\nfunction truncate(value: string | null | undefined, maxLength: number): string | null {\n    if (typeof value !== 'string') {\n        return null;\n    }\n\n    if (value.length <= maxLength) {\n        return value;\n    }\n\n    return value.substring(0, maxLength);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuCA,MAAMe,YAAY;AAElB,IAAaC,eAAb,cAAkCP,sBAAAA;CACpBQ;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,UAAUE,IAAIF,WAAW,CAAC;EAC/B,KAAKC,SAASC,IAAID;CACtB;CAEUE,UAAUC,QAAeC,OAA8B;EAC7D,OAAO,CAAC,CAACA,MAAMC,YACX,CAAC,CAACF,OAAOG,WACTH,OAAOG,YAAYF,MAAMC,SAASE,KAAKC,MACvCL,OAAOM,cAAcL,MAAMC,SAASK;CAC5C;CAEA,MAAgBC,aAAaP,OAAqBQ,SAA0C;EACxF,IAAI;GACA,MAAMR,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM3B,eAAe4B;IACrBT,MAAMxB,iBAAiB,GAAGD,kBAAkBmC,cAAcL,QAAQ,CAAA;IAClEb,SAAS,EACLmB,kBAAkB;KACdpC,kBAAkBqC;KAClBrC,kBAAkBsC;KAClBtC,kBAAkBmC;MAE1B;GACJ,CAAA;GACA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;CAEA,MAAgBI,sBAAsBjB,OAA+D;EACjG,MAAMkB,eAAe,KAAKC,gBAAgBnB,KAAAA;EAC1C,IAAIoB,iBAAiB3C,WAAAA;EACrB,OAAO2C,mBAAmBF,cACtBE,iBAAiB3C,WAAAA;EAGrB,IAAI,MAAM,KAAK8B,aAAaP,OAAOoB,cAAAA,GAC/B;EAGJ,MAAME,WAAiC,CAAA;EACvC,IAAIJ,gBAAgB,MAAM,KAAKX,aAAaP,OAAOkB,YAAAA,GAC/CI,SAASC,KAAKL,YAAAA;EAElB,IAAI,MAAM,KAAKX,aAAaP,OAAO,IAAA,GAC/BsB,SAASC,KAAK,IAAA;EAGlB,OAAO;GACHD;GACA,GAAItB,MAAMC,WAAW,EACjBuB,OAAO;IACHtB,SAASF,MAAMC,SAASE,KAAKC;IAC7BC,WAAWL,MAAMC,SAASK;GAC9B,EACJ,IAAI,CAAC;EACT;CACJ;CAEA,MAAMmB,OAAOC,OAAwC;EACjD,MAAMvB,OAAOf,kBAAkBsC,MAAMvB,IAAI;EAIzC,KAAKP,QAAQ+B,KAAK,UAAUD,MAAME,MAAM,GAAGF,MAAMf,QAAQ;GACrDiB,OAAOF,MAAME;GACbjB,MAAMe,MAAMf;GACZkB,SAASH,MAAMG,WAAW;GAC1BC,OAAOJ,MAAMI,SAAS;GACtBC,UAAUL,MAAMK,YAAY;GAC5B1B,WAAWqB,MAAMrB,aAAa;GAC9BH,SAASwB,MAAMxB,WAAW;GAC1BM,SAASkB,MAAMlB,WAAW;GAC1B,GAAIL,OAAO,EAAEA,KAAK,IAAI,CAAC;EAC3B,CAAA;EAEA,IAAI,KAAKR,QAAQqC,YAAY,OACzB;EAGJ,IAAI;GACA,MAAMC,gBAAgBP,MAAMO,iBAAiB,KAAKtC,QAAQsC,iBAAAA;GAE1D,MAAMlC,SAAS,KAAKL,WAAWwC,OAAO;IAClC9B,IAAI3B,WAAAA;IACJmD,OAAOF,MAAME;IACbjB,MAAMe,MAAMf;IACZkB,SAASM,SAAST,MAAMG,SAAS,EAAA;IACjCC,OAAOK,SAAST,MAAMI,OAAO,EAAA;IAC7BC,UAAUL,MAAMK,YAAY;IAC5B1B,WAAWqB,MAAMrB,aAAa;IAC9BH,SAASwB,MAAMxB,WAAW;IAC1BkC,WAAWD,SAAST,MAAMU,WAAW,GAAA;IACrCC,aAAaF,SAAST,MAAMW,aAAa,GAAA;IACzCC,eAAeH,SAAST,MAAMY,eAAe,EAAA;IAC7CC,kBAAkBJ,SAAST,MAAMa,kBAAkB,EAAA;IACnDC,kBAAkBL,SAAST,MAAMc,kBAAkB,GAAA;IACnDhC,SAASkB,MAAMlB,WAAW;IAC1BL;IACAsC,UAAUR,gBAAgB;IAC1BS,WAAWT,gBAAgB,IACvB,IAAIU,KAAKA,KAAKC,IAAG,IAAMX,gBAAgBzC,SAAAA,CAAAA,CAAYqD,YAAW,IAC9D;GACR,CAAA;GAEA,MAAM,KAAKnD,WAAWoD,KAAK/C,MAAAA;EAC/B,QAAQ;GAEJ,KAAKH,QAAQmD,KAAK,6BAA6BrB,MAAME,MAAM,GAAGF,MAAMf,KAAK,SAAS;EACtF;CACJ;CAEA,MAAMqC,QACFC,OACAjD,OACAL,UAAmC,CAAC,GACU;EAC9C,MAAMuD,SAAS,MAAM5D,YAAY2D,OAAO;GAAEE,QAAQ5D;GAAaS;EAAM,CAAA;EAErE,IAAIoD,aAAa;EACjB,IAAI;GACA,MAAMpD,MAAMS,oBAAoB4C,YAAY,EAAE1C,MAAM3B,eAAe4B,WAAW,CAAA;EAClF,SAAS0C,GAAG;GACR,IAAI,CAACtD,MAAMC,UACP,MAAMqD;GAEVF,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAK1D,WAAW6D,SAASL,QAAQ;GACpC1B,OAAO;IACHtB,SAASF,MAAMC,SAAUE,KAAKC;IAC9BC,WAAWL,MAAMC,SAAUK;GAC/B;GACA,GAAIX,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;EAC1D,CAAA;EASJ,MAAMgD,WAAW,MAAMxD,MAAMS,oBAAoBgD,QAAQ,EAAE9C,MAAM3B,eAAe4B,WAAW,CAAA;EAC3F,IAAI4C,SAASE,YAAY,QAAQ;GAC7B,MAAMC,YAAY3D,MAAMC,WACpBrB,IAAIC,GAAG,WAAWmB,MAAMC,SAASE,KAAKC,EAAE,GAAGvB,GAAG,aAAamB,MAAMC,SAASK,IAAI,CAAA,IAC9E;GAEJ,IAAIsD,SAASV;GACb,IAAIM,SAASE,YAAY,QACrBE,SAASvE,sBAAsB6D,QAAQS,aAAa7E,QAAQ,MAAM,CAAA,CAAE,CAAA;QACjE,IAAI0E,SAASE,YAAY,eAC5BE,SAASvE,sBACL6D,QACAS,YAAY5E,GAAG4E,WAAWH,SAASK,SAAS,IAAIL,SAASK,SAAS;GAI1E,OAAO,KAAKnE,WAAW6D,SAASK,QAAQ,EAAE,GAAIjE,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC,EAAG,CAAA;EACvG;EAEA,MAAMsD,aAAa,MAAM,KAAK7C,sBAAsBjB,KAAAA;EACpD,MAAM,EAAEG,MAAM4D,UAAUC,SAAS,MAAM,KAAKtE,WAAW6D,SAASL,QAAQ;GACpE,GAAIvD,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;GACtD,GAAIsD,aAAa,EAAEA,WAAW,IAAI,CAAC;EACvC,CAAA;EAEA,MAAM3D,OAAgB,CAAA;EAEtB,KAAK,MAAMJ,UAAUgE,UAAU;GAC3B,IAAI,KAAKjE,UAAUC,QAAQC,KAAAA,GAAQ;IAC/BG,KAAKoB,KAAKxB,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMC,MAAMS,oBAAoBC,SAAS;KACrCC,MAAM3B,eAAe4B;KACrBT,MAAMxB,iBAAiB;OAClBD,kBAAkBuF,aAAalE;MAChC,GAAG,KAAKmE,mBAAmBnE,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAI,KAAKoB,KAAKxB,MAAAA;GACd,QAAQ;IACJ;GACJ;EACJ;EAEA,OAAO;GACHI;GACA6D,MAAM;IACF,GAAGA;IACHG,OAAOH,KAAKG,SAASJ,SAASK,SAASjE,KAAKiE;GAChD;EACJ;CACJ;CAEA,MAAMC,OAAOjE,IAAYJ,OAAqBL,UAAmC,CAAC,GAAmB;EACjG,MAAMI,SAAS,MAAM,KAAKL,WAAW4E,YAAYlE,EAAAA;EACjD,IAAI,CAACL,UAAWJ,QAAQa,WAAWT,OAAOS,YAAYb,QAAQa,SAC1D,MAAM,IAAIvB,oBAAAA;EAGd,IAAI,CAAC,KAAKa,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMS,oBAAoB4C,YAAY,EAAE1C,MAAM3B,eAAe4B,WAAW,CAAA;GAC9E,MAAMZ,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM3B,eAAe4B;IACrBT,MAAMxB,iBAAiB;MAClBD,kBAAkBuF,aAAalE;KAChC,GAAG,KAAKmE,mBAAmBnE,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;AACJ;AAEA,SAASoC,SAASoC,OAAkCC,WAAiB;CACjE,IAAI,OAAOD,UAAU,UACjB,OAAO;CAGX,IAAIA,MAAMH,UAAUI,WAChB,OAAOD;CAGX,OAAOA,MAAME,UAAU,GAAGD,SAAAA;AAC9B"}

package/dist/core/entities/event/types.d.ts

@@ -0,0 +1,125 @@
+import type { Event, EventName, EventScope, IdentityType } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { IQuery } from '@rapiq/core';
+export type EventOwner = {
+    actorId: string;
+    actorType: string;
+};
+export type EventReadVisibility = {
+    owner?: EventOwner;
+    realmIds: Array<string | null>;
+};
+export type EventFindManyOptions = {
+    /**
+     * Mandatory owner constraint (self-service scope) — not overridable by a
+     * rapiq filter.
+     */
+    owner?: EventOwner;
+    realmId?: string;
+    /**
+     * Rows reachable through the actor's realm-scoped permission, plus the
+     * actor's own rows. Applied before pagination so meta.total cannot include
+     * events outside that reach.
+     */
+    visibility?: EventReadVisibility;
+};
+export type EventCountRecentFilter = {
+    name: `${EventName}`;
+    actorName?: string;
+    requestIpAddress?: string;
+    realmId?: string | null;
+    /**
+     * Window start (iso) — only rows created after this instant count.
+     */
+    since: string;
+};
+export interface IEventRepository {
+    create(data: Partial<Event>): Event;
+    save(entity: Event): Promise<Event>;
+    findMany(query: IQuery, options?: EventFindManyOptions): Promise<EntityRepositoryFindManyResult<Event>>;
+    findOneById(id: string): Promise<Event | null>;
+    countRecent(filter: EventCountRecentFilter): Promise<number>;
+    /**
+     * Retention sweep: drop every expiring row whose expiresAt lies before
+     * the given instant (non-expiring rows are kept forever). Returns the
+     * number of removed rows.
+     */
+    deleteExpired(now: string): Promise<number>;
+}
+export type EventRecordInput = {
+    scope: `${EventScope}`;
+    name: `${EventName}`;
+    refType?: string | null;
+    refId?: string | null;
+    clientId?: string | null;
+    actorType?: `${IdentityType}` | null;
+    actorId?: string | null;
+    actorName?: string | null;
+    requestPath?: string | null;
+    requestMethod?: string | null;
+    requestIpAddress?: string | null;
+    requestUserAgent?: string | null;
+    realmId?: string | null;
+    data?: Record<string, any> | null;
+    /**
+     * Per-event retention override in days — wins over the service-level
+     * retentionDays; 0 = keep forever. expiring/expiresAt derive from the
+     * effective value.
+     */
+    retentionDays?: number;
+};
+export type EventServiceOptions = {
+    /**
+     * config.eventLogEnabled — when false, record() only emits the structured
+     * log line and persists nothing.
+     */
+    enabled?: boolean;
+    /**
+     * config.eventLogRetentionDays — stamped per row as expiring/expiresAt
+     * at write time; 0 = keep forever (expiring stays false, expiresAt null).
+     */
+    retentionDays?: number;
+};
+export type EventServiceReadOptions = {
+    realmId?: string;
+};
+/**
+ * Actor + request attribution for entity-CRUD audit rows. The shape is
+ * defined here (core) so core never imports from adapters/http — the wiring
+ * injects the HTTP adapter's AsyncLocalStorage getter, and writes outside an
+ * HTTP request (provisioning, CLI, cron) simply resolve to undefined.
+ */
+export type EventRequestContext = {
+    actorType: `${IdentityType}` | null;
+    actorId: string | null;
+    actorName: string | null;
+    requestPath: string | null;
+    requestMethod: string | null;
+    requestIpAddress: string | null;
+    requestUserAgent: string | null;
+};
+export type EntityEventHandlerOptions = {
+    /**
+     * Per-row retention (days) for entity-CRUD audit rows — entity churn
+     * self-prunes on a short TTL (config eventLogEntityRetentionDays).
+     */
+    retentionDays?: number;
+};
+export interface IEventService {
+    /**
+     * Persist an audit event. Fire-and-forget-safe: never throws — a write
+     * failure must not fail the originating auth operation.
+     */
+    record(input: EventRecordInput): Promise<void>;
+    /**
+     * List audit events. An actor without EVENT_READ is scoped to its own
+     * rows ("my sign-in history"); an actor with EVENT_READ sees every row
+     * its realm reach permits.
+     */
+    getMany(query: Record<string, any>, actor: ActorContext, options?: EventServiceReadOptions): Promise<EntityRepositoryFindManyResult<Event>>;
+    /**
+     * Read a single audit event. Own rows need no permission.
+     */
+    getOne(id: string, actor: ActorContext, options?: EventServiceReadOptions): Promise<Event>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/event/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,KAAK,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,MAAM,UAAU,GAAG;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,mBAAmB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IAEpC,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAEpC,QAAQ,CACJ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,oBAAoB,GAC/B,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IAElD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAE/C,WAAW,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7D;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC3B,KAAK,EAAE,GAAG,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAC9B,SAAS,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACpC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;;;OAIG;IACH,OAAO,CACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,uBAAuB,GAClC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IAElD;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CAC9F"}

package/dist/core/entities/identity-provider/index.d.ts

@@ -1,2 +1,3 @@
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/identity-provider/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/identity-provider/index.mjs

@@ -1,4 +1,5 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-export {};
+import { identityProviderSchema } from "./schema.mjs";
+export { identityProviderSchema };

package/dist/core/entities/identity-provider/schema.d.ts

@@ -0,0 +1,3 @@
+import type { IdentityProvider } from '@authup/core-kit';
+export declare const identityProviderSchema: import("@rapiq/core").Schema<IdentityProvider, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/identity-provider/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAMzD,eAAO,MAAM,sBAAsB,qDAoBjC,CAAC"}

package/dist/core/entities/identity-provider/schema.mjs

@@ -0,0 +1,43 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/identity-provider/schema.ts
+const schemaMapping = { realm: EntityType.REALM };
+const identityProviderSchema = defineSchema({
+	name: EntityType.IDENTITY_PROVIDER,
+	fields: { default: [
+		"id",
+		"name",
+		"displayName",
+		"protocol",
+		"preset",
+		"enabled",
+		"realmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: [
+		"name",
+		"protocol",
+		"enabled",
+		"realmId"
+	] },
+	relations: {
+		allowed: ["realm"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"id",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { identityProviderSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/identity-provider/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","identityProviderSchema","name","IDENTITY_PROVIDER","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/identity-provider/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { IdentityProvider } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const identityProviderSchema = defineSchema<IdentityProvider>({\n    name: EntityType.IDENTITY_PROVIDER,\n    fields: {\n        default: [\n            'id',\n            'name',\n            'displayName',\n            'protocol',\n            'preset',\n            'enabled',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['name', 'protocol', 'enabled', 'realmId'] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,yBAAyBN,aAA+B;CACjEO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAQ;EAAY;EAAW;GAAW;CAC/DC,WAAW;EAAED,SAAS,CAAC,OAAA;EAAUE,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;GAAa;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}

package/dist/core/entities/identity-provider-role-mapping/index.d.ts

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/identity-provider-role-mapping/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/identity-provider-role-mapping/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { identityProviderRoleMappingSchema } from "./schema.mjs";
 import { IdentityProviderRoleMappingService } from "./service.mjs";
-export { IdentityProviderRoleMappingService };
+export { IdentityProviderRoleMappingService, identityProviderRoleMappingSchema };

package/dist/core/entities/identity-provider-role-mapping/schema.d.ts

@@ -0,0 +1,3 @@
+import type { IdentityProviderRoleMapping } from '@authup/core-kit';
+export declare const identityProviderRoleMappingSchema: import("@rapiq/core").Schema<IdentityProviderRoleMapping, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/identity-provider-role-mapping/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAMpE,eAAO,MAAM,iCAAiC,gEAuB5C,CAAC"}

package/dist/core/entities/identity-provider-role-mapping/schema.mjs

@@ -0,0 +1,43 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/identity-provider-role-mapping/schema.ts
+const schemaMapping = {
+	role: EntityType.ROLE,
+	provider: EntityType.IDENTITY_PROVIDER
+};
+const identityProviderRoleMappingSchema = defineSchema({
+	name: EntityType.IDENTITY_PROVIDER_ROLE_MAPPING,
+	fields: { default: [
+		"id",
+		"name",
+		"value",
+		"valueIsRegex",
+		"synchronizationMode",
+		"providerId",
+		"providerRealmId",
+		"roleId",
+		"roleRealmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: ["roleId", "providerId"] },
+	relations: {
+		allowed: ["role", "provider"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"id",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { identityProviderRoleMappingSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/identity-provider-role-mapping/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","role","ROLE","provider","IDENTITY_PROVIDER","identityProviderRoleMappingSchema","name","IDENTITY_PROVIDER_ROLE_MAPPING","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/identity-provider-role-mapping/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { IdentityProviderRoleMapping } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { role: EntityType.ROLE, provider: EntityType.IDENTITY_PROVIDER };\n\nexport const identityProviderRoleMappingSchema = defineSchema<IdentityProviderRoleMapping>({\n    name: EntityType.IDENTITY_PROVIDER_ROLE_MAPPING,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'name',\n            'value',\n            'valueIsRegex',\n            'synchronizationMode',\n            'providerId',\n            'providerRealmId',\n            'roleId',\n            'roleRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['roleId', 'providerId'] },\n    relations: { allowed: ['role', 'provider'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,UAAUL,WAAWM;AAAkB;AAEtF,MAAaC,oCAAoCR,aAA0C;CACvFS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAEC,SAAS,CAAC,UAAU,YAAA,EAAc;CAC7CC,WAAW;EAAED,SAAS,CAAC,QAAQ,UAAA;EAAaE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC7Fc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;GAAa;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/identity-provider-role-mapping/service.d.ts

@@ -10,7 +10,7 @@ export type IdentityProviderRoleMappingServiceContext = {
     identityPermissionProvider: IIdentityPermissionProvider;
 };
 export declare class IdentityProviderRoleMappingService extends JunctionEntityService implements IIdentityProviderRoleMappingService {
-    protected readonly ownerRealmKey = "provider_realm_id";
+    protected readonly ownerRealmKey = "providerRealmId";
     protected repository: IIdentityProviderRoleMappingRepository;
     protected roleRepository: IEntityRepository<Role>;
     protected identityPermissionProvider: IIdentityPermissionProvider;

package/dist/core/entities/identity-provider-role-mapping/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,oCAAoC,EAAkB,MAAM,kBAAkB,CAAC;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,sCAAsC,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAE9G,MAAM,MAAM,yCAAyC,GAAG;IACpD,UAAU,EAAE,sCAAsC,CAAC;IACnD,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,kCAAmC,SAAQ,qBAAsB,YAAW,mCAAmC;IACxH,SAAS,CAAC,QAAQ,CAAC,aAAa,uBAAuB;IAEvD,SAAS,CAAC,UAAU,EAAE,sCAAsC,CAAC;IAE7D,SAAS,CAAC,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAElD,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,oCAAoC,CAAC;gBAE9C,GAAG,EAAE,yCAAyC;IAQpD,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,2BAA2B,CAAC,CAAC;IAajE,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;IAkBjC,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;IA+DjC,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;IAiDjC,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;CAuB1C"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,oCAAoC,EAAkB,MAAM,kBAAkB,CAAC;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,sCAAsC,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAI9G,MAAM,MAAM,yCAAyC,GAAG;IACpD,UAAU,EAAE,sCAAsC,CAAC;IACnD,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,kCAAmC,SAAQ,qBAAsB,YAAW,mCAAmC;IACxH,SAAS,CAAC,QAAQ,CAAC,aAAa,qBAAqB;IAErD,SAAS,CAAC,UAAU,EAAE,sCAAsC,CAAC;IAE7D,SAAS,CAAC,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAElD,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,oCAAoC,CAAC;gBAE9C,GAAG,EAAE,yCAAyC;IAQpD,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,2BAA2B,CAAC,CAAC;IAajE,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;IAkBjC,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;IA+DjC,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;IAiDjC,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,2BAA2B,CAAC;CAuB1C"}

package/dist/core/entities/identity-provider-role-mapping/service.mjs

@@ -1,14 +1,17 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { identityProviderRoleMappingSchema } from "./schema.mjs";
+import { decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { ValidatorGroup } from "@authup/kit";
 import { IdentityProviderRoleMappingValidator, PermissionName } from "@authup/core-kit";
 import { JunctionEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, PermissionError, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityConflictError, EntityNotFoundError } from "@authup/errors";
+import { EntityConflictError, EntityNotFoundError, ValidationError } from "@authup/errors";
 //#region src/core/entities/identity-provider-role-mapping/service.ts
 var IdentityProviderRoleMappingService = class extends JunctionEntityService {
-	ownerRealmKey = "provider_realm_id";
+	ownerRealmKey = "providerRealmId";
 	repository;
 	roleRepository;
 	identityPermissionProvider;
@@ -27,7 +30,10 @@ var IdentityProviderRoleMappingService = class extends JunctionEntityService {
 			PermissionName.IDENTITY_PROVIDER_UPDATE,
 			PermissionName.IDENTITY_PROVIDER_DELETE
 		] });
-		return this.repository.findMany(query);
+		return this.repository.findMany(await decodeQuery(query, {
+			schema: identityProviderRoleMappingSchema,
+			actor
+		}));
 	}
 	async getOne(id, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -45,20 +51,20 @@ var IdentityProviderRoleMappingService = class extends JunctionEntityService {
 		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
 		await this.repository.validateJoinColumns(validated);
 		if (await this.repository.findOneBy({
-			provider_id: validated.provider_id,
-			role_id: validated.role_id
+			providerId: validated.providerId,
+			roleId: validated.roleId
 		})) throw new EntityConflictError({ entity: "identity-provider-role-mapping" });
-		if (validated.provider) validated.provider_realm_id = validated.provider.realm_id;
-		if (validated.role) validated.role_realm_id = validated.role.realm_id;
-		if (validated.role_realm_id && validated.provider_realm_id && validated.role_realm_id !== validated.provider_realm_id) throw new BadRequestError("It is not possible to map an identity provider to a role of another realm.");
+		if (validated.provider) validated.providerRealmId = validated.provider.realmId;
+		if (validated.role) validated.roleRealmId = validated.role.realmId;
+		if (validated.roleRealmId && validated.providerRealmId && validated.roleRealmId !== validated.providerRealmId) throw new ValidationError("It is not possible to map an identity provider to a role of another realm.");
 		if (validated.role && actor.identity) {
 			if (!await this.identityPermissionProvider.isSuperset({
 				type: actor.identity.type,
 				id: actor.identity.data.id
 			}, {
 				type: "role",
-				id: validated.role_id,
-				clientId: validated.role.client_id
+				id: validated.roleId,
+				clientId: validated.role.clientId
 			})) throw new PermissionError({ message: "You don't own the required permissions." });
 		}
 		await actor.permissionEvaluator.evaluate({
@@ -78,7 +84,7 @@ var IdentityProviderRoleMappingService = class extends JunctionEntityService {
 		if (!entity) throw new EntityNotFoundError();
 		const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });
 		await this.repository.validateJoinColumns(validated);
-		const role = await this.roleRepository.findOneById(entity.role_id);
+		const role = await this.roleRepository.findOneById(entity.roleId);
 		if (role && actor.identity) {
 			if (!await this.identityPermissionProvider.isSuperset({
 				type: actor.identity.type,
@@ -86,7 +92,7 @@ var IdentityProviderRoleMappingService = class extends JunctionEntityService {
 			}, {
 				type: "role",
 				id: role.id,
-				clientId: role.client_id
+				clientId: role.clientId
 			})) throw new PermissionError({ message: "You don't own the required permissions." });
 		}
 		const merged = this.repository.merge(entity, validated);