@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/entities/role-attribute/schema.d.ts

@@ -0,0 +1,3 @@
+import type { RoleAttribute } from '@authup/core-kit';
+export declare const roleAttributeSchema: import("@rapiq/core").Schema<RoleAttribute, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/role-attribute/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role-attribute/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMtD,eAAO,MAAM,mBAAmB,kDA4B9B,CAAC"}

package/dist/core/entities/role-attribute/schema.mjs

@@ -0,0 +1,47 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/role-attribute/schema.ts
+const schemaMapping = {
+	role: EntityType.ROLE,
+	realm: EntityType.REALM
+};
+const roleAttributeSchema = defineSchema({
+	name: EntityType.ROLE_ATTRIBUTE,
+	fields: { default: [
+		"id",
+		"name",
+		"value",
+		"roleId",
+		"realmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: [
+		"id",
+		"name",
+		"roleId",
+		"realmId"
+	] },
+	relations: {
+		allowed: ["role", "realm"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"id",
+		"name",
+		"roleId",
+		"realmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { roleAttributeSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/role-attribute/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","role","ROLE","realm","REALM","roleAttributeSchema","name","ROLE_ATTRIBUTE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/role-attribute/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { RoleAttribute } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { role: EntityType.ROLE, realm: EntityType.REALM };\n\nexport const roleAttributeSchema = defineSchema<RoleAttribute>({\n    name: EntityType.ROLE_ATTRIBUTE,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'name',\n            'value',\n            'roleId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'name', 'roleId', 'realmId'] },\n    relations: { allowed: ['role', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: {\n        allowed: [\n            'id',\n            'name',\n            'roleId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,sBAAsBR,aAA4B;CAC3DS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAM;EAAQ;EAAU;GAAW;CACxDC,WAAW;EAAED,SAAS,CAAC,QAAQ,OAAA;EAAUE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC1Fc,MAAM,EACFH,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;GAER;CACAI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/role-attribute/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role-attribute/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAElF,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE,wBAAwB,CAAC;IACrC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,qBAAsB,YAAW,qBAAqB;IAC5F,SAAS,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAE/C,SAAS,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAEjC,GAAG,EAAE,2BAA2B;IAMtC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,aAAa,CAAC,CAAC;IA0CnD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IA0BnB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IA0BnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAsCnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;CAmB5B"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role-attribute/service.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAIlF,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE,wBAAwB,CAAC;IACrC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,qBAAsB,YAAW,qBAAqB;IAC5F,SAAS,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAE/C,SAAS,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAEjC,GAAG,EAAE,2BAA2B;IAMtC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,aAAa,CAAC,CAAC;IA2DnD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IA0BnB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IA0BnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAsCnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;CAmB5B"}

package/dist/core/entities/role-attribute/service.mjs

@@ -1,10 +1,14 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { roleAttributeSchema } from "./schema.mjs";
+import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
+import { inArray } from "@rapiq/core";
 //#region src/core/entities/role-attribute/service.ts
 var RoleAttributeService = class extends AbstractEntityService {
 	repository;
@@ -15,12 +19,21 @@ var RoleAttributeService = class extends AbstractEntityService {
 		this.reservedNames = ctx.reservedNames ?? /* @__PURE__ */ new Set();
 	}
 	async getMany(query, actor) {
-		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+		const permissionNames = [
 			PermissionName.ROLE_READ,
 			PermissionName.ROLE_UPDATE,
 			PermissionName.ROLE_DELETE
-		] });
-		const { data: entities, meta } = await this.repository.findMany(query);
+		];
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });
+		let parsed = await decodeQuery(query, {
+			schema: roleAttributeSchema,
+			actor
+		});
+		const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });
+		if (compiled.verdict === "deny") parsed = appendQueryConditions(parsed, inArray("id", []));
+		else if (compiled.verdict === "conditional") parsed = appendQueryConditions(parsed, compiled.condition);
+		if (compiled.verdict !== "post") return this.repository.findMany(parsed);
+		const { data: entities, meta } = await this.repository.findMany(parsed);
 		const data = [];
 		let { total } = meta;
 		for (const entity of entities) try {
@@ -71,8 +84,8 @@ var RoleAttributeService = class extends AbstractEntityService {
 	async create(data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });
 		await this.repository.validateJoinColumns(data);
-		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new BadRequestError(`The role-attribute name '${data.name}' collides with a Role entity column.`);
-		data.realm_id = data.role.realm_id;
+		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new ValidationError(`The role-attribute name '${data.name}' collides with a Role entity column.`);
+		data.realmId = data.role.realmId;
 		const entity = this.repository.create(data);
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.ROLE_UPDATE,
@@ -87,12 +100,12 @@ var RoleAttributeService = class extends AbstractEntityService {
 	async update(id, data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });
 		await this.repository.validateJoinColumns(data);
-		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new BadRequestError(`The role-attribute name '${data.name}' collides with a Role entity column.`);
+		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new ValidationError(`The role-attribute name '${data.name}' collides with a Role entity column.`);
 		let entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
-		delete data.role_id;
+		delete data.roleId;
 		delete data.role;
-		delete data.realm_id;
+		delete data.realmId;
 		entity = this.repository.merge(entity, data);
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.ROLE_UPDATE,

package/dist/core/entities/role-attribute/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","BadRequestError","EntityNotFoundError","PermissionName","AbstractEntityService","RoleAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","ROLE_READ","ROLE_UPDATE","ROLE_DELETE","data","entities","meta","findMany","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","id","findOneBy","create","preEvaluate","validateJoinColumns","has","realm_id","role","evaluate","value","save","update","role_id","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/role-attribute/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PermissionName } from '@authup/core-kit';\nimport type { RoleAttribute } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRoleAttributeRepository, IRoleAttributeService } from './types.ts';\n\nexport type RoleAttributeServiceContext = {\n    repository: IRoleAttributeRepository;\n    reservedNames?: ReadonlySet<string>;\n};\n\nexport class RoleAttributeService extends AbstractEntityService implements IRoleAttributeService {\n    protected repository: IRoleAttributeRepository;\n\n    protected reservedNames: ReadonlySet<string>;\n\n    constructor(ctx: RoleAttributeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.reservedNames = ctx.reservedNames ?? new Set();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<RoleAttribute>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n        });\n\n        const {\n            data: entities, \n            meta, \n        } = await this.repository.findMany(query);\n\n        const data: RoleAttribute[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: [\n                        PermissionName.ROLE_READ,\n                        PermissionName.ROLE_UPDATE,\n                        PermissionName.ROLE_DELETE,\n                    ],\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n                data.push(entity);\n            } catch {\n                total--;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new BadRequestError(`The role-attribute name '${data.name}' collides with a Role entity column.`);\n        }\n\n        data.realm_id = data.role.realm_id;\n\n        const entity = this.repository.create(data);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new BadRequestError(`The role-attribute name '${data.name}' collides with a Role entity column.`);\n        }\n\n        let entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // An attribute belongs to a fixed role; its owner (and the role-derived realm_id) is\n        // IMMUTABLE on update — strip both from the body. This blocks reassigning the attribute\n        // to another role (which would otherwise be authorized against the new realm, not the\n        // one the attribute currently lives in) and blocks a caller-supplied realm_id that would\n        // gate ROLE_UPDATE against a realm of their choosing. To move an attribute, delete + recreate.\n        delete data.role_id;\n        delete data.role;\n        delete data.realm_id;\n\n        entity = this.repository.merge(entity, data);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_UPDATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;AAoBA,IAAaM,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKf,WAAWgB,SAASX,KAAAA;EAEnC,MAAMQ,OAAwB,CAAA;EAC9B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UACjB,IAAI;GACA,MAAMR,MAAMC,oBAAoBY,cAAc;IAC1CV,MAAM;KACFZ,eAAea;KACfb,eAAec;KACfd,eAAee;;IAEnBC,MAAMnB,iBAAiB;MAAGD,kBAAkB2B,aAAaF;KAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;IAAQ,CAAA;GACxG,CAAA;GACAL,KAAKS,KAAKJ,MAAAA;EACd,QAAQ;GACJD;EACJ;EAGJ,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,IACAlB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;IAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKlB,WAAWyB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACN,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMU,MAAMC,oBAAoBY,cAAc;GAC1CV,MAAM;IACFZ,eAAea;IACfb,eAAec;IACfd,eAAee;;GAEnBC,MAAMnB,iBAAiB;KAAGD,kBAAkB2B,aAAaF;IAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMQ,OACFb,MACAP,OACsB;EACtB,MAAMA,MAAMC,oBAAoBoB,YAAY,EAAElB,MAAMZ,eAAec,YAAY,CAAA;EAE/E,MAAM,KAAKX,WAAW4B,oBAAoBf,IAAAA;EAE1C,IAAI,OAAOA,KAAKJ,SAAS,YAAY,KAAKR,cAAc4B,IAAIhB,KAAKJ,IAAI,GACjE,MAAM,IAAId,gBAAgB,4BAA4BkB,KAAKJ,KAAK,sCAAsC;EAG1GI,KAAKiB,WAAWjB,KAAKkB,KAAKD;EAE1B,MAAMZ,SAAS,KAAKlB,WAAW0B,OAAOb,IAAAA;EAEtC,MAAMP,MAAMC,oBAAoByB,SAAS;GACrCvB,MAAMZ,eAAec;GACrBE,MAAMnB,iBAAiB;KAClBD,kBAAkB2B,aAAa,GAAGP,KAAKJ,OAAOI,KAAKoB,MAAM;IAC1D,GAAG,KAAKZ,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKlB,WAAWkC,KAAKhB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMiB,OACFX,IACAX,MACAP,OACsB;EACtB,MAAMA,MAAMC,oBAAoBoB,YAAY,EAAElB,MAAMZ,eAAec,YAAY,CAAA;EAE/E,MAAM,KAAKX,WAAW4B,oBAAoBf,IAAAA;EAE1C,IAAI,OAAOA,KAAKJ,SAAS,YAAY,KAAKR,cAAc4B,IAAIhB,KAAKJ,IAAI,GACjE,MAAM,IAAId,gBAAgB,4BAA4BkB,KAAKJ,KAAK,sCAAsC;EAG1G,IAAIS,SAAS,MAAM,KAAKlB,WAAWyB,UAAU,EAAED,GAAG,CAAA;EAClD,IAAI,CAACN,QACD,MAAM,IAAItB,oBAAAA;EAQd,OAAOiB,KAAKuB;EACZ,OAAOvB,KAAKkB;EACZ,OAAOlB,KAAKiB;EAEZZ,SAAS,KAAKlB,WAAWqC,MAAMnB,QAAQL,IAAAA;EAEvC,MAAMP,MAAMC,oBAAoByB,SAAS;GACrCvB,MAAMZ,eAAec;GACrBE,MAAMnB,iBAAiB;KAClBD,kBAAkB2B,aAAa,GAAGF,OAAOT,OAAOS,OAAOe,MAAM;IAC9D,GAAG,KAAKZ,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKlB,WAAWkC,KAAKhB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMoB,OACFd,IACAlB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBoB,YAAY,EAAElB,MAAMZ,eAAec,YAAY,CAAA;EAE/E,MAAMO,SAAS,MAAM,KAAKlB,WAAWyB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACN,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMU,MAAMC,oBAAoByB,SAAS;GACrCvB,MAAMZ,eAAec;GACrBE,MAAMnB,iBAAiB;KAAGD,kBAAkB2B,aAAaF;IAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEM,IAAIe,aAAarB;EACzB,MAAM,KAAKlB,WAAWwC,OAAOtB,MAAAA;EAC7BA,OAAOM,KAAKe;EAEZ,OAAOrB;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityNotFoundError","ValidationError","inArray","PermissionName","AbstractEntityService","appendQueryConditions","decodeQuery","roleAttributeSchema","RoleAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionNames","ROLE_READ","ROLE_UPDATE","ROLE_DELETE","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","compiled","compile","verdict","condition","findMany","data","entities","meta","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","id","findOneBy","create","preEvaluate","validateJoinColumns","has","realmId","role","evaluate","value","save","update","roleId","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/role-attribute/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { inArray } from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { RoleAttribute } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRoleAttributeRepository, IRoleAttributeService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { roleAttributeSchema } from './schema.ts';\n\nexport type RoleAttributeServiceContext = {\n    repository: IRoleAttributeRepository;\n    reservedNames?: ReadonlySet<string>;\n};\n\nexport class RoleAttributeService extends AbstractEntityService implements IRoleAttributeService {\n    protected repository: IRoleAttributeRepository;\n\n    protected reservedNames: ReadonlySet<string>;\n\n    constructor(ctx: RoleAttributeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.reservedNames = ctx.reservedNames ?? new Set();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<RoleAttribute>> {\n        const permissionNames = [\n            PermissionName.ROLE_READ,\n            PermissionName.ROLE_UPDATE,\n            PermissionName.ROLE_DELETE,\n        ];\n\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n\n        let parsed = await decodeQuery(query, { schema: roleAttributeSchema, actor });\n\n        // Compile the read permissions into a row condition (#3286 phase 3): the\n        // authorization runs as WHERE, so pagination and totals stay exact. A\n        // non-expressible policy falls back to the per-row loop below.\n        const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });\n        if (compiled.verdict === 'deny') {\n            // no row can pass — a constant-false condition keeps the meta shape\n            parsed = appendQueryConditions(parsed, inArray('id', []));\n        } else if (compiled.verdict === 'conditional') {\n            parsed = appendQueryConditions(parsed, compiled.condition);\n        }\n\n        if (compiled.verdict !== 'post') {\n            return this.repository.findMany(parsed);\n        }\n\n        const {\n            data: entities,\n            meta,\n        } = await this.repository.findMany(parsed);\n\n        const data: RoleAttribute[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: [\n                        PermissionName.ROLE_READ,\n                        PermissionName.ROLE_UPDATE,\n                        PermissionName.ROLE_DELETE,\n                    ],\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n                data.push(entity);\n            } catch {\n                total--;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new ValidationError(`The role-attribute name '${data.name}' collides with a Role entity column.`);\n        }\n\n        data.realmId = data.role.realmId;\n\n        const entity = this.repository.create(data);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new ValidationError(`The role-attribute name '${data.name}' collides with a Role entity column.`);\n        }\n\n        let entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // An attribute belongs to a fixed role; its owner (and the role-derived realmId) is\n        // IMMUTABLE on update — strip both from the body. This blocks reassigning the attribute\n        // to another role (which would otherwise be authorized against the new realm, not the\n        // one the attribute currently lives in) and blocks a caller-supplied realmId that would\n        // gate ROLE_UPDATE against a realm of their choosing. To move an attribute, delete + recreate.\n        delete data.roleId;\n        delete data.role;\n        delete data.realmId;\n\n        entity = this.repository.merge(entity, data);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RoleAttribute> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_UPDATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAuBA,IAAaU,uBAAb,cAA0CJ,sBAAAA;CAC5BK;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMC,kBAAkB;GACpBb,eAAec;GACfd,eAAee;GACff,eAAegB;;EAGnB,MAAMJ,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAEzE,IAAIO,SAAS,MAAMjB,YAAYQ,OAAO;GAAEU,QAAQjB;GAAqBQ;EAAM,CAAA;EAK3E,MAAMU,WAAW,MAAMV,MAAMK,oBAAoBM,QAAQ,EAAEJ,MAAMN,gBAAgB,CAAA;EACjF,IAAIS,SAASE,YAAY,QAErBJ,SAASlB,sBAAsBkB,QAAQrB,QAAQ,MAAM,CAAA,CAAE,CAAA;OACpD,IAAIuB,SAASE,YAAY,eAC5BJ,SAASlB,sBAAsBkB,QAAQE,SAASG,SAAS;EAG7D,IAAIH,SAASE,YAAY,QACrB,OAAO,KAAKlB,WAAWoB,SAASN,MAAAA;EAGpC,MAAM,EACFO,MAAMC,UACNC,SACA,MAAM,KAAKvB,WAAWoB,SAASN,MAAAA;EAEnC,MAAMO,OAAwB,CAAA;EAC9B,IAAI,EAAEG,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UACjB,IAAI;GACA,MAAMhB,MAAMK,oBAAoBe,cAAc;IAC1Cb,MAAM;KACFnB,eAAec;KACfd,eAAee;KACff,eAAegB;;IAEnBW,MAAM/B,iBAAiB;MAAGD,kBAAkBsC,aAAaF;KAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;IAAQ,CAAA;GACxG,CAAA;GACAJ,KAAKQ,KAAKJ,MAAAA;EACd,QAAQ;GACJD;EACJ;EAGJ,OAAO;GACHH;GACAE,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,IACAzB,OACsB;EACtB,MAAMA,MAAMK,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFnB,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMe,SAAS,MAAM,KAAKzB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACN,QACD,MAAM,IAAIlC,oBAAAA;EAGd,MAAMe,MAAMK,oBAAoBe,cAAc;GAC1Cb,MAAM;IACFnB,eAAec;IACfd,eAAee;IACff,eAAegB;;GAEnBW,MAAM/B,iBAAiB;KAAGD,kBAAkBsC,aAAaF;IAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMQ,OACFZ,MACAf,OACsB;EACtB,MAAMA,MAAMK,oBAAoBuB,YAAY,EAAErB,MAAMnB,eAAee,YAAY,CAAA;EAE/E,MAAM,KAAKT,WAAWmC,oBAAoBd,IAAAA;EAE1C,IAAI,OAAOA,KAAKR,SAAS,YAAY,KAAKZ,cAAcmC,IAAIf,KAAKR,IAAI,GACjE,MAAM,IAAIrB,gBAAgB,4BAA4B6B,KAAKR,KAAK,sCAAsC;EAG1GQ,KAAKgB,UAAUhB,KAAKiB,KAAKD;EAEzB,MAAMZ,SAAS,KAAKzB,WAAWiC,OAAOZ,IAAAA;EAEtC,MAAMf,MAAMK,oBAAoB4B,SAAS;GACrC1B,MAAMnB,eAAee;GACrBY,MAAM/B,iBAAiB;KAClBD,kBAAkBsC,aAAa,GAAGN,KAAKR,OAAOQ,KAAKmB,MAAM;IAC1D,GAAG,KAAKZ,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKzB,WAAWyC,KAAKhB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMiB,OACFX,IACAV,MACAf,OACsB;EACtB,MAAMA,MAAMK,oBAAoBuB,YAAY,EAAErB,MAAMnB,eAAee,YAAY,CAAA;EAE/E,MAAM,KAAKT,WAAWmC,oBAAoBd,IAAAA;EAE1C,IAAI,OAAOA,KAAKR,SAAS,YAAY,KAAKZ,cAAcmC,IAAIf,KAAKR,IAAI,GACjE,MAAM,IAAIrB,gBAAgB,4BAA4B6B,KAAKR,KAAK,sCAAsC;EAG1G,IAAIY,SAAS,MAAM,KAAKzB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EAClD,IAAI,CAACN,QACD,MAAM,IAAIlC,oBAAAA;EAQd,OAAO8B,KAAKsB;EACZ,OAAOtB,KAAKiB;EACZ,OAAOjB,KAAKgB;EAEZZ,SAAS,KAAKzB,WAAW4C,MAAMnB,QAAQJ,IAAAA;EAEvC,MAAMf,MAAMK,oBAAoB4B,SAAS;GACrC1B,MAAMnB,eAAee;GACrBY,MAAM/B,iBAAiB;KAClBD,kBAAkBsC,aAAa,GAAGF,OAAOZ,OAAOY,OAAOe,MAAM;IAC9D,GAAG,KAAKZ,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKzB,WAAWyC,KAAKhB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMoB,OACFd,IACAzB,OACsB;EACtB,MAAMA,MAAMK,oBAAoBuB,YAAY,EAAErB,MAAMnB,eAAee,YAAY,CAAA;EAE/E,MAAMgB,SAAS,MAAM,KAAKzB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACN,QACD,MAAM,IAAIlC,oBAAAA;EAGd,MAAMe,MAAMK,oBAAoB4B,SAAS;GACrC1B,MAAMnB,eAAee;GACrBY,MAAM/B,iBAAiB;KAAGD,kBAAkBsC,aAAaF;IAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEM,IAAIe,aAAarB;EACzB,MAAM,KAAKzB,WAAW+C,OAAOtB,MAAAA;EAC7BA,OAAOM,KAAKe;EAEZ,OAAOrB;CACX;AACJ"}

package/dist/core/entities/role-permission/index.d.ts

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/role-permission/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role-permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role-permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/role-permission/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { rolePermissionSchema } from "./schema.mjs";
 import { RolePermissionService } from "./service.mjs";
-export { RolePermissionService };
+export { RolePermissionService, rolePermissionSchema };

package/dist/core/entities/role-permission/schema.d.ts

@@ -0,0 +1,3 @@
+import type { RolePermission } from '@authup/core-kit';
+export declare const rolePermissionSchema: import("@rapiq/core").Schema<RolePermission, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/role-permission/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role-permission/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAMvD,eAAO,MAAM,oBAAoB,mDAqB/B,CAAC"}

package/dist/core/entities/role-permission/schema.mjs

@@ -0,0 +1,41 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/role-permission/schema.ts
+const schemaMapping = {
+	role: EntityType.ROLE,
+	permission: EntityType.PERMISSION
+};
+const rolePermissionSchema = defineSchema({
+	name: EntityType.ROLE_PERMISSION,
+	fields: { default: [
+		"id",
+		"policyId",
+		"realmScope",
+		"permissionId",
+		"permissionRealmId",
+		"roleId",
+		"roleRealmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: ["roleId", "permissionId"] },
+	relations: {
+		allowed: ["role", "permission"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"id",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { rolePermissionSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/role-permission/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","role","ROLE","permission","PERMISSION","rolePermissionSchema","name","ROLE_PERMISSION","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/role-permission/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { RolePermission } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { role: EntityType.ROLE, permission: EntityType.PERMISSION };\n\nexport const rolePermissionSchema = defineSchema<RolePermission>({\n    name: EntityType.ROLE_PERMISSION,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'policyId',\n            'realmScope',\n            'permissionId',\n            'permissionRealmId',\n            'roleId',\n            'roleRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['roleId', 'permissionId'] },\n    relations: { allowed: ['role', 'permission'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,YAAYL,WAAWM;AAAW;AAEjF,MAAaC,uBAAuBR,aAA6B;CAC7DS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAEC,SAAS,CAAC,UAAU,cAAA,EAAgB;CAC/CC,WAAW;EAAED,SAAS,CAAC,QAAQ,YAAA;EAAeE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC/Fc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;GAAa;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/role-permission/service.d.ts

@@ -10,7 +10,7 @@ export type RolePermissionServiceContext = {
     identityPermissionProvider: IIdentityPermissionProvider;
 };
 export declare class RolePermissionService extends JunctionEntityService implements IRolePermissionService {
-    protected readonly ownerRealmKey = "role_realm_id";
+    protected readonly ownerRealmKey = "roleRealmId";
     protected repository: IRolePermissionRepository;
     protected permissionRepository: IEntityRepository<Permission>;
     protected identityPermissionProvider: IIdentityPermissionProvider;

package/dist/core/entities/role-permission/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role-permission/service.ts"],"names":[],"mappings":"AAcA,OAAO,EAEH,uBAAuB,EAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpF,MAAM,MAAM,4BAA4B,GAAG;IACvC,UAAU,EAAE,yBAAyB,CAAC;IACtC,oBAAoB,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACpD,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,qBAAsB,SAAQ,qBAAsB,YAAW,sBAAsB;IAC9F,SAAS,CAAC,QAAQ,CAAC,aAAa,mBAAmB;IAEnD,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAEhD,SAAS,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE9D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,uBAAuB,CAAC;gBAEjC,GAAG,EAAE,4BAA4B;IAQvC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,cAAc,CAAC,CAAC;IAWpD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAgBpB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IA+DpB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAoEpB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;CAsB7B"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role-permission/service.ts"],"names":[],"mappings":"AAcA,OAAO,EAEH,uBAAuB,EAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAIpF,MAAM,MAAM,4BAA4B,GAAG;IACvC,UAAU,EAAE,yBAAyB,CAAC;IACtC,oBAAoB,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACpD,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,qBAAsB,SAAQ,qBAAsB,YAAW,sBAAsB;IAC9F,SAAS,CAAC,QAAQ,CAAC,aAAa,iBAAiB;IAEjD,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAEhD,SAAS,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE9D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,uBAAuB,CAAC;gBAEjC,GAAG,EAAE,4BAA4B;IAQvC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,cAAc,CAAC,CAAC;IAWpD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAgBpB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IA+DpB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;IAoEpB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,cAAc,CAAC;CAsB7B"}

package/dist/core/entities/role-permission/service.mjs

@@ -1,6 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { rolePermissionSchema } from "./schema.mjs";
+import { decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { applyJunctionCreateGrant, buildJunctionUpdateData } from "../../identity/permission/junction-grant.mjs";
 import { ValidatorGroup } from "@authup/kit";
 import { PermissionName, RolePermissionValidator } from "@authup/core-kit";
@@ -9,7 +12,7 @@ import { BuiltInPolicyType, RealmScope, definePolicyData } from "@authup/access"
 import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/role-permission/service.ts
 var RolePermissionService = class extends JunctionEntityService {
-	ownerRealmKey = "role_realm_id";
+	ownerRealmKey = "roleRealmId";
 	repository;
 	permissionRepository;
 	identityPermissionProvider;
@@ -23,7 +26,10 @@ var RolePermissionService = class extends JunctionEntityService {
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.ROLE_PERMISSION_DELETE, PermissionName.ROLE_PERMISSION_READ] });
-		return this.repository.findMany(query);
+		return this.repository.findMany(await decodeQuery(query, {
+			schema: rolePermissionSchema,
+			actor
+		}));
 	}
 	async getOne(id, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.ROLE_PERMISSION_DELETE, PermissionName.ROLE_PERMISSION_READ] });
@@ -36,26 +42,26 @@ var RolePermissionService = class extends JunctionEntityService {
 		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
 		await this.repository.validateJoinColumns(validated);
 		if (await this.repository.findOneBy({
-			role_id: validated.role_id,
-			permission_id: validated.permission_id
+			roleId: validated.roleId,
+			permissionId: validated.permissionId
 		})) throw new EntityConflictError({ entity: "role-permission" });
 		if (validated.permission) {
-			validated.permission_realm_id = validated.permission.realm_id;
+			validated.permissionRealmId = validated.permission.realmId;
 			await actor.permissionEvaluator.preEvaluate({
 				name: validated.permission.name,
-				realmId: validated.permission.realm_id,
-				clientId: validated.permission.client_id
+				realmId: validated.permission.realmId,
+				clientId: validated.permission.clientId
 			});
 		}
-		if (validated.role) validated.role_realm_id = validated.role.realm_id;
+		if (validated.role) validated.roleRealmId = validated.role.realmId;
 		if (validated.permission && actor.identity) applyJunctionCreateGrant(validated, await this.identityPermissionProvider.resolveJunctionGrant({
 			type: actor.identity.type,
 			id: actor.identity.data.id
 		}, {
 			name: validated.permission.name,
-			realmId: validated.permission.realm_id,
-			clientId: validated.permission.client_id,
-			realmScope: validated.realm_scope ?? RealmScope.OWN
+			realmId: validated.permission.realmId,
+			clientId: validated.permission.clientId,
+			realmScope: validated.realmScope ?? RealmScope.OWN
 		}));
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.ROLE_PERMISSION_CREATE,
@@ -73,11 +79,11 @@ var RolePermissionService = class extends JunctionEntityService {
 		const entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
 		const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });
-		const permission = await this.permissionRepository.findOneById(entity.permission_id);
+		const permission = await this.permissionRepository.findOneById(entity.permissionId);
 		if (permission) await actor.permissionEvaluator.preEvaluate({
 			name: permission.name,
-			realmId: permission.realm_id,
-			clientId: permission.client_id
+			realmId: permission.realmId,
+			clientId: permission.clientId
 		});
 		let actorScope = RealmScope.ANY;
 		let actorPolicyFree = true;
@@ -88,9 +94,9 @@ var RolePermissionService = class extends JunctionEntityService {
 				id: actor.identity.data.id
 			}, {
 				name: permission.name,
-				realmId: permission.realm_id,
-				clientId: permission.client_id,
-				realmScope: validated.realm_scope ?? entity.realm_scope
+				realmId: permission.realmId,
+				clientId: permission.clientId,
+				realmScope: validated.realmScope ?? entity.realmScope
 			});
 			actorScope = grant.realmScope;
 			actorPolicyFree = !grant.policy;
@@ -98,7 +104,7 @@ var RolePermissionService = class extends JunctionEntityService {
 		} else if (actor.identity) actorScope = RealmScope.OWN;
 		const updateData = buildJunctionUpdateData({
 			data: validated,
-			existingScope: entity.realm_scope,
+			existingScope: entity.realmScope,
 			actorScope,
 			actorPolicyFree,
 			actorPolicyId

package/dist/core/entities/role-permission/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","RolePermissionValidator","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","RolePermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","ROLE_PERMISSION_DELETE","ROLE_PERMISSION_READ","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","ROLE_PERMISSION_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","role_id","permission_id","permission","permission_realm_id","realm_id","realmId","clientId","client_id","role","role_realm_id","identity","grant","resolveJunctionGrant","type","realmScope","realm_scope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","ROLE_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/role-permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    BuiltInPolicyType,\n    RealmScope,\n    definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport {\n    PermissionName,\n    RolePermissionValidator,\n} from '@authup/core-kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IRolePermissionRepository, IRolePermissionService } from './types.ts';\n\nexport type RolePermissionServiceContext = {\n    repository: IRolePermissionRepository;\n    permissionRepository: IEntityRepository<Permission>;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class RolePermissionService extends JunctionEntityService implements IRolePermissionService {\n    protected readonly ownerRealmKey = 'role_realm_id';\n\n    protected repository: IRolePermissionRepository;\n\n    protected permissionRepository: IEntityRepository<Permission>;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: RolePermissionValidator;\n\n    constructor(ctx: RolePermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.permissionRepository = ctx.permissionRepository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new RolePermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<RolePermission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_PERMISSION_DELETE,\n                PermissionName.ROLE_PERMISSION_READ,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_PERMISSION_DELETE,\n                PermissionName.ROLE_PERMISSION_READ,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            role_id: validated.role_id,\n            permission_id: validated.permission_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'role-permission' });\n        }\n\n        if (validated.permission) {\n            validated.permission_realm_id = validated.permission.realm_id;\n\n            // Q4: the superset gate runs uniformly — no ROLE_ADMIN_NAME bypass.\n            await actor.permissionEvaluator.preEvaluate({\n                name: validated.permission.name,\n                realmId: validated.permission.realm_id,\n                clientId: validated.permission.client_id,\n            });\n        }\n\n        if (validated.role) {\n            validated.role_realm_id = validated.role.realm_id;\n        }\n\n        if (validated.permission && actor.identity) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    name: validated.permission.name,\n                    realmId: validated.permission.realm_id,\n                    clientId: validated.permission.client_id,\n                    realmScope: validated.realm_scope ?? RealmScope.OWN,\n                },\n            );\n\n            applyJunctionCreateGrant(validated, grant);\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_PERMISSION_CREATE,\n            // Stamp the owner (role) realm as the canonical `realm_id` so the realm_scope\n            // factor gates this junction write against the actor's reach (no cross-realm).\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        // Resolve the actor's grant for this junction's permission (the existing entity only\n        // carries scalar FKs — load the permission relation to derive it).\n        const permission = await this.permissionRepository.findOneById(entity.permission_id);\n        if (permission) {\n            // Member-permission gate: an actor may only modify a binding for a permission it\n            // holds (mirrors create()).\n            await actor.permissionEvaluator.preEvaluate({\n                name: permission.name,\n                realmId: permission.realm_id,\n                clientId: permission.client_id,\n            });\n        }\n\n        // No actor identity (system context) is not realm-gated here; the operation is still\n        // authorized by the evaluate() below.\n        let actorScope: `${RealmScope}` = RealmScope.ANY;\n        let actorPolicyFree = true;\n        let actorPolicyId: string | null = null;\n        if (actor.identity && permission) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                { type: actor.identity.type, id: actor.identity.data.id },\n                {\n                    name: permission.name,\n                    realmId: permission.realm_id,\n                    clientId: permission.client_id,\n                    realmScope: validated.realm_scope ?? entity.realm_scope,\n                },\n            );\n            actorScope = grant.realmScope;\n            actorPolicyFree = !grant.policy;\n            actorPolicyId = grant.policy ? grant.policy.id : null;\n        } else if (actor.identity) {\n            actorScope = RealmScope.OWN;\n        }\n\n        const updateData = buildJunctionUpdateData({\n            data: validated,\n            existingScope: entity.realm_scope,\n            actorScope,\n            actorPolicyFree,\n            actorPolicyId,\n        });\n\n        await this.repository.validateJoinColumns(updateData);\n\n        const merged = this.repository.merge(entity, updateData);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n            }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_PERMISSION_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;AA+BA,IAAaW,wBAAb,cAA2CD,sBAAAA;CACpBE,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIT,wBAAAA;CACzB;CAEA,MAAMW,QACFC,OACAC,OACuD;EACvD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFjB,eAAekB,wBACflB,eAAemB,oBAAAA,EAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASP,KAAAA;CACpC;CAEA,MAAMQ,OACFC,IACAR,OACuB;EACvB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFjB,eAAekB,wBACflB,eAAemB,oBAAAA,EAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIzB,oBAAAA;EAGd,OAAOyB;CACX;CAEA,MAAME,OACFC,MACAZ,OACuB;EACvB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMjB,eAAe4B,uBAAuB,CAAA;EAE1F,MAAMC,YAAY,MAAM,KAAKnB,UAAUoB,IAAIJ,MAAM,EAAEK,OAAOhC,eAAeiC,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWiB,UAAU;GAC7CW,SAASN,UAAUM;GACnBC,eAAeP,UAAUO;EAC7B,CAAA,GAEI,MAAM,IAAIvC,oBAAoB,EAAE0B,QAAQ,kBAAkB,CAAA;EAG9D,IAAIM,UAAUQ,YAAY;GACtBR,UAAUS,sBAAsBT,UAAUQ,WAAWE;GAGrD,MAAMzB,MAAMC,oBAAoBY,YAAY;IACxCV,MAAMY,UAAUQ,WAAWpB;IAC3BuB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWK;GACnC,CAAA;EACJ;EAEA,IAAIb,UAAUc,MACVd,UAAUe,gBAAgBf,UAAUc,KAAKJ;EAG7C,IAAIV,UAAUQ,cAAcvB,MAAM+B,UAc9B3C,yBAAyB2B,WAAWiB,MAbhB,KAAKrC,2BAA2BsC,qBAChD;GACIC,MAAMlC,MAAM+B,SAASG;GACrB1B,IAAIR,MAAM+B,SAASnB,KAAKJ;EAC5B,GACA;GACIL,MAAMY,UAAUQ,WAAWpB;GAC3BuB,SAASX,UAAUQ,WAAWE;GAC9BE,UAAUZ,UAAUQ,WAAWK;GAC/BO,YAAYpB,UAAUqB,eAAevD,WAAWwD;EACpD,CAAA,CAGgCL;EAGxC,MAAMhC,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAe4B;GAGrBF,MAAM9B,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBzB,SAAAA;KACvDnC,kBAAkB6D,cAAc,KAAKC,sBAAsB3B,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKhB,WAAWkB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKhB,WAAWkD,KAAKlC,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMmC,OACFpC,IACAI,MACAZ,OACuB;EACvB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMjB,eAAe2D,uBAAuB,CAAA;EAE1F,MAAMpC,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAM+B,YAAY,MAAM,KAAKnB,UAAUoB,IAAIJ,MAAM,EAAEK,OAAOhC,eAAe6D,OAAO,CAAA;EAIhF,MAAMvB,aAAa,MAAM,KAAK7B,qBAAqBqD,YAAYtC,OAAOa,aAAa;EACnF,IAAIC,YAGA,MAAMvB,MAAMC,oBAAoBY,YAAY;GACxCV,MAAMoB,WAAWpB;GACjBuB,SAASH,WAAWE;GACpBE,UAAUJ,WAAWK;EACzB,CAAA;EAKJ,IAAIoB,aAA8BnE,WAAWoE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAInD,MAAM+B,YAAYR,YAAY;GAC9B,MAAMS,QAAQ,MAAM,KAAKrC,2BAA2BsC,qBAChD;IAAEC,MAAMlC,MAAM+B,SAASG;IAAM1B,IAAIR,MAAM+B,SAASnB,KAAKJ;GAAG,GACxD;IACIL,MAAMoB,WAAWpB;IACjBuB,SAASH,WAAWE;IACpBE,UAAUJ,WAAWK;IACrBO,YAAYpB,UAAUqB,eAAe3B,OAAO2B;GAChD,CAAA;GAEJY,aAAahB,MAAMG;GACnBe,kBAAkB,CAAClB,MAAMoB;GACzBD,gBAAgBnB,MAAMoB,SAASpB,MAAMoB,OAAO5C,KAAK;EACrD,OAAO,IAAIR,MAAM+B,UACbiB,aAAanE,WAAWwD;EAG5B,MAAMgB,aAAahE,wBAAwB;GACvCuB,MAAMG;GACNuC,eAAe7C,OAAO2B;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAK1D,WAAW0B,oBAAoBkC,UAAAA;EAE1C,MAAME,SAAS,KAAK9D,WAAW+D,MAAM/C,QAAQ4C,UAAAA;EAE7C,MAAMrD,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAe2D;GACrBjC,MAAM9B,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBe,MAAAA;KACvD3E,kBAAkB6D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK9D,WAAWkD,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACFjD,IACAR,OACuB;EACvB,MAAMA,MAAMC,oBAAoBY,YAAY,EAAEV,MAAMjB,eAAekB,uBAAuB,CAAA;EAE1F,MAAMK,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIzB,oBAAAA;EAGd,MAAMgB,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAekB;GACrBQ,MAAM9B,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmB/B,MAAAA;KACvD7B,kBAAkB6D,cAAc,KAAKC,sBAAsBjC,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIkD,aAAajD;EACzB,MAAM,KAAKhB,WAAWkE,OAAOlD,MAAAA;EAC7BA,OAAOD,KAAKkD;EAEZ,OAAOjD;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","RolePermissionValidator","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","decodeQuery","rolePermissionSchema","RolePermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","ROLE_PERMISSION_DELETE","ROLE_PERMISSION_READ","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","ROLE_PERMISSION_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","roleId","permissionId","permission","permissionRealmId","realmId","clientId","role","roleRealmId","identity","grant","resolveJunctionGrant","type","realmScope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","ROLE_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/role-permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    BuiltInPolicyType,\n    RealmScope,\n    definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport {\n    PermissionName,\n    RolePermissionValidator,\n} from '@authup/core-kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IRolePermissionRepository, IRolePermissionService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { rolePermissionSchema } from './schema.ts';\n\nexport type RolePermissionServiceContext = {\n    repository: IRolePermissionRepository;\n    permissionRepository: IEntityRepository<Permission>;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class RolePermissionService extends JunctionEntityService implements IRolePermissionService {\n    protected readonly ownerRealmKey = 'roleRealmId';\n\n    protected repository: IRolePermissionRepository;\n\n    protected permissionRepository: IEntityRepository<Permission>;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: RolePermissionValidator;\n\n    constructor(ctx: RolePermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.permissionRepository = ctx.permissionRepository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new RolePermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<RolePermission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_PERMISSION_DELETE,\n                PermissionName.ROLE_PERMISSION_READ,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: rolePermissionSchema, actor }));\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_PERMISSION_DELETE,\n                PermissionName.ROLE_PERMISSION_READ,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            roleId: validated.roleId,\n            permissionId: validated.permissionId,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'role-permission' });\n        }\n\n        if (validated.permission) {\n            validated.permissionRealmId = validated.permission.realmId;\n\n            // Q4: the superset gate runs uniformly — no ROLE_ADMIN_NAME bypass.\n            await actor.permissionEvaluator.preEvaluate({\n                name: validated.permission.name,\n                realmId: validated.permission.realmId,\n                clientId: validated.permission.clientId,\n            });\n        }\n\n        if (validated.role) {\n            validated.roleRealmId = validated.role.realmId;\n        }\n\n        if (validated.permission && actor.identity) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    name: validated.permission.name,\n                    realmId: validated.permission.realmId,\n                    clientId: validated.permission.clientId,\n                    realmScope: validated.realmScope ?? RealmScope.OWN,\n                },\n            );\n\n            applyJunctionCreateGrant(validated, grant);\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_PERMISSION_CREATE,\n            // Stamp the owner (role) realm as the canonical `realmId` so the realmScope\n            // factor gates this junction write against the actor's reach (no cross-realm).\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        // Resolve the actor's grant for this junction's permission (the existing entity only\n        // carries scalar FKs — load the permission relation to derive it).\n        const permission = await this.permissionRepository.findOneById(entity.permissionId);\n        if (permission) {\n            // Member-permission gate: an actor may only modify a binding for a permission it\n            // holds (mirrors create()).\n            await actor.permissionEvaluator.preEvaluate({\n                name: permission.name,\n                realmId: permission.realmId,\n                clientId: permission.clientId,\n            });\n        }\n\n        // No actor identity (system context) is not realm-gated here; the operation is still\n        // authorized by the evaluate() below.\n        let actorScope: `${RealmScope}` = RealmScope.ANY;\n        let actorPolicyFree = true;\n        let actorPolicyId: string | null = null;\n        if (actor.identity && permission) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                { type: actor.identity.type, id: actor.identity.data.id },\n                {\n                    name: permission.name,\n                    realmId: permission.realmId,\n                    clientId: permission.clientId,\n                    realmScope: validated.realmScope ?? entity.realmScope,\n                },\n            );\n            actorScope = grant.realmScope;\n            actorPolicyFree = !grant.policy;\n            actorPolicyId = grant.policy ? grant.policy.id : null;\n        } else if (actor.identity) {\n            actorScope = RealmScope.OWN;\n        }\n\n        const updateData = buildJunctionUpdateData({\n            data: validated,\n            existingScope: entity.realmScope,\n            actorScope,\n            actorPolicyFree,\n            actorPolicyId,\n        });\n\n        await this.repository.validateJoinColumns(updateData);\n\n        const merged = this.repository.merge(entity, updateData);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n            }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_PERMISSION_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAiCA,IAAaa,wBAAb,cAA2CH,sBAAAA;CACpBI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIX,wBAAAA;CACzB;CAEA,MAAMa,QACFC,OACAC,OACuD;EACvD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFnB,eAAeoB,wBACfpB,eAAeqB,oBAAAA,EAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYU,OAAO;GAAEQ,QAAQjB;GAAsBU;EAAM,CAAA,CAAA;CACnG;CAEA,MAAMQ,OACFC,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFnB,eAAeoB,wBACfpB,eAAeqB,oBAAAA,EAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,OAAO4B;CACX;CAEA,MAAME,OACFC,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMnB,eAAe+B,uBAAuB,CAAA;EAE1F,MAAMC,YAAY,MAAM,KAAKpB,UAAUqB,IAAIJ,MAAM,EAAEK,OAAOnC,eAAeoC,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,QAAQN,UAAUM;GAClBC,cAAcP,UAAUO;EAC5B,CAAA,GAEI,MAAM,IAAI1C,oBAAoB,EAAE6B,QAAQ,kBAAkB,CAAA;EAG9D,IAAIM,UAAUQ,YAAY;GACtBR,UAAUS,oBAAoBT,UAAUQ,WAAWE;GAGnD,MAAM1B,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMa,UAAUQ,WAAWrB;IAC3BuB,SAASV,UAAUQ,WAAWE;IAC9BC,UAAUX,UAAUQ,WAAWG;GACnC,CAAA;EACJ;EAEA,IAAIX,UAAUY,MACVZ,UAAUa,cAAcb,UAAUY,KAAKF;EAG3C,IAAIV,UAAUQ,cAAcxB,MAAM8B,UAc9B5C,yBAAyB8B,WAAWe,MAbhB,KAAKpC,2BAA2BqC,qBAChD;GACIC,MAAMjC,MAAM8B,SAASG;GACrBxB,IAAIT,MAAM8B,SAASjB,KAAKJ;EAC5B,GACA;GACIN,MAAMa,UAAUQ,WAAWrB;GAC3BuB,SAASV,UAAUQ,WAAWE;GAC9BC,UAAUX,UAAUQ,WAAWG;GAC/BO,YAAYlB,UAAUkB,cAAcvD,WAAWwD;EACnD,CAAA,CAGgCJ;EAGxC,MAAM/B,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAe+B;GAGrBF,MAAMjC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBtB,SAAAA;KACvDtC,kBAAkB6D,cAAc,KAAKC,sBAAsBxB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAWgD,KAAK/B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMgC,OACFjC,IACAI,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMnB,eAAe2D,uBAAuB,CAAA;EAE1F,MAAMjC,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMkC,YAAY,MAAM,KAAKpB,UAAUqB,IAAIJ,MAAM,EAAEK,OAAOnC,eAAe6D,OAAO,CAAA;EAIhF,MAAMpB,aAAa,MAAM,KAAK9B,qBAAqBmD,YAAYnC,OAAOa,YAAY;EAClF,IAAIC,YAGA,MAAMxB,MAAMC,oBAAoBa,YAAY;GACxCX,MAAMqB,WAAWrB;GACjBuB,SAASF,WAAWE;GACpBC,UAAUH,WAAWG;EACzB,CAAA;EAKJ,IAAImB,aAA8BnE,WAAWoE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAIjD,MAAM8B,YAAYN,YAAY;GAC9B,MAAMO,QAAQ,MAAM,KAAKpC,2BAA2BqC,qBAChD;IAAEC,MAAMjC,MAAM8B,SAASG;IAAMxB,IAAIT,MAAM8B,SAASjB,KAAKJ;GAAG,GACxD;IACIN,MAAMqB,WAAWrB;IACjBuB,SAASF,WAAWE;IACpBC,UAAUH,WAAWG;IACrBO,YAAYlB,UAAUkB,cAAcxB,OAAOwB;GAC/C,CAAA;GAEJY,aAAaf,MAAMG;GACnBc,kBAAkB,CAACjB,MAAMmB;GACzBD,gBAAgBlB,MAAMmB,SAASnB,MAAMmB,OAAOzC,KAAK;EACrD,OAAO,IAAIT,MAAM8B,UACbgB,aAAanE,WAAWwD;EAG5B,MAAMgB,aAAahE,wBAAwB;GACvC0B,MAAMG;GACNoC,eAAe1C,OAAOwB;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAKxD,WAAW2B,oBAAoB+B,UAAAA;EAE1C,MAAME,SAAS,KAAK5D,WAAW6D,MAAM5C,QAAQyC,UAAAA;EAE7C,MAAMnD,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAe2D;GACrB9B,MAAMjC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBe,MAAAA;KACvD3E,kBAAkB6D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK5D,WAAWgD,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACF9C,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMnB,eAAeoB,uBAAuB,CAAA;EAE1F,MAAMM,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAeoB;GACrBS,MAAMjC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmB5B,MAAAA;KACvDhC,kBAAkB6D,cAAc,KAAKC,sBAAsB9B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI+C,aAAa9C;EACzB,MAAM,KAAKjB,WAAWgE,OAAO/C,MAAAA;EAC7BA,OAAOD,KAAK+C;EAEZ,OAAO9C;CACX;AACJ"}

package/dist/core/entities/scope/index.d.ts

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/scope/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/scope/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/scope/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/scope/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { scopeSchema } from "./schema.mjs";
 import { ScopeService } from "./service.mjs";
-export { ScopeService };
+export { ScopeService, scopeSchema };

package/dist/core/entities/scope/schema.d.ts

@@ -0,0 +1,3 @@
+import type { Scope } from '@authup/core-kit';
+export declare const scopeSchema: import("@rapiq/core").Schema<Scope, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/scope/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/scope/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAM9C,eAAO,MAAM,WAAW,0CAmBtB,CAAC"}

package/dist/core/entities/scope/schema.mjs

@@ -0,0 +1,43 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/scope/schema.ts
+const schemaMapping = { realm: EntityType.REALM };
+const scopeSchema = defineSchema({
+	name: EntityType.SCOPE,
+	fields: { allowed: [
+		"id",
+		"builtIn",
+		"name",
+		"displayName",
+		"description",
+		"realmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: [
+		"id",
+		"builtIn",
+		"name",
+		"realmId"
+	] },
+	relations: {
+		allowed: ["realm"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"id",
+		"name",
+		"updatedAt",
+		"createdAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { scopeSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/scope/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","scopeSchema","name","SCOPE","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/scope/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Scope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const scopeSchema = defineSchema<Scope>({\n    name: EntityType.SCOPE,\n    fields: {\n        allowed: [\n            'id',\n            'builtIn',\n            'name',\n            'displayName',\n            'description',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'builtIn', 'name', 'realmId'] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'name', 'updatedAt', 'createdAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,cAAcN,aAAoB;CAC3CO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAW;EAAQ;GAAW;CACzDE,WAAW;EAAEF,SAAS,CAAC,OAAA;EAAUG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAa;GAAa;CAC1DK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}

package/dist/core/entities/scope/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/scope/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAEH,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC;gBAExB,GAAG,EAAE,mBAAmB;IAO9B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAY3C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAiBX,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAmFI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;CAmBpB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/scope/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAEH,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIlE,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC;gBAExB,GAAG,EAAE,mBAAmB;IAO9B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAY3C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAiBX,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAmFI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;CAmBpB"}

package/dist/core/entities/scope/service.mjs

@@ -1,6 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { scopeSchema } from "./schema.mjs";
+import { decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { ValidatorGroup, isPropertySet, isUUID } from "@authup/kit";
 import { PermissionName, ScopeValidator } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
@@ -23,7 +26,10 @@ var ScopeService = class extends AbstractEntityService {
 			PermissionName.SCOPE_UPDATE,
 			PermissionName.SCOPE_DELETE
 		] });
-		return this.repository.findMany(query);
+		return this.repository.findMany(await decodeQuery(query, {
+			schema: scopeSchema,
+			actor
+		}));
 	}
 	async getOne(idOrName, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -45,13 +51,13 @@ var ScopeService = class extends AbstractEntityService {
 	}
 	async save(idOrName, data, actor, options = {}) {
 		let group;
-		const realm = typeof data.realm_id === "string" ? await this.realmRepository.resolve(data.realm_id) : void 0;
+		const realm = typeof data.realmId === "string" ? await this.realmRepository.resolve(data.realmId) : void 0;
 		let entity;
 		if (idOrName) {
 			const where = {};
 			if (isUUID(idOrName)) where.id = idOrName;
 			else where.name = idOrName;
-			if (realm) where.realm_id = realm.id;
+			if (realm) where.realmId = realm.id;
 			entity = await this.repository.findOneBy(where);
 			if (!entity && options.updateOnly) throw new EntityNotFoundError();
 		} else if (options.updateOnly) throw new EntityNotFoundError();
@@ -72,7 +78,7 @@ var ScopeService = class extends AbstractEntityService {
 						...entity,
 						...validated
 					},
-					[BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null
+					[BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null
 				})
 			});
 			await this.repository.checkUniqueness(validated, entity);
@@ -83,7 +89,7 @@ var ScopeService = class extends AbstractEntityService {
 				created: false
 			};
 		}
-		if (!isPropertySet(validated, "realm_id") && actor.identity) validated.realm_id = this.getActorRealmId(actor) || null;
+		if (!isPropertySet(validated, "realmId") && actor.identity) validated.realmId = this.getActorRealmId(actor) || null;
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.SCOPE_CREATE,
 			data: definePolicyData({