@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/entities/scope/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","PermissionName","ScopeValidator","AbstractEntityService","ScopeService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","SCOPE_READ","SCOPE_UPDATE","SCOPE_DELETE","findMany","getOne","idOrName","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","id","findOneBy","preEvaluate","UPDATE","SCOPE_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","merge","created","identity","getActorRealmId","resourceRealmMatch","delete","entityId","remove"],"sources":["../../../../src/core/entities/scope/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    ScopeValidator,\n} from '@authup/core-kit';\nimport type { Scope } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IScopeRepository, IScopeService } from './types.ts';\n\nexport type ScopeServiceContext = {\n    repository: IScopeRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ScopeService extends AbstractEntityService implements IScopeService {\n    protected repository: IScopeRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ScopeValidator;\n\n    constructor(ctx: ScopeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ScopeValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Scope>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.SCOPE_READ,\n                PermissionName.SCOPE_UPDATE,\n                PermissionName.SCOPE_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.SCOPE_READ,\n                PermissionName.SCOPE_UPDATE,\n                PermissionName.SCOPE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Scope,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realm_id === 'string' ?\n            await this.realmRepository.resolve(data.realm_id) :\n            undefined;\n\n        let entity: Scope | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realm_id = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SCOPE_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realm_id') && actor.identity) {\n            validated.realm_id = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.SCOPE_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.SCOPE_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAyBA,IAAaS,eAAb,cAAkCD,sBAAAA;CACpBE;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIL,eAAAA;CACzB;CAEA,MAAMO,QACFC,OACAC,OAC8C;EAC9C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,UACAT,OACc;EACd,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIrB,oBAAAA;EAGd,OAAOqB;CACX;CAEA,MAAME,OACFC,MACAb,OACc;EACd,MAAM,EAAEU,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMb,KAAAA;EACpD,OAAOU;CACX;CAEA,MAAMM,OACFP,UACAI,MACAb,OACc;EACd,MAAM,EAAEU,WAAW,MAAM,KAAKI,KAAKL,UAAUI,MAAMb,OAAO,EAAEiB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFL,UACAI,MACAb,OACAkB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOP,KAAKQ,aAAa,WACnC,MAAM,KAAK1B,gBAAgB2B,QAAQT,KAAKQ,QAAQ,IAChDN,KAAAA;EAEJ,IAAIL;EACJ,IAAID,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAInC,OAAOqB,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMpB,OAAOM;GAGjB,IAAIW,OACAG,MAAMF,WAAWD,MAAMI;GAG3Bd,SAAS,MAAM,KAAKhB,WAAW+B,UAAUF,KAAAA;GACzC,IAAI,CAACb,UAAUQ,QAAQD,YACnB,MAAM,IAAI5B,oBAAAA;EAElB,OAAO,IAAI6B,QAAQD,YACf,MAAM,IAAI5B,oBAAAA;EAGd,IAAIqB,QAAQ;GACR,MAAMV,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,aAAa,CAAA;GAChFc,QAAQjC,eAAeyC;EAC3B,OAAO;GACH,MAAM3B,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAesC,aAAa,CAAA;GAChFT,QAAQjC,eAAe2C;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKlC,UAAUmC,IAAIlB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAKzB,WAAWsC,oBAAoBF,SAAAA;EAE1C,IAAIpB,QAAQ;GACR,MAAMV,MAAMC,oBAAoBgC,SAAS;IACrC9B,MAAMb,eAAee;IACrBQ,MAAM5B,iBAAiB;MAClBD,kBAAkBkD,aAAa;MAC5B,GAAGxB;MACH,GAAGoB;KACP;MACC9C,kBAAkBmD,cAAcL,UAAUT,YAAYX,OAAOW,YAAY;IAC9E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK3B,WAAW0C,gBAAgBN,WAAWpB,MAAAA;GAEjDA,SAAS,KAAKhB,WAAW2C,MAAM3B,QAAQoB,SAAAA;GACvC,MAAM,KAAKpC,WAAWoB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA4B,SAAS;GACb;EACJ;EAEA,IAAI,CAACnD,cAAc2C,WAAW,UAAA,KAAe9B,MAAMuC,UAC/CT,UAAUT,WAAW,KAAKmB,gBAAgBxC,KAAAA,KAAU;EAGxD,MAAMA,MAAMC,oBAAoBgC,SAAS;GACrC9B,MAAMb,eAAesC;GACrBf,MAAM5B,iBAAiB;KAAGD,kBAAkBkD,aAAaJ;IAAW,GAAG,KAAKW,mBAAmBX,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKpC,WAAW0C,gBAAgBN,SAAAA;EAEtCpB,SAAS,KAAKhB,WAAWkB,OAAOkB,SAAAA;EAChC,MAAM,KAAKpC,WAAWoB,KAAKJ,MAAAA;EAE3B,OAAO;GACHA;GACA4B,SAAS;EACb;CACJ;CAEA,MAAMI,OACFlB,IACAxB,OACc;EACd,MAAMA,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAegB,aAAa,CAAA;EAEhF,MAAMI,SAAS,MAAM,KAAKhB,WAAW+B,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAIrB,oBAAAA;EAGd,MAAMW,MAAMC,oBAAoBgC,SAAS;GACrC9B,MAAMb,eAAegB;GACrBO,MAAM5B,iBAAiB;KAAGD,kBAAkBkD,aAAaxB;IAAQ,GAAG,KAAK+B,mBAAmB/B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAImB,aAAajC;EACzB,MAAM,KAAKhB,WAAWkD,OAAOlC,MAAAA;EAC7BA,OAAOc,KAAKmB;EAEZ,OAAOjC;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","PermissionName","ScopeValidator","AbstractEntityService","decodeQuery","scopeSchema","ScopeService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","SCOPE_READ","SCOPE_UPDATE","SCOPE_DELETE","findMany","schema","getOne","idOrName","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","SCOPE_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","merge","created","identity","getActorRealmId","resourceRealmMatch","delete","entityId","remove"],"sources":["../../../../src/core/entities/scope/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    ScopeValidator,\n} from '@authup/core-kit';\nimport type { Scope } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IScopeRepository, IScopeService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { scopeSchema } from './schema.ts';\n\nexport type ScopeServiceContext = {\n    repository: IScopeRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ScopeService extends AbstractEntityService implements IScopeService {\n    protected repository: IScopeRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ScopeValidator;\n\n    constructor(ctx: ScopeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ScopeValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Scope>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.SCOPE_READ,\n                PermissionName.SCOPE_UPDATE,\n                PermissionName.SCOPE_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: scopeSchema, actor }));\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.SCOPE_READ,\n                PermissionName.SCOPE_UPDATE,\n                PermissionName.SCOPE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Scope,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Scope | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SCOPE_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realmId') && actor.identity) {\n            validated.realmId = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.SCOPE_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.SCOPE_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA2BA,IAAaW,eAAb,cAAkCH,sBAAAA;CACpBI;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,eAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC8C;EAC9C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMhB,YAAYQ,OAAO;GAAES,QAAQhB;GAAaQ;EAAM,CAAA,CAAA;CAC1F;CAEA,MAAMS,OACFC,UACAV,OACc;EACd,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIxB,oBAAAA;EAGd,OAAOwB;CACX;CAEA,MAAME,OACFC,MACAd,OACc;EACd,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMd,KAAAA;EACpD,OAAOW;CACX;CAEA,MAAMM,OACFP,UACAI,MACAd,OACc;EACd,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKL,UAAUI,MAAMd,OAAO,EAAEkB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFL,UACAI,MACAd,OACAmB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOP,KAAKQ,YAAY,WAClC,MAAM,KAAK3B,gBAAgB4B,QAAQT,KAAKQ,OAAO,IAC/CN,KAAAA;EAEJ,IAAIL;EACJ,IAAID,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAItC,OAAOwB,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMrB,OAAOO;GAGjB,IAAIW,OACAG,MAAMF,UAAUD,MAAMI;GAG1Bd,SAAS,MAAM,KAAKjB,WAAWgC,UAAUF,KAAAA;GACzC,IAAI,CAACb,UAAUQ,QAAQD,YACnB,MAAM,IAAI/B,oBAAAA;EAElB,OAAO,IAAIgC,QAAQD,YACf,MAAM,IAAI/B,oBAAAA;EAGd,IAAIwB,QAAQ;GACR,MAAMX,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMf,eAAeiB,aAAa,CAAA;GAChFe,QAAQpC,eAAe4C;EAC3B,OAAO;GACH,MAAM5B,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMf,eAAeyC,aAAa,CAAA;GAChFT,QAAQpC,eAAe8C;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKnC,UAAUoC,IAAIlB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK1B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIpB,QAAQ;GACR,MAAMX,MAAMC,oBAAoBiC,SAAS;IACrC/B,MAAMf,eAAeiB;IACrBS,MAAM/B,iBAAiB;MAClBD,kBAAkBqD,aAAa;MAC5B,GAAGxB;MACH,GAAGoB;KACP;MACCjD,kBAAkBsD,cAAcL,UAAUT,WAAWX,OAAOW,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK5B,WAAW2C,gBAAgBN,WAAWpB,MAAAA;GAEjDA,SAAS,KAAKjB,WAAW4C,MAAM3B,QAAQoB,SAAAA;GACvC,MAAM,KAAKrC,WAAWqB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA4B,SAAS;GACb;EACJ;EAEA,IAAI,CAACtD,cAAc8C,WAAW,SAAA,KAAc/B,MAAMwC,UAC9CT,UAAUT,UAAU,KAAKmB,gBAAgBzC,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMf,eAAeyC;GACrBf,MAAM/B,iBAAiB;KAAGD,kBAAkBqD,aAAaJ;IAAW,GAAG,KAAKW,mBAAmBX,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW2C,gBAAgBN,SAAAA;EAEtCpB,SAAS,KAAKjB,WAAWmB,OAAOkB,SAAAA;EAChC,MAAM,KAAKrC,WAAWqB,KAAKJ,MAAAA;EAE3B,OAAO;GACHA;GACA4B,SAAS;EACb;CACJ;CAEA,MAAMI,OACFlB,IACAzB,OACc;EACd,MAAMA,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMf,eAAekB,aAAa,CAAA;EAEhF,MAAMK,SAAS,MAAM,KAAKjB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAIxB,oBAAAA;EAGd,MAAMa,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMf,eAAekB;GACrBQ,MAAM/B,iBAAiB;KAAGD,kBAAkBqD,aAAaxB;IAAQ,GAAG,KAAK+B,mBAAmB/B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAImB,aAAajC;EACzB,MAAM,KAAKjB,WAAWmD,OAAOlC,MAAAA;EAC7BA,OAAOc,KAAKmB;EAEZ,OAAOjC;CACX;AACJ"}

package/dist/core/entities/session/index.d.ts

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/session/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/session/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { sessionSchema } from "./schema.mjs";
 import { SessionService } from "./service.mjs";
-export { SessionService };
+export { SessionService, sessionSchema };

package/dist/core/entities/session/schema.d.ts

@@ -0,0 +1,3 @@
+import type { Session } from '@authup/core-kit';
+export declare const sessionSchema: import("@rapiq/core").Schema<Session, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/session/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAOhD,eAAO,MAAM,aAAa,4CAwBxB,CAAC"}

package/dist/core/entities/session/schema.mjs

@@ -0,0 +1,44 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SESSION_FILTER_KEYS } from "../../authentication/session/types.mjs";
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/session/schema.ts
+const schemaMapping = { realm: EntityType.REALM };
+const sessionSchema = defineSchema({
+	name: EntityType.SESSION,
+	fields: { allowed: [
+		"id",
+		"sub",
+		"subKind",
+		"ipAddress",
+		"userAgent",
+		"expiresAt",
+		"refreshedAt",
+		"seenAt",
+		"createdAt",
+		"updatedAt",
+		"userId",
+		"clientId",
+		"realmId"
+	] },
+	filters: { allowed: [...SESSION_FILTER_KEYS] },
+	relations: {
+		allowed: ["realm"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"seenAt",
+		"expiresAt",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { sessionSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/session/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","SESSION_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","sessionSchema","name","SESSION","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/session/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Session } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { SESSION_FILTER_KEYS } from '../../authentication/session/types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const sessionSchema = defineSchema<Session>({\n    name: EntityType.SESSION,\n    fields: {\n        allowed: [\n            'id',\n            'sub',\n            'subKind',\n            'ipAddress',\n            'userAgent',\n            'expiresAt',\n            'refreshedAt',\n            'seenAt',\n            'createdAt',\n            'updatedAt',\n            'userId',\n            'clientId',\n            'realmId',\n        ],\n    },\n    filters: { allowed: [...SESSION_FILTER_KEYS] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['seenAt', 'expiresAt', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAED,SAAS,CAAA,GAAIT,mBAAAA,EAAqB;CAC7CW,WAAW;EAAEF,SAAS,CAAC,OAAA;EAAUG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAU;EAAa;EAAa;GAAa;CACnEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}

package/dist/core/entities/session/service.d.ts

@@ -1,3 +1,4 @@
+import type { ICondition } from '@rapiq/core';
 import type { Session } from '@authup/core-kit';
 import { AbstractEntityService } from '@authup/server-kit';
 import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
@@ -19,8 +20,18 @@ export declare class SessionService extends AbstractEntityService implements ISe
      * discriminator between the admin bulk-revoke path and self-service. An
      * unrecognized / empty filter falls through to self-service (fail-safe: a
      * typo can never trigger an unconstrained mass delete).
+     *
+     * The wire may carry either dialect (v2 expression or legacy bracket
+     * filters), so the decision decodes to the rapiq IR and inspects the
+     * condition tree instead of poking at the raw payload.
      */
     protected hasTargetFilter(query?: Record<string, any>): boolean;
+    protected hasTargetCondition(condition: ICondition): boolean;
+    /**
+     * Schemaless decode — dialect detection only. The allow-list is
+     * enforced downstream by the repository's schema-bound decode.
+     */
+    protected static queryCodec: import("@rapiq/codec-url").URLCodec;
     protected deleteManyForSelf(actor: ActorContext, currentSessionId?: string): Promise<SessionDeleteManyResult>;
     protected deleteManyByQuery(actor: ActorContext, query: Record<string, any>): Promise<SessionDeleteManyResult>;
 }

package/dist/core/entities/session/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/service.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAExE,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAErG,MAAM,MAAM,qBAAqB,GAAG;IAChC,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,qBAAa,cAAe,SAAQ,qBAAsB,YAAW,eAAe;IAChF,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAE7B,GAAG,EAAE,qBAAqB;IAKtC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAM7D,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAuD7C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBzD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBzD,UAAU,CACZ,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,wBAA6B,GACvC,OAAO,CAAC,uBAAuB,CAAC;IAYnC;;;;;OAKG;IACH,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;cAY/C,iBAAiB,CAC7B,KAAK,EAAE,YAAY,EACnB,gBAAgB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,uBAAuB,CAAC;cAkBnB,iBAAiB,CAC7B,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,uBAAuB,CAAC;CAgCtC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/service.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAU9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAExE,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAIrG,MAAM,MAAM,qBAAqB,GAAG;IAChC,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,qBAAa,cAAe,SAAQ,qBAAsB,YAAW,eAAe;IAChF,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAE7B,GAAG,EAAE,qBAAqB;IAKtC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAM7D,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAgF7C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBzD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBzD,UAAU,CACZ,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,wBAA6B,GACvC,OAAO,CAAC,uBAAuB,CAAC;IAYnC;;;;;;;;;OASG;IACH,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;IAoB/D,SAAS,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO;IAa5D;;;OAGG;IACH,SAAS,CAAC,MAAM,CAAC,UAAU,sCAAoB;cAE/B,iBAAiB,CAC7B,KAAK,EAAE,YAAY,EACnB,gBAAgB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,uBAAuB,CAAC;cAkBnB,iBAAiB,CAC7B,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,uBAAuB,CAAC;CAsCtC"}

package/dist/core/entities/session/service.mjs

@@ -3,22 +3,31 @@ import "node:url";
 import.meta.url;
 import { SESSION_FILTER_KEYS } from "../../authentication/session/types.mjs";
 import "../../authentication/index.mjs";
+import { sessionSchema } from "./schema.mjs";
+import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { isObject } from "@authup/kit";
 import { PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
-import { EntityNotFoundError, UnauthorizedError } from "@authup/errors";
+import { AuthupError, EntityNotFoundError, ErrorCode } from "@authup/errors";
+import { and, eq, inArray, isFilter, isFilters, or } from "@rapiq/core";
+import { createURLCodec } from "@rapiq/codec-url";
 //#region src/core/entities/session/service.ts
-var SessionService = class extends AbstractEntityService {
+var SessionService = class SessionService extends AbstractEntityService {
 	repository;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
 	}
 	isOwnedBy(session, actor) {
-		return !!actor.identity && session.sub === actor.identity.data.id && session.sub_kind === actor.identity.type;
+		return !!actor.identity && session.sub === actor.identity.data.id && session.subKind === actor.identity.type;
 	}
 	async getMany(query, actor) {
+		const parsed = await decodeQuery(query, {
+			schema: sessionSchema,
+			actor
+		});
 		let canReadAll = true;
 		try {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });
@@ -26,11 +35,19 @@ var SessionService = class extends AbstractEntityService {
 			if (!actor.identity) throw e;
 			canReadAll = false;
 		}
-		if (!canReadAll) return this.repository.findMany(query, { owner: {
+		if (!canReadAll) return this.repository.findMany(parsed, { owner: {
 			sub: actor.identity.data.id,
 			subKind: actor.identity.type
 		} });
-		const { data: entities, meta } = await this.repository.findMany(query);
+		const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.SESSION_READ });
+		if (compiled.verdict !== "post") {
+			const ownership = actor.identity ? and(eq("sub", actor.identity.data.id), eq("subKind", actor.identity.type)) : null;
+			let scoped = parsed;
+			if (compiled.verdict === "deny") scoped = appendQueryConditions(parsed, ownership ?? inArray("id", []));
+			else if (compiled.verdict === "conditional") scoped = appendQueryConditions(parsed, ownership ? or(ownership, compiled.condition) : compiled.condition);
+			return this.repository.findMany(scoped);
+		}
+		const { data: entities, meta } = await this.repository.findMany(parsed);
 		const data = [];
 		let { total } = meta;
 		for (const entity of entities) {
@@ -93,7 +110,10 @@ var SessionService = class extends AbstractEntityService {
 		return entity;
 	}
 	async deleteMany(actor, options = {}) {
-		if (!actor.identity) throw new UnauthorizedError();
+		if (!actor.identity) throw new AuthupError({
+			code: ErrorCode.IDENTITY_UNAUTHORIZED,
+			message: "Authentication required."
+		});
 		if (this.hasTargetFilter(options.query)) return this.deleteManyByQuery(actor, options.query);
 		return this.deleteManyForSelf(actor, options.currentSessionId);
 	}
@@ -102,14 +122,30 @@ var SessionService = class extends AbstractEntityService {
 	* discriminator between the admin bulk-revoke path and self-service. An
 	* unrecognized / empty filter falls through to self-service (fail-safe: a
 	* typo can never trigger an unconstrained mass delete).
+	*
+	* The wire may carry either dialect (v2 expression or legacy bracket
+	* filters), so the decision decodes to the rapiq IR and inspects the
+	* condition tree instead of poking at the raw payload.
 	*/ hasTargetFilter(query) {
-		const filter = query?.filter;
-		if (!isObject(filter)) return false;
-		return SESSION_FILTER_KEYS.some((key) => {
-			const value = filter[key];
-			return typeof value !== "undefined" && value !== "";
-		});
+		if (!isObject(query)) return false;
+		let parsed;
+		try {
+			parsed = SessionService.queryCodec.decode(query);
+		} catch {
+			return false;
+		}
+		if (!parsed) return false;
+		return this.hasTargetCondition(parsed.filters);
 	}
+	hasTargetCondition(condition) {
+		if (isFilters(condition)) return condition.value.some((child) => this.hasTargetCondition(child));
+		if (isFilter(condition)) return SESSION_FILTER_KEYS.includes(condition.field) && condition.value !== "";
+		return false;
+	}
+	/**
+	* Schemaless decode — dialect detection only. The allow-list is
+	* enforced downstream by the repository's schema-bound decode.
+	*/ static queryCodec = createURLCodec();
 	async deleteManyForSelf(actor, currentSessionId) {
 		const sessions = await this.repository.findAllByOwner({
 			sub: actor.identity.data.id,
@@ -125,7 +161,11 @@ var SessionService = class extends AbstractEntityService {
 	}
 	async deleteManyByQuery(actor, query) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });
-		const sessions = await this.repository.findAllByQuery(query);
+		const sessions = await this.repository.findAllByQuery(await decodeQuery(query, {
+			schema: sessionSchema,
+			parameters: ["filters"],
+			actor
+		}));
 		let count = 0;
 		for (const session of sessions) {
 			if (!this.isOwnedBy(session, actor)) try {

package/dist/core/entities/session/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityNotFoundError","UnauthorizedError","isObject","PermissionName","AbstractEntityService","SESSION_FILTER_KEYS","SessionService","repository","ctx","isOwnedBy","session","actor","identity","sub","data","id","sub_kind","type","getMany","query","canReadAll","permissionEvaluator","preEvaluate","name","SESSION_READ","e","findMany","owner","subKind","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","delete","SESSION_DELETE","entityId","remove","deleteMany","options","hasTargetFilter","deleteManyByQuery","deleteManyForSelf","currentSessionId","filter","some","key","value","sessions","findAllByOwner","count","findAllByQuery"],"sources":["../../../../src/core/entities/session/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError, UnauthorizedError } from '@authup/errors';\nimport { isObject } from '@authup/kit';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Session } from '@authup/core-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { ISessionRepository } from '../../authentication/index.ts';\nimport { SESSION_FILTER_KEYS } from '../../authentication/index.ts';\nimport type { ISessionService, SessionDeleteManyOptions, SessionDeleteManyResult } from './types.ts';\n\nexport type SessionServiceContext = {\n    repository: ISessionRepository,\n};\n\nexport class SessionService extends AbstractEntityService implements ISessionService {\n    protected repository: ISessionRepository;\n\n    constructor(ctx: SessionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n    }\n\n    protected isOwnedBy(session: Session, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            session.sub === actor.identity.data.id &&\n            session.sub_kind === actor.identity.type;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own sessions\n            return this.repository.findMany(query, {\n                owner: {\n                    sub: actor.identity!.data.id,\n                    subKind: actor.identity!.type,\n                },\n            });\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(query);\n\n        const data: Session[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.SESSION_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext): Promise<Session> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SESSION_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n\n    async delete(id: string, actor: ActorContext): Promise<Session> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SESSION_DELETE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    async deleteMany(\n        actor: ActorContext,\n        options: SessionDeleteManyOptions = {},\n    ): Promise<SessionDeleteManyResult> {\n        if (!actor.identity) {\n            throw new UnauthorizedError();\n        }\n\n        if (this.hasTargetFilter(options.query)) {\n            return this.deleteManyByQuery(actor, options.query!);\n        }\n\n        return this.deleteManyForSelf(actor, options.currentSessionId);\n    }\n\n    /**\n     * True when the query carries at least one recognized target filter — the\n     * discriminator between the admin bulk-revoke path and self-service. An\n     * unrecognized / empty filter falls through to self-service (fail-safe: a\n     * typo can never trigger an unconstrained mass delete).\n     */\n    protected hasTargetFilter(query?: Record<string, any>): boolean {\n        const filter = query?.filter;\n        if (!isObject(filter)) {\n            return false;\n        }\n\n        return SESSION_FILTER_KEYS.some((key) => {\n            const value = filter[key];\n            return typeof value !== 'undefined' && value !== '';\n        });\n    }\n\n    protected async deleteManyForSelf(\n        actor: ActorContext,\n        currentSessionId?: string,\n    ): Promise<SessionDeleteManyResult> {\n        const sessions = await this.repository.findAllByOwner({\n            sub: actor.identity!.data.id,\n            subKind: actor.identity!.type,\n        });\n\n        let count = 0;\n        for (const session of sessions) {\n            if (currentSessionId && session.id === currentSessionId) {\n                continue;\n            }\n            await this.repository.remove(session);\n            count += 1;\n        }\n\n        return { count };\n    }\n\n    protected async deleteManyByQuery(\n        actor: ActorContext,\n        query: Record<string, any>,\n    ): Promise<SessionDeleteManyResult> {\n        // Gate: an actor without SESSION_DELETE cannot force-logout anyone → 403.\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n\n        const sessions = await this.repository.findAllByQuery(query);\n\n        let count = 0;\n        for (const session of sessions) {\n            // Own sessions are always deletable by the actor (mirrors getMany).\n            // Otherwise per-session realm-match: a realm_admin only reaches\n            // sessions in its realm — cross-realm rows are skipped, not failed,\n            // so filter breadth cannot escalate beyond the actor's reach.\n            if (!this.isOwnedBy(session, actor)) {\n                try {\n                    await actor.permissionEvaluator.evaluate({\n                        name: PermissionName.SESSION_DELETE,\n                        data: definePolicyData({\n                            [BuiltInPolicyType.ATTRIBUTES]: session,\n                            ...this.resourceRealmMatch(session),\n                        }),\n                    });\n                } catch {\n                    continue;\n                }\n            }\n\n            await this.repository.remove(session);\n            count += 1;\n        }\n\n        return { count };\n    }\n}\n"],"mappings":";;;;;;;;;;;AAsBA,IAAaQ,iBAAb,cAAoCF,sBAAAA;CACtBG;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,aAAaL,MAAMC,SAASK;CAC5C;CAEA,MAAMC,QACFC,OACAR,OACgD;EAChD,IAAIS,aAAa;EACjB,IAAI;GACA,MAAMT,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqB,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAACd,MAAMC,UACP,MAAMa;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKb,WAAWmB,SAASP,OAAO,EACnCQ,OAAO;GACHd,KAAKF,MAAMC,SAAUE,KAAKC;GAC1Ba,SAASjB,MAAMC,SAAUK;EAC7B,EACJ,CAAA;EAGJ,MAAM,EAAEH,MAAMe,UAAUC,SAAS,MAAM,KAAKvB,WAAWmB,SAASP,KAAAA;EAEhE,MAAML,OAAkB,CAAA;EACxB,IAAI,EAAEiB,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAKpB,UAAUuB,QAAQrB,KAAAA,GAAQ;IAC/BG,KAAKmB,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMrB,MAAMU,oBAAoBa,SAAS;KACrCX,MAAMpB,eAAeqB;KACrBV,MAAMf,iBAAiB;OAClBD,kBAAkBqC,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAlB,KAAKmB,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHjB;GACAgB,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAOtB,IAAYJ,OAAuC;EAC5D,MAAMqB,SAAS,MAAM,KAAKzB,WAAW+B,YAAYvB,EAAAA;EACjD,IAAI,CAACiB,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAAC,KAAKS,UAAUuB,QAAQrB,KAAAA,GAAQ;GAChC,MAAMA,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqB,aAAa,CAAA;GAChF,MAAMb,MAAMU,oBAAoBa,SAAS;IACrCX,MAAMpB,eAAeqB;IACrBV,MAAMf,iBAAiB;MAClBD,kBAAkBqC,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMO,OAAOxB,IAAYJ,OAAuC;EAC5D,MAAMqB,SAAS,MAAM,KAAKzB,WAAW+B,YAAYvB,EAAAA;EACjD,IAAI,CAACiB,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAAC,KAAKS,UAAUuB,QAAQrB,KAAAA,GAAQ;GAChC,MAAMA,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqC,eAAe,CAAA;GAClF,MAAM7B,MAAMU,oBAAoBa,SAAS;IACrCX,MAAMpB,eAAeqC;IACrB1B,MAAMf,iBAAiB;MAClBD,kBAAkBqC,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAEjB,IAAI0B,aAAaT;EACzB,MAAM,KAAKzB,WAAWmC,OAAOV,MAAAA;EAC7BA,OAAOjB,KAAK0B;EAEZ,OAAOT;CACX;CAEA,MAAMW,WACFhC,OACAiC,UAAoC,CAAC,GACL;EAChC,IAAI,CAACjC,MAAMC,UACP,MAAM,IAAIX,kBAAAA;EAGd,IAAI,KAAK4C,gBAAgBD,QAAQzB,KAAK,GAClC,OAAO,KAAK2B,kBAAkBnC,OAAOiC,QAAQzB,KAAK;EAGtD,OAAO,KAAK4B,kBAAkBpC,OAAOiC,QAAQI,gBAAgB;CACjE;;;;;;IAQA,gBAA0B7B,OAAsC;EAC5D,MAAM8B,SAAS9B,OAAO8B;EACtB,IAAI,CAAC/C,SAAS+C,MAAAA,GACV,OAAO;EAGX,OAAO5C,oBAAoB6C,MAAMC,QAAAA;GAC7B,MAAMC,QAAQH,OAAOE;GACrB,OAAO,OAAOC,UAAU,eAAeA,UAAU;EACrD,CAAA;CACJ;CAEA,MAAgBL,kBACZpC,OACAqC,kBACgC;EAChC,MAAMK,WAAW,MAAM,KAAK9C,WAAW+C,eAAe;GAClDzC,KAAKF,MAAMC,SAAUE,KAAKC;GAC1Ba,SAASjB,MAAMC,SAAUK;EAC7B,CAAA;EAEA,IAAIsC,QAAQ;EACZ,KAAK,MAAM7C,WAAW2C,UAAU;GAC5B,IAAIL,oBAAoBtC,QAAQK,OAAOiC,kBACnC;GAEJ,MAAM,KAAKzC,WAAWmC,OAAOhC,OAAAA;GAC7B6C,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;CAEA,MAAgBT,kBACZnC,OACAQ,OACgC;EAEhC,MAAMR,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqC,eAAe,CAAA;EAElF,MAAMa,WAAW,MAAM,KAAK9C,WAAWiD,eAAerC,KAAAA;EAEtD,IAAIoC,QAAQ;EACZ,KAAK,MAAM7C,WAAW2C,UAAU;GAK5B,IAAI,CAAC,KAAK5C,UAAUC,SAASC,KAAAA,GACzB,IAAI;IACA,MAAMA,MAAMU,oBAAoBa,SAAS;KACrCX,MAAMpB,eAAeqC;KACrB1B,MAAMf,iBAAiB;OAClBD,kBAAkBqC,aAAazB;MAChC,GAAG,KAAK0B,mBAAmB1B,OAAAA;KAC/B,CAAA;IACJ,CAAA;GACJ,QAAQ;IACJ;GACJ;GAGJ,MAAM,KAAKH,WAAWmC,OAAOhC,OAAAA;GAC7B6C,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","AuthupError","EntityNotFoundError","ErrorCode","isObject","createURLCodec","and","eq","inArray","isFilter","isFilters","or","PermissionName","AbstractEntityService","SESSION_FILTER_KEYS","appendQueryConditions","decodeQuery","sessionSchema","SessionService","repository","ctx","isOwnedBy","session","actor","identity","sub","data","id","subKind","type","getMany","query","parsed","schema","canReadAll","permissionEvaluator","preEvaluate","name","SESSION_READ","e","findMany","owner","compiled","compile","verdict","ownership","scoped","condition","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","delete","SESSION_DELETE","entityId","remove","deleteMany","options","code","IDENTITY_UNAUTHORIZED","message","hasTargetFilter","deleteManyByQuery","deleteManyForSelf","currentSessionId","queryCodec","decode","hasTargetCondition","filters","value","some","child","includes","field","sessions","findAllByOwner","count","findAllByQuery","parameters"],"sources":["../../../../src/core/entities/session/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { AuthupError, EntityNotFoundError, ErrorCode } from '@authup/errors';\nimport { isObject } from '@authup/kit';\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type { ICondition } from '@rapiq/core';\nimport {\n    and, \n    eq, \n    inArray, \n    isFilter, \n    isFilters, \n    or,\n} from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Session } from '@authup/core-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { ISessionRepository } from '../../authentication/index.ts';\nimport { SESSION_FILTER_KEYS } from '../../authentication/index.ts';\nimport type { ISessionService, SessionDeleteManyOptions, SessionDeleteManyResult } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { sessionSchema } from './schema.ts';\n\nexport type SessionServiceContext = {\n    repository: ISessionRepository,\n};\n\nexport class SessionService extends AbstractEntityService implements ISessionService {\n    protected repository: ISessionRepository;\n\n    constructor(ctx: SessionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n    }\n\n    protected isOwnedBy(session: Session, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            session.sub === actor.identity.data.id &&\n            session.subKind === actor.identity.type;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        const parsed = await decodeQuery(query, { schema: sessionSchema, actor });\n\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own sessions\n            return this.repository.findMany(parsed, {\n                owner: {\n                    sub: actor.identity!.data.id,\n                    subKind: actor.identity!.type,\n                },\n            });\n        }\n\n        // Compile SESSION_READ into a row condition (#3286 phase 3). Own sessions\n        // are always readable, so ownership composes as an OR-alternative — the\n        // whole gate runs as WHERE and pagination/totals stay exact. Only a\n        // non-expressible policy falls back to the per-row loop below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.SESSION_READ });\n        if (compiled.verdict !== 'post') {\n            const ownership = actor.identity ?\n                and(eq('sub', actor.identity.data.id), eq('subKind', actor.identity.type)) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, ownership ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    ownership ? or(ownership, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped);\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(parsed);\n\n        const data: Session[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.SESSION_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext): Promise<Session> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SESSION_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n\n    async delete(id: string, actor: ActorContext): Promise<Session> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SESSION_DELETE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    async deleteMany(\n        actor: ActorContext,\n        options: SessionDeleteManyOptions = {},\n    ): Promise<SessionDeleteManyResult> {\n        if (!actor.identity) {\n            throw new AuthupError({ code: ErrorCode.IDENTITY_UNAUTHORIZED, message: 'Authentication required.' });\n        }\n\n        if (this.hasTargetFilter(options.query)) {\n            return this.deleteManyByQuery(actor, options.query!);\n        }\n\n        return this.deleteManyForSelf(actor, options.currentSessionId);\n    }\n\n    /**\n     * True when the query carries at least one recognized target filter — the\n     * discriminator between the admin bulk-revoke path and self-service. An\n     * unrecognized / empty filter falls through to self-service (fail-safe: a\n     * typo can never trigger an unconstrained mass delete).\n     *\n     * The wire may carry either dialect (v2 expression or legacy bracket\n     * filters), so the decision decodes to the rapiq IR and inspects the\n     * condition tree instead of poking at the raw payload.\n     */\n    protected hasTargetFilter(query?: Record<string, any>): boolean {\n        if (!isObject(query)) {\n            return false;\n        }\n\n        let parsed;\n        try {\n            parsed = SessionService.queryCodec.decode(query);\n        } catch {\n            // unreadable filter — fail-safe to self-service\n            return false;\n        }\n\n        if (!parsed) {\n            return false;\n        }\n\n        return this.hasTargetCondition(parsed.filters);\n    }\n\n    protected hasTargetCondition(condition: ICondition): boolean {\n        if (isFilters(condition)) {\n            return condition.value.some((child) => this.hasTargetCondition(child));\n        }\n\n        if (isFilter(condition)) {\n            return (SESSION_FILTER_KEYS as readonly string[]).includes(condition.field) &&\n                condition.value !== '';\n        }\n\n        return false;\n    }\n\n    /**\n     * Schemaless decode — dialect detection only. The allow-list is\n     * enforced downstream by the repository's schema-bound decode.\n     */\n    protected static queryCodec = createURLCodec();\n\n    protected async deleteManyForSelf(\n        actor: ActorContext,\n        currentSessionId?: string,\n    ): Promise<SessionDeleteManyResult> {\n        const sessions = await this.repository.findAllByOwner({\n            sub: actor.identity!.data.id,\n            subKind: actor.identity!.type,\n        });\n\n        let count = 0;\n        for (const session of sessions) {\n            if (currentSessionId && session.id === currentSessionId) {\n                continue;\n            }\n            await this.repository.remove(session);\n            count += 1;\n        }\n\n        return { count };\n    }\n\n    protected async deleteManyByQuery(\n        actor: ActorContext,\n        query: Record<string, any>,\n    ): Promise<SessionDeleteManyResult> {\n        // Gate: an actor without SESSION_DELETE cannot force-logout anyone → 403.\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n\n        const sessions = await this.repository.findAllByQuery(\n            await decodeQuery(query, {\n                schema: sessionSchema, \n                parameters: ['filters'], \n                actor, \n            }),\n        );\n\n        let count = 0;\n        for (const session of sessions) {\n            // Own sessions are always deletable by the actor (mirrors getMany).\n            // Otherwise per-session realm-match: a realm_admin only reaches\n            // sessions in its realm — cross-realm rows are skipped, not failed,\n            // so filter breadth cannot escalate beyond the actor's reach.\n            if (!this.isOwnedBy(session, actor)) {\n                try {\n                    await actor.permissionEvaluator.evaluate({\n                        name: PermissionName.SESSION_DELETE,\n                        data: definePolicyData({\n                            [BuiltInPolicyType.ATTRIBUTES]: session,\n                            ...this.resourceRealmMatch(session),\n                        }),\n                    });\n                } catch {\n                    continue;\n                }\n            }\n\n            await this.repository.remove(session);\n            count += 1;\n        }\n\n        return { count };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkCA,IAAamB,iBAAb,MAAaA,uBAAuBL,sBAAAA;CACtBM;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,YAAYL,MAAMC,SAASK;CAC3C;CAEA,MAAMC,QACFC,OACAR,OACgD;EAChD,MAAMS,SAAS,MAAMhB,YAAYe,OAAO;GAAEE,QAAQhB;GAAeM;EAAM,CAAA;EAEvE,IAAIW,aAAa;EACjB,IAAI;GACA,MAAMX,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe0B,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAAChB,MAAMC,UACP,MAAMe;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKf,WAAWqB,SAASR,QAAQ,EACpCS,OAAO;GACHhB,KAAKF,MAAMC,SAAUE,KAAKC;GAC1BC,SAASL,MAAMC,SAAUK;EAC7B,EACJ,CAAA;EAOJ,MAAMa,WAAW,MAAMnB,MAAMY,oBAAoBQ,QAAQ,EAAEN,MAAMzB,eAAe0B,aAAa,CAAA;EAC7F,IAAII,SAASE,YAAY,QAAQ;GAC7B,MAAMC,YAAYtB,MAAMC,WACpBlB,IAAIC,GAAG,OAAOgB,MAAMC,SAASE,KAAKC,EAAE,GAAGpB,GAAG,WAAWgB,MAAMC,SAASK,IAAI,CAAA,IACxE;GAEJ,IAAIiB,SAASd;GACb,IAAIU,SAASE,YAAY,QACrBE,SAAS/B,sBAAsBiB,QAAQa,aAAarC,QAAQ,MAAM,CAAA,CAAE,CAAA;QACjE,IAAIkC,SAASE,YAAY,eAC5BE,SAAS/B,sBACLiB,QACAa,YAAYlC,GAAGkC,WAAWH,SAASK,SAAS,IAAIL,SAASK,SAAS;GAI1E,OAAO,KAAK5B,WAAWqB,SAASM,MAAAA;EACpC;EAEA,MAAM,EAAEpB,MAAMsB,UAAUC,SAAS,MAAM,KAAK9B,WAAWqB,SAASR,MAAAA;EAEhE,MAAMN,OAAkB,CAAA;EACxB,IAAI,EAAEwB,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAK3B,UAAU8B,QAAQ5B,KAAAA,GAAQ;IAC/BG,KAAK0B,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAM5B,MAAMY,oBAAoBkB,SAAS;KACrChB,MAAMzB,eAAe0B;KACrBZ,MAAM1B,iBAAiB;OAClBD,kBAAkBuD,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAzB,KAAK0B,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHxB;GACAuB,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAO7B,IAAYJ,OAAuC;EAC5D,MAAM4B,SAAS,MAAM,KAAKhC,WAAWsC,YAAY9B,EAAAA;EACjD,IAAI,CAACwB,QACD,MAAM,IAAIjD,oBAAAA;EAGd,IAAI,CAAC,KAAKmB,UAAU8B,QAAQ5B,KAAAA,GAAQ;GAChC,MAAMA,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe0B,aAAa,CAAA;GAChF,MAAMf,MAAMY,oBAAoBkB,SAAS;IACrChB,MAAMzB,eAAe0B;IACrBZ,MAAM1B,iBAAiB;MAClBD,kBAAkBuD,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMO,OAAO/B,IAAYJ,OAAuC;EAC5D,MAAM4B,SAAS,MAAM,KAAKhC,WAAWsC,YAAY9B,EAAAA;EACjD,IAAI,CAACwB,QACD,MAAM,IAAIjD,oBAAAA;EAGd,IAAI,CAAC,KAAKmB,UAAU8B,QAAQ5B,KAAAA,GAAQ;GAChC,MAAMA,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe+C,eAAe,CAAA;GAClF,MAAMpC,MAAMY,oBAAoBkB,SAAS;IACrChB,MAAMzB,eAAe+C;IACrBjC,MAAM1B,iBAAiB;MAClBD,kBAAkBuD,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAExB,IAAIiC,aAAaT;EACzB,MAAM,KAAKhC,WAAW0C,OAAOV,MAAAA;EAC7BA,OAAOxB,KAAKiC;EAEZ,OAAOT;CACX;CAEA,MAAMW,WACFvC,OACAwC,UAAoC,CAAC,GACL;EAChC,IAAI,CAACxC,MAAMC,UACP,MAAM,IAAIvB,YAAY;GAAE+D,MAAM7D,UAAU8D;GAAuBC,SAAS;EAA2B,CAAA;EAGvG,IAAI,KAAKC,gBAAgBJ,QAAQhC,KAAK,GAClC,OAAO,KAAKqC,kBAAkB7C,OAAOwC,QAAQhC,KAAK;EAGtD,OAAO,KAAKsC,kBAAkB9C,OAAOwC,QAAQO,gBAAgB;CACjE;;;;;;;;;;IAYA,gBAA0BvC,OAAsC;EAC5D,IAAI,CAAC3B,SAAS2B,KAAAA,GACV,OAAO;EAGX,IAAIC;EACJ,IAAI;GACAA,SAASd,eAAeqD,WAAWC,OAAOzC,KAAAA;EAC9C,QAAQ;GAEJ,OAAO;EACX;EAEA,IAAI,CAACC,QACD,OAAO;EAGX,OAAO,KAAKyC,mBAAmBzC,OAAO0C,OAAO;CACjD;CAEUD,mBAAmB1B,WAAgC;EACzD,IAAIrC,UAAUqC,SAAAA,GACV,OAAOA,UAAU4B,MAAMC,MAAMC,UAAU,KAAKJ,mBAAmBI,KAAAA,CAAAA;EAGnE,IAAIpE,SAASsC,SAAAA,GACT,OAAO,oBAA2C+B,SAAS/B,UAAUgC,KAAK,KACtEhC,UAAU4B,UAAU;EAG5B,OAAO;CACX;;;;IAMA,OAAiBJ,aAAalE,eAAAA;CAE9B,MAAgBgE,kBACZ9C,OACA+C,kBACgC;EAChC,MAAMU,WAAW,MAAM,KAAK7D,WAAW8D,eAAe;GAClDxD,KAAKF,MAAMC,SAAUE,KAAKC;GAC1BC,SAASL,MAAMC,SAAUK;EAC7B,CAAA;EAEA,IAAIqD,QAAQ;EACZ,KAAK,MAAM5D,WAAW0D,UAAU;GAC5B,IAAIV,oBAAoBhD,QAAQK,OAAO2C,kBACnC;GAEJ,MAAM,KAAKnD,WAAW0C,OAAOvC,OAAAA;GAC7B4D,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;CAEA,MAAgBd,kBACZ7C,OACAQ,OACgC;EAEhC,MAAMR,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe+C,eAAe,CAAA;EAElF,MAAMqB,WAAW,MAAM,KAAK7D,WAAWgE,eACnC,MAAMnE,YAAYe,OAAO;GACrBE,QAAQhB;GACRmE,YAAY,CAAC,SAAA;GACb7D;EACJ,CAAA,CAAA;EAGJ,IAAI2D,QAAQ;EACZ,KAAK,MAAM5D,WAAW0D,UAAU;GAK5B,IAAI,CAAC,KAAK3D,UAAUC,SAASC,KAAAA,GACzB,IAAI;IACA,MAAMA,MAAMY,oBAAoBkB,SAAS;KACrChB,MAAMzB,eAAe+C;KACrBjC,MAAM1B,iBAAiB;OAClBD,kBAAkBuD,aAAahC;MAChC,GAAG,KAAKiC,mBAAmBjC,OAAAA;KAC/B,CAAA;IACJ,CAAA;GACJ,QAAQ;IACJ;GACJ;GAGJ,MAAM,KAAKH,WAAW0C,OAAOvC,OAAAA;GAC7B4D,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;AACJ"}

package/dist/core/entities/session/types.d.ts

@@ -6,7 +6,7 @@ export type SessionDeleteManyResult = {
 export type SessionDeleteManyOptions = {
     /**
      * The parsed request query. When it carries a recognized target filter
-     * (`SESSION_FILTER_KEYS`, e.g. `filter[user_id]`) the call is an admin
+     * (`SESSION_FILTER_KEYS`, e.g. `filter[userId]`) the call is an admin
      * bulk revoke; otherwise it is the self-service path.
      */
     query?: Record<string, any>;
@@ -38,7 +38,7 @@ export interface ISessionService {
      *   the actor except the current one ("log out my other devices"). No
      *   permission required.
      * - **A recognized target filter** (`SESSION_FILTER_KEYS`, e.g.
-     *   `filter[user_id]`, `filter[realm_id]`) → admin "force-logout": revoke
+     *   `filter[userId]`, `filter[realmId]`) → admin "force-logout": revoke
      *   every matching session. Requires `SESSION_DELETE`, and each session is
      *   additionally realm-matched (drop-unauthorized), so a `realm_admin` only
      *   revokes sessions in its reach and filter breadth cannot escalate.

package/dist/core/entities/trust-anchor/index.d.ts

@@ -0,0 +1,4 @@
+export * from './service.ts';
+export * from './types.ts';
+export * from './schema.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/trust-anchor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/trust-anchor/index.mjs

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { trustAnchorSchema } from "./schema.mjs";
+import { TrustAnchorService } from "./service.mjs";
+export { TrustAnchorService, trustAnchorSchema };

package/dist/core/entities/trust-anchor/schema.d.ts

@@ -0,0 +1,3 @@
+import type { TrustAnchor } from '@authup/core-kit';
+export declare const trustAnchorSchema: import("@rapiq/core").Schema<TrustAnchor, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/trust-anchor/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,eAAO,MAAM,iBAAiB,gDAkB5B,CAAC"}

package/dist/core/entities/trust-anchor/schema.mjs

@@ -0,0 +1,43 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/trust-anchor/schema.ts
+const schemaMapping = { realm: EntityType.REALM };
+const trustAnchorSchema = defineSchema({
+	name: EntityType.TRUST_ANCHOR,
+	fields: { allowed: [
+		"id",
+		"name",
+		"certificate",
+		"enabled",
+		"realmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: [
+		"id",
+		"name",
+		"enabled",
+		"realmId"
+	] },
+	relations: {
+		allowed: ["realm"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"id",
+		"name",
+		"enabled",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { trustAnchorSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/trust-anchor/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","trustAnchorSchema","name","TRUST_ANCHOR","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/trust-anchor/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const trustAnchorSchema = defineSchema<TrustAnchor>({\n    name: EntityType.TRUST_ANCHOR,\n    fields: {\n        allowed: [\n            'id',\n            'name',\n            'certificate',\n            'enabled',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'name', 'enabled', 'realmId'] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'name', 'enabled', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,oBAAoBN,aAA0B;CACvDO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;EAAW;GAAW;CACzDE,WAAW;EAAEF,SAAS,CAAC,OAAA;EAAUG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAW;EAAa;GAAa;CACrEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}

package/dist/core/entities/trust-anchor/service.d.ts

@@ -0,0 +1,33 @@
+import type { TrustAnchor } from '@authup/core-kit';
+import { EventName, TrustAnchorValidator } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { EventRequestContext, IEventService } from '../event/index.ts';
+import type { ITrustAnchorRepository, ITrustAnchorService, TrustAnchorServiceReadOptions } from './types.ts';
+export type TrustAnchorServiceContext = {
+    repository: ITrustAnchorRepository;
+    eventService?: IEventService;
+    requestContext?: () => EventRequestContext | undefined;
+};
+export declare class TrustAnchorService extends AbstractEntityService implements ITrustAnchorService {
+    protected repository: ITrustAnchorRepository;
+    protected validator: TrustAnchorValidator;
+    protected eventService?: IEventService;
+    protected requestContext?: () => EventRequestContext | undefined;
+    constructor(ctx: TrustAnchorServiceContext);
+    getMany(query: Record<string, any>, actor: ActorContext, options?: TrustAnchorServiceReadOptions): Promise<EntityRepositoryFindManyResult<TrustAnchor>>;
+    getOne(idOrName: string, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;
+    create(data: Record<string, any>, actor: ActorContext): Promise<TrustAnchor>;
+    update(idOrName: string, data: Record<string, any>, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;
+    delete(id: string, actor: ActorContext): Promise<TrustAnchor>;
+    /**
+     * Metadata-only audit trail for trust-anchor lifecycle operations
+     * (issue #3269) — trust anchors have no entity subscriber, so the
+     * security-relevant mutations (an enabled CA anchor turns on mTLS client
+     * auth for a realm) are recorded explicitly. The payload never carries
+     * certificate bytes.
+     */
+    protected recordEvent(name: `${EventName}`, entity: TrustAnchor, actor: ActorContext, data?: Record<string, any>): Promise<void>;
+    protected pickAuditFields(entity: TrustAnchor): Record<string, any>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/trust-anchor/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAEH,SAAS,EAGT,oBAAoB,EACvB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,KAAK,EACR,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAChC,MAAM,YAAY,CAAC;AAIpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,UAAU,EAAE,sBAAsB,CAAC;IACnC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;CAC1D,CAAC;AAQF,qBAAa,kBAAmB,SAAQ,qBAAsB,YAAW,mBAAmB;IACxF,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;IAE1C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;gBAErD,GAAG,EAAE,yBAAyB;IAQpC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,6BAAkC,GAC5C,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAqDjD,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAmBjB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IA6CjB,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAuCjB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IA2BvB;;;;;;OAMG;cACa,WAAW,CACvB,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,YAAY,EACnB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IA0BhB,SAAS,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;CAMtE"}