npm - @authup/server-core - Versions diffs - 1.0.0-beta.52 → 1.0.0-beta.54 - Mend

@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1541) hide show

package/dist/core/identity/password-recovery/service.mjs CHANGED Viewed

@@ -8,12 +8,12 @@ import "./constants.mjs";
 import { PasswordRecoveryDisabledError } from "./disabled.mjs";
 import { EmailVerificationRequiredError } from "./email-verification-required.mjs";
 import { ResetTokenExpiredError } from "./token-expired.mjs";
-import { USER_PASSWORD_MAX_LENGTH, USER_PASSWORD_MIN_LENGTH } from "@authup/core-kit";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { EventName, EventRefType, EventScope, IdentityType, USER_PASSWORD_MAX_LENGTH, USER_PASSWORD_MIN_LENGTH } from "@authup/core-kit";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
+import { randomBytes } from "node:crypto";
 import { Container } from "validup";
 import { createValidator } from "@validup/zod";
 import { z } from "zod";
-import { randomBytes } from "node:crypto";
 //#region src/core/identity/password-recovery/service.ts
 var PasswordRecoveryService = class {
 	options;
@@ -21,36 +21,38 @@ var PasswordRecoveryService = class {
 	realmRepository;
 	mailClient;
 	mailTemplateRenderer;
+	eventService;
 	constructor(ctx) {
 		this.options = ctx.options;
 		this.repository = ctx.repository;
 		this.realmRepository = ctx.realmRepository;
 		this.mailClient = ctx.mailClient;
 		this.mailTemplateRenderer = ctx.mailTemplateRenderer;
+		this.eventService = ctx.eventService;
 	}
 	async forgotPassword(data, context) {
 		if (!this.options.passwordRecoveryEnabled) throw new PasswordRecoveryDisabledError();
 		if (!this.options.emailVerificationEnabled) throw new EmailVerificationRequiredError("Email verification is not enabled, but required to reset a password.");
 		const validated = await this.runForgotPasswordValidator(data);
-		const realm = await this.realmRepository.resolve(validated.realm_id, true);
+		const realm = await this.realmRepository.resolve(validated.realmId, true);
 		const where = {
 			...validated.name ? { name: validated.name } : {},
 			...validated.email ? { email: validated.email } : {},
-			realm_id: realm.id
+			realmId: realm.id
 		};
 		const entity = await this.repository.findOneByWithEmail(where);
 		if (!entity) throw new EntityNotFoundError();
 		const merged = this.repository.merge(entity, {
-			reset_expires: new Date(Date.now() + 1e3 * 60 * 30).toISOString(),
-			reset_hash: randomBytes(32).toString("hex")
+			resetExpires: new Date(Date.now() + 1e3 * 60 * 30).toISOString(),
+			resetHash: randomBytes(32).toString("hex")
 		});
 		await this.repository.save(merged);
 		try {
-			const resetUrl = this.options.publicUrl ? `${this.options.publicUrl.replace(/\/+$/, "")}/password-reset?token=${encodeURIComponent(merged.reset_hash)}&realm_id=${encodeURIComponent(entity.realm_id)}` : void 0;
+			const resetUrl = this.options.publicUrl ? `${this.options.publicUrl.replace(/\/+$/, "")}/password-reset?token=${encodeURIComponent(merged.resetHash)}&realmId=${encodeURIComponent(entity.realmId)}` : void 0;
 			const mail = await this.mailTemplateRenderer.render({
 				template: MailTemplateName.PASSWORD_RESET,
 				params: {
-					code: merged.reset_hash,
+					code: merged.resetHash,
 					url: resetUrl,
 					expiresInMinutes: 30
 				},
@@ -62,37 +64,57 @@ var PasswordRecoveryService = class {
 			});
 		} catch {
 			this.repository.merge(merged, {
-				reset_hash: null,
-				reset_expires: null
+				resetHash: null,
+				resetExpires: null
 			});
 			await this.repository.save(merged);
-			throw new BadRequestError("Password recovery failed. Could not send reset email.");
+			throw new ValidationError("Password recovery failed. Could not send reset email.");
 		}
-		return { reset_expires: merged.reset_expires };
+		await this.eventService?.record({
+			scope: EventScope.IDENTITY,
+			name: EventName.PASSWORD_RESET_REQUESTED,
+			refType: EventRefType.USER,
+			refId: merged.id,
+			actorType: IdentityType.USER,
+			actorId: merged.id,
+			actorName: merged.name,
+			realmId: merged.realmId
+		});
+		return { resetExpires: merged.resetExpires };
 	}
 	async resetPassword(data) {
 		if (!this.options.passwordRecoveryEnabled) throw new PasswordRecoveryDisabledError();
 		const validated = await this.runResetPasswordValidator(data);
 		await this.repository.validateJoinColumns(validated);
-		const realm = await this.realmRepository.resolve(validated.realm_id, true);
+		const realm = await this.realmRepository.resolve(validated.realmId, true);
 		const where = {
 			...validated.name ? { name: validated.name } : {},
 			...validated.email ? { email: validated.email } : {},
-			reset_hash: validated.token,
-			realm_id: realm.id
+			resetHash: validated.token,
+			realmId: realm.id
 		};
 		const entity = await this.repository.findOneBy(where);
 		if (!entity) throw new EntityNotFoundError();
-		if (!entity.reset_expires || new Date(entity.reset_expires) < /* @__PURE__ */ new Date()) throw new ResetTokenExpiredError();
+		if (!entity.resetExpires || new Date(entity.resetExpires) < /* @__PURE__ */ new Date()) throw new ResetTokenExpiredError();
 		const hashedPassword = await new UserCredentialsService().protect(validated.password);
 		const merged = this.repository.merge(entity, {
-			reset_at: (/* @__PURE__ */ new Date()).toISOString(),
-			reset_hash: null,
-			reset_expires: null,
+			resetAt: (/* @__PURE__ */ new Date()).toISOString(),
+			resetHash: null,
+			resetExpires: null,
 			password: hashedPassword
 		});
 		await this.repository.save(merged);
-		return { reset_at: merged.reset_at };
+		await this.eventService?.record({
+			scope: EventScope.IDENTITY,
+			name: EventName.PASSWORD_RESET_COMPLETED,
+			refType: EventRefType.USER,
+			refId: merged.id,
+			actorType: IdentityType.USER,
+			actorId: merged.id,
+			actorName: merged.name,
+			realmId: merged.realmId
+		});
+		return { resetAt: merged.resetAt };
 	}
 	async runForgotPasswordValidator(data) {
 		const validator = new Container({});
@@ -100,7 +122,7 @@ var PasswordRecoveryService = class {
 		oneOfContainer.mount("email", createValidator(z.string().trim().toLowerCase().email().regex(/^[^A-Z]+$/, { message: "Email must be lowercase." })));
 		oneOfContainer.mount("name", createValidator(z.string().trim().toLowerCase().min(1)));
 		validator.mount(oneOfContainer);
-		validator.mount("realm_id", { optional: true }, createValidator(z.uuid().nullable()));
+		validator.mount("realmId", { optional: true }, createValidator(z.uuid().nullable()));
 		return validator.run(data);
 	}
 	async runResetPasswordValidator(data) {
@@ -109,7 +131,7 @@ var PasswordRecoveryService = class {
 		oneOfContainer.mount("email", createValidator(z.string().trim().toLowerCase().email().regex(/^[^A-Z]+$/, { message: "Email must be lowercase." })));
 		oneOfContainer.mount("name", createValidator(z.string().trim().toLowerCase().min(1)));
 		validator.mount(oneOfContainer);
-		validator.mount("realm_id", { optional: true }, createValidator(z.uuid().nullable()));
+		validator.mount("realmId", { optional: true }, createValidator(z.uuid().nullable()));
 		validator.mount("token", createValidator(z.string().min(3).max(256)));
 		validator.mount("password", createValidator(z.string().min(this.options.passwordMinLength ?? USER_PASSWORD_MIN_LENGTH).max(USER_PASSWORD_MAX_LENGTH)));
 		return validator.run(data);

package/dist/core/identity/password-recovery/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["USER_PASSWORD_MAX_LENGTH","USER_PASSWORD_MIN_LENGTH","BadRequestError","EntityNotFoundError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidator","randomBytes","Container","z","UserCredentialsService","MailTemplateName","PASSWORD_RESET_EXPIRES_IN_MINUTES","PasswordRecoveryService","options","repository","realmRepository","mailClient","mailTemplateRenderer","ctx","forgotPassword","data","context","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realm_id","where","name","email","id","entity","findOneByWithEmail","merged","merge","reset_expires","Date","now","toISOString","reset_hash","toString","save","resetUrl","publicUrl","replace","encodeURIComponent","undefined","mail","render","template","PASSWORD_RESET","params","code","url","expiresInMinutes","locale","send","to","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","reset_at","validator","oneOfContainer","oneOf","mount","string","trim","toLowerCase","regex","message","min","optional","uuid","nullable","run","max","passwordMinLength"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { USER_PASSWORD_MAX_LENGTH, USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidator } from '@validup/zod';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n IPasswordRecoveryService,\n PasswordForgotResult,\n PasswordRecoveryServiceContext,\n PasswordRecoveryServiceOptions,\n PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\nimport { PASSWORD_RESET_EXPIRES_IN_MINUTES } from './constants.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n protected options: PasswordRecoveryServiceOptions;\n\n protected repository: IUserRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected mailClient: IMailClient;\n\n protected mailTemplateRenderer: IMailTemplateRenderer;\n\n constructor(ctx: PasswordRecoveryServiceContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.mailClient = ctx.mailClient;\n this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n }\n\n async forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult> {\n if (!this.options.passwordRecoveryEnabled) {\n throw new PasswordRecoveryDisabledError();\n }\n\n if (!this.options.emailVerificationEnabled) {\n throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n }\n\n const validated = await this.runForgotPasswordValidator(data);\n\n const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n const where: Record<string, any> = {\n ...(validated.name ? { name: validated.name } : {}),\n ...(validated.email ? { email: validated.email } : {}),\n realm_id: realm.id,\n };\n\n const entity = await this.repository.findOneByWithEmail(where);\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const merged = this.repository.merge(entity, {\n reset_expires: new Date(\n Date.now() + (1000 60 * PASSWORD_RESET_EXPIRES_IN_MINUTES),\n ).toISOString(),\n reset_hash: randomBytes(32).toString('hex'),\n });\n\n await this.repository.save(merged);\n\n try {\n // realm_id MUST ride the link: resetPassword resolves the realm\n // from the request and filters the lookup by it, so a realm-less\n // link resolves to the master realm and never matches a\n // non-master user.\n const resetUrl = this.options.publicUrl ?\n `${this.options.publicUrl.replace(/\\/+$/, '')}/password-reset` +\n `?token=${encodeURIComponent(merged.reset_hash!)}` +\n `&realm_id=${encodeURIComponent(entity.realm_id)}` :\n undefined;\n\n const mail = await this.mailTemplateRenderer.render({\n template: MailTemplateName.PASSWORD_RESET,\n params: {\n code: merged.reset_hash!,\n url: resetUrl,\n expiresInMinutes: PASSWORD_RESET_EXPIRES_IN_MINUTES,\n },\n locale: context?.locale,\n });\n\n await this.mailClient.send({\n to: entity.email,\n ...mail,\n });\n } catch {\n this.repository.merge(merged, {\n reset_hash: null,\n reset_expires: null,\n });\n await this.repository.save(merged);\n\n throw new BadRequestError('Password recovery failed. Could not send reset email.');\n }\n\n return { reset_expires: merged.reset_expires! };\n }\n\n async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n if (!this.options.passwordRecoveryEnabled) {\n throw new PasswordRecoveryDisabledError();\n }\n\n const validated = await this.runResetPasswordValidator(data);\n\n await this.repository.validateJoinColumns(validated);\n\n const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n const where: Record<string, any> = {\n ...(validated.name ? { name: validated.name } : {}),\n ...(validated.email ? { email: validated.email } : {}),\n reset_hash: validated.token,\n realm_id: realm.id,\n };\n\n const entity = await this.repository.findOneBy(where);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (!entity.reset_expires \|\| new Date(entity.reset_expires) < new Date()) {\n throw new ResetTokenExpiredError();\n }\n\n const credentialsService = new UserCredentialsService();\n const hashedPassword = await credentialsService.protect(validated.password);\n\n const merged = this.repository.merge(entity, {\n reset_at: new Date().toISOString(),\n reset_hash: null,\n reset_expires: null,\n password: hashedPassword,\n });\n\n await this.repository.save(merged);\n\n return { reset_at: merged.reset_at! };\n }\n\n private async runForgotPasswordValidator(data: Record<string, any>) {\n const validator = new Container<any>({});\n\n const oneOfContainer = new Container({ oneOf: true });\n\n oneOfContainer.mount(\n 'email',\n createValidator(\n z.string()\n .trim()\n .toLowerCase()\n .email()\n .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n ),\n );\n\n oneOfContainer.mount(\n 'name',\n createValidator(z.string().trim().toLowerCase().min(1)),\n );\n\n validator.mount(oneOfContainer);\n\n validator.mount(\n 'realm_id',\n { optional: true },\n createValidator(z.uuid().nullable()),\n );\n\n return validator.run(data);\n }\n\n private async runResetPasswordValidator(data: Record<string, any>) {\n const validator = new Container<any>({});\n\n const oneOfContainer = new Container({ oneOf: true });\n oneOfContainer.mount(\n 'email',\n createValidator(\n z.string()\n .trim()\n .toLowerCase()\n .email()\n .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n ),\n );\n oneOfContainer.mount(\n 'name',\n createValidator(z.string().trim().toLowerCase().min(1)),\n );\n\n validator.mount(oneOfContainer);\n\n validator.mount(\n 'realm_id',\n { optional: true },\n createValidator(z.uuid().nullable()),\n );\n\n validator.mount(\n 'token',\n createValidator(z.string().min(3).max(256)),\n );\n\n validator.mount(\n 'password',\n createValidator(\n z.string()\n .min(this.options.passwordMinLength ?? USER_PASSWORD_MIN_LENGTH)\n .max(USER_PASSWORD_MAX_LENGTH),\n ),\n );\n\n return validator.run(data);\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA8BA,IAAac,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKL,UAAUK,IAAIL;EACnB,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,uBAAuBC,IAAID;CACpC;CAEA,MAAME,eAAeC,MAA2BC,SAAkE;EAC9G,IAAI,CAAC,KAAKR,QAAQS,yBACd,MAAM,IAAIpB,8BAAAA;EAGd,IAAI,CAAC,KAAKW,QAAQU,0BACd,MAAM,IAAIpB,+BAA+B,sEAAA;EAG7C,MAAMqB,YAAY,MAAM,KAAKC,2BAA2BL,IAAAA;EAExD,MAAMM,QAAQ,MAAM,KAAKX,gBAAgBY,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKnB,WAAWoB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkC,SAAS,KAAKrB,WAAWsB,MAAMH,QAAQ;GACzCI,eAAe,IAAIC,KACfA,KAAKC,IAAG,IAAM,MAAO,KAAA,EAAK5B,CAAAA,CAC5B6B,YAAW;GACbC,YAAYnC,YAAY,EAAA,CAAA,CAAIoC,SAAS,KAAA;EACzC,CAAA;EAEA,MAAM,KAAK5B,WAAW6B,KAAKR,MAAAA;EAE3B,IAAI;GAKA,MAAMS,WAAW,KAAK/B,QAAQgC,YAC1B,GAAG,KAAKhC,QAAQgC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,wBACpCC,mBAAmBZ,OAAOM,UAAU,EAAA,YACjCM,mBAAmBd,OAAOL,QAAQ,MAC/CoB,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKhC,qBAAqBiC,OAAO;IAChDC,UAAUzC,iBAAiB0C;IAC3BC,QAAQ;KACJC,MAAMnB,OAAOM;KACbc,KAAKX;KACLY,kBAAAA;IACJ;IACAC,QAAQpC,SAASoC;GACrB,CAAA;GAEA,MAAM,KAAKzC,WAAW0C,KAAK;IACvBC,IAAI1B,OAAOF;IACX,GAAGkB;GACP,CAAA;EACJ,QAAQ;GACJ,KAAKnC,WAAWsB,MAAMD,QAAQ;IAC1BM,YAAY;IACZJ,eAAe;GACnB,CAAA;GACA,MAAM,KAAKvB,WAAW6B,KAAKR,MAAAA;GAE3B,MAAM,IAAInC,gBAAgB,uDAAA;EAC9B;EAEA,OAAO,EAAEqC,eAAeF,OAAOE,cAAe;CAClD;CAEA,MAAMuB,cAAcxC,MAAyD;EACzE,IAAI,CAAC,KAAKP,QAAQS,yBACd,MAAM,IAAIpB,8BAAAA;EAGd,MAAMsB,YAAY,MAAM,KAAKqC,0BAA0BzC,IAAAA;EAEvD,MAAM,KAAKN,WAAWgD,oBAAoBtC,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKX,gBAAgBY,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,YAAYjB,UAAUuC;GACtBnC,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKnB,WAAWkD,UAAUnC,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAACgC,OAAOI,iBAAiB,IAAIC,KAAKL,OAAOI,aAAa,oBAAI,IAAIC,KAAAA,GAC9D,MAAM,IAAIlC,uBAAAA;EAId,MAAM8D,iBAAiB,MAAMD,IADExD,uBACFwD,CAAAA,CAAmBE,QAAQ3C,UAAU4C,QAAQ;EAE1E,MAAMjC,SAAS,KAAKrB,WAAWsB,MAAMH,QAAQ;GACzCoC,2BAAU,IAAI/B,KAAAA,EAAAA,CAAOE,YAAW;GAChCC,YAAY;GACZJ,eAAe;GACf+B,UAAUF;EACd,CAAA;EAEA,MAAM,KAAKpD,WAAW6B,KAAKR,MAAAA;EAE3B,OAAO,EAAEkC,UAAUlC,OAAOkC,SAAU;CACxC;CAEA,MAAc5C,2BAA2BL,MAA2B;EAChE,MAAMkD,YAAY,IAAI/D,UAAe,CAAC,CAAA;EAEtC,MAAMgE,iBAAiB,IAAIhE,UAAU,EAAEiE,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MACX,SACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACX7C,MAAK,CAAA,CACL8C,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAItEP,eAAeE,MACX,QACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3E,gBAAgBG,EAAEyE,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrC,OAAOZ,UAAUa,IAAI/D,IAAAA;CACzB;CAEA,MAAcyC,0BAA0BzC,MAA2B;EAC/D,MAAMkD,YAAY,IAAI/D,UAAe,CAAC,CAAA;EAEtC,MAAMgE,iBAAiB,IAAIhE,UAAU,EAAEiE,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACX7C,MAAK,CAAA,CACL8C,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAGtEP,eAAeE,MACX,QACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjB3E,gBAAgBG,EAAEyE,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrCZ,UAAUG,MACN,SACApE,gBAAgBG,EAAEkE,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1Cd,UAAUG,MACN,YACApE,gBACIG,EAAEkE,OAAM,CAAA,CACHK,IAAI,KAAKlE,QAAQwE,qBAAqBtF,wBAAAA,CAAAA,CACtCqF,IAAItF,wBAAAA,CAAAA,CAAAA;EAIjB,OAAOwE,UAAUa,IAAI/D,IAAAA;CACzB;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["EventName","EventRefType","EventScope","IdentityType","USER_PASSWORD_MAX_LENGTH","USER_PASSWORD_MIN_LENGTH","EntityNotFoundError","ValidationError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidator","randomBytes","Container","z","UserCredentialsService","MailTemplateName","PASSWORD_RESET_EXPIRES_IN_MINUTES","PasswordRecoveryService","options","repository","realmRepository","mailClient","mailTemplateRenderer","eventService","ctx","forgotPassword","data","context","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realmId","where","name","email","id","entity","findOneByWithEmail","merged","merge","resetExpires","Date","now","toISOString","resetHash","toString","save","resetUrl","publicUrl","replace","encodeURIComponent","undefined","mail","render","template","PASSWORD_RESET","params","code","url","expiresInMinutes","locale","send","to","record","scope","IDENTITY","PASSWORD_RESET_REQUESTED","refType","USER","refId","actorType","actorId","actorName","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","resetAt","PASSWORD_RESET_COMPLETED","validator","oneOfContainer","oneOf","mount","string","trim","toLowerCase","regex","message","min","optional","uuid","nullable","run","max","passwordMinLength"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport {\n EventName,\n EventRefType,\n EventScope,\n IdentityType,\n USER_PASSWORD_MAX_LENGTH,\n USER_PASSWORD_MIN_LENGTH,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidator } from '@validup/zod';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n IPasswordRecoveryService,\n PasswordForgotResult,\n PasswordRecoveryServiceContext,\n PasswordRecoveryServiceOptions,\n PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\nimport { PASSWORD_RESET_EXPIRES_IN_MINUTES } from './constants.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n protected options: PasswordRecoveryServiceOptions;\n\n protected repository: IUserRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected mailClient: IMailClient;\n\n protected mailTemplateRenderer: IMailTemplateRenderer;\n\n protected eventService?: IEventService;\n\n constructor(ctx: PasswordRecoveryServiceContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.mailClient = ctx.mailClient;\n this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n this.eventService = ctx.eventService;\n }\n\n async forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult> {\n if (!this.options.passwordRecoveryEnabled) {\n throw new PasswordRecoveryDisabledError();\n }\n\n if (!this.options.emailVerificationEnabled) {\n throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n }\n\n const validated = await this.runForgotPasswordValidator(data);\n\n const realm = await this.realmRepository.resolve(validated.realmId, true);\n\n const where: Record<string, any> = {\n ...(validated.name ? { name: validated.name } : {}),\n ...(validated.email ? { email: validated.email } : {}),\n realmId: realm.id,\n };\n\n const entity = await this.repository.findOneByWithEmail(where);\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const merged = this.repository.merge(entity, {\n resetExpires: new Date(\n Date.now() + (1000 60 * PASSWORD_RESET_EXPIRES_IN_MINUTES),\n ).toISOString(),\n resetHash: randomBytes(32).toString('hex'),\n });\n\n await this.repository.save(merged);\n\n try {\n // realmId MUST ride the link: resetPassword resolves the realm\n // from the request and filters the lookup by it, so a realm-less\n // link resolves to the master realm and never matches a\n // non-master user.\n const resetUrl = this.options.publicUrl ?\n `${this.options.publicUrl.replace(/\\/+$/, '')}/password-reset` +\n `?token=${encodeURIComponent(merged.resetHash!)}` +\n `&realmId=${encodeURIComponent(entity.realmId)}` :\n undefined;\n\n const mail = await this.mailTemplateRenderer.render({\n template: MailTemplateName.PASSWORD_RESET,\n params: {\n code: merged.resetHash!,\n url: resetUrl,\n expiresInMinutes: PASSWORD_RESET_EXPIRES_IN_MINUTES,\n },\n locale: context?.locale,\n });\n\n await this.mailClient.send({\n to: entity.email,\n ...mail,\n });\n } catch {\n this.repository.merge(merged, {\n resetHash: null,\n resetExpires: null,\n });\n await this.repository.save(merged);\n\n throw new ValidationError('Password recovery failed. Could not send reset email.');\n }\n\n await this.eventService?.record({\n scope: EventScope.IDENTITY,\n name: EventName.PASSWORD_RESET_REQUESTED,\n refType: EventRefType.USER,\n refId: merged.id,\n actorType: IdentityType.USER,\n actorId: merged.id,\n actorName: merged.name,\n realmId: merged.realmId,\n });\n\n return { resetExpires: merged.resetExpires! };\n }\n\n async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n if (!this.options.passwordRecoveryEnabled) {\n throw new PasswordRecoveryDisabledError();\n }\n\n const validated = await this.runResetPasswordValidator(data);\n\n await this.repository.validateJoinColumns(validated);\n\n const realm = await this.realmRepository.resolve(validated.realmId, true);\n\n const where: Record<string, any> = {\n ...(validated.name ? { name: validated.name } : {}),\n ...(validated.email ? { email: validated.email } : {}),\n resetHash: validated.token,\n realmId: realm.id,\n };\n\n const entity = await this.repository.findOneBy(where);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (!entity.resetExpires \|\| new Date(entity.resetExpires) < new Date()) {\n throw new ResetTokenExpiredError();\n }\n\n const credentialsService = new UserCredentialsService();\n const hashedPassword = await credentialsService.protect(validated.password);\n\n const merged = this.repository.merge(entity, {\n resetAt: new Date().toISOString(),\n resetHash: null,\n resetExpires: null,\n password: hashedPassword,\n });\n\n await this.repository.save(merged);\n\n await this.eventService?.record({\n scope: EventScope.IDENTITY,\n name: EventName.PASSWORD_RESET_COMPLETED,\n refType: EventRefType.USER,\n refId: merged.id,\n actorType: IdentityType.USER,\n actorId: merged.id,\n actorName: merged.name,\n realmId: merged.realmId,\n });\n\n return { resetAt: merged.resetAt! };\n }\n\n private async runForgotPasswordValidator(data: Record<string, any>) {\n const validator = new Container<any>({});\n\n const oneOfContainer = new Container({ oneOf: true });\n\n oneOfContainer.mount(\n 'email',\n createValidator(\n z.string()\n .trim()\n .toLowerCase()\n .email()\n .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n ),\n );\n\n oneOfContainer.mount(\n 'name',\n createValidator(z.string().trim().toLowerCase().min(1)),\n );\n\n validator.mount(oneOfContainer);\n\n validator.mount(\n 'realmId',\n { optional: true },\n createValidator(z.uuid().nullable()),\n );\n\n return validator.run(data);\n }\n\n private async runResetPasswordValidator(data: Record<string, any>) {\n const validator = new Container<any>({});\n\n const oneOfContainer = new Container({ oneOf: true });\n oneOfContainer.mount(\n 'email',\n createValidator(\n z.string()\n .trim()\n .toLowerCase()\n .email()\n .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n ),\n );\n oneOfContainer.mount(\n 'name',\n createValidator(z.string().trim().toLowerCase().min(1)),\n );\n\n validator.mount(oneOfContainer);\n\n validator.mount(\n 'realmId',\n { optional: true },\n createValidator(z.uuid().nullable()),\n );\n\n validator.mount(\n 'token',\n createValidator(z.string().min(3).max(256)),\n );\n\n validator.mount(\n 'password',\n createValidator(\n z.string()\n .min(this.options.passwordMinLength ?? USER_PASSWORD_MIN_LENGTH)\n .max(USER_PASSWORD_MAX_LENGTH),\n ),\n );\n\n return validator.run(data);\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAqCA,IAAakB,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,UAAUM,IAAIN;EACnB,KAAKC,aAAaK,IAAIL;EACtB,KAAKC,kBAAkBI,IAAIJ;EAC3B,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,uBAAuBE,IAAIF;EAChC,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,eAAeC,MAA2BC,SAAkE;EAC9G,IAAI,CAAC,KAAKT,QAAQU,yBACd,MAAM,IAAIrB,8BAAAA;EAGd,IAAI,CAAC,KAAKW,QAAQW,0BACd,MAAM,IAAIrB,+BAA+B,sEAAA;EAG7C,MAAMsB,YAAY,MAAM,KAAKC,2BAA2BL,IAAAA;EAExD,MAAMM,QAAQ,MAAM,KAAKZ,gBAAgBa,QAAQH,UAAUI,SAAS,IAAA;EAEpE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,SAASF,MAAMM;EACnB;EAEA,MAAMC,SAAS,MAAM,KAAKpB,WAAWqB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAIlC,oBAAAA;EAGd,MAAMoC,SAAS,KAAKtB,WAAWuB,MAAMH,QAAQ;GACzCI,cAAc,IAAIC,KACdA,KAAKC,IAAG,IAAM,MAAO,KAAA,EAAK7B,CAAAA,CAC5B8B,YAAW;GACbC,WAAWpC,YAAY,EAAA,CAAA,CAAIqC,SAAS,KAAA;EACxC,CAAA;EAEA,MAAM,KAAK7B,WAAW8B,KAAKR,MAAAA;EAE3B,IAAI;GAKA,MAAMS,WAAW,KAAKhC,QAAQiC,YAC1B,GAAG,KAAKjC,QAAQiC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,wBACpCC,mBAAmBZ,OAAOM,SAAS,EAAA,WACjCM,mBAAmBd,OAAOL,OAAO,MAC7CoB,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKjC,qBAAqBkC,OAAO;IAChDC,UAAU1C,iBAAiB2C;IAC3BC,QAAQ;KACJC,MAAMnB,OAAOM;KACbc,KAAKX;KACLY,kBAAAA;IACJ;IACAC,QAAQpC,SAASoC;GACrB,CAAA;GAEA,MAAM,KAAK1C,WAAW2C,KAAK;IACvBC,IAAI1B,OAAOF;IACX,GAAGkB;GACP,CAAA;EACJ,QAAQ;GACJ,KAAKpC,WAAWuB,MAAMD,QAAQ;IAC1BM,WAAW;IACXJ,cAAc;GAClB,CAAA;GACA,MAAM,KAAKxB,WAAW8B,KAAKR,MAAAA;GAE3B,MAAM,IAAInC,gBAAgB,uDAAA;EAC9B;EAEA,MAAM,KAAKiB,cAAc2C,OAAO;GAC5BC,OAAOlE,WAAWmE;GAClBhC,MAAMrC,UAAUsE;GAChBC,SAAStE,aAAauE;GACtBC,OAAO/B,OAAOH;GACdmC,WAAWvE,aAAaqE;GACxBG,SAASjC,OAAOH;GAChBqC,WAAWlC,OAAOL;GAClBF,SAASO,OAAOP;EACpB,CAAA;EAEA,OAAO,EAAES,cAAcF,OAAOE,aAAc;CAChD;CAEA,MAAMiC,cAAclD,MAAyD;EACzE,IAAI,CAAC,KAAKR,QAAQU,yBACd,MAAM,IAAIrB,8BAAAA;EAGd,MAAMuB,YAAY,MAAM,KAAK+C,0BAA0BnD,IAAAA;EAEvD,MAAM,KAAKP,WAAW2D,oBAAoBhD,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKZ,gBAAgBa,QAAQH,UAAUI,SAAS,IAAA;EAEpE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,WAAWjB,UAAUiD;GACrB7C,SAASF,MAAMM;EACnB;EAEA,MAAMC,SAAS,MAAM,KAAKpB,WAAW6D,UAAU7C,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAIlC,oBAAAA;EAGd,IAAI,CAACkC,OAAOI,gBAAgB,IAAIC,KAAKL,OAAOI,YAAY,oBAAI,IAAIC,KAAAA,GAC5D,MAAM,IAAInC,uBAAAA;EAId,MAAMyE,iBAAiB,MAAMD,IADEnE,uBACFmE,CAAAA,CAAmBE,QAAQrD,UAAUsD,QAAQ;EAE1E,MAAM3C,SAAS,KAAKtB,WAAWuB,MAAMH,QAAQ;GACzC8C,0BAAS,IAAIzC,KAAAA,EAAAA,CAAOE,YAAW;GAC/BC,WAAW;GACXJ,cAAc;GACdyC,UAAUF;EACd,CAAA;EAEA,MAAM,KAAK/D,WAAW8B,KAAKR,MAAAA;EAE3B,MAAM,KAAKlB,cAAc2C,OAAO;GAC5BC,OAAOlE,WAAWmE;GAClBhC,MAAMrC,UAAUuF;GAChBhB,SAAStE,aAAauE;GACtBC,OAAO/B,OAAOH;GACdmC,WAAWvE,aAAaqE;GACxBG,SAASjC,OAAOH;GAChBqC,WAAWlC,OAAOL;GAClBF,SAASO,OAAOP;EACpB,CAAA;EAEA,OAAO,EAAEmD,SAAS5C,OAAO4C,QAAS;CACtC;CAEA,MAActD,2BAA2BL,MAA2B;EAChE,MAAM6D,YAAY,IAAI3E,UAAe,CAAC,CAAA;EAEtC,MAAM4E,iBAAiB,IAAI5E,UAAU,EAAE6E,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MACX,SACAhF,gBACIG,EAAE8E,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXxD,MAAK,CAAA,CACLyD,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAItEP,eAAeE,MACX,QACAhF,gBAAgBG,EAAE8E,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,WACA,EAAEO,UAAU,KAAK,GACjBvF,gBAAgBG,EAAEqF,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrC,OAAOZ,UAAUa,IAAI1E,IAAAA;CACzB;CAEA,MAAcmD,0BAA0BnD,MAA2B;EAC/D,MAAM6D,YAAY,IAAI3E,UAAe,CAAC,CAAA;EAEtC,MAAM4E,iBAAiB,IAAI5E,UAAU,EAAE6E,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACAhF,gBACIG,EAAE8E,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXxD,MAAK,CAAA,CACLyD,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAGtEP,eAAeE,MACX,QACAhF,gBAAgBG,EAAE8E,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,WACA,EAAEO,UAAU,KAAK,GACjBvF,gBAAgBG,EAAEqF,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrCZ,UAAUG,MACN,SACAhF,gBAAgBG,EAAE8E,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1Cd,UAAUG,MACN,YACAhF,gBACIG,EAAE8E,OAAM,CAAA,CACHK,IAAI,KAAK9E,QAAQoF,qBAAqBlG,wBAAAA,CAAAA,CACtCiG,IAAIlG,wBAAAA,CAAAA,CAAAA;EAIjB,OAAOoF,UAAUa,IAAI1E,IAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/token-expired.d.ts CHANGED Viewed

@@ -1,6 +1,6 @@
-import { BadRequestError } from '@authup/errors';
+import { ValidationError } from '@authup/errors';
 export declare const RESET_TOKEN_EXPIRED_ERROR_INSTANCE: unique symbol;
-export declare class ResetTokenExpiredError extends BadRequestError {
+export declare class ResetTokenExpiredError extends ValidationError {
     constructor();
 }
 //# sourceMappingURL=token-expired.d.ts.map

package/dist/core/identity/password-recovery/token-expired.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"token-expired.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/token-expired.ts"],"names":[],"mappings":"AAOA,OAAO,~~EAAE~~,eAAe,~~EAA6B~~,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,kCAAkC,eAA2D,CAAC;AAE3G,qBAAa,sBAAuB,SAAQ,eAAe;;CAQ1D"}
1	+ {"version":3,"file":"token-expired.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/token-expired.ts"],"names":[],"mappings":"AAOA,OAAO,EAAa,eAAe,EAAkB,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,kCAAkC,eAA2D,CAAC;AAE3G,qBAAa,sBAAuB,SAAQ,eAAe;;CAQ1D"}

package/dist/core/identity/password-recovery/token-expired.mjs CHANGED Viewed

@@ -1,10 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { BadRequestError, ErrorCode, markInstanceof } from "@authup/errors";
+import { ErrorCode, ValidationError, markInstanceof } from "@authup/errors";
 //#region src/core/identity/password-recovery/token-expired.ts
 const RESET_TOKEN_EXPIRED_ERROR_INSTANCE = Symbol.for("@authup/server-core/ResetTokenExpiredError");
-var ResetTokenExpiredError = class extends BadRequestError {
+var ResetTokenExpiredError = class extends ValidationError {
 	constructor() {
 		super({
 			code: ErrorCode.RESET_TOKEN_EXPIRED,

package/dist/core/identity/password-recovery/token-expired.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"token-expired.mjs","names":["~~BadRequestError~~","~~ErrorCode~~","markInstanceof","RESET_TOKEN_EXPIRED_ERROR_INSTANCE","Symbol","for","ResetTokenExpiredError","code","RESET_TOKEN_EXPIRED","message"],"sources":["../../../../src/core/identity/password-recovery/token-expired.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ~~BadRequestError~~, ~~ErrorCode~~, markInstanceof } from '@authup/errors';\n\nexport const RESET_TOKEN_EXPIRED_ERROR_INSTANCE = Symbol.for('@authup/server-core/ResetTokenExpiredError');\n\nexport class ResetTokenExpiredError extends ~~BadRequestError~~ {\n constructor() {\n super({\n code: ErrorCode.RESET_TOKEN_EXPIRED,\n message: 'Reset token has expired.',\n });\n markInstanceof(this, RESET_TOKEN_EXPIRED_ERROR_INSTANCE);\n }\n}\n"],"mappings":";;;;;AASA,MAAaG,qCAAqCC,OAAOC,IAAI,4CAAA;AAE7D,IAAaC,yBAAb,~~cAA4CN~~,gBAAAA;CACxC,cAAc;EACV,MAAM;~~GACFO~~,~~MAAMN~~,~~UAAUO~~;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,kCAAAA;CACzB;AACJ"}
1	+ {"version":3,"file":"token-expired.mjs","names":["ErrorCode","ValidationError","markInstanceof","RESET_TOKEN_EXPIRED_ERROR_INSTANCE","Symbol","for","ResetTokenExpiredError","code","RESET_TOKEN_EXPIRED","message"],"sources":["../../../../src/core/identity/password-recovery/token-expired.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode, ValidationError, markInstanceof } from '@authup/errors';\n\nexport const RESET_TOKEN_EXPIRED_ERROR_INSTANCE = Symbol.for('@authup/server-core/ResetTokenExpiredError');\n\nexport class ResetTokenExpiredError extends ValidationError {\n constructor() {\n super({\n code: ErrorCode.RESET_TOKEN_EXPIRED,\n message: 'Reset token has expired.',\n });\n markInstanceof(this, RESET_TOKEN_EXPIRED_ERROR_INSTANCE);\n }\n}\n"],"mappings":";;;;;AASA,MAAaG,qCAAqCC,OAAOC,IAAI,4CAAA;AAE7D,IAAaC,yBAAb,cAA4CL,gBAAAA;CACxC,cAAc;EACV,MAAM;GACFM,MAAMP,UAAUQ;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,kCAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/types.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
-import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';
 import type { IdentityWorkflowContext } from '../types.ts';
 export type PasswordRecoveryServiceOptions = {
     passwordRecoveryEnabled?: boolean;
@@ -13,12 +13,13 @@ export type PasswordRecoveryServiceContext = {
     mailTemplateRenderer: IMailTemplateRenderer;
     repository: IUserRepository;
     realmRepository: IRealmRepository;
+    eventService?: IEventService;
 };
 export type PasswordForgotResult = {
-    reset_expires: string;
+    resetExpires: string;
 };
 export type PasswordResetResult = {
-    reset_at: string;
+    resetAt: string;
 };
 export interface IPasswordRecoveryService {
     forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult>;

package/dist/core/identity/password-recovery/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;~~AACjF~~,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,8BAA8B,GAAG;IACzC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;~~CACrC~~,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,~~aAAa~~,EAAE,MAAM,CAAC;~~CACzB~~,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,~~QAAQ~~,EAAE,MAAM,CAAC;~~CACpB~~,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1E"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,8BAA8B,GAAG;IACzC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;IAClC,YAAY,CAAC,EAAE,aAAa,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,YAAY,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1E"}

package/dist/core/identity/permission/checker/service.mjs CHANGED Viewed

@@ -20,7 +20,7 @@ var PermissionCheckerService = class {
 			if (realm) {
 				const realmId = await this.ctx.realmRepository.resolveId(realm);
 				if (!realmId) throw new EntityNotFoundError();
-				criteria.realm_id = realmId;
+				criteria.realmId = realmId;
 			}
 		}
 		const entity = await this.ctx.repository.findOneBy(criteria);
@@ -28,7 +28,7 @@ var PermissionCheckerService = class {
 		const input = { ...data };
 		if (typeof input[BuiltInPolicyType.IDENTITY] === "undefined") input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);
 		const attributes = input[BuiltInPolicyType.ATTRIBUTES];
-		if (attributes && hasOwnProperty(attributes, "realm_id")) input[BuiltInPolicyType.REALM_MATCH] = attributes.realm_id ?? null;
+		if (attributes && hasOwnProperty(attributes, "realmId")) input[BuiltInPolicyType.REALM_MATCH] = attributes.realmId ?? null;
 		const evaluationContext = {
 			name: entity.name,
 			data: definePolicyData(input)

package/dist/core/identity/permission/checker/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionEvaluator","definePolicyData","hasOwnProperty","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PermissionCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","name","realmId","realmRepository","resolveId","~~realm_id","~~entity","repository","findOneBy","input","IDENTITY","identity","attributes","ATTRIBUTES","REALM_MATCH","evaluationContext","evaluator","provider","permissionProvider","policyEngine","identityPermissionProvider","has","evaluate","preEvaluate","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/permission/checker/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PermissionEvaluationContext } from '@authup/access';\nimport { BuiltInPolicyType, PermissionEvaluator, definePolicyData } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { hasOwnProperty, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../identity-policy-data.ts';\nimport type {\n IPermissionCheckerService,\n PermissionCheckerServiceContext,\n} from './types.ts';\n\nexport class PermissionCheckerService implements IPermissionCheckerService {\n protected ctx: PermissionCheckerServiceContext;\n\n constructor(ctx: PermissionCheckerServiceContext) {\n this.ctx = ctx;\n }\n\n async check(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realm?: string,\n ): Promise<void> {\n let criteria: Record<string, any>;\n if (isUUID(idOrName)) {\n criteria = { id: idOrName };\n } else {\n criteria = { name: idOrName };\n\n if (realm) {\n const realmId = await this.ctx.realmRepository.resolveId(realm);\n if (!realmId) {\n throw new EntityNotFoundError();\n }\n criteria.~~realm_id~~ = realmId;\n }\n }\n\n const entity = await this.ctx.repository.findOneBy(criteria);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const input = { ...data };\n if (typeof input[BuiltInPolicyType.IDENTITY] === 'undefined') {\n input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n }\n // Surface the resource realm to the realm_scope reach factor (realm-match scope mode).\n // Only when the body carries an ATTRIBUTES realm — so a realm-less check still rides\n // the preEvaluate path below and neutral-passes.\n const attributes = input[BuiltInPolicyType.ATTRIBUTES] as Record<string, any> \| undefined;\n if (attributes && hasOwnProperty(attributes, '~~realm_id~~')) {\n input[BuiltInPolicyType.REALM_MATCH] = attributes.~~realm_id~~ ?? null;\n }\n\n const evaluationContext: PermissionEvaluationContext = {\n name: entity.name,\n data: definePolicyData(input),\n };\n\n const evaluator = new PermissionEvaluator({\n provider: this.ctx.permissionProvider,\n policyEngine: new PolicyEngine(this.ctx.identityPermissionProvider),\n });\n\n if (\n evaluationContext.data &&\n evaluationContext.data.has(BuiltInPolicyType.ATTRIBUTES)\n ) {\n await evaluator.evaluate(evaluationContext);\n } else {\n await evaluator.preEvaluate(evaluationContext);\n }\n }\n\n async safeCheck(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realm?: string,\n ): Promise<Result<null>> {\n try {\n await this.check(idOrName, data, actor, realm);\n return { success: true, data: null };\n } catch (e) {\n return { success: false, error: normalizeError(e) };\n }\n }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaS,2BAAb,MAAaA;CACCC;CAEV,YAAYA,KAAsC;EAC9C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACHI,WAAW,EAAEE,MAAMN,SAAS;GAE5B,IAAIG,OAAO;IACP,MAAMI,UAAU,MAAM,KAAKT,IAAIU,gBAAgBC,UAAUN,KAAAA;IACzD,IAAI,CAACI,SACD,MAAM,IAAId,oBAAAA;IAEdW,~~SAASM~~,~~WAAWH~~;~~GACxB~~;EACJ;EAEA,~~MAAMI~~,SAAS,MAAM,~~KAAKb~~,~~IAAIc~~,WAAWC,~~UAAUT~~,QAAAA;EACnD,IAAI,~~CAACO~~,QACD,MAAM,~~IAAIlB~~,oBAAAA;EAGd,~~MAAMqB~~,QAAQ,EAAE,~~GAAGb~~,KAAK;EACxB,IAAI,~~OAAOa~~,~~MAAM1B~~,~~kBAAkB2B~~,cAAc,aAC7CD,~~MAAM1B~~,~~kBAAkB2B~~,~~YAAYnB~~,qBAAqBM,~~MAAMc~~,QAAQ;EAK3E,MAAMC,aAAaH,~~MAAM1B~~,~~kBAAkB8B~~;EAC3C,IAAID,~~cAAc1B~~,~~eAAe0B~~,YAAY,~~UAAA~~,GACzCH,~~MAAM1B~~,~~kBAAkB+B~~,eAAeF,~~WAAWP~~,~~YAAY~~;~~EAGlE~~,~~MAAMU~~,oBAAiD;~~GACnDd~~,~~MAAMK~~,~~OAAOL~~;GACbL,MAAMX,~~iBAAiBwB~~,KAAAA;EAC3B;EAEA,MAAMO,YAAY,~~IAAIhC~~,oBAAoB;~~GACtCiC~~,UAAU,~~KAAKxB~~,~~IAAIyB~~;GACnBC,cAAc,~~IAAI7B~~,eAAa,KAAKG,~~IAAI2B~~,0BAA0B;EACtE,CAAA;EAEA,IACIL,~~kBAAkBnB~~,~~QAClBmB~~,~~kBAAkBnB~~,~~KAAKyB~~,~~IAAItC~~,~~kBAAkB8B~~,UAAU,GAEvD,MAAMG,UAAUM,SAASP,iBAAAA;OAEzB,MAAMC,UAAUO,YAAYR,iBAAAA;CAEpC;CAEA,MAAMS,~~UACF7B~~,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;~~IAAE2B~~,SAAS;~~IAAM7B~~,MAAM;GAAK;EACvC,~~SAAS8B~~,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,~~OAAOtC~~,~~eAAeqC~~,CAAAA;GAAG;EACtD;CACJ;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionEvaluator","definePolicyData","hasOwnProperty","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PermissionCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","name","realmId","realmRepository","resolveId","entity","repository","findOneBy","input","IDENTITY","identity","attributes","ATTRIBUTES","REALM_MATCH","evaluationContext","evaluator","provider","permissionProvider","policyEngine","identityPermissionProvider","has","evaluate","preEvaluate","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/permission/checker/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PermissionEvaluationContext } from '@authup/access';\nimport { BuiltInPolicyType, PermissionEvaluator, definePolicyData } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { hasOwnProperty, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../identity-policy-data.ts';\nimport type {\n IPermissionCheckerService,\n PermissionCheckerServiceContext,\n} from './types.ts';\n\nexport class PermissionCheckerService implements IPermissionCheckerService {\n protected ctx: PermissionCheckerServiceContext;\n\n constructor(ctx: PermissionCheckerServiceContext) {\n this.ctx = ctx;\n }\n\n async check(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realm?: string,\n ): Promise<void> {\n let criteria: Record<string, any>;\n if (isUUID(idOrName)) {\n criteria = { id: idOrName };\n } else {\n criteria = { name: idOrName };\n\n if (realm) {\n const realmId = await this.ctx.realmRepository.resolveId(realm);\n if (!realmId) {\n throw new EntityNotFoundError();\n }\n criteria.realmId = realmId;\n }\n }\n\n const entity = await this.ctx.repository.findOneBy(criteria);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const input = { ...data };\n if (typeof input[BuiltInPolicyType.IDENTITY] === 'undefined') {\n input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n }\n // Surface the resource realm to the realm_scope reach factor (realm-match scope mode).\n // Only when the body carries an ATTRIBUTES realm — so a realm-less check still rides\n // the preEvaluate path below and neutral-passes.\n const attributes = input[BuiltInPolicyType.ATTRIBUTES] as Record<string, any> \| undefined;\n if (attributes && hasOwnProperty(attributes, 'realmId')) {\n input[BuiltInPolicyType.REALM_MATCH] = attributes.realmId ?? null;\n }\n\n const evaluationContext: PermissionEvaluationContext = {\n name: entity.name,\n data: definePolicyData(input),\n };\n\n const evaluator = new PermissionEvaluator({\n provider: this.ctx.permissionProvider,\n policyEngine: new PolicyEngine(this.ctx.identityPermissionProvider),\n });\n\n if (\n evaluationContext.data &&\n evaluationContext.data.has(BuiltInPolicyType.ATTRIBUTES)\n ) {\n await evaluator.evaluate(evaluationContext);\n } else {\n await evaluator.preEvaluate(evaluationContext);\n }\n }\n\n async safeCheck(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realm?: string,\n ): Promise<Result<null>> {\n try {\n await this.check(idOrName, data, actor, realm);\n return { success: true, data: null };\n } catch (e) {\n return { success: false, error: normalizeError(e) };\n }\n }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaS,2BAAb,MAAaA;CACCC;CAEV,YAAYA,KAAsC;EAC9C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACHI,WAAW,EAAEE,MAAMN,SAAS;GAE5B,IAAIG,OAAO;IACP,MAAMI,UAAU,MAAM,KAAKT,IAAIU,gBAAgBC,UAAUN,KAAAA;IACzD,IAAI,CAACI,SACD,MAAM,IAAId,oBAAAA;IAEdW,SAASG,UAAUA;GACvB;EACJ;EAEA,MAAMG,SAAS,MAAM,KAAKZ,IAAIa,WAAWC,UAAUR,QAAAA;EACnD,IAAI,CAACM,QACD,MAAM,IAAIjB,oBAAAA;EAGd,MAAMoB,QAAQ,EAAE,GAAGZ,KAAK;EACxB,IAAI,OAAOY,MAAMzB,kBAAkB0B,cAAc,aAC7CD,MAAMzB,kBAAkB0B,YAAYlB,qBAAqBM,MAAMa,QAAQ;EAK3E,MAAMC,aAAaH,MAAMzB,kBAAkB6B;EAC3C,IAAID,cAAczB,eAAeyB,YAAY,SAAA,GACzCH,MAAMzB,kBAAkB8B,eAAeF,WAAWT,WAAW;EAGjE,MAAMY,oBAAiD;GACnDb,MAAMI,OAAOJ;GACbL,MAAMX,iBAAiBuB,KAAAA;EAC3B;EAEA,MAAMO,YAAY,IAAI/B,oBAAoB;GACtCgC,UAAU,KAAKvB,IAAIwB;GACnBC,cAAc,IAAI5B,eAAa,KAAKG,IAAI0B,0BAA0B;EACtE,CAAA;EAEA,IACIL,kBAAkBlB,QAClBkB,kBAAkBlB,KAAKwB,IAAIrC,kBAAkB6B,UAAU,GAEvD,MAAMG,UAAUM,SAASP,iBAAAA;OAEzB,MAAMC,UAAUO,YAAYR,iBAAAA;CAEpC;CAEA,MAAMS,UACF5B,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAE0B,SAAS;IAAM5B,MAAM;GAAK;EACvC,SAAS6B,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAOrC,eAAeoC,CAAAA;GAAG;EACtD;CACJ;AACJ"}

package/dist/core/identity/permission/identity-policy-data.mjs CHANGED Viewed

@@ -8,9 +8,9 @@ function toIdentityPolicyData(identity) {
 	const { type, data } = identity;
 	let clientId;
 	if (type === IdentityType.CLIENT) clientId = data.id;
-	else if ("client_id" in data) clientId = data.client_id ?? null;
+	else if ("clientId" in data) clientId = data.clientId ?? null;
 	else clientId = null;
-	let realmId = data.realm_id ?? null;
+	let realmId = data.realmId ?? null;
 	if (!realmId && data.realm && data.realm.id) realmId = data.realm.id ?? null;
 	return {
 		type,

package/dist/core/identity/permission/identity-policy-data.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"identity-policy-data.mjs","names":["IdentityType","toIdentityPolicyData","identity","undefined","type","data","clientId","CLIENT","id","~~client_id","~~realmId","~~realm_id","~~realm","realmName","name"],"sources":["../../../../src/core/identity/permission/identity-policy-data.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityPolicyData } from '@authup/access';\nimport { IdentityType } from '@authup/core-kit';\nimport type { Identity } from '@authup/core-kit';\n\nexport function toIdentityPolicyData(identity: Identity \| undefined): IdentityPolicyData \| undefined {\n if (!identity) {\n return undefined;\n }\n\n const { type, data } = identity;\n\n let clientId: string \| null;\n if (type === IdentityType.CLIENT) {\n clientId = data.id;\n } else if ('~~client_id~~' in data) {\n clientId = data.~~client_id~~ ?? null;\n } else {\n clientId = null;\n }\n\n let realmId: string \| null = data.~~realm_id~~ ?? null;\n if (!realmId && data.realm && data.realm.id) {\n realmId = data.realm.id ?? null;\n }\n\n return {\n type,\n id: data.id,\n clientId,\n realmId,\n realmName: data.realm?.name ?? null,\n };\n}\n"],"mappings":";;;;;AAWA,SAAgBC,qBAAqBC,UAA8B;CAC/D,IAAI,CAACA,UACD;CAGJ,MAAM,EAAEE,MAAMC,SAASH;CAEvB,IAAII;CACJ,IAAIF,SAASJ,aAAaO,QACtBD,WAAWD,KAAKG;MACb,IAAI,~~eAAeH~~,~~MACtBC~~,WAAWD,~~KAAKI~~,~~aAAa~~;~~MAE7BH~~,WAAW;CAGf,~~IAAII~~,~~UAAyBL~~,~~KAAKM~~,~~YAAY~~;~~CAC9C~~,IAAI,~~CAACD~~,~~WAAWL~~,~~KAAKO~~,~~SAASP~~,~~KAAKO~~,~~MAAMJ~~,~~IACrCE~~,~~UAAUL~~,~~KAAKO~~,~~MAAMJ~~,MAAM;CAG/B,OAAO;EACHJ;EACAI,IAAIH,KAAKG;EACTF;~~EACAI~~;~~EACAG~~,~~WAAWR~~,~~KAAKO~~,OAAOE,QAAQ;CACnC;AACJ"}
1	+ {"version":3,"file":"identity-policy-data.mjs","names":["IdentityType","toIdentityPolicyData","identity","undefined","type","data","clientId","CLIENT","id","realmId","realm","realmName","name"],"sources":["../../../../src/core/identity/permission/identity-policy-data.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityPolicyData } from '@authup/access';\nimport { IdentityType } from '@authup/core-kit';\nimport type { Identity } from '@authup/core-kit';\n\nexport function toIdentityPolicyData(identity: Identity \| undefined): IdentityPolicyData \| undefined {\n if (!identity) {\n return undefined;\n }\n\n const { type, data } = identity;\n\n let clientId: string \| null;\n if (type === IdentityType.CLIENT) {\n clientId = data.id;\n } else if ('clientId' in data) {\n clientId = data.clientId ?? null;\n } else {\n clientId = null;\n }\n\n let realmId: string \| null = data.realmId ?? null;\n if (!realmId && data.realm && data.realm.id) {\n realmId = data.realm.id ?? null;\n }\n\n return {\n type,\n id: data.id,\n clientId,\n realmId,\n realmName: data.realm?.name ?? null,\n };\n}\n"],"mappings":";;;;;AAWA,SAAgBC,qBAAqBC,UAA8B;CAC/D,IAAI,CAACA,UACD;CAGJ,MAAM,EAAEE,MAAMC,SAASH;CAEvB,IAAII;CACJ,IAAIF,SAASJ,aAAaO,QACtBD,WAAWD,KAAKG;MACb,IAAI,cAAcH,MACrBC,WAAWD,KAAKC,YAAY;MAE5BA,WAAW;CAGf,IAAIG,UAAyBJ,KAAKI,WAAW;CAC7C,IAAI,CAACA,WAAWJ,KAAKK,SAASL,KAAKK,MAAMF,IACrCC,UAAUJ,KAAKK,MAAMF,MAAM;CAG/B,OAAO;EACHJ;EACAI,IAAIH,KAAKG;EACTF;EACAG;EACAE,WAAWN,KAAKK,OAAOE,QAAQ;CACnC;AACJ"}

package/dist/core/identity/permission/index.d.ts CHANGED Viewed

@@ -1,4 +1,5 @@
 export * from './checker/index.ts';
+export * from './identity-policy-data.ts';
 export * from './junction-grant.ts';
 export * from './module.ts';
 export * from './types.ts';

package/dist/core/identity/permission/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/identity/permission/index.mjs CHANGED Viewed

@@ -2,7 +2,8 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { applyJunctionCreateGrant, buildJunctionUpdateData } from "./junction-grant.mjs";
+import { toIdentityPolicyData } from "./identity-policy-data.mjs";
 import { PermissionCheckerService } from "./checker/service.mjs";
 import "./checker/index.mjs";
 import { IdentityPermissionProvider } from "./module.mjs";
-export { IdentityPermissionProvider, PermissionCheckerService, applyJunctionCreateGrant, buildJunctionUpdateData };
+export { IdentityPermissionProvider, PermissionCheckerService, applyJunctionCreateGrant, buildJunctionUpdateData, toIdentityPolicyData };

package/dist/core/identity/permission/junction-grant.d.ts CHANGED Viewed

@@ -2,7 +2,7 @@ import { RealmScope } from '@authup/access';
 import type { ResolveJunctionGrantResult } from './types.ts';
 /**
  * The privilege-escalation boundary for permission-binding junctions, shared verbatim by
- * role/user/client/robot-permission. Kept in ONE place (rather than copied into each service)
+ * role/user/client-permission. Kept in ONE place (rather than copied into each service)
  * so the fail-closed cap/inherit rule is audited and changed once — see #3160 / #3158 / #3159,
  * which each had to patch this rule across all four services.
  *
@@ -12,9 +12,9 @@ import type { ResolveJunctionGrantResult } from './types.ts';
 /**
  * Cap a junction CREATE to the actor's request-relative selected grant and inherit its policy.
  *
- * - `realm_scope` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).
+ * - `realmScope` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).
  * - The policy follows the grant: only a genuinely unrestricted actor (an UNCAPPED `any` reach
- *   AND no policy) may keep an explicitly-requested `policy_id`; any restricted/policy-bound
+ *   AND no policy) may keep an explicitly-requested `policyId`; any restricted/policy-bound
  *   actor inherits its own grant's policy (it can neither attach an unowned policy nor detach to
  *   widen). The check reads `grant.realmScope` UNCAPPED precisely to distinguish that case — the
  *   grant is returned uncapped by `resolveJunctionGrant` for exactly this reason.
@@ -35,13 +35,13 @@ export type BuildJunctionUpdateDataInput = {
     actorPolicyId: string | null;
 };
 /**
- * Build the `{ realm_scope?, policy_id? }` delta for a junction UPDATE, capped to the actor's
+ * Build the `{ realmScope?, policyId? }` delta for a junction UPDATE, capped to the actor's
  * request-relative grant.
  *
- * - An unrestricted (`any`, policy-free) actor may set/clear `policy_id` explicitly and is never
+ * - An unrestricted (`any`, policy-free) actor may set/clear `policyId` explicitly and is never
  *   narrowed.
  * - A restricted/policy-bound actor that touches the binding inherits its own grant's policy AND
- *   has the reach re-capped — including the EXISTING `realm_scope` when the update omits it, so a
+ *   has the reach re-capped — including the EXISTING `realmScope` when the update omits it, so a
  *   policy-only edit cannot leave a wider pre-existing reach standing (fail-OPEN otherwise: the
  *   persisted binding must always be dominated by a grant the actor really holds — #3160).
  */

package/dist/core/identity/permission/junction-grant.mjs CHANGED Viewed

@@ -6,7 +6,7 @@ import { RealmScope, minRealmScope } from "@authup/access";
 //#region src/core/identity/permission/junction-grant.ts
 /**
 * The privilege-escalation boundary for permission-binding junctions, shared verbatim by
-* role/user/client/robot-permission. Kept in ONE place (rather than copied into each service)
+* role/user/client-permission. Kept in ONE place (rather than copied into each service)
 * so the fail-closed cap/inherit rule is audited and changed once — see #3160 / #3158 / #3159,
 * which each had to patch this rule across all four services.
 *
@@ -15,39 +15,39 @@ import { RealmScope, minRealmScope } from "@authup/access";
 */ /**
 * Cap a junction CREATE to the actor's request-relative selected grant and inherit its policy.
 *
-* - `realm_scope` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).
+* - `realmScope` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).
 * - The policy follows the grant: only a genuinely unrestricted actor (an UNCAPPED `any` reach
-*   AND no policy) may keep an explicitly-requested `policy_id`; any restricted/policy-bound
+*   AND no policy) may keep an explicitly-requested `policyId`; any restricted/policy-bound
 *   actor inherits its own grant's policy (it can neither attach an unowned policy nor detach to
 *   widen). The check reads `grant.realmScope` UNCAPPED precisely to distinguish that case — the
 *   grant is returned uncapped by `resolveJunctionGrant` for exactly this reason.
 *
 * Mutates `validated` in place (mirrors the surrounding service style).
 */ function applyJunctionCreateGrant(validated, grant) {
-	validated.realm_scope = minRealmScope([validated.realm_scope ?? RealmScope.OWN, grant.realmScope]);
-	if (grant.realmScope !== RealmScope.ANY || grant.policy) validated.policy_id = grant.policy ? grant.policy.id : null;
+	validated.realmScope = minRealmScope([validated.realmScope ?? RealmScope.OWN, grant.realmScope]);
+	if (grant.realmScope !== RealmScope.ANY || grant.policy) validated.policyId = grant.policy ? grant.policy.id : null;
 }
 /**
-* Build the `{ realm_scope?, policy_id? }` delta for a junction UPDATE, capped to the actor's
+* Build the `{ realmScope?, policyId? }` delta for a junction UPDATE, capped to the actor's
 * request-relative grant.
 *
-* - An unrestricted (`any`, policy-free) actor may set/clear `policy_id` explicitly and is never
+* - An unrestricted (`any`, policy-free) actor may set/clear `policyId` explicitly and is never
 *   narrowed.
 * - A restricted/policy-bound actor that touches the binding inherits its own grant's policy AND
-*   has the reach re-capped — including the EXISTING `realm_scope` when the update omits it, so a
+*   has the reach re-capped — including the EXISTING `realmScope` when the update omits it, so a
 *   policy-only edit cannot leave a wider pre-existing reach standing (fail-OPEN otherwise: the
 *   persisted binding must always be dominated by a grant the actor really holds — #3160).
 */ function buildJunctionUpdateData(input) {
 	const { data, existingScope, actorScope, actorPolicyFree, actorPolicyId } = input;
 	const updateData = {};
-	const touchesScope = hasOwnProperty(data, "realm_scope");
-	const touchesPolicy = hasOwnProperty(data, "policy_id");
-	if (touchesScope) updateData.realm_scope = minRealmScope([data.realm_scope, actorScope]);
+	const touchesScope = hasOwnProperty(data, "realmScope");
+	const touchesPolicy = hasOwnProperty(data, "policyId");
+	if (touchesScope) updateData.realmScope = minRealmScope([data.realmScope, actorScope]);
 	if (actorScope === RealmScope.ANY && actorPolicyFree) {
-		if (touchesPolicy) updateData.policy_id = data.policy_id;
+		if (touchesPolicy) updateData.policyId = data.policyId;
 	} else if (touchesScope || touchesPolicy) {
-		updateData.policy_id = actorPolicyId;
-		if (!touchesScope) updateData.realm_scope = minRealmScope([existingScope, actorScope]);
+		updateData.policyId = actorPolicyId;
+		if (!touchesScope) updateData.realmScope = minRealmScope([existingScope, actorScope]);
 	}
 	return updateData;
 }

package/dist/core/identity/permission/junction-grant.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"junction-grant.mjs","names":["RealmScope","minRealmScope","hasOwnProperty","applyJunctionCreateGrant","validated","grant","~~realm_scope~~","OWN","~~realmScope","~~ANY","policy","~~policy_id~~","id","buildJunctionUpdateData","input","data","existingScope","actorScope","actorPolicyFree","actorPolicyId","updateData","touchesScope","touchesPolicy"],"sources":["../../../../src/core/identity/permission/junction-grant.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { RealmScope, minRealmScope } from '@authup/access';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { ResolveJunctionGrantResult } from './types.ts';\n\n/\n The privilege-escalation boundary for permission-binding junctions, shared verbatim by\n * role/user/client~~/robot~~-permission. Kept in ONE place (rather than copied into each service)\n * so the fail-closed cap/inherit rule is audited and changed once — see #3160 / #3158 / #3159,\n * which each had to patch this rule across all four services.\n \n It depends on a server-core type (`ResolveJunctionGrantResult`) and so cannot live on the\n * generic `JunctionEntityService` in `@authup/server-kit` (that would invert the layering).\n /\n\n/\n Cap a junction CREATE to the actor's request-relative selected grant and inherit its policy.\n \n - `~~realm_scope~~` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).\n * - The policy follows the grant: only a genuinely unrestricted actor (an UNCAPPED `any` reach\n * AND no policy) may keep an explicitly-requested `~~policy_id~~`; any restricted/policy-bound\n * actor inherits its own grant's policy (it can neither attach an unowned policy nor detach to\n * widen). The check reads `grant.realmScope` UNCAPPED precisely to distinguish that case — the\n * grant is returned uncapped by `resolveJunctionGrant` for exactly this reason.\n \n Mutates `validated` in place (mirrors the surrounding service style).\n /\nexport function applyJunctionCreateGrant(\n validated: Record<string, any>,\n grant: ResolveJunctionGrantResult,\n): void {\n validated.~~realm_scope~~ = minRealmScope([validated.~~realm_scope~~ ?? RealmScope.OWN, grant.realmScope]);\n\n if (grant.realmScope !== RealmScope.ANY \|\| grant.policy) {\n validated.~~policy_id~~ = grant.policy ? grant.policy.id : null;\n }\n}\n\nexport type BuildJunctionUpdateDataInput = {\n /* The validated update payload (UPDATE group) — presence of a key signals caller intent. /\n data: Record<string, any>,\n /* The persisted junction's current reach (used to re-cap a policy-only edit). /\n existingScope: `${RealmScope}`,\n /* The actor's UNCAPPED selected reach for this permission (`any` for system context). /\n actorScope: `${RealmScope}`,\n /* Whether the actor's selected grant carries no policy. /\n actorPolicyFree: boolean,\n /* The id of the actor's selected grant policy (null when policy-free). /\n actorPolicyId: string \| null,\n};\n\n/\n Build the `{ ~~realm_scope~~?, ~~policy_id~~? }` delta for a junction UPDATE, capped to the actor's\n * request-relative grant.\n \n - An unrestricted (`any`, policy-free) actor may set/clear `~~policy_id~~` explicitly and is never\n * narrowed.\n * - A restricted/policy-bound actor that touches the binding inherits its own grant's policy AND\n * has the reach re-capped — including the EXISTING `~~realm_scope~~` when the update omits it, so a\n * policy-only edit cannot leave a wider pre-existing reach standing (fail-OPEN otherwise: the\n * persisted binding must always be dominated by a grant the actor really holds — #3160).\n */\nexport function buildJunctionUpdateData(input: BuildJunctionUpdateDataInput): Record<string, any> {\n const {\n data, \n existingScope, \n actorScope, \n actorPolicyFree, \n actorPolicyId,\n } = input;\n\n const updateData: Record<string, any> = {};\n\n const touchesScope = hasOwnProperty(data, '~~realm_scope~~');\n const touchesPolicy = hasOwnProperty(data, '~~policy_id~~');\n\n // CAP to the actor's ceiling — a restricted actor may narrow but never widen.\n // (`data` is the validated UPDATE payload, so ~~realm_scope~~ is already a valid enum value;\n // minRealmScope additionally normalizes any out-of-band input fail-closed to `own`.)\n if (touchesScope) {\n updateData.~~realm_scope~~ = minRealmScope([data.~~realm_scope~~ as `${RealmScope}`, actorScope]);\n }\n\n if (actorScope === RealmScope.ANY && actorPolicyFree) {\n if (touchesPolicy) {\n updateData.~~policy_id~~ = data.~~policy_id~~;\n }\n } else if (touchesScope \|\| touchesPolicy) {\n updateData.~~policy_id~~ = actorPolicyId;\n\n if (!touchesScope) {\n updateData.~~realm_scope~~ = minRealmScope([existingScope, actorScope]);\n }\n }\n\n return updateData;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;GAiCA,SAAgBG,yBACZC,WACAC,OAAiC;CAEjCD,UAAUE,~~cAAcL~~,cAAc,CAACG,UAAUE,~~eAAeN~~,WAAWO,KAAKF,~~MAAMG~~,UAAAA,CAAW;~~CAEjG~~,~~IAAIH~~,~~MAAMG~~,~~eAAeR~~,~~WAAWS~~,~~OAAOJ~~,~~MAAMK~~,~~QAC7CN~~,~~UAAUO~~,~~YAAYN~~,~~MAAMK~~,~~SAASL~~,~~MAAMK~~,OAAOE,KAAK;~~AAE/D~~;;;;;;;;;;;GA0BA,SAAgBC,wBAAwBC,OAAmC;CACvE,MAAM,EACFC,MACAC,eACAC,YACAC,iBACAC,kBACAL;CAEJ,MAAMM,aAAkC,CAAC;CAEzC,MAAMC,~~eAAenB~~,~~eAAea~~,MAAM,~~aAAA~~;CAC1C,MAAMO,~~gBAAgBpB~~,~~eAAea~~,MAAM,~~WAAA~~;CAK3C,IAAIM,cACAD,~~WAAWd~~,~~cAAcL~~,cAAc,~~CAACc~~,~~KAAKT~~,~~aAAgCW~~,UAAAA,CAAW;~~CAG5F~~,IAAIA,~~eAAejB~~,~~WAAWS~~,OAAOS;MAC7BI,eACAF,WAAWT,~~YAAYI~~,KAAKJ;CAAAA,~~OAE7B~~,IAAIU,gBAAgBC,eAAe;EACtCF,WAAWT,~~YAAYQ~~;~~EAEvB~~,IAAI,CAACE,cACDD,~~WAAWd~~,~~cAAcL~~,cAAc,~~CAACe~~,eAAeC,UAAAA,CAAW;~~CAE1E~~;CAEA,OAAOG;AACX"}
1	+ {"version":3,"file":"junction-grant.mjs","names":["RealmScope","minRealmScope","hasOwnProperty","applyJunctionCreateGrant","validated","grant","realmScope","OWN","ANY","policy","policyId","id","buildJunctionUpdateData","input","data","existingScope","actorScope","actorPolicyFree","actorPolicyId","updateData","touchesScope","touchesPolicy"],"sources":["../../../../src/core/identity/permission/junction-grant.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { RealmScope, minRealmScope } from '@authup/access';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { ResolveJunctionGrantResult } from './types.ts';\n\n/\n The privilege-escalation boundary for permission-binding junctions, shared verbatim by\n * role/user/client-permission. Kept in ONE place (rather than copied into each service)\n * so the fail-closed cap/inherit rule is audited and changed once — see #3160 / #3158 / #3159,\n * which each had to patch this rule across all four services.\n \n It depends on a server-core type (`ResolveJunctionGrantResult`) and so cannot live on the\n * generic `JunctionEntityService` in `@authup/server-kit` (that would invert the layering).\n /\n\n/\n Cap a junction CREATE to the actor's request-relative selected grant and inherit its policy.\n \n - `realmScope` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).\n * - The policy follows the grant: only a genuinely unrestricted actor (an UNCAPPED `any` reach\n * AND no policy) may keep an explicitly-requested `policyId`; any restricted/policy-bound\n * actor inherits its own grant's policy (it can neither attach an unowned policy nor detach to\n * widen). The check reads `grant.realmScope` UNCAPPED precisely to distinguish that case — the\n * grant is returned uncapped by `resolveJunctionGrant` for exactly this reason.\n \n Mutates `validated` in place (mirrors the surrounding service style).\n /\nexport function applyJunctionCreateGrant(\n validated: Record<string, any>,\n grant: ResolveJunctionGrantResult,\n): void {\n validated.realmScope = minRealmScope([validated.realmScope ?? RealmScope.OWN, grant.realmScope]);\n\n if (grant.realmScope !== RealmScope.ANY \|\| grant.policy) {\n validated.policyId = grant.policy ? grant.policy.id : null;\n }\n}\n\nexport type BuildJunctionUpdateDataInput = {\n /* The validated update payload (UPDATE group) — presence of a key signals caller intent. /\n data: Record<string, any>,\n /* The persisted junction's current reach (used to re-cap a policy-only edit). /\n existingScope: `${RealmScope}`,\n /* The actor's UNCAPPED selected reach for this permission (`any` for system context). /\n actorScope: `${RealmScope}`,\n /* Whether the actor's selected grant carries no policy. /\n actorPolicyFree: boolean,\n /* The id of the actor's selected grant policy (null when policy-free). /\n actorPolicyId: string \| null,\n};\n\n/\n Build the `{ realmScope?, policyId? }` delta for a junction UPDATE, capped to the actor's\n * request-relative grant.\n \n - An unrestricted (`any`, policy-free) actor may set/clear `policyId` explicitly and is never\n * narrowed.\n * - A restricted/policy-bound actor that touches the binding inherits its own grant's policy AND\n * has the reach re-capped — including the EXISTING `realmScope` when the update omits it, so a\n * policy-only edit cannot leave a wider pre-existing reach standing (fail-OPEN otherwise: the\n * persisted binding must always be dominated by a grant the actor really holds — #3160).\n */\nexport function buildJunctionUpdateData(input: BuildJunctionUpdateDataInput): Record<string, any> {\n const {\n data, \n existingScope, \n actorScope, \n actorPolicyFree, \n actorPolicyId,\n } = input;\n\n const updateData: Record<string, any> = {};\n\n const touchesScope = hasOwnProperty(data, 'realmScope');\n const touchesPolicy = hasOwnProperty(data, 'policyId');\n\n // CAP to the actor's ceiling — a restricted actor may narrow but never widen.\n // (`data` is the validated UPDATE payload, so realmScope is already a valid enum value;\n // minRealmScope additionally normalizes any out-of-band input fail-closed to `own`.)\n if (touchesScope) {\n updateData.realmScope = minRealmScope([data.realmScope as `${RealmScope}`, actorScope]);\n }\n\n if (actorScope === RealmScope.ANY && actorPolicyFree) {\n if (touchesPolicy) {\n updateData.policyId = data.policyId;\n }\n } else if (touchesScope \|\| touchesPolicy) {\n updateData.policyId = actorPolicyId;\n\n if (!touchesScope) {\n updateData.realmScope = minRealmScope([existingScope, actorScope]);\n }\n }\n\n return updateData;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;GAiCA,SAAgBG,yBACZC,WACAC,OAAiC;CAEjCD,UAAUE,aAAaL,cAAc,CAACG,UAAUE,cAAcN,WAAWO,KAAKF,MAAMC,UAAAA,CAAW;CAE/F,IAAID,MAAMC,eAAeN,WAAWQ,OAAOH,MAAMI,QAC7CL,UAAUM,WAAWL,MAAMI,SAASJ,MAAMI,OAAOE,KAAK;AAE9D;;;;;;;;;;;GA0BA,SAAgBC,wBAAwBC,OAAmC;CACvE,MAAM,EACFC,MACAC,eACAC,YACAC,iBACAC,kBACAL;CAEJ,MAAMM,aAAkC,CAAC;CAEzC,MAAMC,eAAelB,eAAeY,MAAM,YAAA;CAC1C,MAAMO,gBAAgBnB,eAAeY,MAAM,UAAA;CAK3C,IAAIM,cACAD,WAAWb,aAAaL,cAAc,CAACa,KAAKR,YAA+BU,UAAAA,CAAW;CAG1F,IAAIA,eAAehB,WAAWQ,OAAOS;MAC7BI,eACAF,WAAWT,WAAWI,KAAKJ;CAAAA,OAE5B,IAAIU,gBAAgBC,eAAe;EACtCF,WAAWT,WAAWQ;EAEtB,IAAI,CAACE,cACDD,WAAWb,aAAaL,cAAc,CAACc,eAAeC,UAAAA,CAAW;CAEzE;CAEA,OAAOG;AACX"}

package/dist/core/identity/permission/module.d.ts CHANGED Viewed

@@ -1,6 +1,5 @@
 import type { IdentityPolicyData, PermissionPolicyBinding } from '@authup/access';
 import type { IClientRepository } from '../../entities/client/types.ts';
-import type { IRobotRepository } from '../../entities/robot/types.ts';
 import type { IRoleRepository } from '../../entities/role/types.ts';
 import type { IUserRepository } from '../../entities/user/types.ts';
 import type { IIdentityRoleProvider } from '../role/types.ts';
@@ -9,7 +8,6 @@ export declare class IdentityPermissionProvider implements IIdentityPermissionPr
     protected clientRepository: IClientRepository;
     protected userRepository: IUserRepository;
     protected roleRepository: IRoleRepository;
-    protected robotRepository: IRobotRepository;
     protected roleProvider: IIdentityRoleProvider;
     constructor(ctx: IdentityPermissionProviderContext);
     isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData): Promise<boolean>;
@@ -17,7 +15,6 @@ export declare class IdentityPermissionProvider implements IIdentityPermissionPr
     getFor(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
     getForClient(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
     getForUser(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
-    getForRobot(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
     getForRole(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
     private combineWithRoleBindings;
     private reduceBindingsByIdentityClient;

package/dist/core/identity/permission/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,kBAAkB,EAElB,uBAAuB,EAC1B,MAAM,gBAAgB,CAAC;AAWxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,~~gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,~~eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EACR,2BAA2B,EAC3B,iCAAiC,EACjC,0BAA0B,EAC1B,4BAA4B,EAC/B,MAAM,YAAY,CAAC;AAEpB,qBAAa,0BAA2B,YAAW,2BAA2B;IAC1E,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,~~eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,~~YAAY,EAAE,qBAAqB,CAAC;gBAElC,GAAG,EAAE,iCAAiC;~~IAQ5C~~,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,OAAO,CAAC;IAgCpF,oBAAoB,CACtB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,4BAA4B,GACtC,OAAO,CAAC,0BAA0B,CAAC;IA6DhC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;~~IAmBzE~~,YAAY,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAO/E,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAQ7E,~~WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAQ9E,~~UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YAKrE,uBAAuB;IAmBrC,OAAO,CAAC,8BAA8B;CAUzC"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,kBAAkB,EAElB,uBAAuB,EAC1B,MAAM,gBAAgB,CAAC;AAWxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EACR,2BAA2B,EAC3B,iCAAiC,EACjC,0BAA0B,EAC1B,4BAA4B,EAC/B,MAAM,YAAY,CAAC;AAEpB,qBAAa,0BAA2B,YAAW,2BAA2B;IAC1E,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,YAAY,EAAE,qBAAqB,CAAC;gBAElC,GAAG,EAAE,iCAAiC;IAO5C,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,OAAO,CAAC;IAgCpF,oBAAoB,CACtB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,4BAA4B,GACtC,OAAO,CAAC,0BAA0B,CAAC;IA6DhC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAgBzE,YAAY,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAO/E,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAQ7E,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YAKrE,uBAAuB;IAmBrC,OAAO,CAAC,8BAA8B;CAUzC"}