@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/entities/permission/service.mjs

@@ -1,11 +1,14 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { permissionSchema } from "./schema.mjs";
+import { decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { ValidatorGroup, isPropertySet, isUUID } from "@authup/kit";
 import { PermissionName, PermissionValidator, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, RealmScope, SystemPolicyName, definePolicyData } from "@authup/access";
-import { AuthupError, BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { AuthupError, EntityNotFoundError, ValidationError } from "@authup/errors";
 //#region src/core/entities/permission/service.ts
 const REALM_ADMIN_EXCLUDED_PERMISSIONS = [
 	PermissionName.REALM_CREATE,
@@ -13,14 +16,14 @@ const REALM_ADMIN_EXCLUDED_PERMISSIONS = [
 	PermissionName.REALM_DELETE
 ];
 /**
-* Direct-entity CUD permissions that realm_admin grants at `realm_scope: own`
+* Direct-entity CUD permissions that realm_admin grants at `realmScope: own`
 * (strictly the actor's own realm — see line 372). Every other realm_admin
 * permission defaults to `ownOrNull` (own realm OR global/null resources) so it
 * can act on global building blocks.
 *
 * Junction CUD (e.g. user_role, role_permission) is intentionally NOT listed here:
 * it stays `ownOrNull` because a junction can legitimately reference a global
-* side (realm_id: null) — a strict `own` would reject those.
+* side (realmId: null) — a strict `own` would reject those.
 */ const REALM_ADMIN_BOUND_PERMISSIONS = [
 	PermissionName.CLIENT_CREATE,
 	PermissionName.CLIENT_UPDATE,
@@ -31,9 +34,6 @@ const REALM_ADMIN_EXCLUDED_PERMISSIONS = [
 	PermissionName.PERMISSION_CREATE,
 	PermissionName.PERMISSION_UPDATE,
 	PermissionName.PERMISSION_DELETE,
-	PermissionName.ROBOT_CREATE,
-	PermissionName.ROBOT_UPDATE,
-	PermissionName.ROBOT_DELETE,
 	PermissionName.ROLE_CREATE,
 	PermissionName.ROLE_UPDATE,
 	PermissionName.ROLE_DELETE,
@@ -68,7 +68,10 @@ var PermissionService = class extends AbstractEntityService {
 			PermissionName.PERMISSION_UPDATE,
 			PermissionName.PERMISSION_DELETE
 		] });
-		return this.repository.findMany(query);
+		return this.repository.findMany(await decodeQuery(query, {
+			schema: permissionSchema,
+			actor
+		}));
 	}
 	async getOne(idOrName, actor, realm) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -90,13 +93,13 @@ var PermissionService = class extends AbstractEntityService {
 	}
 	async save(idOrName, data, actor, options = {}) {
 		let group;
-		const realm = typeof data.realm_id === "string" ? await this.realmRepository.resolve(data.realm_id) : void 0;
+		const realm = typeof data.realmId === "string" ? await this.realmRepository.resolve(data.realmId) : void 0;
 		let entity;
 		if (idOrName) {
 			const where = {};
 			if (isUUID(idOrName)) where.id = idOrName;
 			else where.name = idOrName;
-			if (realm) where.realm_id = realm.id;
+			if (realm) where.realmId = realm.id;
 			entity = await this.repository.findOneBy(where);
 			if (!entity && options.updateOnly) throw new EntityNotFoundError();
 		} else if (options.updateOnly) throw new EntityNotFoundError();
@@ -110,7 +113,7 @@ var PermissionService = class extends AbstractEntityService {
 		const validated = await this.validator.run(data, { group });
 		await this.repository.validateJoinColumns(validated);
 		if (entity) {
-			if (entity.built_in && isPropertySet(validated, "name") && entity.name !== validated.name) throw new BadRequestError("The name of a built-in permission can not be changed.");
+			if (entity.builtIn && isPropertySet(validated, "name") && entity.name !== validated.name) throw new ValidationError("The name of a built-in permission can not be changed.");
 			await actor.permissionEvaluator.evaluate({
 				name: PermissionName.PERMISSION_UPDATE,
 				data: definePolicyData({
@@ -118,7 +121,7 @@ var PermissionService = class extends AbstractEntityService {
 						...entity,
 						...validated
 					},
-					[BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null
+					[BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null
 				})
 			});
 			await this.repository.checkUniqueness(validated, entity);
@@ -129,7 +132,7 @@ var PermissionService = class extends AbstractEntityService {
 				created: false
 			};
 		}
-		if (!isPropertySet(validated, "realm_id") && actor.identity) validated.realm_id = this.getActorRealmId(actor) || null;
+		if (!isPropertySet(validated, "realmId") && actor.identity) validated.realmId = this.getActorRealmId(actor) || null;
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.PERMISSION_CREATE,
 			data: definePolicyData({
@@ -140,9 +143,14 @@ var PermissionService = class extends AbstractEntityService {
 		await this.repository.checkUniqueness(validated);
 		entity = this.repository.create(validated);
 		entity = await this.repository.save(entity);
-		await this.assignDefaultPolicy(entity);
-		await this.assignToAdminRole(entity);
-		await this.assignToRealmAdminRoles(entity);
+		try {
+			await this.assignToAdminRole(entity);
+			await this.assignToRealmAdminRoles(entity);
+			await this.assignDefaultPolicy(entity);
+		} catch (e) {
+			await this.repository.remove(entity).catch(() => {});
+			throw e;
+		}
 		return {
 			entity,
 			created: true
@@ -152,7 +160,7 @@ var PermissionService = class extends AbstractEntityService {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });
 		const entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
-		if (entity.built_in) throw new BadRequestError("A built-in permission can not be deleted.");
+		if (entity.builtIn) throw new ValidationError("A built-in permission can not be deleted.");
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.PERMISSION_DELETE,
 			data: definePolicyData({
@@ -173,40 +181,45 @@ var PermissionService = class extends AbstractEntityService {
 		const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);
 		if (!defaultPolicy) throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);
 		if (await this.permissionPolicyRepository.findOneBy({
-			permission_id: permission.id,
-			policy_id: defaultPolicy.id
+			permissionId: permission.id,
+			policyId: defaultPolicy.id
 		})) return;
 		const entry = this.permissionPolicyRepository.create({
-			permission_id: permission.id,
-			permission_realm_id: permission.realm_id,
-			policy_id: defaultPolicy.id,
-			policy_realm_id: defaultPolicy.realm_id
+			permissionId: permission.id,
+			permissionRealmId: permission.realmId,
+			policyId: defaultPolicy.id,
+			policyRealmId: defaultPolicy.realmId
 		});
 		await this.permissionPolicyRepository.save(entry);
 	}
 	/**
 	* Assign a newly created permission to the global admin role.
 	* The admin role receives every permission without policy restrictions.
+	*
+	* Throws when the admin role is not provisioned: without an admin grant the
+	* permission is bound by `system.default` yet held by nobody, and the uniform
+	* member gate on junction creation makes it permanently un-grantable (even by
+	* admin). Fail loud so the stranded state is surfaced instead of swallowed.
 	*/ async assignToAdminRole(permission) {
 		const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);
-		if (!adminRole) return;
+		if (!adminRole) throw new AuthupError(`The ${ROLE_ADMIN_NAME} role is not provisioned. Cannot grant the created permission to the administrator role.`);
 		if (await this.rolePermissionRepository.findOneBy({
-			role_id: adminRole.id,
-			permission_id: permission.id
+			roleId: adminRole.id,
+			permissionId: permission.id
 		})) return;
 		const entry = this.rolePermissionRepository.create({
-			role_id: adminRole.id,
-			role_realm_id: adminRole.realm_id,
-			permission_id: permission.id,
-			permission_realm_id: permission.realm_id,
-			realm_scope: RealmScope.ANY
+			roleId: adminRole.id,
+			roleRealmId: adminRole.realmId,
+			permissionId: permission.id,
+			permissionRealmId: permission.realmId,
+			realmScope: RealmScope.ANY
 		});
 		await this.rolePermissionRepository.save(entry);
 	}
 	/**
 	* Assign a newly created permission to all matching realm_admin roles.
 	*
-	* Uses differentiated realm_scope on the junction:
+	* Uses differentiated realmScope on the junction:
 	* - CUD on global-capable entity types → own (strictly own realm)
 	* - Everything else → ownOrNull (own realm + null/global resources)
 	*
@@ -216,25 +229,25 @@ var PermissionService = class extends AbstractEntityService {
 	*
 	* Excluded:
 	* - Realm CRUD permissions (realm_create, realm_update, realm_delete)
-	* - Custom global permissions (non-built-in with realm_id: null)
+	* - Custom global permissions (non-built-in with realmId: null)
 	*/ async assignToRealmAdminRoles(permission) {
 		if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name)) return;
 		const isBuiltIn = Object.values(PermissionName).includes(permission.name);
-		if (!permission.realm_id && !isBuiltIn) return;
+		if (!permission.realmId && !isBuiltIn) return;
 		const realmScope = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name) ? RealmScope.OWN : RealmScope.OWN_OR_NULL;
 		const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });
 		for (const role of realmAdminRoles) {
-			if (permission.realm_id && permission.realm_id !== role.realm_id) continue;
+			if (permission.realmId && permission.realmId !== role.realmId) continue;
 			if (await this.rolePermissionRepository.findOneBy({
-				role_id: role.id,
-				permission_id: permission.id
+				roleId: role.id,
+				permissionId: permission.id
 			})) continue;
 			const entry = this.rolePermissionRepository.create({
-				role_id: role.id,
-				role_realm_id: role.realm_id,
-				permission_id: permission.id,
-				permission_realm_id: permission.realm_id,
-				realm_scope: realmScope
+				roleId: role.id,
+				roleRealmId: role.realmId,
+				permissionId: permission.id,
+				permissionRealmId: permission.realmId,
+				realmScope
 			});
 			await this.rolePermissionRepository.save(entry);
 		}

package/dist/core/entities/permission/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","definePolicyData","ValidatorGroup","isPropertySet","isUUID","AuthupError","BadRequestError","EntityNotFoundError","PermissionName","PermissionValidator","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","AbstractEntityService","REALM_ADMIN_EXCLUDED_PERMISSIONS","REALM_CREATE","REALM_UPDATE","REALM_DELETE","REALM_ADMIN_BOUND_PERMISSIONS","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","PermissionService","repository","realmRepository","roleRepository","rolePermissionRepository","policyRepository","permissionPolicyRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","findMany","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","CREATE","validated","run","validateJoinColumns","built_in","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","merge","created","identity","getActorRealmId","resourceRealmMatch","assignDefaultPolicy","assignToAdminRole","assignToRealmAdminRoles","delete","entityId","remove","permission","defaultPolicy","findOneByName","DEFAULT","existing","permission_id","policy_id","entry","permission_realm_id","policy_realm_id","adminRole","role_id","role_realm_id","realm_scope","ANY","includes","isBuiltIn","Object","values","realmScope","OWN","OWN_OR_NULL","realmAdminRoles","findManyBy","role"],"sources":["../../../../src/core/entities/permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { \n    BuiltInPolicyType, \n    RealmScope, \n    SystemPolicyName, \n    definePolicyData, \n} from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { AuthupError, BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    PermissionValidator,\n    ROLE_ADMIN_NAME,\n    ROLE_REALM_ADMIN_NAME,\n} from '@authup/core-kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository } from '../permission-policy/types.ts';\nimport type { IPolicyRepository } from '../policy/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport type { IRoleRepository } from '../role/types.ts';\nimport type { IRolePermissionRepository } from '../role-permission/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IPermissionRepository, IPermissionService } from './types.ts';\n\nconst REALM_ADMIN_EXCLUDED_PERMISSIONS = [\n    PermissionName.REALM_CREATE,\n    PermissionName.REALM_UPDATE,\n    PermissionName.REALM_DELETE,\n];\n\n/**\n * Direct-entity CUD permissions that realm_admin grants at `realm_scope: own`\n * (strictly the actor's own realm — see line 372). Every other realm_admin\n * permission defaults to `ownOrNull` (own realm OR global/null resources) so it\n * can act on global building blocks.\n *\n * Junction CUD (e.g. user_role, role_permission) is intentionally NOT listed here:\n * it stays `ownOrNull` because a junction can legitimately reference a global\n * side (realm_id: null) — a strict `own` would reject those.\n */\nconst REALM_ADMIN_BOUND_PERMISSIONS = [\n    PermissionName.CLIENT_CREATE,\n    PermissionName.CLIENT_UPDATE,\n    PermissionName.CLIENT_DELETE,\n    PermissionName.IDENTITY_PROVIDER_CREATE,\n    PermissionName.IDENTITY_PROVIDER_UPDATE,\n    PermissionName.IDENTITY_PROVIDER_DELETE,\n    PermissionName.PERMISSION_CREATE,\n    PermissionName.PERMISSION_UPDATE,\n    PermissionName.PERMISSION_DELETE,\n    PermissionName.ROBOT_CREATE,\n    PermissionName.ROBOT_UPDATE,\n    PermissionName.ROBOT_DELETE,\n    PermissionName.ROLE_CREATE,\n    PermissionName.ROLE_UPDATE,\n    PermissionName.ROLE_DELETE,\n    PermissionName.SCOPE_CREATE,\n    PermissionName.SCOPE_UPDATE,\n    PermissionName.SCOPE_DELETE,\n    PermissionName.USER_CREATE,\n    PermissionName.USER_UPDATE,\n    PermissionName.USER_DELETE,\n];\n\nexport type PermissionServiceContext = {\n    repository: IPermissionRepository;\n    realmRepository: IRealmRepository;\n    roleRepository: IRoleRepository;\n    rolePermissionRepository: IRolePermissionRepository;\n    policyRepository: IPolicyRepository;\n    permissionPolicyRepository: IPermissionPolicyRepository;\n};\n\nexport class PermissionService extends AbstractEntityService implements IPermissionService {\n    protected repository: IPermissionRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected roleRepository: IRoleRepository;\n\n    protected rolePermissionRepository: IRolePermissionRepository;\n\n    protected policyRepository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    protected validator: PermissionValidator;\n\n    constructor(ctx: PermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.rolePermissionRepository = ctx.rolePermissionRepository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n        this.validator = new PermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Permission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Permission,\n        created: boolean\n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Permission | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            if (\n                entity.built_in &&\n                isPropertySet(validated, 'name') &&\n                entity.name !== validated.name\n            ) {\n                throw new BadRequestError('The name of a built-in permission can not be changed.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            entity = this.repository.merge(entity, validated);\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false,\n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        await this.assignDefaultPolicy(entity);\n        await this.assignToAdminRole(entity);\n        await this.assignToRealmAdminRoles(entity);\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.built_in) {\n            throw new BadRequestError('A built-in permission can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    /**\n     * Assign the system.default policy to a newly created permission.\n     * This ensures all permissions are evaluated with the baseline security\n     * policy (identity, permission-binding, realm-match) by default.\n     */\n    private async assignDefaultPolicy(permission: Permission): Promise<void> {\n        const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);\n        }\n\n        const existing = await this.permissionPolicyRepository.findOneBy({\n            permission_id: permission.id,\n            policy_id: defaultPolicy.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.permissionPolicyRepository.create({\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n            policy_id: defaultPolicy.id,\n            policy_realm_id: defaultPolicy.realm_id,\n        });\n        await this.permissionPolicyRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to the global admin role.\n     * The admin role receives every permission without policy restrictions.\n     */\n    private async assignToAdminRole(permission: Permission): Promise<void> {\n        const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);\n        if (!adminRole) {\n            return;\n        }\n\n        const existing = await this.rolePermissionRepository.findOneBy({\n            role_id: adminRole.id,\n            permission_id: permission.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.rolePermissionRepository.create({\n            role_id: adminRole.id,\n            role_realm_id: adminRole.realm_id,\n            permission_id: permission.id,\n            permission_realm_id: permission.realm_id,\n            // Global admin: unrestricted realm reach.\n            realm_scope: RealmScope.ANY,\n        });\n        await this.rolePermissionRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to all matching realm_admin roles.\n     *\n     * Uses differentiated realm_scope on the junction:\n     * - CUD on global-capable entity types → own (strictly own realm)\n     * - Everything else → ownOrNull (own realm + null/global resources)\n     *\n     * Eligible permissions:\n     * - Built-in authup permissions (global) — assigned to all realm_admin roles\n     * - Realm-scoped permissions — assigned to the realm_admin in the matching realm\n     *\n     * Excluded:\n     * - Realm CRUD permissions (realm_create, realm_update, realm_delete)\n     * - Custom global permissions (non-built-in with realm_id: null)\n     */\n    private async assignToRealmAdminRoles(permission: Permission): Promise<void> {\n        if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name as PermissionName)) {\n            return;\n        }\n\n        const isBuiltIn = (Object.values(PermissionName) as string[]).includes(permission.name);\n        if (!permission.realm_id && !isBuiltIn) {\n            return;\n        }\n\n        const realmScope = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name as PermissionName) ?\n            RealmScope.OWN :\n            RealmScope.OWN_OR_NULL;\n\n        const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });\n\n        for (const role of realmAdminRoles) {\n            if (permission.realm_id && permission.realm_id !== role.realm_id) {\n                continue;\n            }\n\n            const existing = await this.rolePermissionRepository.findOneBy({\n                role_id: role.id,\n                permission_id: permission.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.rolePermissionRepository.create({\n                role_id: role.id,\n                role_realm_id: role.realm_id,\n                permission_id: permission.id,\n                permission_realm_id: permission.realm_id,\n                realm_scope: realmScope,\n            });\n            await this.rolePermissionRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AA+BA,MAAMe,mCAAmC;CACrCL,eAAeM;CACfN,eAAeO;CACfP,eAAeQ;;;;;;;;;;;GAanB,MAAMC,gCAAgC;CAClCT,eAAeU;CACfV,eAAeW;CACfX,eAAeY;CACfZ,eAAea;CACfb,eAAec;CACfd,eAAee;CACff,eAAegB;CACfhB,eAAeiB;CACfjB,eAAekB;CACflB,eAAemB;CACfnB,eAAeoB;CACfpB,eAAeqB;CACfrB,eAAesB;CACftB,eAAeuB;CACfvB,eAAewB;CACfxB,eAAeyB;CACfzB,eAAe0B;CACf1B,eAAe2B;CACf3B,eAAe4B;CACf5B,eAAe6B;CACf7B,eAAe8B;;AAYnB,IAAaC,oBAAb,cAAuC3B,sBAAAA;CACzB4B;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKP,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIrC,oBAAAA;CACzB;CAEA,MAAMuC,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKc,WAAWe,SAASN,KAAAA;CACpC;CAEA,MAAMO,OACFC,UACAP,OACAQ,OACmB;EACnB,MAAMR,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF7C,eAAe8C;GACf9C,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMiC,SAAS,MAAM,KAAKnB,WAAWoB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAIpD,oBAAAA;EAGd,OAAOoD;CACX;CAEA,MAAME,OACFC,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMZ,KAAAA;EACpD,OAAOS;CACX;CAEA,MAAMM,OACFR,UACAK,MACAZ,OACmB;EACnB,MAAM,EAAES,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMZ,OAAO,EAAEgB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAZ,OACAiB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,aAAa,WACnC,MAAM,KAAK5B,gBAAgB6B,QAAQR,KAAKO,QAAQ,IAChDL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAInE,OAAOqD,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMlB,OAAOI;GAGjB,IAAIC,OACAa,MAAMF,WAAWX,MAAMc;GAG3Bb,SAAS,MAAM,KAAKnB,WAAWiC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAI3D,oBAAAA;EAElB,OAAO,IAAI4D,QAAQD,YACf,MAAM,IAAI3D,oBAAAA;EAGd,IAAIoD,QAAQ;GACR,MAAMT,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAeiB,kBAAkB,CAAA;GACrF2C,QAAQlE,eAAeyE;EAC3B,OAAO;GACH,MAAMzB,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAegB,kBAAkB,CAAA;GACrF4C,QAAQlE,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK/B,UAAUgC,IAAIhB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK5B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIlB,QAAQ;GACR,IACIA,OAAOqB,YACP7E,cAAc0E,WAAW,MAAA,KACzBlB,OAAON,SAASwB,UAAUxB,MAE1B,MAAM,IAAI/C,gBAAgB,uDAAA;GAG9B,MAAM4C,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAM7C,eAAeiB;IACrBqC,MAAM7D,iBAAiB;MAClBH,kBAAkBoF,aAAa;MAC5B,GAAGvB;MACH,GAAGkB;KACP;MACC/E,kBAAkBqF,cAAcN,UAAUR,YAAYV,OAAOU,YAAY;IAC9E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK7B,WAAW4C,gBAAgBP,WAAWlB,MAAAA;GAEjDA,SAAS,KAAKnB,WAAW6C,MAAM1B,QAAQkB,SAAAA;GAEvC,MAAM,KAAKrC,WAAWuB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,IAAI,CAACnF,cAAc0E,WAAW,UAAA,KAAe3B,MAAMqC,UAC/CV,UAAUR,WAAW,KAAKmB,gBAAgBtC,KAAAA,KAAU;EAGxD,MAAMA,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAegB;GACrBsC,MAAM7D,iBAAiB;KAAGH,kBAAkBoF,aAAaL;IAAW,GAAG,KAAKY,mBAAmBZ,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,SAAAA;EAEtClB,SAAS,KAAKnB,WAAWqB,OAAOgB,SAAAA;EAChClB,SAAS,MAAM,KAAKnB,WAAWuB,KAAKJ,MAAAA;EAEpC,MAAM,KAAK+B,oBAAoB/B,MAAAA;EAC/B,MAAM,KAAKgC,kBAAkBhC,MAAAA;EAC7B,MAAM,KAAKiC,wBAAwBjC,MAAAA;EAEnC,OAAO;GACHA;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMO,OACFrB,IACAtB,OACmB;EACnB,MAAMA,MAAMC,oBAAoBuB,YAAY,EAAErB,MAAM7C,eAAekB,kBAAkB,CAAA;EAErF,MAAMiC,SAAS,MAAM,KAAKnB,WAAWiC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAIpD,oBAAAA;EAGd,IAAIoD,OAAOqB,UACP,MAAM,IAAI1E,gBAAgB,2CAAA;EAG9B,MAAM4C,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAM7C,eAAekB;GACrBoC,MAAM7D,iBAAiB;KAAGH,kBAAkBoF,aAAavB;IAAQ,GAAG,KAAK8B,mBAAmB9B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEa,IAAIsB,aAAanC;EACzB,MAAM,KAAKnB,WAAWuD,OAAOpC,MAAAA;EAC7BA,OAAOa,KAAKsB;EAEZ,OAAOnC;CACX;;;;;IAOA,MAAc+B,oBAAoBM,YAAuC;EACrE,MAAMC,gBAAgB,MAAM,KAAKrD,iBAAiBsD,cAAclG,iBAAiBmG,OAAO;EACxF,IAAI,CAACF,eACD,MAAM,IAAI5F,YAAY,OAAOL,iBAAiBmG,QAAQ,2FAA2F;EAOrJ,IAAIC,MAJmB,KAAKvD,2BAA2B4B,UAAU;GAC7D4B,eAAeL,WAAWxB;GAC1B8B,WAAWL,cAAczB;EAC7B,CAAA,GAEI;EAGJ,MAAM+B,QAAQ,KAAK1D,2BAA2BgB,OAAO;GACjDwC,eAAeL,WAAWxB;GAC1BgC,qBAAqBR,WAAW3B;GAChCiC,WAAWL,cAAczB;GACzBiC,iBAAiBR,cAAc5B;EACnC,CAAA;EACA,MAAM,KAAKxB,2BAA2BkB,KAAKwC,KAAAA;CAC/C;;;;IAMA,MAAcZ,kBAAkBK,YAAuC;EACnE,MAAMU,YAAY,MAAM,KAAKhE,eAAewD,cAAcxF,eAAAA;EAC1D,IAAI,CAACgG,WACD;EAOJ,IAAIN,MAJmB,KAAKzD,yBAAyB8B,UAAU;GAC3DkC,SAASD,UAAUlC;GACnB6B,eAAeL,WAAWxB;EAC9B,CAAA,GAEI;EAGJ,MAAM+B,QAAQ,KAAK5D,yBAAyBkB,OAAO;GAC/C8C,SAASD,UAAUlC;GACnBoC,eAAeF,UAAUrC;GACzBgC,eAAeL,WAAWxB;GAC1BgC,qBAAqBR,WAAW3B;GAEhCwC,aAAa9G,WAAW+G;EAC5B,CAAA;EACA,MAAM,KAAKnE,yBAAyBoB,KAAKwC,KAAAA;CAC7C;;;;;;;;;;;;;;;IAiBA,MAAcX,wBAAwBI,YAAuC;EACzE,IAAInF,iCAAiCkG,SAASf,WAAW3C,IAAI,GACzD;EAGJ,MAAM2D,YAAY,OAAQE,OAAO1G,cAAAA,CAAAA,CAA6BuG,SAASf,WAAW3C,IAAI;EACtF,IAAI,CAAC2C,WAAW3B,YAAY,CAAC2C,WACzB;EAGJ,MAAMG,aAAalG,8BAA8B8F,SAASf,WAAW3C,IAAI,IACrEtD,WAAWqH,MACXrH,WAAWsH;EAEf,MAAMC,kBAAkB,MAAM,KAAK5E,eAAe6E,WAAW,EAAElE,MAAM1C,sBAAsB,CAAA;EAE3F,KAAK,MAAM6G,QAAQF,iBAAiB;GAChC,IAAItB,WAAW3B,YAAY2B,WAAW3B,aAAamD,KAAKnD,UACpD;GAOJ,IAAI+B,MAJmB,KAAKzD,yBAAyB8B,UAAU;IAC3DkC,SAASa,KAAKhD;IACd6B,eAAeL,WAAWxB;GAC9B,CAAA,GAEI;GAGJ,MAAM+B,QAAQ,KAAK5D,yBAAyBkB,OAAO;IAC/C8C,SAASa,KAAKhD;IACdoC,eAAeY,KAAKnD;IACpBgC,eAAeL,WAAWxB;IAC1BgC,qBAAqBR,WAAW3B;IAChCwC,aAAaM;GACjB,CAAA;GACA,MAAM,KAAKxE,yBAAyBoB,KAAKwC,KAAAA;EAC7C;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","definePolicyData","ValidatorGroup","isPropertySet","isUUID","AuthupError","EntityNotFoundError","ValidationError","PermissionName","PermissionValidator","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","AbstractEntityService","decodeQuery","permissionSchema","REALM_ADMIN_EXCLUDED_PERMISSIONS","REALM_CREATE","REALM_UPDATE","REALM_DELETE","REALM_ADMIN_BOUND_PERMISSIONS","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","PermissionService","repository","realmRepository","roleRepository","rolePermissionRepository","policyRepository","permissionPolicyRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","findMany","schema","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","CREATE","validated","run","validateJoinColumns","builtIn","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","merge","created","identity","getActorRealmId","resourceRealmMatch","assignToAdminRole","assignToRealmAdminRoles","assignDefaultPolicy","e","remove","catch","delete","entityId","permission","defaultPolicy","findOneByName","DEFAULT","existing","permissionId","policyId","entry","permissionRealmId","policyRealmId","adminRole","roleId","roleRealmId","realmScope","ANY","includes","isBuiltIn","Object","values","OWN","OWN_OR_NULL","realmAdminRoles","findManyBy","role"],"sources":["../../../../src/core/entities/permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { \n    BuiltInPolicyType, \n    RealmScope, \n    SystemPolicyName, \n    definePolicyData, \n} from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { AuthupError, EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    PermissionValidator,\n    ROLE_ADMIN_NAME,\n    ROLE_REALM_ADMIN_NAME,\n} from '@authup/core-kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository } from '../permission-policy/types.ts';\nimport type { IPolicyRepository } from '../policy/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport type { IRoleRepository } from '../role/types.ts';\nimport type { IRolePermissionRepository } from '../role-permission/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IPermissionRepository, IPermissionService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { permissionSchema } from './schema.ts';\n\nconst REALM_ADMIN_EXCLUDED_PERMISSIONS = [\n    PermissionName.REALM_CREATE,\n    PermissionName.REALM_UPDATE,\n    PermissionName.REALM_DELETE,\n];\n\n/**\n * Direct-entity CUD permissions that realm_admin grants at `realmScope: own`\n * (strictly the actor's own realm — see line 372). Every other realm_admin\n * permission defaults to `ownOrNull` (own realm OR global/null resources) so it\n * can act on global building blocks.\n *\n * Junction CUD (e.g. user_role, role_permission) is intentionally NOT listed here:\n * it stays `ownOrNull` because a junction can legitimately reference a global\n * side (realmId: null) — a strict `own` would reject those.\n */\nconst REALM_ADMIN_BOUND_PERMISSIONS = [\n    PermissionName.CLIENT_CREATE,\n    PermissionName.CLIENT_UPDATE,\n    PermissionName.CLIENT_DELETE,\n    PermissionName.IDENTITY_PROVIDER_CREATE,\n    PermissionName.IDENTITY_PROVIDER_UPDATE,\n    PermissionName.IDENTITY_PROVIDER_DELETE,\n    PermissionName.PERMISSION_CREATE,\n    PermissionName.PERMISSION_UPDATE,\n    PermissionName.PERMISSION_DELETE,\n    PermissionName.ROLE_CREATE,\n    PermissionName.ROLE_UPDATE,\n    PermissionName.ROLE_DELETE,\n    PermissionName.SCOPE_CREATE,\n    PermissionName.SCOPE_UPDATE,\n    PermissionName.SCOPE_DELETE,\n    PermissionName.USER_CREATE,\n    PermissionName.USER_UPDATE,\n    PermissionName.USER_DELETE,\n];\n\nexport type PermissionServiceContext = {\n    repository: IPermissionRepository;\n    realmRepository: IRealmRepository;\n    roleRepository: IRoleRepository;\n    rolePermissionRepository: IRolePermissionRepository;\n    policyRepository: IPolicyRepository;\n    permissionPolicyRepository: IPermissionPolicyRepository;\n};\n\nexport class PermissionService extends AbstractEntityService implements IPermissionService {\n    protected repository: IPermissionRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected roleRepository: IRoleRepository;\n\n    protected rolePermissionRepository: IRolePermissionRepository;\n\n    protected policyRepository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    protected validator: PermissionValidator;\n\n    constructor(ctx: PermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.rolePermissionRepository = ctx.rolePermissionRepository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n        this.validator = new PermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Permission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: permissionSchema, actor }));\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Permission,\n        created: boolean\n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Permission | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            if (\n                entity.builtIn &&\n                isPropertySet(validated, 'name') &&\n                entity.name !== validated.name\n            ) {\n                throw new ValidationError('The name of a built-in permission can not be changed.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            entity = this.repository.merge(entity, validated);\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false,\n            };\n        }\n\n        if (!isPropertySet(validated, 'realmId') && actor.identity) {\n            validated.realmId = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        // The permission row is now committed, but its security wiring — the\n        // admin/realm_admin grants and the system.default binding — is written\n        // through separate repositories with no shared transaction. A failure\n        // partway through would strand the permission bound by system.default\n        // yet held by nobody, which the uniform member gate on\n        // POST /role-permissions then makes permanently un-grantable (#3303).\n        // Two safeguards:\n        //   1. Establish the grants BEFORE binding system.default, so even an\n        //      un-compensated interruption (a hard process crash) cannot produce\n        //      the bound-but-ungranted strand — at worst a benign, still-grantable\n        //      permission that lacks its baseline policy.\n        //   2. On any thrown failure, remove the just-created permission — its\n        //      CASCADE foreign keys drop any partial junction/binding rows — and\n        //      rethrow so the caller sees the failure instead of a stale record.\n        try {\n            await this.assignToAdminRole(entity);\n            await this.assignToRealmAdminRoles(entity);\n            await this.assignDefaultPolicy(entity);\n        } catch (e) {\n            await this.repository.remove(entity).catch(() => { /* best-effort rollback */ });\n            throw e;\n        }\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.builtIn) {\n            throw new ValidationError('A built-in permission can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    /**\n     * Assign the system.default policy to a newly created permission.\n     * This ensures all permissions are evaluated with the baseline security\n     * policy (identity, permission-binding, realm-match) by default.\n     */\n    private async assignDefaultPolicy(permission: Permission): Promise<void> {\n        const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);\n        }\n\n        const existing = await this.permissionPolicyRepository.findOneBy({\n            permissionId: permission.id,\n            policyId: defaultPolicy.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.permissionPolicyRepository.create({\n            permissionId: permission.id,\n            permissionRealmId: permission.realmId,\n            policyId: defaultPolicy.id,\n            policyRealmId: defaultPolicy.realmId,\n        });\n        await this.permissionPolicyRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to the global admin role.\n     * The admin role receives every permission without policy restrictions.\n     *\n     * Throws when the admin role is not provisioned: without an admin grant the\n     * permission is bound by `system.default` yet held by nobody, and the uniform\n     * member gate on junction creation makes it permanently un-grantable (even by\n     * admin). Fail loud so the stranded state is surfaced instead of swallowed.\n     */\n    private async assignToAdminRole(permission: Permission): Promise<void> {\n        const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);\n        if (!adminRole) {\n            throw new AuthupError(`The ${ROLE_ADMIN_NAME} role is not provisioned. Cannot grant the created permission to the administrator role.`);\n        }\n\n        const existing = await this.rolePermissionRepository.findOneBy({\n            roleId: adminRole.id,\n            permissionId: permission.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.rolePermissionRepository.create({\n            roleId: adminRole.id,\n            roleRealmId: adminRole.realmId,\n            permissionId: permission.id,\n            permissionRealmId: permission.realmId,\n            // Global admin: unrestricted realm reach.\n            realmScope: RealmScope.ANY,\n        });\n        await this.rolePermissionRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to all matching realm_admin roles.\n     *\n     * Uses differentiated realmScope on the junction:\n     * - CUD on global-capable entity types → own (strictly own realm)\n     * - Everything else → ownOrNull (own realm + null/global resources)\n     *\n     * Eligible permissions:\n     * - Built-in authup permissions (global) — assigned to all realm_admin roles\n     * - Realm-scoped permissions — assigned to the realm_admin in the matching realm\n     *\n     * Excluded:\n     * - Realm CRUD permissions (realm_create, realm_update, realm_delete)\n     * - Custom global permissions (non-built-in with realmId: null)\n     */\n    private async assignToRealmAdminRoles(permission: Permission): Promise<void> {\n        if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name as PermissionName)) {\n            return;\n        }\n\n        const isBuiltIn = (Object.values(PermissionName) as string[]).includes(permission.name);\n        if (!permission.realmId && !isBuiltIn) {\n            return;\n        }\n\n        const realmScope = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name as PermissionName) ?\n            RealmScope.OWN :\n            RealmScope.OWN_OR_NULL;\n\n        const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });\n\n        for (const role of realmAdminRoles) {\n            if (permission.realmId && permission.realmId !== role.realmId) {\n                continue;\n            }\n\n            const existing = await this.rolePermissionRepository.findOneBy({\n                roleId: role.id,\n                permissionId: permission.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.rolePermissionRepository.create({\n                roleId: role.id,\n                roleRealmId: role.realmId,\n                permissionId: permission.id,\n                permissionRealmId: permission.realmId,\n                realmScope,\n            });\n            await this.rolePermissionRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAiCA,MAAMiB,mCAAmC;CACrCP,eAAeQ;CACfR,eAAeS;CACfT,eAAeU;;;;;;;;;;;GAanB,MAAMC,gCAAgC;CAClCX,eAAeY;CACfZ,eAAea;CACfb,eAAec;CACfd,eAAee;CACff,eAAegB;CACfhB,eAAeiB;CACfjB,eAAekB;CACflB,eAAemB;CACfnB,eAAeoB;CACfpB,eAAeqB;CACfrB,eAAesB;CACftB,eAAeuB;CACfvB,eAAewB;CACfxB,eAAeyB;CACfzB,eAAe0B;CACf1B,eAAe2B;CACf3B,eAAe4B;CACf5B,eAAe6B;;AAYnB,IAAaC,oBAAb,cAAuC1B,sBAAAA;CACzB2B;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKP,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIpC,oBAAAA;CACzB;CAEA,MAAMsC,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF5C,eAAe6C;GACf7C,eAAemB;GACfnB,eAAeoB;IAEvB,CAAA;EAEA,OAAO,KAAKW,WAAWe,SAAS,MAAMzC,YAAYmC,OAAO;GAAEO,QAAQzC;GAAkBmC;EAAM,CAAA,CAAA;CAC/F;CAEA,MAAMO,OACFC,UACAR,OACAS,OACmB;EACnB,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF5C,eAAe6C;GACf7C,eAAemB;GACfnB,eAAeoB;IAEvB,CAAA;EAEA,MAAM+B,SAAS,MAAM,KAAKpB,WAAWqB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAIrD,oBAAAA;EAGd,OAAOqD;CACX;CAEA,MAAME,OACFC,MACAb,OACmB;EACnB,MAAM,EAAEU,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMb,KAAAA;EACpD,OAAOU;CACX;CAEA,MAAMM,OACFR,UACAK,MACAb,OACmB;EACnB,MAAM,EAAEU,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMb,OAAO,EAAEiB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAb,OACAkB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,YAAY,WAClC,MAAM,KAAK7B,gBAAgB8B,QAAQR,KAAKO,OAAO,IAC/CL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAInE,OAAOqD,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMnB,OAAOK;GAGjB,IAAIC,OACAa,MAAMF,UAAUX,MAAMc;GAG1Bb,SAAS,MAAM,KAAKpB,WAAWkC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAI5D,oBAAAA;EAElB,OAAO,IAAI6D,QAAQD,YACf,MAAM,IAAI5D,oBAAAA;EAGd,IAAIqD,QAAQ;GACR,MAAMV,MAAMC,oBAAoBwB,YAAY,EAAEtB,MAAM5C,eAAemB,kBAAkB,CAAA;GACrFyC,QAAQlE,eAAeyE;EAC3B,OAAO;GACH,MAAM1B,MAAMC,oBAAoBwB,YAAY,EAAEtB,MAAM5C,eAAekB,kBAAkB,CAAA;GACrF0C,QAAQlE,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKhC,UAAUiC,IAAIhB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK7B,WAAWwC,oBAAoBF,SAAAA;EAE1C,IAAIlB,QAAQ;GACR,IACIA,OAAOqB,WACP7E,cAAc0E,WAAW,MAAA,KACzBlB,OAAOP,SAASyB,UAAUzB,MAE1B,MAAM,IAAI7C,gBAAgB,uDAAA;GAG9B,MAAM0C,MAAMC,oBAAoB+B,SAAS;IACrC7B,MAAM5C,eAAemB;IACrBmC,MAAM7D,iBAAiB;MAClBH,kBAAkBoF,aAAa;MAC5B,GAAGvB;MACH,GAAGkB;KACP;MACC/E,kBAAkBqF,cAAcN,UAAUR,WAAWV,OAAOU,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK9B,WAAW6C,gBAAgBP,WAAWlB,MAAAA;GAEjDA,SAAS,KAAKpB,WAAW8C,MAAM1B,QAAQkB,SAAAA;GAEvC,MAAM,KAAKtC,WAAWwB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,IAAI,CAACnF,cAAc0E,WAAW,SAAA,KAAc5B,MAAMsC,UAC9CV,UAAUR,UAAU,KAAKmB,gBAAgBvC,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoB+B,SAAS;GACrC7B,MAAM5C,eAAekB;GACrBoC,MAAM7D,iBAAiB;KAAGH,kBAAkBoF,aAAaL;IAAW,GAAG,KAAKY,mBAAmBZ,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKtC,WAAW6C,gBAAgBP,SAAAA;EAEtClB,SAAS,KAAKpB,WAAWsB,OAAOgB,SAAAA;EAChClB,SAAS,MAAM,KAAKpB,WAAWwB,KAAKJ,MAAAA;EAgBpC,IAAI;GACA,MAAM,KAAK+B,kBAAkB/B,MAAAA;GAC7B,MAAM,KAAKgC,wBAAwBhC,MAAAA;GACnC,MAAM,KAAKiC,oBAAoBjC,MAAAA;EACnC,SAASkC,GAAG;GACR,MAAM,KAAKtD,WAAWuD,OAAOnC,MAAAA,CAAAA,CAAQoC,YAAM,CAAmC,CAAA;GAC9E,MAAMF;EACV;EAEA,OAAO;GACHlC;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMU,OACFxB,IACAvB,OACmB;EACnB,MAAMA,MAAMC,oBAAoBwB,YAAY,EAAEtB,MAAM5C,eAAeoB,kBAAkB,CAAA;EAErF,MAAM+B,SAAS,MAAM,KAAKpB,WAAWkC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAIrD,oBAAAA;EAGd,IAAIqD,OAAOqB,SACP,MAAM,IAAIzE,gBAAgB,2CAAA;EAG9B,MAAM0C,MAAMC,oBAAoB+B,SAAS;GACrC7B,MAAM5C,eAAeoB;GACrBkC,MAAM7D,iBAAiB;KAAGH,kBAAkBoF,aAAavB;IAAQ,GAAG,KAAK8B,mBAAmB9B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEa,IAAIyB,aAAatC;EACzB,MAAM,KAAKpB,WAAWuD,OAAOnC,MAAAA;EAC7BA,OAAOa,KAAKyB;EAEZ,OAAOtC;CACX;;;;;IAOA,MAAciC,oBAAoBM,YAAuC;EACrE,MAAMC,gBAAgB,MAAM,KAAKxD,iBAAiByD,cAAcpG,iBAAiBqG,OAAO;EACxF,IAAI,CAACF,eACD,MAAM,IAAI9F,YAAY,OAAOL,iBAAiBqG,QAAQ,2FAA2F;EAOrJ,IAAIC,MAJmB,KAAK1D,2BAA2B6B,UAAU;GAC7D8B,cAAcL,WAAW1B;GACzBgC,UAAUL,cAAc3B;EAC5B,CAAA,GAEI;EAGJ,MAAMiC,QAAQ,KAAK7D,2BAA2BiB,OAAO;GACjD0C,cAAcL,WAAW1B;GACzBkC,mBAAmBR,WAAW7B;GAC9BmC,UAAUL,cAAc3B;GACxBmC,eAAeR,cAAc9B;EACjC,CAAA;EACA,MAAM,KAAKzB,2BAA2BmB,KAAK0C,KAAAA;CAC/C;;;;;;;;;IAWA,MAAcf,kBAAkBQ,YAAuC;EACnE,MAAMU,YAAY,MAAM,KAAKnE,eAAe2D,cAAc1F,eAAAA;EAC1D,IAAI,CAACkG,WACD,MAAM,IAAIvG,YAAY,OAAOK,gBAAgB,yFAAyF;EAO1I,IAAI4F,MAJmB,KAAK5D,yBAAyB+B,UAAU;GAC3DoC,QAAQD,UAAUpC;GAClB+B,cAAcL,WAAW1B;EAC7B,CAAA,GAEI;EAGJ,MAAMiC,QAAQ,KAAK/D,yBAAyBmB,OAAO;GAC/CgD,QAAQD,UAAUpC;GAClBsC,aAAaF,UAAUvC;GACvBkC,cAAcL,WAAW1B;GACzBkC,mBAAmBR,WAAW7B;GAE9B0C,YAAYhH,WAAWiH;EAC3B,CAAA;EACA,MAAM,KAAKtE,yBAAyBqB,KAAK0C,KAAAA;CAC7C;;;;;;;;;;;;;;;IAiBA,MAAcd,wBAAwBO,YAAuC;EACzE,IAAInF,iCAAiCkG,SAASf,WAAW9C,IAAI,GACzD;EAGJ,MAAM8D,YAAY,OAAQE,OAAO5G,cAAAA,CAAAA,CAA6ByG,SAASf,WAAW9C,IAAI;EACtF,IAAI,CAAC8C,WAAW7B,WAAW,CAAC6C,WACxB;EAGJ,MAAMH,aAAa5F,8BAA8B8F,SAASf,WAAW9C,IAAI,IACrErD,WAAWsH,MACXtH,WAAWuH;EAEf,MAAMC,kBAAkB,MAAM,KAAK9E,eAAe+E,WAAW,EAAEpE,MAAMzC,sBAAsB,CAAA;EAE3F,KAAK,MAAM8G,QAAQF,iBAAiB;GAChC,IAAIrB,WAAW7B,WAAW6B,WAAW7B,YAAYoD,KAAKpD,SAClD;GAOJ,IAAIiC,MAJmB,KAAK5D,yBAAyB+B,UAAU;IAC3DoC,QAAQY,KAAKjD;IACb+B,cAAcL,WAAW1B;GAC7B,CAAA,GAEI;GAGJ,MAAMiC,QAAQ,KAAK/D,yBAAyBmB,OAAO;IAC/CgD,QAAQY,KAAKjD;IACbsC,aAAaW,KAAKpD;IAClBkC,cAAcL,WAAW1B;IACzBkC,mBAAmBR,WAAW7B;IAC9B0C;GACJ,CAAA;GACA,MAAM,KAAKrE,yBAAyBqB,KAAK0C,KAAAA;EAC7C;CACJ;AACJ"}

package/dist/core/entities/permission-policy/index.d.ts

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/permission-policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/permission-policy/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { permissionPolicySchema } from "./schema.mjs";
 import { PermissionPolicyService } from "./service.mjs";
-export { PermissionPolicyService };
+export { PermissionPolicyService, permissionPolicySchema };

package/dist/core/entities/permission-policy/schema.d.ts

@@ -0,0 +1,3 @@
+import type { PermissionPolicy } from '@authup/core-kit';
+export declare const permissionPolicySchema: import("@rapiq/core").Schema<PermissionPolicy, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/permission-policy/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAMzD,eAAO,MAAM,sBAAsB,qDAmBjC,CAAC"}

package/dist/core/entities/permission-policy/schema.mjs

@@ -0,0 +1,39 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/permission-policy/schema.ts
+const schemaMapping = {
+	permission: EntityType.PERMISSION,
+	policy: EntityType.POLICY
+};
+const permissionPolicySchema = defineSchema({
+	name: EntityType.PERMISSION_POLICY,
+	fields: { default: [
+		"id",
+		"permissionId",
+		"permissionRealmId",
+		"policyId",
+		"policyRealmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: ["permissionId", "policyId"] },
+	relations: {
+		allowed: ["permission", "policy"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"id",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { permissionPolicySchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/permission-policy/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","permission","PERMISSION","policy","POLICY","permissionPolicySchema","name","PERMISSION_POLICY","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/permission-policy/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { PermissionPolicy } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { permission: EntityType.PERMISSION, policy: EntityType.POLICY };\n\nexport const permissionPolicySchema = defineSchema<PermissionPolicy>({\n    name: EntityType.PERMISSION_POLICY,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'permissionId',\n            'permissionRealmId',\n            'policyId',\n            'policyRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['permissionId', 'policyId'] },\n    relations: { allowed: ['permission', 'policy'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,YAAYH,WAAWI;CAAYC,QAAQL,WAAWM;AAAO;AAErF,MAAaC,yBAAyBR,aAA+B;CACjES,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAEC,SAAS,CAAC,gBAAgB,UAAA,EAAY;CACjDC,WAAW;EAAED,SAAS,CAAC,cAAc,QAAA;EAAWE,UAAUd,wBAAwBC,aAAAA;CAAe;CACjGc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;GAAa;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/permission-policy/service.d.ts

@@ -7,7 +7,7 @@ export type PermissionPolicyServiceContext = {
     repository: IPermissionPolicyRepository;
 };
 export declare class PermissionPolicyService extends JunctionEntityService implements IPermissionPolicyService {
-    protected readonly ownerRealmKey = "permission_realm_id";
+    protected readonly ownerRealmKey = "permissionRealmId";
     protected repository: IPermissionPolicyRepository;
     protected validator: PermissionPolicyValidator;
     constructor(ctx: PermissionPolicyServiceContext);

package/dist/core/entities/permission-policy/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,MAAM,8BAA8B,GAAG;IACzC,UAAU,EAAE,2BAA2B,CAAC;CAC3C,CAAC;AAEF,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,QAAQ,CAAC,aAAa,yBAAyB;IAEzD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,SAAS,EAAE,yBAAyB,CAAC;gBAEnC,GAAG,EAAE,8BAA8B;IAMzC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IAWtD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAgBtB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAsCtB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;CAuB/B"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/permission-policy/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAIxF,MAAM,MAAM,8BAA8B,GAAG;IACzC,UAAU,EAAE,2BAA2B,CAAC;CAC3C,CAAC;AAEF,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,QAAQ,CAAC,aAAa,uBAAuB;IAEvD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,SAAS,EAAE,yBAAyB,CAAC;gBAEnC,GAAG,EAAE,8BAA8B;IAMzC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IAWtD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAgBtB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAsCtB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,gBAAgB,CAAC;CAuB/B"}

package/dist/core/entities/permission-policy/service.mjs

@@ -1,6 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { permissionPolicySchema } from "./schema.mjs";
+import { decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { ValidatorGroup } from "@authup/kit";
 import { PermissionName, PermissionPolicyValidator } from "@authup/core-kit";
 import { JunctionEntityService } from "@authup/server-kit";
@@ -8,7 +11,7 @@ import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/permission-policy/service.ts
 var PermissionPolicyService = class extends JunctionEntityService {
-	ownerRealmKey = "permission_realm_id";
+	ownerRealmKey = "permissionRealmId";
 	repository;
 	validator;
 	constructor(ctx) {
@@ -18,7 +21,10 @@ var PermissionPolicyService = class extends JunctionEntityService {
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.PERMISSION_READ, PermissionName.PERMISSION_UPDATE] });
-		return this.repository.findMany(query);
+		return this.repository.findMany(await decodeQuery(query, {
+			schema: permissionPolicySchema,
+			actor
+		}));
 	}
 	async getOne(id, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.PERMISSION_READ, PermissionName.PERMISSION_UPDATE] });
@@ -31,11 +37,11 @@ var PermissionPolicyService = class extends JunctionEntityService {
 		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
 		await this.repository.validateJoinColumns(validated);
 		if (await this.repository.findOneBy({
-			permission_id: validated.permission_id,
-			policy_id: validated.policy_id
+			permissionId: validated.permissionId,
+			policyId: validated.policyId
 		})) throw new EntityConflictError({ entity: "permission-policy" });
-		if (validated.permission) validated.permission_realm_id = validated.permission.realm_id;
-		if (validated.policy) validated.policy_realm_id = validated.policy.realm_id;
+		if (validated.permission) validated.permissionRealmId = validated.permission.realmId;
+		if (validated.policy) validated.policyRealmId = validated.policy.realmId;
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.PERMISSION_UPDATE,
 			data: definePolicyData({

package/dist/core/entities/permission-policy/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","PermissionPolicyValidator","JunctionEntityService","PermissionPolicyService","ownerRealmKey","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permission_id","policy_id","permission","permission_realm_id","realm_id","policy","policy_realm_id","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/permission-policy/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, PermissionPolicyValidator } from '@authup/core-kit';\nimport type { PermissionPolicy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository, IPermissionPolicyService } from './types.ts';\n\nexport type PermissionPolicyServiceContext = {\n    repository: IPermissionPolicyRepository;\n};\n\nexport class PermissionPolicyService extends JunctionEntityService implements IPermissionPolicyService {\n    protected readonly ownerRealmKey = 'permission_realm_id';\n\n    protected repository: IPermissionPolicyRepository;\n\n    protected validator: PermissionPolicyValidator;\n\n    constructor(ctx: PermissionPolicyServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new PermissionPolicyValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<PermissionPolicy>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<PermissionPolicy> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<PermissionPolicy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            permission_id: validated.permission_id,\n            policy_id: validated.policy_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'permission-policy' });\n        }\n\n        if (validated.permission) {\n            validated.permission_realm_id = validated.permission.realm_id;\n        }\n\n        if (validated.policy) {\n            validated.policy_realm_id = validated.policy.realm_id;\n        }\n\n        // Stamp the owner (permission) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<PermissionPolicy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (permission) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaQ,0BAAb,cAA6CD,sBAAAA;CACtBE,gBAAgB;CAEzBC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIL,0BAAAA;CACzB;CAEA,MAAMO,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,iBACfd,eAAee,iBAAAA,EAEvB,CAAA;EAEA,OAAO,KAAKV,WAAWW,SAASP,KAAAA;CACpC;CAEA,MAAMQ,OACFC,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,iBACfd,eAAee,iBAAAA,EAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKd,WAAWe,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIrB,oBAAAA;EAGd,OAAOqB;CACX;CAEA,MAAME,OACFC,MACAZ,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMb,eAAee,kBAAkB,CAAA;EAErF,MAAMS,YAAY,MAAM,KAAKlB,UAAUmB,IAAIH,MAAM,EAAEI,OAAO3B,eAAe4B,OAAO,CAAA;EAEhF,MAAM,KAAKtB,WAAWuB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAKxB,WAAWe,UAAU;GAC7CU,eAAeN,UAAUM;GACzBC,WAAWP,UAAUO;EACzB,CAAA,GAEI,MAAM,IAAIlC,oBAAoB,EAAEsB,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YACVR,UAAUS,sBAAsBT,UAAUQ,WAAWE;EAGzD,IAAIV,UAAUW,QACVX,UAAUY,kBAAkBZ,UAAUW,OAAOD;EAIjD,MAAMxB,MAAMC,oBAAoB0B,SAAS;GACrCxB,MAAMb,eAAee;GACrBO,MAAM1B,iBAAiB;KAClBD,kBAAkB2C,aAAa,KAAKC,mBAAmBf,SAAAA;KACvD7B,kBAAkB6C,cAAc,KAAKC,sBAAsBjB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKd,WAAWgB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKd,WAAWqC,KAAKvB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMwB,OACFzB,IACAR,OACyB;EACzB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMb,eAAee,kBAAkB,CAAA;EAErF,MAAMI,SAAS,MAAM,KAAKd,WAAWe,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIrB,oBAAAA;EAId,MAAMY,MAAMC,oBAAoB0B,SAAS;GACrCxB,MAAMb,eAAee;GACrBO,MAAM1B,iBAAiB;KAClBD,kBAAkB2C,aAAa,KAAKC,mBAAmBpB,MAAAA;KACvDxB,kBAAkB6C,cAAc,KAAKC,sBAAsBtB,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI0B,aAAazB;EACzB,MAAM,KAAKd,WAAWwC,OAAO1B,MAAAA;EAC7BA,OAAOD,KAAK0B;EAEZ,OAAOzB;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","PermissionPolicyValidator","JunctionEntityService","decodeQuery","permissionPolicySchema","PermissionPolicyService","ownerRealmKey","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permissionId","policyId","permission","permissionRealmId","realmId","policy","policyRealmId","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/permission-policy/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, PermissionPolicyValidator } from '@authup/core-kit';\nimport type { PermissionPolicy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository, IPermissionPolicyService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { permissionPolicySchema } from './schema.ts';\n\nexport type PermissionPolicyServiceContext = {\n    repository: IPermissionPolicyRepository;\n};\n\nexport class PermissionPolicyService extends JunctionEntityService implements IPermissionPolicyService {\n    protected readonly ownerRealmKey = 'permissionRealmId';\n\n    protected repository: IPermissionPolicyRepository;\n\n    protected validator: PermissionPolicyValidator;\n\n    constructor(ctx: PermissionPolicyServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new PermissionPolicyValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<PermissionPolicy>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: permissionPolicySchema, actor }));\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<PermissionPolicy> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<PermissionPolicy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            permissionId: validated.permissionId,\n            policyId: validated.policyId,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'permission-policy' });\n        }\n\n        if (validated.permission) {\n            validated.permissionRealmId = validated.permission.realmId;\n        }\n\n        if (validated.policy) {\n            validated.policyRealmId = validated.policy.realmId;\n        }\n\n        // Stamp the owner (permission) realm so the realmScope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<PermissionPolicy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (permission) realm so the realmScope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAsBA,IAAaU,0BAAb,cAA6CH,sBAAAA;CACtBI,gBAAgB;CAEzBC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIP,0BAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFf,eAAegB,iBACfhB,eAAeiB,iBAAAA,EAEvB,CAAA;EAEA,OAAO,KAAKV,WAAWW,SAAS,MAAMf,YAAYQ,OAAO;GAAEQ,QAAQf;GAAwBQ;EAAM,CAAA,CAAA;CACrG;CAEA,MAAMQ,OACFC,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFf,eAAegB,iBACfhB,eAAeiB,iBAAAA,EAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKf,WAAWgB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIxB,oBAAAA;EAGd,OAAOwB;CACX;CAEA,MAAME,OACFC,MACAb,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMf,eAAeiB,kBAAkB,CAAA;EAErF,MAAMU,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAO9B,eAAe+B,OAAO,CAAA;EAEhF,MAAM,KAAKvB,WAAWwB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAKzB,WAAWgB,UAAU;GAC7CU,cAAcN,UAAUM;GACxBC,UAAUP,UAAUO;EACxB,CAAA,GAEI,MAAM,IAAIrC,oBAAoB,EAAEyB,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YACVR,UAAUS,oBAAoBT,UAAUQ,WAAWE;EAGvD,IAAIV,UAAUW,QACVX,UAAUY,gBAAgBZ,UAAUW,OAAOD;EAI/C,MAAMzB,MAAMC,oBAAoB2B,SAAS;GACrCzB,MAAMf,eAAeiB;GACrBQ,MAAM7B,iBAAiB;KAClBD,kBAAkB8C,aAAa,KAAKC,mBAAmBf,SAAAA;KACvDhC,kBAAkBgD,cAAc,KAAKC,sBAAsBjB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKf,WAAWiB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKf,WAAWsC,KAAKvB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMwB,OACFzB,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMf,eAAeiB,kBAAkB,CAAA;EAErF,MAAMK,SAAS,MAAM,KAAKf,WAAWgB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIxB,oBAAAA;EAId,MAAMc,MAAMC,oBAAoB2B,SAAS;GACrCzB,MAAMf,eAAeiB;GACrBQ,MAAM7B,iBAAiB;KAClBD,kBAAkB8C,aAAa,KAAKC,mBAAmBpB,MAAAA;KACvD3B,kBAAkBgD,cAAc,KAAKC,sBAAsBtB,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI0B,aAAazB;EACzB,MAAM,KAAKf,WAAWyC,OAAO1B,MAAAA;EAC7BA,OAAOD,KAAK0B;EAEZ,OAAOzB;CACX;AACJ"}

package/dist/core/entities/policy/index.d.ts

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/policy/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { policySchema } from "./schema.mjs";
 import { PolicyService } from "./service.mjs";
-export { PolicyService };
+export { PolicyService, policySchema };

package/dist/core/entities/policy/schema.d.ts

@@ -0,0 +1,3 @@
+import type { Policy } from '@authup/core-kit';
+export declare const policySchema: import("@rapiq/core").Schema<Policy, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/policy/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/policy/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM/C,eAAO,MAAM,YAAY,2CAsBvB,CAAC"}

package/dist/core/entities/policy/schema.mjs

@@ -0,0 +1,49 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/policy/schema.ts
+const schemaMapping = {
+	children: EntityType.POLICY,
+	realm: EntityType.REALM
+};
+const policySchema = defineSchema({
+	name: EntityType.POLICY,
+	fields: { default: [
+		"id",
+		"builtIn",
+		"type",
+		"displayName",
+		"name",
+		"description",
+		"invert",
+		"parentId",
+		"realmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: [
+		"id",
+		"name",
+		"type",
+		"parentId",
+		"realmId"
+	] },
+	relations: {
+		allowed: ["children", "realm"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"id",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { policySchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/policy/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","children","POLICY","realm","REALM","policySchema","name","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/policy/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Policy } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { children: EntityType.POLICY, realm: EntityType.REALM };\n\nexport const policySchema = defineSchema<Policy>({\n    name: EntityType.POLICY,\n    fields: {\n        default: [\n            'id',\n            'builtIn',\n            'type',\n            'displayName',\n            'name',\n            'description',\n            'invert',\n            'parentId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'name', 'type', 'parentId', 'realmId'] },\n    relations: { allowed: ['children', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,UAAUH,WAAWI;CAAQC,OAAOL,WAAWM;AAAM;AAE7E,MAAaC,eAAeR,aAAqB;CAC7CS,MAAMR,WAAWI;CACjBK,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAM;EAAQ;EAAQ;EAAY;GAAW;CAClEC,WAAW;EAAED,SAAS,CAAC,YAAY,OAAA;EAAUE,UAAUb,wBAAwBC,aAAAA;CAAe;CAC9Fa,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;GAAa;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}

package/dist/core/entities/policy/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/policy/service.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEH,eAAe,EAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;IAErC,SAAS,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;gBAE7C,GAAG,EAAE,oBAAoB;IAQ/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAY5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;IAiBZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;YA+FY,QAAQ;IAqBhB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CA4BrB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/policy/service.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEH,eAAe,EAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;IAErC,SAAS,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;gBAE7C,GAAG,EAAE,oBAAoB;IAQ/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAY5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;IAiBZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;YA+FY,QAAQ;IAqBhB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CA4BrB"}