npm - @authup/server-core - Versions diffs - 1.0.0-beta.52 → 1.0.0-beta.54 - Mend

@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1541) hide show

package/dist/core/identity/permission/module.mjs CHANGED Viewed

@@ -8,13 +8,11 @@ var IdentityPermissionProvider = class {
 	clientRepository;
 	userRepository;
 	roleRepository;
-	robotRepository;
 	roleProvider;
 	constructor(ctx) {
 		this.clientRepository = ctx.clientRepository;
 		this.userRepository = ctx.userRepository;
 		this.roleRepository = ctx.roleRepository;
-		this.robotRepository = ctx.robotRepository;
 		this.roleProvider = ctx.roleProvider;
 	}
 	async isSuperset(parent, child) {
@@ -31,10 +29,10 @@ var IdentityPermissionProvider = class {
 		const matching = (await this.getFor(identity)).filter((b) => {
 			if (b.permission.name !== options.name) return false;
 			if (typeof options.realmId !== "undefined") {
-				if ((b.permission.realm_id ?? null) !== (options.realmId ?? null)) return false;
+				if ((b.permission.realmId ?? null) !== (options.realmId ?? null)) return false;
 			}
 			if (typeof options.clientId !== "undefined") {
-				if ((b.permission.client_id ?? null) !== (options.clientId ?? null)) return false;
+				if ((b.permission.clientId ?? null) !== (options.clientId ?? null)) return false;
 			}
 			return true;
 		});
@@ -49,14 +47,13 @@ var IdentityPermissionProvider = class {
 		}
 		return {
 			policy,
-			realmScope: selected.realm_scope
+			realmScope: selected.realmScope
 		};
 	}
 	async getFor(identity) {
 		switch (identity.type) {
 			case "client": return this.getForClient(identity);
 			case "user": return this.getForUser(identity);
-			case "robot": return this.getForRobot(identity);
 			case "role": return this.getForRole(identity);
 		}
 		return [];
@@ -67,9 +64,6 @@ var IdentityPermissionProvider = class {
 	async getForUser(identity) {
 		return this.combineWithRoleBindings(this.userRepository.getBoundPermissions(identity.id).then((data) => this.reduceBindingsByIdentityClient(data, identity)), identity);
 	}
-	async getForRobot(identity) {
-		return this.combineWithRoleBindings(this.robotRepository.getBoundPermissions(identity.id).then((data) => this.reduceBindingsByIdentityClient(data, identity)), identity);
-	}
 	async getForRole(identity) {
 		return this.roleRepository.getBoundPermissions(identity.id).then((data) => this.reduceBindingsByIdentityClient(data, identity));
 	}
@@ -81,19 +75,19 @@ var IdentityPermissionProvider = class {
 	}
 	reduceBindingsByIdentityClient(bindings, identity) {
 		if (!identity.clientId) return bindings;
-		return bindings.filter((binding) => binding.permission.client_id === identity.clientId);
+		return bindings.filter((binding) => binding.permission.clientId === identity.clientId);
 	}
 };
 /**
 * Select the held grant that confers the least-restrictive junction for `requested` reach.
 *
 * Each grant is ranked by the reach it can actually confer for THIS request — its own
-* `realm_scope` capped to `requested` — so a lower-scoped policy-free grant beats a
+* `realmScope` capped to `requested` — so a lower-scoped policy-free grant beats a
 * higher-scoped policy-bound grant when both cap to the same requested reach (the mixed-grant
 * fix, #3160). On equal capped reach, a policy-free grant wins (least restrictive). The
 * ORIGINAL (uncapped) grant is returned: the consumer applies the `min` cap itself, and its
-* uncapped `realm_scope`/`policy` drive the "actor is unrestricted-any?" check that decides
-* whether an explicitly-requested `policy_id` may stand.
+* uncapped `realmScope`/`policy` drive the "actor is unrestricted-any?" check that decides
+* whether an explicitly-requested `policyId` may stand.
 *
 * The ordering is TOTAL and deterministic (independent of grant/repository order): ties between
 * two policy-bound grants on equal capped reach are broken by higher uncapped reach, then a
@@ -103,10 +97,10 @@ var IdentityPermissionProvider = class {
 	return grants.reduce((best, grant) => isGrantPreferred(grant, best, requested) ? grant : best);
 }
 /** True when `candidate` is a strictly better propagation source than `incumbent` for `requested`. */ function isGrantPreferred(candidate, incumbent, requested) {
-	const byCapped = compareRealmScope(minRealmScope([candidate.realm_scope, requested]), minRealmScope([incumbent.realm_scope, requested]));
+	const byCapped = compareRealmScope(minRealmScope([candidate.realmScope, requested]), minRealmScope([incumbent.realmScope, requested]));
 	if (byCapped !== 0) return byCapped > 0;
 	if (!candidate.policy !== !incumbent.policy) return !candidate.policy;
-	const byUncapped = compareRealmScope(candidate.realm_scope, incumbent.realm_scope);
+	const byUncapped = compareRealmScope(candidate.realmScope, incumbent.realmScope);
 	if (byUncapped !== 0) return byUncapped > 0;
 	const candidateId = candidate.policy && isPolicy(candidate.policy) ? candidate.policy.id : void 0;
 	const incumbentId = incumbent.policy && isPolicy(incumbent.policy) ? incumbent.policy.id : void 0;

package/dist/core/identity/permission/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["RealmScope","aggregatePermissionPolicyBindings","compareRealmScope","grantDominates","isPermissionPolicyBindingEqual","minRealmScope","isPolicy","IdentityPermissionProvider","clientRepository","userRepository","roleRepository","robotRepository","roleProvider","ctx","isSuperset","parent","child","parentAggregated","getFor","childAggregated","childItem","parentItem","find","p","childGrant","grants","dominated","some","parentGrant","resolveJunctionGrant","identity","options","bindings","matching","filter","b","permission","name","realmId","realm_id","clientId","client_id","length","realmScope","OWN","flatMap","item","requested","selected","selectGrantForRequest","policy","NONE","realm_scope","type","getForClient","getForUser","getForRobot","getForRole","combineWithRoleBindings","getBoundPermissions","id","then","data","reduceBindingsByIdentityClient","bindingsPromise","roles","Promise","all","getRolesFor","roleBindings","getBoundPermissionsForMany","binding","reduce","best","grant","isGrantPreferred","candidate","incumbent","byCapped","byUncapped","candidateId","undefined","incumbentId"],"sources":["../../../../src/core/identity/permission/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type {\n IdentityPolicyData,\n PermissionGrant,\n PermissionPolicyBinding,\n} from '@authup/access';\nimport {\n RealmScope,\n aggregatePermissionPolicyBindings,\n compareRealmScope,\n grantDominates,\n isPermissionPolicyBindingEqual,\n minRealmScope,\n} from '@authup/access';\nimport type { Policy } from '@authup/core-kit';\nimport { isPolicy } from '@authup/core-kit';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IRoleRepository } from '../../entities/role/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider } from '../role/types.ts';\nimport type {\n IIdentityPermissionProvider,\n IdentityPermissionProviderContext,\n ResolveJunctionGrantResult,\n ResolveJunctionPolicyOptions,\n} from './types.ts';\n\nexport class IdentityPermissionProvider implements IIdentityPermissionProvider {\n protected clientRepository: IClientRepository;\n\n protected userRepository: IUserRepository;\n\n protected roleRepository: IRoleRepository;\n\n protected robotRepository: IRobotRepository;\n\n protected roleProvider: IIdentityRoleProvider;\n\n constructor(ctx: IdentityPermissionProviderContext) {\n this.clientRepository = ctx.clientRepository;\n this.userRepository = ctx.userRepository;\n this.roleRepository = ctx.roleRepository;\n this.robotRepository = ctx.robotRepository;\n this.roleProvider = ctx.roleProvider;\n }\n\n async isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData) : Promise<boolean> {\n const parentAggregated = aggregatePermissionPolicyBindings(await this.getFor(parent));\n const childAggregated = aggregatePermissionPolicyBindings(await this.getFor(child));\n\n for (const childItem of childAggregated) {\n const parentItem = parentAggregated.find(\n (p) => isPermissionPolicyBindingEqual(p, childItem),\n );\n\n if (!parentItem) {\n return false;\n }\n\n // Disjunction-aware superset: EVERY child grant must be dominated by SOME parent\n // grant (reach >= AND the parent's policy provably covers the child's — see\n // grantDominates). A child grant the parent cannot match — an unconditional `any`\n // the parent only holds policy-gated, or a policy the parent does not itself hold\n // (#3159) — fails the check; the actor cannot assign more than it holds.\n for (const childGrant of childItem.grants) {\n const dominated = parentItem.grants.some(\n (parentGrant) => grantDominates(parentGrant, childGrant),\n );\n\n if (!dominated) {\n return false;\n }\n }\n }\n\n return true;\n }\n\n async resolveJunctionGrant(\n identity: IdentityPolicyData,\n options: ResolveJunctionPolicyOptions,\n ): Promise<ResolveJunctionGrantResult> {\n const bindings = await this.getFor(identity);\n const matching = bindings.filter((b) => {\n if (b.permission.name !== options.name) {\n return false;\n }\n\n if (typeof options.realmId !== 'undefined') {\n if ((b.permission.realm_id ?? null) !== (options.realmId ?? null)) {\n return false;\n }\n }\n\n if (typeof options.clientId !== 'undefined') {\n if ((b.permission.client_id ?? null) !== (options.clientId ?? null)) {\n return false;\n }\n }\n\n return true;\n });\n\n if (matching.length === 0) {\n return { realmScope: RealmScope.OWN };\n }\n\n // Consider EVERY matching grant (a caller omitting realmId/clientId may leave more\n // than one permission-key group); combined with the total ordering in\n // selectGrantForRequest, the selection never depends on grant/repository order.\n const grants = aggregatePermissionPolicyBindings(matching)\n .flatMap((item) => item.grants);\n if (grants.length === 0) {\n return { realmScope: RealmScope.OWN };\n }\n\n // Select the actor's grant RELATIVE to the requested reach (#3160): the grant that\n // confers the least-restrictive junction once capped to `realmScope` (highest capped\n // reach, policy-free preferred on a tie) — NOT a global \"ceiling\". A mixed-grant actor\n // (e.g. own+no-policy and any+policy) thus propagates its policy-free own grant for an\n // own request instead of inheriting the wider grant's policy. The selected grant is\n // returned UNCAPPED so the consumer's own cap (`min(requested, realmScope)`) and its\n // \"actor is unrestricted-any?\" check (which honours an explicit policy_id) still hold.\n const requested = options.realmScope ?? RealmScope.OWN;\n const selected = selectGrantForRequest(grants, requested);\n\n let policy: Policy \| undefined;\n if (selected.policy) {\n // The selected grant is policy-restricted but its policy is not a propagatable\n // Policy (e.g. a composite with no id). Fail CLOSED: a `none` reach blocks\n // propagation rather than silently dropping the restriction and widening to an\n // unrestricted grant.\n if (!isPolicy(selected.policy)) {\n return { realmScope: RealmScope.NONE };\n }\n\n policy = selected.policy;\n }\n\n return { policy, realmScope: selected.realm_scope };\n }\n\n async getFor(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n switch (identity.type) {\n case 'client': {\n return this.getForClient(identity);\n }\n case 'user': {\n return this.getForUser(identity);\n }\n case 'robot': {\n return this.getForRobot(identity);\n }\n case 'role': {\n return this.getForRole(identity);\n }\n }\n\n return [];\n }\n\n async getForClient(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n return this.combineWithRoleBindings(\n this.clientRepository.getBoundPermissions(identity.id),\n identity,\n );\n }\n\n async getForUser(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n return this.combineWithRoleBindings(\n this.userRepository.getBoundPermissions(identity.id)\n .then((data) => this.reduceBindingsByIdentityClient(data, identity)),\n identity,\n );\n }\n\n async getForRobot(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n return this.combineWithRoleBindings(\n this.robotRepository.getBoundPermissions(identity.id)\n .then((data) => this.reduceBindingsByIdentityClient(data, identity)),\n identity,\n );\n }\n\n async getForRole(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n return this.roleRepository.getBoundPermissions(identity.id)\n .then((data) => this.reduceBindingsByIdentityClient(data, identity));\n }\n\n private async combineWithRoleBindings(\n bindingsPromise: Promise<PermissionPolicyBinding[]>,\n identity: IdentityPolicyData,\n ): Promise<PermissionPolicyBinding[]> {\n const [bindings, roles] = await Promise.all([\n bindingsPromise,\n this.roleProvider.getRolesFor(identity),\n ]);\n const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);\n if (roleBindings.length === 0) {\n return bindings;\n }\n\n return [\n ...bindings,\n ...roleBindings,\n ];\n }\n\n private reduceBindingsByIdentityClient(\n bindings: PermissionPolicyBinding[],\n identity: IdentityPolicyData,\n ): PermissionPolicyBinding[] {\n if (!identity.clientId) {\n return bindings;\n }\n\n return bindings.filter((binding) => binding.permission.client_id === identity.clientId);\n }\n}\n\n/\n Select the held grant that confers the least-restrictive junction for `requested` reach.\n \n Each grant is ranked by the reach it can actually confer for THIS request — its own\n * `realm_scope` capped to `requested` — so a lower-scoped policy-free grant beats a\n * higher-scoped policy-bound grant when both cap to the same requested reach (the mixed-grant\n * fix, #3160). On equal capped reach, a policy-free grant wins (least restrictive). The\n * ORIGINAL (uncapped) grant is returned: the consumer applies the `min` cap itself, and its\n * uncapped `realm_scope`/`policy` drive the \"actor is unrestricted-any?\" check that decides\n * whether an explicitly-requested `policy_id` may stand.\n \n The ordering is TOTAL and deterministic (independent of grant/repository order): ties between\n * two policy-bound grants on equal capped reach are broken by higher uncapped reach, then a\n * propagatable policy (one with an id) over an id-less composite that would fail closed, then\n * lexicographic policy id.\n /\nfunction selectGrantForRequest(\n grants: PermissionGrant[],\n requested: `${RealmScope}`,\n): PermissionGrant {\n return grants.reduce((best, grant) => (isGrantPreferred(grant, best, requested) ? grant : best));\n}\n\n/* True when `candidate` is a strictly better propagation source than `incumbent` for `requested`. */\nfunction isGrantPreferred(\n candidate: PermissionGrant,\n incumbent: PermissionGrant,\n requested: `${RealmScope}`,\n): boolean {\n const byCapped = compareRealmScope(\n minRealmScope([candidate.realm_scope, requested]),\n minRealmScope([incumbent.realm_scope, requested]),\n );\n if (byCapped !== 0) {\n return byCapped > 0;\n }\n\n // Least restrictive: a policy-free grant beats a policy-bound one on equal capped reach.\n if (!candidate.policy !== !incumbent.policy) {\n return !candidate.policy;\n }\n\n // Deterministic tie-break for two policy-bound grants on equal capped reach.\n const byUncapped = compareRealmScope(candidate.realm_scope, incumbent.realm_scope);\n if (byUncapped !== 0) {\n return byUncapped > 0;\n }\n\n // Prefer a propagatable policy (has an id) over an id-less composite that would fail closed.\n const candidateId = candidate.policy && isPolicy(candidate.policy) ? candidate.policy.id : undefined;\n const incumbentId = incumbent.policy && isPolicy(incumbent.policy) ? incumbent.policy.id : undefined;\n if (candidateId !== incumbentId) {\n if (typeof candidateId === 'undefined') {\n return false;\n }\n if (typeof incumbentId === 'undefined') {\n return true;\n }\n return candidateId < incumbentId;\n }\n\n return false;\n}\n"],"mappings":";;;;;;AAkCA,IAAaO,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKL,mBAAmBK,IAAIL;EAC5B,KAAKC,iBAAiBI,IAAIJ;EAC1B,KAAKC,iBAAiBG,IAAIH;EAC1B,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,WAAWC,QAA4BC,OAA8C;EACvF,MAAMC,mBAAmBhB,kCAAkC,MAAM,KAAKiB,OAAOH,MAAAA,CAAAA;EAC7E,MAAMI,kBAAkBlB,kCAAkC,MAAM,KAAKiB,OAAOF,KAAAA,CAAAA;EAE5E,KAAK,MAAMI,aAAaD,iBAAiB;GACrC,MAAME,aAAaJ,iBAAiBK,MAC/BC,MAAMnB,+BAA+BmB,GAAGH,SAAAA,CAAAA;GAG7C,IAAI,CAACC,YACD,OAAO;GAQX,KAAK,MAAMG,cAAcJ,UAAUK,QAK/B,IAAI,CAJcJ,WAAWI,OAAOE,MAC/BC,gBAAgBzB,eAAeyB,aAAaJ,UAAAA,CAG5CE,GACD,OAAO;EAGnB;EAEA,OAAO;CACX;CAEA,MAAMG,qBACFC,UACAC,SACmC;EAEnC,MAAME,YAAWD,MADM,KAAKd,OAAOY,QAAAA,EAAAA,CACTI,QAAQC,MAAAA;GAC9B,IAAIA,EAAEC,WAAWC,SAASN,QAAQM,MAC9B,OAAO;GAGX,IAAI,OAAON,QAAQO,YAAY;SACtBH,EAAEC,WAAWG,YAAY,WAAWR,QAAQO,WAAW,OACxD,OAAO;GAAA;GAIf,IAAI,OAAOP,QAAQS,aAAa;SACvBL,EAAEC,WAAWK,aAAa,WAAWV,QAAQS,YAAY,OAC1D,OAAO;GAAA;GAIf,OAAO;EACX,CAAA;EAEA,IAAIP,SAASS,WAAW,GACpB,OAAO,EAAEC,YAAY3C,WAAW4C,IAAI;EAMxC,MAAMnB,SAASxB,kCAAkCgC,QAAAA,CAAAA,CAC5CY,SAASC,SAASA,KAAKrB,MAAM;EAClC,IAAIA,OAAOiB,WAAW,GAClB,OAAO,EAAEC,YAAY3C,WAAW4C,IAAI;EAWxC,MAAMI,WAAWC,sBAAsBxB,QADrBM,QAAQY,cAAc3C,WAAW4C,GACJG;EAE/C,IAAIG;EACJ,IAAIF,SAASE,QAAQ;GAKjB,IAAI,CAAC5C,SAAS0C,SAASE,MAAM,GACzB,OAAO,EAAEP,YAAY3C,WAAWmD,KAAK;GAGzCD,SAASF,SAASE;EACtB;EAEA,OAAO;GAAEA;GAAQP,YAAYK,SAASI;EAAY;CACtD;CAEA,MAAMlC,OAAOY,UAAmE;EAC5E,QAAQA,SAASuB,MAAjB;GACI,KAAK,UACD,OAAO,KAAKC,aAAaxB,QAAAA;GAE7B,KAAK,QACD,OAAO,KAAKyB,WAAWzB,QAAAA;GAE3B,KAAK,SACD,OAAO,KAAK0B,YAAY1B,QAAAA;GAE5B,KAAK,QACD,OAAO,KAAK2B,WAAW3B,QAAAA;EAE/B;EAEA,OAAO,CAAA;CACX;CAEA,MAAMwB,aAAaxB,UAAmE;EAClF,OAAO,KAAK4B,wBACR,KAAKlD,iBAAiBmD,oBAAoB7B,SAAS8B,EAAE,GACrD9B,QAAAA;CAER;CAEA,MAAMyB,WAAWzB,UAAmE;EAChF,OAAO,KAAK4B,wBACR,KAAKjD,eAAekD,oBAAoB7B,SAAS8B,EAAE,CAAA,CAC9CC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAMhC,QAAAA,CAAAA,GAC9DA,QAAAA;CAER;CAEA,MAAM0B,YAAY1B,UAAmE;EACjF,OAAO,KAAK4B,wBACR,KAAK/C,gBAAgBgD,oBAAoB7B,SAAS8B,EAAE,CAAA,CAC/CC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAMhC,QAAAA,CAAAA,GAC9DA,QAAAA;CAER;CAEA,MAAM2B,WAAW3B,UAAmE;EAChF,OAAO,KAAKpB,eAAeiD,oBAAoB7B,SAAS8B,EAAE,CAAA,CACrDC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAMhC,QAAAA,CAAAA;CAClE;CAEA,MAAc4B,wBACVM,iBACAlC,UACkC;EAClC,MAAM,CAACE,UAAUiC,SAAS,MAAMC,QAAQC,IAAI,CACxCH,iBACA,KAAKpD,aAAawD,YAAYtC,QAAAA,CAAAA,CACjC;EACD,MAAMuC,eAAe,MAAM,KAAK3D,eAAe4D,2BAA2BL,KAAAA;EAC1E,IAAII,aAAa3B,WAAW,GACxB,OAAOV;EAGX,OAAO,CAAA,GACAA,UAAAA,GACAqC,YAAAA;CAEX;CAEQN,+BACJ/B,UACAF,UACyB;EACzB,IAAI,CAACA,SAASU,UACV,OAAOR;EAGX,OAAOA,SAASE,QAAQqC,YAAYA,QAAQnC,WAAWK,cAAcX,SAASU,QAAQ;CAC1F;AACJ;;;;;;;;;;;;;;;;GAkBA,SAASS,sBACLxB,QACAsB,WAA0B;CAE1B,OAAOtB,OAAO+C,QAAQC,MAAMC,UAAWC,iBAAiBD,OAAOD,MAAM1B,SAAAA,IAAa2B,QAAQD,IAAAA;AAC9F;uGAGA,SAASE,iBACLC,WACAC,WACA9B,WAA0B;CAE1B,MAAM+B,WAAW5E,kBACbG,cAAc,CAACuE,UAAUxB,aAAaL,SAAAA,CAAU,GAChD1C,cAAc,CAACwE,UAAUzB,aAAaL,SAAAA,CAAU,CAAA;CAEpD,IAAI+B,aAAa,GACb,OAAOA,WAAW;CAItB,IAAI,CAACF,UAAU1B,WAAW,CAAC2B,UAAU3B,QACjC,OAAO,CAAC0B,UAAU1B;CAItB,MAAM6B,aAAa7E,kBAAkB0E,UAAUxB,aAAayB,UAAUzB,WAAW;CACjF,IAAI2B,eAAe,GACf,OAAOA,aAAa;CAIxB,MAAMC,cAAcJ,UAAU1B,UAAU5C,SAASsE,UAAU1B,MAAM,IAAI0B,UAAU1B,OAAOU,KAAKqB,KAAAA;CAC3F,MAAMC,cAAcL,UAAU3B,UAAU5C,SAASuE,UAAU3B,MAAM,IAAI2B,UAAU3B,OAAOU,KAAKqB,KAAAA;CAC3F,IAAID,gBAAgBE,aAAa;EAC7B,IAAI,OAAOF,gBAAgB,aACvB,OAAO;EAEX,IAAI,OAAOE,gBAAgB,aACvB,OAAO;EAEX,OAAOF,cAAcE;CACzB;CAEA,OAAO;AACX"}
1	+ {"version":3,"file":"module.mjs","names":["RealmScope","aggregatePermissionPolicyBindings","compareRealmScope","grantDominates","isPermissionPolicyBindingEqual","minRealmScope","isPolicy","IdentityPermissionProvider","clientRepository","userRepository","roleRepository","roleProvider","ctx","isSuperset","parent","child","parentAggregated","getFor","childAggregated","childItem","parentItem","find","p","childGrant","grants","dominated","some","parentGrant","resolveJunctionGrant","identity","options","bindings","matching","filter","b","permission","name","realmId","clientId","length","realmScope","OWN","flatMap","item","requested","selected","selectGrantForRequest","policy","NONE","type","getForClient","getForUser","getForRole","combineWithRoleBindings","getBoundPermissions","id","then","data","reduceBindingsByIdentityClient","bindingsPromise","roles","Promise","all","getRolesFor","roleBindings","getBoundPermissionsForMany","binding","reduce","best","grant","isGrantPreferred","candidate","incumbent","byCapped","byUncapped","candidateId","undefined","incumbentId"],"sources":["../../../../src/core/identity/permission/module.ts"],"sourcesContent":["/\n Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type {\n IdentityPolicyData,\n PermissionGrant,\n PermissionPolicyBinding,\n} from '@authup/access';\nimport {\n RealmScope,\n aggregatePermissionPolicyBindings,\n compareRealmScope,\n grantDominates,\n isPermissionPolicyBindingEqual,\n minRealmScope,\n} from '@authup/access';\nimport type { Policy } from '@authup/core-kit';\nimport { isPolicy } from '@authup/core-kit';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRoleRepository } from '../../entities/role/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider } from '../role/types.ts';\nimport type {\n IIdentityPermissionProvider,\n IdentityPermissionProviderContext,\n ResolveJunctionGrantResult,\n ResolveJunctionPolicyOptions,\n} from './types.ts';\n\nexport class IdentityPermissionProvider implements IIdentityPermissionProvider {\n protected clientRepository: IClientRepository;\n\n protected userRepository: IUserRepository;\n\n protected roleRepository: IRoleRepository;\n\n protected roleProvider: IIdentityRoleProvider;\n\n constructor(ctx: IdentityPermissionProviderContext) {\n this.clientRepository = ctx.clientRepository;\n this.userRepository = ctx.userRepository;\n this.roleRepository = ctx.roleRepository;\n this.roleProvider = ctx.roleProvider;\n }\n\n async isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData) : Promise<boolean> {\n const parentAggregated = aggregatePermissionPolicyBindings(await this.getFor(parent));\n const childAggregated = aggregatePermissionPolicyBindings(await this.getFor(child));\n\n for (const childItem of childAggregated) {\n const parentItem = parentAggregated.find(\n (p) => isPermissionPolicyBindingEqual(p, childItem),\n );\n\n if (!parentItem) {\n return false;\n }\n\n // Disjunction-aware superset: EVERY child grant must be dominated by SOME parent\n // grant (reach >= AND the parent's policy provably covers the child's — see\n // grantDominates). A child grant the parent cannot match — an unconditional `any`\n // the parent only holds policy-gated, or a policy the parent does not itself hold\n // (#3159) — fails the check; the actor cannot assign more than it holds.\n for (const childGrant of childItem.grants) {\n const dominated = parentItem.grants.some(\n (parentGrant) => grantDominates(parentGrant, childGrant),\n );\n\n if (!dominated) {\n return false;\n }\n }\n }\n\n return true;\n }\n\n async resolveJunctionGrant(\n identity: IdentityPolicyData,\n options: ResolveJunctionPolicyOptions,\n ): Promise<ResolveJunctionGrantResult> {\n const bindings = await this.getFor(identity);\n const matching = bindings.filter((b) => {\n if (b.permission.name !== options.name) {\n return false;\n }\n\n if (typeof options.realmId !== 'undefined') {\n if ((b.permission.realmId ?? null) !== (options.realmId ?? null)) {\n return false;\n }\n }\n\n if (typeof options.clientId !== 'undefined') {\n if ((b.permission.clientId ?? null) !== (options.clientId ?? null)) {\n return false;\n }\n }\n\n return true;\n });\n\n if (matching.length === 0) {\n return { realmScope: RealmScope.OWN };\n }\n\n // Consider EVERY matching grant (a caller omitting realmId/clientId may leave more\n // than one permission-key group); combined with the total ordering in\n // selectGrantForRequest, the selection never depends on grant/repository order.\n const grants = aggregatePermissionPolicyBindings(matching)\n .flatMap((item) => item.grants);\n if (grants.length === 0) {\n return { realmScope: RealmScope.OWN };\n }\n\n // Select the actor's grant RELATIVE to the requested reach (#3160): the grant that\n // confers the least-restrictive junction once capped to `realmScope` (highest capped\n // reach, policy-free preferred on a tie) — NOT a global \"ceiling\". A mixed-grant actor\n // (e.g. own+no-policy and any+policy) thus propagates its policy-free own grant for an\n // own request instead of inheriting the wider grant's policy. The selected grant is\n // returned UNCAPPED so the consumer's own cap (`min(requested, realmScope)`) and its\n // \"actor is unrestricted-any?\" check (which honours an explicit policyId) still hold.\n const requested = options.realmScope ?? RealmScope.OWN;\n const selected = selectGrantForRequest(grants, requested);\n\n let policy: Policy \| undefined;\n if (selected.policy) {\n // The selected grant is policy-restricted but its policy is not a propagatable\n // Policy (e.g. a composite with no id). Fail CLOSED: a `none` reach blocks\n // propagation rather than silently dropping the restriction and widening to an\n // unrestricted grant.\n if (!isPolicy(selected.policy)) {\n return { realmScope: RealmScope.NONE };\n }\n\n policy = selected.policy;\n }\n\n return { policy, realmScope: selected.realmScope };\n }\n\n async getFor(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n switch (identity.type) {\n case 'client': {\n return this.getForClient(identity);\n }\n case 'user': {\n return this.getForUser(identity);\n }\n case 'role': {\n return this.getForRole(identity);\n }\n }\n\n return [];\n }\n\n async getForClient(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n return this.combineWithRoleBindings(\n this.clientRepository.getBoundPermissions(identity.id),\n identity,\n );\n }\n\n async getForUser(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n return this.combineWithRoleBindings(\n this.userRepository.getBoundPermissions(identity.id)\n .then((data) => this.reduceBindingsByIdentityClient(data, identity)),\n identity,\n );\n }\n\n async getForRole(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n return this.roleRepository.getBoundPermissions(identity.id)\n .then((data) => this.reduceBindingsByIdentityClient(data, identity));\n }\n\n private async combineWithRoleBindings(\n bindingsPromise: Promise<PermissionPolicyBinding[]>,\n identity: IdentityPolicyData,\n ): Promise<PermissionPolicyBinding[]> {\n const [bindings, roles] = await Promise.all([\n bindingsPromise,\n this.roleProvider.getRolesFor(identity),\n ]);\n const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);\n if (roleBindings.length === 0) {\n return bindings;\n }\n\n return [\n ...bindings,\n ...roleBindings,\n ];\n }\n\n private reduceBindingsByIdentityClient(\n bindings: PermissionPolicyBinding[],\n identity: IdentityPolicyData,\n ): PermissionPolicyBinding[] {\n if (!identity.clientId) {\n return bindings;\n }\n\n return bindings.filter((binding) => binding.permission.clientId === identity.clientId);\n }\n}\n\n/\n Select the held grant that confers the least-restrictive junction for `requested` reach.\n \n Each grant is ranked by the reach it can actually confer for THIS request — its own\n * `realmScope` capped to `requested` — so a lower-scoped policy-free grant beats a\n * higher-scoped policy-bound grant when both cap to the same requested reach (the mixed-grant\n * fix, #3160). On equal capped reach, a policy-free grant wins (least restrictive). The\n * ORIGINAL (uncapped) grant is returned: the consumer applies the `min` cap itself, and its\n * uncapped `realmScope`/`policy` drive the \"actor is unrestricted-any?\" check that decides\n * whether an explicitly-requested `policyId` may stand.\n \n The ordering is TOTAL and deterministic (independent of grant/repository order): ties between\n * two policy-bound grants on equal capped reach are broken by higher uncapped reach, then a\n * propagatable policy (one with an id) over an id-less composite that would fail closed, then\n * lexicographic policy id.\n /\nfunction selectGrantForRequest(\n grants: PermissionGrant[],\n requested: `${RealmScope}`,\n): PermissionGrant {\n return grants.reduce((best, grant) => (isGrantPreferred(grant, best, requested) ? grant : best));\n}\n\n/* True when `candidate` is a strictly better propagation source than `incumbent` for `requested`. */\nfunction isGrantPreferred(\n candidate: PermissionGrant,\n incumbent: PermissionGrant,\n requested: `${RealmScope}`,\n): boolean {\n const byCapped = compareRealmScope(\n minRealmScope([candidate.realmScope, requested]),\n minRealmScope([incumbent.realmScope, requested]),\n );\n if (byCapped !== 0) {\n return byCapped > 0;\n }\n\n // Least restrictive: a policy-free grant beats a policy-bound one on equal capped reach.\n if (!candidate.policy !== !incumbent.policy) {\n return !candidate.policy;\n }\n\n // Deterministic tie-break for two policy-bound grants on equal capped reach.\n const byUncapped = compareRealmScope(candidate.realmScope, incumbent.realmScope);\n if (byUncapped !== 0) {\n return byUncapped > 0;\n }\n\n // Prefer a propagatable policy (has an id) over an id-less composite that would fail closed.\n const candidateId = candidate.policy && isPolicy(candidate.policy) ? candidate.policy.id : undefined;\n const incumbentId = incumbent.policy && isPolicy(incumbent.policy) ? incumbent.policy.id : undefined;\n if (candidateId !== incumbentId) {\n if (typeof candidateId === 'undefined') {\n return false;\n }\n if (typeof incumbentId === 'undefined') {\n return true;\n }\n return candidateId < incumbentId;\n }\n\n return false;\n}\n"],"mappings":";;;;;;AAiCA,IAAaO,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKJ,mBAAmBI,IAAIJ;EAC5B,KAAKC,iBAAiBG,IAAIH;EAC1B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,WAAWC,QAA4BC,OAA8C;EACvF,MAAMC,mBAAmBf,kCAAkC,MAAM,KAAKgB,OAAOH,MAAAA,CAAAA;EAC7E,MAAMI,kBAAkBjB,kCAAkC,MAAM,KAAKgB,OAAOF,KAAAA,CAAAA;EAE5E,KAAK,MAAMI,aAAaD,iBAAiB;GACrC,MAAME,aAAaJ,iBAAiBK,MAC/BC,MAAMlB,+BAA+BkB,GAAGH,SAAAA,CAAAA;GAG7C,IAAI,CAACC,YACD,OAAO;GAQX,KAAK,MAAMG,cAAcJ,UAAUK,QAK/B,IAAI,CAJcJ,WAAWI,OAAOE,MAC/BC,gBAAgBxB,eAAewB,aAAaJ,UAAAA,CAG5CE,GACD,OAAO;EAGnB;EAEA,OAAO;CACX;CAEA,MAAMG,qBACFC,UACAC,SACmC;EAEnC,MAAME,YAAWD,MADM,KAAKd,OAAOY,QAAAA,EAAAA,CACTI,QAAQC,MAAAA;GAC9B,IAAIA,EAAEC,WAAWC,SAASN,QAAQM,MAC9B,OAAO;GAGX,IAAI,OAAON,QAAQO,YAAY;SACtBH,EAAEC,WAAWE,WAAW,WAAWP,QAAQO,WAAW,OACvD,OAAO;GAAA;GAIf,IAAI,OAAOP,QAAQQ,aAAa;SACvBJ,EAAEC,WAAWG,YAAY,WAAWR,QAAQQ,YAAY,OACzD,OAAO;GAAA;GAIf,OAAO;EACX,CAAA;EAEA,IAAIN,SAASO,WAAW,GACpB,OAAO,EAAEC,YAAYxC,WAAWyC,IAAI;EAMxC,MAAMjB,SAASvB,kCAAkC+B,QAAAA,CAAAA,CAC5CU,SAASC,SAASA,KAAKnB,MAAM;EAClC,IAAIA,OAAOe,WAAW,GAClB,OAAO,EAAEC,YAAYxC,WAAWyC,IAAI;EAWxC,MAAMI,WAAWC,sBAAsBtB,QADrBM,QAAQU,cAAcxC,WAAWyC,GACJG;EAE/C,IAAIG;EACJ,IAAIF,SAASE,QAAQ;GAKjB,IAAI,CAACzC,SAASuC,SAASE,MAAM,GACzB,OAAO,EAAEP,YAAYxC,WAAWgD,KAAK;GAGzCD,SAASF,SAASE;EACtB;EAEA,OAAO;GAAEA;GAAQP,YAAYK,SAASL;EAAW;CACrD;CAEA,MAAMvB,OAAOY,UAAmE;EAC5E,QAAQA,SAASoB,MAAjB;GACI,KAAK,UACD,OAAO,KAAKC,aAAarB,QAAAA;GAE7B,KAAK,QACD,OAAO,KAAKsB,WAAWtB,QAAAA;GAE3B,KAAK,QACD,OAAO,KAAKuB,WAAWvB,QAAAA;EAE/B;EAEA,OAAO,CAAA;CACX;CAEA,MAAMqB,aAAarB,UAAmE;EAClF,OAAO,KAAKwB,wBACR,KAAK7C,iBAAiB8C,oBAAoBzB,SAAS0B,EAAE,GACrD1B,QAAAA;CAER;CAEA,MAAMsB,WAAWtB,UAAmE;EAChF,OAAO,KAAKwB,wBACR,KAAK5C,eAAe6C,oBAAoBzB,SAAS0B,EAAE,CAAA,CAC9CC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAM5B,QAAAA,CAAAA,GAC9DA,QAAAA;CAER;CAEA,MAAMuB,WAAWvB,UAAmE;EAChF,OAAO,KAAKnB,eAAe4C,oBAAoBzB,SAAS0B,EAAE,CAAA,CACrDC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAM5B,QAAAA,CAAAA;CAClE;CAEA,MAAcwB,wBACVM,iBACA9B,UACkC;EAClC,MAAM,CAACE,UAAU6B,SAAS,MAAMC,QAAQC,IAAI,CACxCH,iBACA,KAAKhD,aAAaoD,YAAYlC,QAAAA,CAAAA,CACjC;EACD,MAAMmC,eAAe,MAAM,KAAKtD,eAAeuD,2BAA2BL,KAAAA;EAC1E,IAAII,aAAazB,WAAW,GACxB,OAAOR;EAGX,OAAO,CAAA,GACAA,UAAAA,GACAiC,YAAAA;CAEX;CAEQN,+BACJ3B,UACAF,UACyB;EACzB,IAAI,CAACA,SAASS,UACV,OAAOP;EAGX,OAAOA,SAASE,QAAQiC,YAAYA,QAAQ/B,WAAWG,aAAaT,SAASS,QAAQ;CACzF;AACJ;;;;;;;;;;;;;;;;GAkBA,SAASQ,sBACLtB,QACAoB,WAA0B;CAE1B,OAAOpB,OAAO2C,QAAQC,MAAMC,UAAWC,iBAAiBD,OAAOD,MAAMxB,SAAAA,IAAayB,QAAQD,IAAAA;AAC9F;uGAGA,SAASE,iBACLC,WACAC,WACA5B,WAA0B;CAE1B,MAAM6B,WAAWvE,kBACbG,cAAc,CAACkE,UAAU/B,YAAYI,SAAAA,CAAU,GAC/CvC,cAAc,CAACmE,UAAUhC,YAAYI,SAAAA,CAAU,CAAA;CAEnD,IAAI6B,aAAa,GACb,OAAOA,WAAW;CAItB,IAAI,CAACF,UAAUxB,WAAW,CAACyB,UAAUzB,QACjC,OAAO,CAACwB,UAAUxB;CAItB,MAAM2B,aAAaxE,kBAAkBqE,UAAU/B,YAAYgC,UAAUhC,UAAU;CAC/E,IAAIkC,eAAe,GACf,OAAOA,aAAa;CAIxB,MAAMC,cAAcJ,UAAUxB,UAAUzC,SAASiE,UAAUxB,MAAM,IAAIwB,UAAUxB,OAAOQ,KAAKqB,KAAAA;CAC3F,MAAMC,cAAcL,UAAUzB,UAAUzC,SAASkE,UAAUzB,MAAM,IAAIyB,UAAUzB,OAAOQ,KAAKqB,KAAAA;CAC3F,IAAID,gBAAgBE,aAAa;EAC7B,IAAI,OAAOF,gBAAgB,aACvB,OAAO;EAEX,IAAI,OAAOE,gBAAgB,aACvB,OAAO;EAEX,OAAOF,cAAcE;CACzB;CAEA,OAAO;AACX"}

package/dist/core/identity/permission/types.d.ts CHANGED Viewed

@@ -1,7 +1,6 @@
 import type { Policy } from '@authup/core-kit';
 import type { IdentityPolicyData, PermissionPolicyBinding, RealmScope } from '@authup/access';
 import type { IClientRepository } from '../../entities/client/types.ts';
-import type { IRobotRepository } from '../../entities/robot/types.ts';
 import type { IRoleRepository } from '../../entities/role/types.ts';
 import type { IUserRepository } from '../../entities/user/types.ts';
 import type { IIdentityRoleProvider } from '../role/types.ts';
@@ -38,7 +37,6 @@ export interface IIdentityPermissionProvider {
 export type IdentityPermissionProviderContext = {
     clientRepository: IClientRepository;
     userRepository: IUserRepository;
-    robotRepository: IRobotRepository;
     roleRepository: IRoleRepository;
     roleProvider: IIdentityRoleProvider;
 };

package/dist/core/identity/permission/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EACR,kBAAkB,EAClB,uBAAuB,EACvB,UAAU,EACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,~~gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,~~eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9D,MAAM,MAAM,4BAA4B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC;CAChC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,WAAW,2BAA2B;IACxC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACzE,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAClI;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC5C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,~~eAAe,EAAE,gBAAgB,CAAC;IAClC,~~cAAc,EAAE,eAAe,CAAC;IAChC,YAAY,EAAE,qBAAqB,CAAC;CACvC,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EACR,kBAAkB,EAClB,uBAAuB,EACvB,UAAU,EACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9D,MAAM,MAAM,4BAA4B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC;CAChC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,WAAW,2BAA2B;IACxC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACzE,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAClI;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC5C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,cAAc,EAAE,eAAe,CAAC;IAChC,YAAY,EAAE,qBAAqB,CAAC;CACvC,CAAC"}

package/dist/core/identity/policy/checker/service.mjs CHANGED Viewed

@@ -20,14 +20,14 @@ var PolicyCheckerService = class {
 			if (realm) {
 				const realmId = await this.ctx.realmRepository.resolveId(realm);
 				if (!realmId) throw new EntityNotFoundError();
-				criteria.realm_id = realmId;
+				criteria.realmId = realmId;
 			}
 		}
 		const entity = await this.ctx.repository.findOneBy(criteria);
 		if (!entity) throw new EntityNotFoundError();
 		const input = { ...data };
 		if (!input[BuiltInPolicyType.IDENTITY] && input[BuiltInPolicyType.IDENTITY] !== null) input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);
-		await new PolicyEngine$1(this.ctx.identityPermissionProvider).evaluate(entity, definePolicyEvaluationContext({ data: new PolicyData(input) }));
+		await new PolicyEngine$1(this.ctx.identityPermissionProvider).evaluateOrFail(entity, definePolicyEvaluationContext({ data: new PolicyData(input) }));
 	}
 	async safeCheck(idOrName, data, actor, realm) {
 		try {

package/dist/core/identity/policy/checker/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","definePolicyEvaluationContext","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PolicyCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","name","realmId","realmRepository","resolveId","~~realm_id","~~entity","repository","findOneBy","input","IDENTITY","identity","engine","identityPermissionProvider","~~evaluate~~","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/policy/checker/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData, definePolicyEvaluationContext } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../../permission/identity-policy-data.ts';\nimport type {\n IPolicyCheckerService,\n PolicyCheckerServiceContext,\n} from './types.ts';\n\nexport class PolicyCheckerService implements IPolicyCheckerService {\n protected ctx: PolicyCheckerServiceContext;\n\n constructor(ctx: PolicyCheckerServiceContext) {\n this.ctx = ctx;\n }\n\n async check(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realm?: string,\n ): Promise<void> {\n let criteria: Record<string, any>;\n if (isUUID(idOrName)) {\n criteria = { id: idOrName };\n } else {\n criteria = { name: idOrName };\n\n if (realm) {\n const realmId = await this.ctx.realmRepository.resolveId(realm);\n if (!realmId) {\n throw new EntityNotFoundError();\n }\n criteria.~~realm_id~~ = realmId;\n }\n }\n\n const entity = await this.ctx.repository.findOneBy(criteria);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const input = { ...data };\n if (\n !input[BuiltInPolicyType.IDENTITY] &&\n input[BuiltInPolicyType.IDENTITY] !== null\n ) {\n input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n }\n\n const engine = new PolicyEngine(this.ctx.identityPermissionProvider);\n await engine.~~evaluate~~(\n entity,\n definePolicyEvaluationContext({ data: new PolicyData(input) }),\n );\n }\n\n async safeCheck(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realm?: string,\n ): Promise<Result<null>> {\n try {\n await this.check(idOrName, data, actor, realm);\n return { success: true, data: null };\n } catch (e) {\n return { success: false, error: normalizeError(e) };\n }\n }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaQ,uBAAb,MAAaA;CACCC;CAEV,YAAYA,KAAkC;EAC1C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACHI,WAAW,EAAEE,MAAMN,SAAS;GAE5B,IAAIG,OAAO;IACP,MAAMI,UAAU,MAAM,KAAKT,IAAIU,gBAAgBC,UAAUN,KAAAA;IACzD,IAAI,CAACI,SACD,MAAM,IAAId,oBAAAA;IAEdW,~~SAASM~~,~~WAAWH~~;~~GACxB~~;EACJ;EAEA,~~MAAMI~~,SAAS,MAAM,~~KAAKb~~,~~IAAIc~~,WAAWC,~~UAAUT~~,QAAAA;EACnD,IAAI,~~CAACO~~,QACD,MAAM,~~IAAIlB~~,oBAAAA;EAGd,~~MAAMqB~~,QAAQ,EAAE,~~GAAGb~~,KAAK;EACxB,IACI,~~CAACa~~,~~MAAMzB~~,~~kBAAkB0B~~,aACzBD,~~MAAMzB~~,~~kBAAkB0B~~,cAAc,MAEtCD,~~MAAMzB~~,~~kBAAkB0B~~,~~YAAYnB~~,qBAAqBM,~~MAAMc~~,QAAQ;EAI3E,MAAMC,~~IADatB~~,eAAa,KAAKG,~~IAAIoB~~,0BACnCD,CAAAA,CAAOE,~~SACTR~~,~~QACApB~~,8BAA8B,EAAEU,MAAM,IAAIX,~~WAAWwB~~,KAAAA,EAAO,CAAA,CAAA;CAEpE;CAEA,MAAMM,~~UACFpB~~,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;~~IAAEkB~~,SAAS;~~IAAMpB~~,MAAM;GAAK;EACvC,~~SAASqB~~,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,~~OAAO7B~~,~~eAAe4B~~,CAAAA;GAAG;EACtD;CACJ;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","definePolicyEvaluationContext","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PolicyCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","name","realmId","realmRepository","resolveId","entity","repository","findOneBy","input","IDENTITY","identity","engine","identityPermissionProvider","evaluateOrFail","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/policy/checker/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData, definePolicyEvaluationContext } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../../permission/identity-policy-data.ts';\nimport type {\n IPolicyCheckerService,\n PolicyCheckerServiceContext,\n} from './types.ts';\n\nexport class PolicyCheckerService implements IPolicyCheckerService {\n protected ctx: PolicyCheckerServiceContext;\n\n constructor(ctx: PolicyCheckerServiceContext) {\n this.ctx = ctx;\n }\n\n async check(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realm?: string,\n ): Promise<void> {\n let criteria: Record<string, any>;\n if (isUUID(idOrName)) {\n criteria = { id: idOrName };\n } else {\n criteria = { name: idOrName };\n\n if (realm) {\n const realmId = await this.ctx.realmRepository.resolveId(realm);\n if (!realmId) {\n throw new EntityNotFoundError();\n }\n criteria.realmId = realmId;\n }\n }\n\n const entity = await this.ctx.repository.findOneBy(criteria);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const input = { ...data };\n if (\n !input[BuiltInPolicyType.IDENTITY] &&\n input[BuiltInPolicyType.IDENTITY] !== null\n ) {\n input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n }\n\n const engine = new PolicyEngine(this.ctx.identityPermissionProvider);\n await engine.evaluateOrFail(\n entity,\n definePolicyEvaluationContext({ data: new PolicyData(input) }),\n );\n }\n\n async safeCheck(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realm?: string,\n ): Promise<Result<null>> {\n try {\n await this.check(idOrName, data, actor, realm);\n return { success: true, data: null };\n } catch (e) {\n return { success: false, error: normalizeError(e) };\n }\n }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaQ,uBAAb,MAAaA;CACCC;CAEV,YAAYA,KAAkC;EAC1C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACHI,WAAW,EAAEE,MAAMN,SAAS;GAE5B,IAAIG,OAAO;IACP,MAAMI,UAAU,MAAM,KAAKT,IAAIU,gBAAgBC,UAAUN,KAAAA;IACzD,IAAI,CAACI,SACD,MAAM,IAAId,oBAAAA;IAEdW,SAASG,UAAUA;GACvB;EACJ;EAEA,MAAMG,SAAS,MAAM,KAAKZ,IAAIa,WAAWC,UAAUR,QAAAA;EACnD,IAAI,CAACM,QACD,MAAM,IAAIjB,oBAAAA;EAGd,MAAMoB,QAAQ,EAAE,GAAGZ,KAAK;EACxB,IACI,CAACY,MAAMxB,kBAAkByB,aACzBD,MAAMxB,kBAAkByB,cAAc,MAEtCD,MAAMxB,kBAAkByB,YAAYlB,qBAAqBM,MAAMa,QAAQ;EAI3E,MAAMC,IADarB,eAAa,KAAKG,IAAImB,0BACnCD,CAAAA,CAAOE,eACTR,QACAnB,8BAA8B,EAAEU,MAAM,IAAIX,WAAWuB,KAAAA,EAAO,CAAA,CAAA;CAEpE;CAEA,MAAMM,UACFnB,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAEiB,SAAS;IAAMnB,MAAM;GAAK;EACvC,SAASoB,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAO5B,eAAe2B,CAAAA;GAAG;EACtD;CACJ;AACJ"}

package/dist/core/identity/provider/account/module.mjs CHANGED Viewed

@@ -36,13 +36,13 @@ var IdentityProviderAccountManager = class {
 		identity.operation = IdentityProviderIdentityOperation.CREATE;
 		const user = await this.saveUser(identity);
 		account = await this.repository.save({
-			provider_id: identity.provider.id,
-			provider_user_id: identity.id,
-			provider_user_name: user.name,
-			provider_realm_id: identity.provider.realm_id,
+			providerId: identity.provider.id,
+			providerUserId: identity.id,
+			providerUserName: user.name,
+			providerRealmId: identity.provider.realmId,
 			user,
-			user_id: user.id,
-			user_realm_id: user.realm_id
+			userId: user.id,
+			userRealmId: user.realmId
 		});
 		await this.saveRoles(identity, account.user);
 		await this.savePermissions(identity, account.user);
@@ -53,10 +53,10 @@ var IdentityProviderAccountManager = class {
 		const entity = {};
 		for (const attribute of attributes) if (attribute.key && attribute.operation === IdentityProviderMapperOperation.CREATE) entity[attribute.key] = attribute.value;
 		if (!user) {
-			entity.realm_id = identity.provider.realm_id;
+			entity.realmId = identity.provider.realmId;
 			entity.active = true;
-			entity.name_locked = true;
-			entity.client_id = identity.clientId || null;
+			entity.nameLocked = true;
+			entity.clientId = identity.clientId || null;
 		}
 		const attributesSelf = await this.validateAttributes(entity, identity, 10);
 		if (!attributesSelf) throw new Error("Identity provider attributes could not be validated.");

package/dist/core/identity/provider/account/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["UserValidator","buildUserFakeEmail","isUserFakeEmail","ValidatorGroup","createNanoID","extendObject","isValidupError","stringifyPath","IdentityProviderIdentityOperation","IdentityProviderMapperOperation","IdentityProviderAccountManager","attributesMapper","permissionMapper","roleMapper","repository","userRepository","userValidator","ctx","attributeMapper","save","identity","account","findOneByProviderIdentity","operation","UPDATE","user","saveUser","saveRoles","savePermissions","CREATE","provider_id","provider","id","provider_user_id","provider_user_name","name","provider_realm_id","realm_id","user_id","user_realm_id","attributes","execute","entity","attribute","key","value","active","name_locked","client_id","clientId","attributesSelf","validateAttributes","Error","attributesSelfKeys","Object","keys","attributesExtra","entityKeys","entityKey","index","indexOf","output","trim","toLowerCase","attempts","Math","max","attributeCandidates","length","saveOneWithEA","names","shift","run","group","email","e","retry","i","issues","child","pathNormalized","path","Array","isArray","first","rest","push","entities"],"sources":["../../../../../src/core/identity/provider/account/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderAccount, User } from '@authup/core-kit';\nimport {\n UserValidator,\n buildUserFakeEmail,\n isUserFakeEmail,\n} from '@authup/core-kit';\nimport { ValidatorGroup, createNanoID, extendObject } from '@authup/kit';\nimport { isValidupError, stringifyPath } from 'validup';\nimport type { IUserIdentityRepository } from '../../entities/index.ts';\nimport { IdentityProviderIdentityOperation } from '../constants.ts';\nimport type { IIdentityProviderMapper } from '../mapper/index.ts';\nimport { IdentityProviderMapperOperation } from '../mapper/index.ts';\nimport type { IdentityProviderIdentity } from '../types.ts';\nimport type { IIdentityProviderAccountManager, IIdentityProviderAccountRepository, IdentityProviderAccountManagerContext } from './types.ts';\n\nexport class IdentityProviderAccountManager implements IIdentityProviderAccountManager {\n protected attributesMapper : IIdentityProviderMapper;\n\n protected permissionMapper : IIdentityProviderMapper;\n\n protected roleMapper : IIdentityProviderMapper;\n\n protected repository : IIdentityProviderAccountRepository;\n\n protected userRepository: IUserIdentityRepository;\n\n protected userValidator : UserValidator;\n\n constructor(ctx: IdentityProviderAccountManagerContext) {\n this.attributesMapper = ctx.attributeMapper;\n this.permissionMapper = ctx.permissionMapper;\n this.roleMapper = ctx.roleMapper;\n this.repository = ctx.repository;\n this.userRepository = ctx.userRepository;\n\n this.userValidator = new UserValidator();\n }\n\n async save(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount> {\n let account = await this.repository.findOneByProviderIdentity(identity);\n if (account) {\n identity.operation = IdentityProviderIdentityOperation.UPDATE;\n\n account.user = await this.saveUser(identity, account.user);\n\n await this.repository.save(account);\n\n await this.saveRoles(identity, account.user);\n await this.savePermissions(identity, account.user);\n\n return account;\n }\n\n identity.operation = IdentityProviderIdentityOperation.CREATE;\n\n const user = await this.saveUser(identity);\n\n account = await this.repository.save({\n provider_id: identity.provider.id,\n provider_user_id: identity.id,\n provider_user_name: user.name, // todo: parse identity.name\n provider_realm_id: identity.provider.realm_id,\n user,\n user_id: user.id,\n user_realm_id: user.realm_id,\n });\n\n await this.saveRoles(identity, account.user);\n await this.savePermissions(identity, account.user);\n\n return account;\n }\n\n async saveUser(\n identity: IdentityProviderIdentity,\n user?: User,\n ): Promise<User> {\n const attributes = await this.attributesMapper.execute(\n identity,\n );\n\n const entity : Record<string, any> = {};\n for (const attribute of attributes) {\n if (\n attribute.key &&\n attribute.operation === IdentityProviderMapperOperation.CREATE\n ) {\n // attribute value might be object, array, ...\n entity[attribute.key] = attribute.value;\n }\n }\n\n if (!user) {\n entity.realm_id = identity.provider.realm_id;\n entity.active = true;\n entity.name_locked = true;\n entity.client_id = identity.clientId \|\| null;\n }\n\n const attributesSelf = await this.validateAttributes(entity, identity, 10);\n if (!attributesSelf) {\n // todo: better error name\n throw new Error('Identity provider attributes could not be validated.');\n }\n const attributesSelfKeys = Object.keys(attributesSelf);\n\n const attributesExtra : Record<string, any> = {};\n\n const entityKeys = Object.keys(entity);\n for (const entityKey of entityKeys) {\n const index = attributesSelfKeys.indexOf(entityKey);\n if (index !== -1) {\n continue;\n }\n\n attributesExtra[entityKey] = entity[entityKey];\n }\n\n let output : User;\n if (user) {\n output = extendObject(user, attributesSelf);\n } else {\n output = attributesSelf;\n }\n\n if (typeof output.name === 'string') {\n output.name = output.name.trim().toLowerCase();\n }\n\n let attempts = Math.max((identity.attributeCandidates?.name?.length \|\| 0) + 1, 10);\n while (attempts > 0) {\n try {\n // todo: we also need to remove existing ones via idp login flow ( but not other attributes!)\n return await this.userRepository.saveOneWithEA(output, attributesExtra);\n } catch {\n const names = identity.attributeCandidates?.name \|\| [];\n if (names.length > 0) {\n while (names.length > 0) {\n output.name = `${names.shift()}`.trim().toLowerCase();\n\n try {\n await this.userValidator.run(output, {\n group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n ValidatorGroup.CREATE :\n ValidatorGroup.UPDATE,\n });\n break;\n } catch {\n // todo: do nothing.\n }\n }\n } else {\n output.name = createNanoID('0123456789abcdefghijklmnopqrstuvwxyz-_', 10);\n }\n\n if (isUserFakeEmail(output.email)) {\n output.email = buildUserFakeEmail(output.name);\n }\n\n attempts -= 1;\n }\n }\n\n throw new Error('The user account could not be created due a conflict error.');\n }\n\n async validateAttributes(\n entity: Record<string, any>,\n identity: IdentityProviderIdentity,\n attempts: number,\n ) : Promise<User \| null> {\n attempts--;\n if (attempts <= 0) {\n return null;\n }\n\n try {\n return await this.userValidator.run(entity, {\n group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n ValidatorGroup.CREATE :\n ValidatorGroup.UPDATE,\n });\n } catch (e: any) {\n if (!isValidupError(e)) {\n return null;\n }\n\n let retry = false;\n for (let i = 0; i < e.issues.length; i++) {\n const child = e.issues[i];\n\n const pathNormalized = stringifyPath(child.path);\n\n if (\n Array.isArray(entity[pathNormalized]) &&\n entity[pathNormalized].length > 0\n ) {\n const [first, ...rest] = entity[pathNormalized];\n entity[pathNormalized] = first;\n\n if (rest.length > 0) {\n if (!identity.attributeCandidates) {\n identity.attributeCandidates = {};\n }\n\n if (!identity.attributeCandidates[pathNormalized]) {\n identity.attributeCandidates[pathNormalized] = [];\n }\n\n identity.attributeCandidates[pathNormalized]!.push(...rest);\n }\n\n retry = true;\n break;\n }\n\n if (\n identity.attributeCandidates &&\n identity.attributeCandidates[pathNormalized] &&\n identity.attributeCandidates[pathNormalized]!.length > 0\n ) {\n entity[pathNormalized] = identity.attributeCandidates[pathNormalized]!.shift();\n retry = true;\n break;\n }\n\n if (\n entity.name &&\n pathNormalized === 'email'\n ) {\n entity[pathNormalized] = buildUserFakeEmail(entity.name);\n retry = true;\n break;\n }\n\n if (entity[pathNormalized]) {\n entity[pathNormalized] = null;\n break;\n }\n }\n\n if (retry) {\n return this.validateAttributes(entity, identity, attempts);\n }\n\n return null;\n }\n }\n\n async savePermissions(\n identity: IdentityProviderIdentity,\n user: User,\n ) {\n const entities = await this.permissionMapper.execute(identity);\n\n await this.userRepository.savePermissions(user, entities);\n }\n\n async saveRoles(\n identity: IdentityProviderIdentity,\n user: User,\n ) {\n const entities = await this.roleMapper.execute(identity);\n\n await this.userRepository.saveRoles(user, entities);\n }\n}\n"],"mappings":";;;;;;;;;;AAsBA,IAAaU,iCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,KAAKN,mBAAmBM,IAAIC;EAC5B,KAAKN,mBAAmBK,IAAIL;EAC5B,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,iBAAiBE,IAAIF;EAE1B,KAAKC,gBAAgB,IAAIhB,cAAAA;CAC7B;CAEA,MAAMmB,KAAKC,UAAsE;EAC7E,IAAIC,UAAU,MAAM,KAAKP,WAAWQ,0BAA0BF,QAAAA;EAC9D,IAAIC,SAAS;GACTD,SAASG,YAAYf,kCAAkCgB;GAEvDH,QAAQI,OAAO,MAAM,KAAKC,SAASN,UAAUC,QAAQI,IAAI;GAEzD,MAAM,KAAKX,WAAWK,KAAKE,OAAAA;GAE3B,MAAM,KAAKM,UAAUP,UAAUC,QAAQI,IAAI;GAC3C,MAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,IAAI;GAEjD,OAAOJ;EACX;EAEAD,SAASG,YAAYf,kCAAkCqB;EAEvD,MAAMJ,OAAO,MAAM,KAAKC,SAASN,QAAAA;EAEjCC,UAAU,MAAM,KAAKP,WAAWK,KAAK;GACjCW,aAAaV,SAASW,SAASC;GAC/BC,kBAAkBb,SAASY;GAC3BE,oBAAoBT,KAAKU;GACzBC,mBAAmBhB,SAASW,SAASM;GACrCZ;GACAa,SAASb,KAAKO;GACdO,eAAed,KAAKY;EACxB,CAAA;EAEA,MAAM,KAAKV,UAAUP,UAAUC,QAAQI,IAAI;EAC3C,MAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,IAAI;EAEjD,OAAOJ;CACX;CAEA,MAAMK,SACFN,UACAK,MACa;EACb,MAAMe,aAAa,MAAM,KAAK7B,iBAAiB8B,QAC3CrB,QAAAA;EAGJ,MAAMsB,SAA+B,CAAC;EACtC,KAAK,MAAMC,aAAaH,YACpB,IACIG,UAAUC,OACVD,UAAUpB,cAAcd,gCAAgCoB,QAGxDa,OAAOC,UAAUC,OAAOD,UAAUE;EAI1C,IAAI,CAACpB,MAAM;GACPiB,OAAOL,WAAWjB,SAASW,SAASM;GACpCK,OAAOI,SAAS;GAChBJ,OAAOK,cAAc;GACrBL,OAAOM,YAAY5B,SAAS6B,YAAY;EAC5C;EAEA,MAAMC,iBAAiB,MAAM,KAAKC,mBAAmBT,QAAQtB,UAAU,EAAA;EACvE,IAAI,CAAC8B,gBAED,MAAM,IAAIE,MAAM,sDAAA;EAEpB,MAAMC,qBAAqBC,OAAOC,KAAKL,cAAAA;EAEvC,MAAMM,kBAAwC,CAAC;EAE/C,MAAMC,aAAaH,OAAOC,KAAKb,MAAAA;EAC/B,KAAK,MAAMgB,aAAaD,YAAY;GAEhC,IADcJ,mBAAmBO,QAAQF,SACrCC,MAAU,IACV;GAGJH,gBAAgBE,aAAahB,OAAOgB;EACxC;EAEA,IAAIG;EACJ,IAAIpC,MACAoC,SAASxD,aAAaoB,MAAMyB,cAAAA;OAE5BW,SAASX;EAGb,IAAI,OAAOW,OAAO1B,SAAS,UACvB0B,OAAO1B,OAAO0B,OAAO1B,KAAK2B,KAAI,CAAA,CAAGC,YAAW;EAGhD,IAAIC,WAAWC,KAAKC,KAAK9C,SAAS+C,qBAAqBhC,MAAMiC,UAAU,KAAK,GAAG,EAAA;EAC/E,OAAOJ,WAAW,GACd,IAAI;GAEA,OAAO,MAAM,KAAKjD,eAAesD,cAAcR,QAAQL,eAAAA;EAC3D,QAAQ;GACJ,MAAMc,QAAQlD,SAAS+C,qBAAqBhC,QAAQ,CAAA;GACpD,IAAImC,MAAMF,SAAS,GACf,OAAOE,MAAMF,SAAS,GAAG;IACrBP,OAAO1B,OAAO,GAAGmC,MAAMC,MAAK,IAAKT,KAAI,CAAA,CAAGC,YAAW;IAEnD,IAAI;KACA,MAAM,KAAK/C,cAAcwD,IAAIX,QAAQ,EACjCY,OAAOrD,SAASG,cAAcf,kCAAkCqB,SAC5D1B,eAAe0B,SACf1B,eAAeqB,OACvB,CAAA;KACA;IACJ,QAAQ,CAER;GACJ;QAEAqC,OAAO1B,OAAO/B,aAAa,0CAA0C,EAAA;GAGzE,IAAIF,gBAAgB2D,OAAOa,KAAK,GAC5Bb,OAAOa,QAAQzE,mBAAmB4D,OAAO1B,IAAI;GAGjD6B,YAAY;EAChB;EAGJ,MAAM,IAAIZ,MAAM,6DAAA;CACpB;CAEA,MAAMD,mBACFT,QACAtB,UACA4C,UACqB;EACrBA;EACA,IAAIA,YAAY,GACZ,OAAO;EAGX,IAAI;GACA,OAAO,MAAM,KAAKhD,cAAcwD,IAAI9B,QAAQ,EACxC+B,OAAOrD,SAASG,cAAcf,kCAAkCqB,SAC5D1B,eAAe0B,SACf1B,eAAeqB,OACvB,CAAA;EACJ,SAASmD,GAAQ;GACb,IAAI,CAACrE,eAAeqE,CAAAA,GAChB,OAAO;GAGX,IAAIC,QAAQ;GACZ,KAAK,IAAIC,IAAI,GAAGA,IAAIF,EAAEG,OAAOV,QAAQS,KAAK;IACtC,MAAME,QAAQJ,EAAEG,OAAOD;IAEvB,MAAMG,iBAAiBzE,cAAcwE,MAAME,IAAI;IAE/C,IACIC,MAAMC,QAAQzC,OAAOsC,eAAe,KACpCtC,OAAOsC,eAAe,CAACZ,SAAS,GAClC;KACE,MAAM,CAACgB,OAAO,GAAGC,QAAQ3C,OAAOsC;KAChCtC,OAAOsC,kBAAkBI;KAEzB,IAAIC,KAAKjB,SAAS,GAAG;MACjB,IAAI,CAAChD,SAAS+C,qBACV/C,SAAS+C,sBAAsB,CAAC;MAGpC,IAAI,CAAC/C,SAAS+C,oBAAoBa,iBAC9B5D,SAAS+C,oBAAoBa,kBAAkB,CAAA;MAGnD5D,SAAS+C,oBAAoBa,eAAe,CAAEM,KAAI,GAAID,IAAAA;KAC1D;KAEAT,QAAQ;KACR;IACJ;IAEA,IACIxD,SAAS+C,uBACT/C,SAAS+C,oBAAoBa,mBAC7B5D,SAAS+C,oBAAoBa,eAAe,CAAEZ,SAAS,GACzD;KACE1B,OAAOsC,kBAAkB5D,SAAS+C,oBAAoBa,eAAe,CAAET,MAAK;KAC5EK,QAAQ;KACR;IACJ;IAEA,IACIlC,OAAOP,QACP6C,mBAAmB,SACrB;KACEtC,OAAOsC,kBAAkB/E,mBAAmByC,OAAOP,IAAI;KACvDyC,QAAQ;KACR;IACJ;IAEA,IAAIlC,OAAOsC,iBAAiB;KACxBtC,OAAOsC,kBAAkB;KACzB;IACJ;GACJ;GAEA,IAAIJ,OACA,OAAO,KAAKzB,mBAAmBT,QAAQtB,UAAU4C,QAAAA;GAGrD,OAAO;EACX;CACJ;CAEA,MAAMpC,gBACFR,UACAK,MACF;EACE,MAAM8D,WAAW,MAAM,KAAK3E,iBAAiB6B,QAAQrB,QAAAA;EAErD,MAAM,KAAKL,eAAea,gBAAgBH,MAAM8D,QAAAA;CACpD;CAEA,MAAM5D,UACFP,UACAK,MACF;EACE,MAAM8D,WAAW,MAAM,KAAK1E,WAAW4B,QAAQrB,QAAAA;EAE/C,MAAM,KAAKL,eAAeY,UAAUF,MAAM8D,QAAAA;CAC9C;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["UserValidator","buildUserFakeEmail","isUserFakeEmail","ValidatorGroup","createNanoID","extendObject","isValidupError","stringifyPath","IdentityProviderIdentityOperation","IdentityProviderMapperOperation","IdentityProviderAccountManager","attributesMapper","permissionMapper","roleMapper","repository","userRepository","userValidator","ctx","attributeMapper","save","identity","account","findOneByProviderIdentity","operation","UPDATE","user","saveUser","saveRoles","savePermissions","CREATE","providerId","provider","id","providerUserId","providerUserName","name","providerRealmId","realmId","userId","userRealmId","attributes","execute","entity","attribute","key","value","active","nameLocked","clientId","attributesSelf","validateAttributes","Error","attributesSelfKeys","Object","keys","attributesExtra","entityKeys","entityKey","index","indexOf","output","trim","toLowerCase","attempts","Math","max","attributeCandidates","length","saveOneWithEA","names","shift","run","group","email","e","retry","i","issues","child","pathNormalized","path","Array","isArray","first","rest","push","entities"],"sources":["../../../../../src/core/identity/provider/account/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderAccount, User } from '@authup/core-kit';\nimport {\n UserValidator,\n buildUserFakeEmail,\n isUserFakeEmail,\n} from '@authup/core-kit';\nimport { ValidatorGroup, createNanoID, extendObject } from '@authup/kit';\nimport { isValidupError, stringifyPath } from 'validup';\nimport type { IUserIdentityRepository } from '../../entities/index.ts';\nimport { IdentityProviderIdentityOperation } from '../constants.ts';\nimport type { IIdentityProviderMapper } from '../mapper/index.ts';\nimport { IdentityProviderMapperOperation } from '../mapper/index.ts';\nimport type { IdentityProviderIdentity } from '../types.ts';\nimport type { IIdentityProviderAccountManager, IIdentityProviderAccountRepository, IdentityProviderAccountManagerContext } from './types.ts';\n\nexport class IdentityProviderAccountManager implements IIdentityProviderAccountManager {\n protected attributesMapper : IIdentityProviderMapper;\n\n protected permissionMapper : IIdentityProviderMapper;\n\n protected roleMapper : IIdentityProviderMapper;\n\n protected repository : IIdentityProviderAccountRepository;\n\n protected userRepository: IUserIdentityRepository;\n\n protected userValidator : UserValidator;\n\n constructor(ctx: IdentityProviderAccountManagerContext) {\n this.attributesMapper = ctx.attributeMapper;\n this.permissionMapper = ctx.permissionMapper;\n this.roleMapper = ctx.roleMapper;\n this.repository = ctx.repository;\n this.userRepository = ctx.userRepository;\n\n this.userValidator = new UserValidator();\n }\n\n async save(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount> {\n let account = await this.repository.findOneByProviderIdentity(identity);\n if (account) {\n identity.operation = IdentityProviderIdentityOperation.UPDATE;\n\n account.user = await this.saveUser(identity, account.user);\n\n await this.repository.save(account);\n\n await this.saveRoles(identity, account.user);\n await this.savePermissions(identity, account.user);\n\n return account;\n }\n\n identity.operation = IdentityProviderIdentityOperation.CREATE;\n\n const user = await this.saveUser(identity);\n\n account = await this.repository.save({\n providerId: identity.provider.id,\n providerUserId: identity.id,\n providerUserName: user.name, // todo: parse identity.name\n providerRealmId: identity.provider.realmId,\n user,\n userId: user.id,\n userRealmId: user.realmId,\n });\n\n await this.saveRoles(identity, account.user);\n await this.savePermissions(identity, account.user);\n\n return account;\n }\n\n async saveUser(\n identity: IdentityProviderIdentity,\n user?: User,\n ): Promise<User> {\n const attributes = await this.attributesMapper.execute(\n identity,\n );\n\n const entity : Record<string, any> = {};\n for (const attribute of attributes) {\n if (\n attribute.key &&\n attribute.operation === IdentityProviderMapperOperation.CREATE\n ) {\n // attribute value might be object, array, ...\n entity[attribute.key] = attribute.value;\n }\n }\n\n if (!user) {\n entity.realmId = identity.provider.realmId;\n entity.active = true;\n entity.nameLocked = true;\n entity.clientId = identity.clientId \|\| null;\n }\n\n const attributesSelf = await this.validateAttributes(entity, identity, 10);\n if (!attributesSelf) {\n // todo: better error name\n throw new Error('Identity provider attributes could not be validated.');\n }\n const attributesSelfKeys = Object.keys(attributesSelf);\n\n const attributesExtra : Record<string, any> = {};\n\n const entityKeys = Object.keys(entity);\n for (const entityKey of entityKeys) {\n const index = attributesSelfKeys.indexOf(entityKey);\n if (index !== -1) {\n continue;\n }\n\n attributesExtra[entityKey] = entity[entityKey];\n }\n\n let output : User;\n if (user) {\n output = extendObject(user, attributesSelf);\n } else {\n output = attributesSelf;\n }\n\n if (typeof output.name === 'string') {\n output.name = output.name.trim().toLowerCase();\n }\n\n let attempts = Math.max((identity.attributeCandidates?.name?.length \|\| 0) + 1, 10);\n while (attempts > 0) {\n try {\n // todo: we also need to remove existing ones via idp login flow ( but not other attributes!)\n return await this.userRepository.saveOneWithEA(output, attributesExtra);\n } catch {\n const names = identity.attributeCandidates?.name \|\| [];\n if (names.length > 0) {\n while (names.length > 0) {\n output.name = `${names.shift()}`.trim().toLowerCase();\n\n try {\n await this.userValidator.run(output, {\n group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n ValidatorGroup.CREATE :\n ValidatorGroup.UPDATE,\n });\n break;\n } catch {\n // todo: do nothing.\n }\n }\n } else {\n output.name = createNanoID('0123456789abcdefghijklmnopqrstuvwxyz-_', 10);\n }\n\n if (isUserFakeEmail(output.email)) {\n output.email = buildUserFakeEmail(output.name);\n }\n\n attempts -= 1;\n }\n }\n\n throw new Error('The user account could not be created due a conflict error.');\n }\n\n async validateAttributes(\n entity: Record<string, any>,\n identity: IdentityProviderIdentity,\n attempts: number,\n ) : Promise<User \| null> {\n attempts--;\n if (attempts <= 0) {\n return null;\n }\n\n try {\n return await this.userValidator.run(entity, {\n group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n ValidatorGroup.CREATE :\n ValidatorGroup.UPDATE,\n });\n } catch (e: any) {\n if (!isValidupError(e)) {\n return null;\n }\n\n let retry = false;\n for (let i = 0; i < e.issues.length; i++) {\n const child = e.issues[i];\n\n const pathNormalized = stringifyPath(child.path);\n\n if (\n Array.isArray(entity[pathNormalized]) &&\n entity[pathNormalized].length > 0\n ) {\n const [first, ...rest] = entity[pathNormalized];\n entity[pathNormalized] = first;\n\n if (rest.length > 0) {\n if (!identity.attributeCandidates) {\n identity.attributeCandidates = {};\n }\n\n if (!identity.attributeCandidates[pathNormalized]) {\n identity.attributeCandidates[pathNormalized] = [];\n }\n\n identity.attributeCandidates[pathNormalized]!.push(...rest);\n }\n\n retry = true;\n break;\n }\n\n if (\n identity.attributeCandidates &&\n identity.attributeCandidates[pathNormalized] &&\n identity.attributeCandidates[pathNormalized]!.length > 0\n ) {\n entity[pathNormalized] = identity.attributeCandidates[pathNormalized]!.shift();\n retry = true;\n break;\n }\n\n if (\n entity.name &&\n pathNormalized === 'email'\n ) {\n entity[pathNormalized] = buildUserFakeEmail(entity.name);\n retry = true;\n break;\n }\n\n if (entity[pathNormalized]) {\n entity[pathNormalized] = null;\n break;\n }\n }\n\n if (retry) {\n return this.validateAttributes(entity, identity, attempts);\n }\n\n return null;\n }\n }\n\n async savePermissions(\n identity: IdentityProviderIdentity,\n user: User,\n ) {\n const entities = await this.permissionMapper.execute(identity);\n\n await this.userRepository.savePermissions(user, entities);\n }\n\n async saveRoles(\n identity: IdentityProviderIdentity,\n user: User,\n ) {\n const entities = await this.roleMapper.execute(identity);\n\n await this.userRepository.saveRoles(user, entities);\n }\n}\n"],"mappings":";;;;;;;;;;AAsBA,IAAaU,iCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,KAAKN,mBAAmBM,IAAIC;EAC5B,KAAKN,mBAAmBK,IAAIL;EAC5B,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,iBAAiBE,IAAIF;EAE1B,KAAKC,gBAAgB,IAAIhB,cAAAA;CAC7B;CAEA,MAAMmB,KAAKC,UAAsE;EAC7E,IAAIC,UAAU,MAAM,KAAKP,WAAWQ,0BAA0BF,QAAAA;EAC9D,IAAIC,SAAS;GACTD,SAASG,YAAYf,kCAAkCgB;GAEvDH,QAAQI,OAAO,MAAM,KAAKC,SAASN,UAAUC,QAAQI,IAAI;GAEzD,MAAM,KAAKX,WAAWK,KAAKE,OAAAA;GAE3B,MAAM,KAAKM,UAAUP,UAAUC,QAAQI,IAAI;GAC3C,MAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,IAAI;GAEjD,OAAOJ;EACX;EAEAD,SAASG,YAAYf,kCAAkCqB;EAEvD,MAAMJ,OAAO,MAAM,KAAKC,SAASN,QAAAA;EAEjCC,UAAU,MAAM,KAAKP,WAAWK,KAAK;GACjCW,YAAYV,SAASW,SAASC;GAC9BC,gBAAgBb,SAASY;GACzBE,kBAAkBT,KAAKU;GACvBC,iBAAiBhB,SAASW,SAASM;GACnCZ;GACAa,QAAQb,KAAKO;GACbO,aAAad,KAAKY;EACtB,CAAA;EAEA,MAAM,KAAKV,UAAUP,UAAUC,QAAQI,IAAI;EAC3C,MAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,IAAI;EAEjD,OAAOJ;CACX;CAEA,MAAMK,SACFN,UACAK,MACa;EACb,MAAMe,aAAa,MAAM,KAAK7B,iBAAiB8B,QAC3CrB,QAAAA;EAGJ,MAAMsB,SAA+B,CAAC;EACtC,KAAK,MAAMC,aAAaH,YACpB,IACIG,UAAUC,OACVD,UAAUpB,cAAcd,gCAAgCoB,QAGxDa,OAAOC,UAAUC,OAAOD,UAAUE;EAI1C,IAAI,CAACpB,MAAM;GACPiB,OAAOL,UAAUjB,SAASW,SAASM;GACnCK,OAAOI,SAAS;GAChBJ,OAAOK,aAAa;GACpBL,OAAOM,WAAW5B,SAAS4B,YAAY;EAC3C;EAEA,MAAMC,iBAAiB,MAAM,KAAKC,mBAAmBR,QAAQtB,UAAU,EAAA;EACvE,IAAI,CAAC6B,gBAED,MAAM,IAAIE,MAAM,sDAAA;EAEpB,MAAMC,qBAAqBC,OAAOC,KAAKL,cAAAA;EAEvC,MAAMM,kBAAwC,CAAC;EAE/C,MAAMC,aAAaH,OAAOC,KAAKZ,MAAAA;EAC/B,KAAK,MAAMe,aAAaD,YAAY;GAEhC,IADcJ,mBAAmBO,QAAQF,SACrCC,MAAU,IACV;GAGJH,gBAAgBE,aAAaf,OAAOe;EACxC;EAEA,IAAIG;EACJ,IAAInC,MACAmC,SAASvD,aAAaoB,MAAMwB,cAAAA;OAE5BW,SAASX;EAGb,IAAI,OAAOW,OAAOzB,SAAS,UACvByB,OAAOzB,OAAOyB,OAAOzB,KAAK0B,KAAI,CAAA,CAAGC,YAAW;EAGhD,IAAIC,WAAWC,KAAKC,KAAK7C,SAAS8C,qBAAqB/B,MAAMgC,UAAU,KAAK,GAAG,EAAA;EAC/E,OAAOJ,WAAW,GACd,IAAI;GAEA,OAAO,MAAM,KAAKhD,eAAeqD,cAAcR,QAAQL,eAAAA;EAC3D,QAAQ;GACJ,MAAMc,QAAQjD,SAAS8C,qBAAqB/B,QAAQ,CAAA;GACpD,IAAIkC,MAAMF,SAAS,GACf,OAAOE,MAAMF,SAAS,GAAG;IACrBP,OAAOzB,OAAO,GAAGkC,MAAMC,MAAK,IAAKT,KAAI,CAAA,CAAGC,YAAW;IAEnD,IAAI;KACA,MAAM,KAAK9C,cAAcuD,IAAIX,QAAQ,EACjCY,OAAOpD,SAASG,cAAcf,kCAAkCqB,SAC5D1B,eAAe0B,SACf1B,eAAeqB,OACvB,CAAA;KACA;IACJ,QAAQ,CAER;GACJ;QAEAoC,OAAOzB,OAAO/B,aAAa,0CAA0C,EAAA;GAGzE,IAAIF,gBAAgB0D,OAAOa,KAAK,GAC5Bb,OAAOa,QAAQxE,mBAAmB2D,OAAOzB,IAAI;GAGjD4B,YAAY;EAChB;EAGJ,MAAM,IAAIZ,MAAM,6DAAA;CACpB;CAEA,MAAMD,mBACFR,QACAtB,UACA2C,UACqB;EACrBA;EACA,IAAIA,YAAY,GACZ,OAAO;EAGX,IAAI;GACA,OAAO,MAAM,KAAK/C,cAAcuD,IAAI7B,QAAQ,EACxC8B,OAAOpD,SAASG,cAAcf,kCAAkCqB,SAC5D1B,eAAe0B,SACf1B,eAAeqB,OACvB,CAAA;EACJ,SAASkD,GAAQ;GACb,IAAI,CAACpE,eAAeoE,CAAAA,GAChB,OAAO;GAGX,IAAIC,QAAQ;GACZ,KAAK,IAAIC,IAAI,GAAGA,IAAIF,EAAEG,OAAOV,QAAQS,KAAK;IACtC,MAAME,QAAQJ,EAAEG,OAAOD;IAEvB,MAAMG,iBAAiBxE,cAAcuE,MAAME,IAAI;IAE/C,IACIC,MAAMC,QAAQxC,OAAOqC,eAAe,KACpCrC,OAAOqC,eAAe,CAACZ,SAAS,GAClC;KACE,MAAM,CAACgB,OAAO,GAAGC,QAAQ1C,OAAOqC;KAChCrC,OAAOqC,kBAAkBI;KAEzB,IAAIC,KAAKjB,SAAS,GAAG;MACjB,IAAI,CAAC/C,SAAS8C,qBACV9C,SAAS8C,sBAAsB,CAAC;MAGpC,IAAI,CAAC9C,SAAS8C,oBAAoBa,iBAC9B3D,SAAS8C,oBAAoBa,kBAAkB,CAAA;MAGnD3D,SAAS8C,oBAAoBa,eAAe,CAAEM,KAAI,GAAID,IAAAA;KAC1D;KAEAT,QAAQ;KACR;IACJ;IAEA,IACIvD,SAAS8C,uBACT9C,SAAS8C,oBAAoBa,mBAC7B3D,SAAS8C,oBAAoBa,eAAe,CAAEZ,SAAS,GACzD;KACEzB,OAAOqC,kBAAkB3D,SAAS8C,oBAAoBa,eAAe,CAAET,MAAK;KAC5EK,QAAQ;KACR;IACJ;IAEA,IACIjC,OAAOP,QACP4C,mBAAmB,SACrB;KACErC,OAAOqC,kBAAkB9E,mBAAmByC,OAAOP,IAAI;KACvDwC,QAAQ;KACR;IACJ;IAEA,IAAIjC,OAAOqC,iBAAiB;KACxBrC,OAAOqC,kBAAkB;KACzB;IACJ;GACJ;GAEA,IAAIJ,OACA,OAAO,KAAKzB,mBAAmBR,QAAQtB,UAAU2C,QAAAA;GAGrD,OAAO;EACX;CACJ;CAEA,MAAMnC,gBACFR,UACAK,MACF;EACE,MAAM6D,WAAW,MAAM,KAAK1E,iBAAiB6B,QAAQrB,QAAAA;EAErD,MAAM,KAAKL,eAAea,gBAAgBH,MAAM6D,QAAAA;CACpD;CAEA,MAAM3D,UACFP,UACAK,MACF;EACE,MAAM6D,WAAW,MAAM,KAAKzE,WAAW4B,QAAQrB,QAAAA;EAE/C,MAAM,KAAKL,eAAeY,UAAUF,MAAM6D,QAAAA;CAC9C;AACJ"}

package/dist/core/identity/provider/authentication/presets/facebook.mjs CHANGED Viewed

@@ -9,9 +9,9 @@ import { mergeOAuth2Scopes } from "@authup/specs";
 var IdentityProviderFacebookAuthenticator = class extends IdentityProviderOAuth2Authenticator {
 	constructor(ctx) {
 		ctx.provider.scope = mergeOAuth2Scopes("email", ctx.provider.scope);
-		ctx.provider.authorize_url = "https://graph.facebook.com/oauth/authorize";
-		ctx.provider.token_url = "https://graph.facebook.com/oauth/access_token";
-		ctx.provider.user_info_url = "https://graph.facebook.com/me?fields=id,name,email,first_name,last_name";
+		ctx.provider.authorizeUrl = "https://graph.facebook.com/oauth/authorize";
+		ctx.provider.tokenUrl = "https://graph.facebook.com/oauth/access_token";
+		ctx.provider.userInfoUrl = "https://graph.facebook.com/me?fields=id,name,email,first_name,last_name";
 		super(ctx);
 	}
 	async buildIdentityWithTokenGrantResponse(input) {
@@ -25,8 +25,8 @@ var IdentityProviderFacebookAuthenticator = class extends IdentityProviderOAuth2
 			attributeCandidates: {
 				name: [userInfo.username, userInfo.id],
 				email: [userInfo.email],
-				first_name: [userInfo.first_name],
-				last_name: [userInfo.last_name]
+				firstName: [userInfo.first_name],
+				lastName: [userInfo.last_name]
 			},
 			data: payload,
 			provider: this.provider

package/dist/core/identity/provider/authentication/presets/facebook.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"facebook.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderFacebookAuthenticator","ctx","provider","scope","~~authorize_url~~","~~token_url~~","~~user_info_url~~","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","username","email","first_name","last_name","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/facebook.ts"],"sourcesContent":["/\n Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderFacebookAuthenticator extends IdentityProviderOAuth2Authenticator {\n constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n ctx.provider.scope = mergeOAuth2Scopes('email', ctx.provider.scope);\n ctx.provider.~~authorize_url~~ = 'https://graph.facebook.com/oauth/authorize';\n ctx.provider.~~token_url~~ = 'https://graph.facebook.com/oauth/access_token';\n ctx.provider.~~user_info_url~~ = 'https://graph.facebook.com/me?fields=id,name,email,first_name,last_name';\n\n super(ctx);\n }\n\n protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n const userInfo = await this.client.userInfo.get({\n type: 'Bearer',\n token: input.access_token,\n });\n\n const payload = extractTokenPayload(input.access_token);\n\n return {\n id: userInfo.id,\n attributeCandidates: {\n name: [\n userInfo.username,\n userInfo.id,\n ],\n email: [\n userInfo.email,\n ],\n ~~first_name~~: [\n userInfo.first_name,\n ],\n ~~last_name~~: [\n userInfo.last_name,\n ],\n },\n data: payload,\n provider: this.provider,\n };\n }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaG,wCAAb,cAA2DD,oCAAAA;CACvD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQL,kBAAkB,SAASG,IAAIC,SAASC,KAAK;EAClEF,IAAIC,SAASE,~~gBAAgB~~;~~EAC7BH~~,IAAIC,SAASG,~~YAAY~~;~~EACzBJ~~,IAAIC,SAASI,~~gBAAgB~~;~~EAE7B~~,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUlB,oBAAoBW,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB;IACjBC,MAAM,CACFT,SAASU,UACTV,SAASO,EAAAA;IAEbI,OAAO,CACHX,SAASW,KAAAA;IAEbC,~~YAAY~~,~~CACRZ~~,~~SAASY~~,UAAAA;IAEbC,~~WAAW~~,~~CACPb~~,~~SAASa~~,SAAAA;GAEjB;GACAC,~~MAAMR~~;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}
1	+ {"version":3,"file":"facebook.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderFacebookAuthenticator","ctx","provider","scope","authorizeUrl","tokenUrl","userInfoUrl","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","username","email","firstName","first_name","lastName","last_name","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/facebook.ts"],"sourcesContent":["/\n Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderFacebookAuthenticator extends IdentityProviderOAuth2Authenticator {\n constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n ctx.provider.scope = mergeOAuth2Scopes('email', ctx.provider.scope);\n ctx.provider.authorizeUrl = 'https://graph.facebook.com/oauth/authorize';\n ctx.provider.tokenUrl = 'https://graph.facebook.com/oauth/access_token';\n ctx.provider.userInfoUrl = 'https://graph.facebook.com/me?fields=id,name,email,first_name,last_name';\n\n super(ctx);\n }\n\n protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n const userInfo = await this.client.userInfo.get({\n type: 'Bearer',\n token: input.access_token,\n });\n\n const payload = extractTokenPayload(input.access_token);\n\n return {\n id: userInfo.id,\n attributeCandidates: {\n name: [\n userInfo.username,\n userInfo.id,\n ],\n email: [\n userInfo.email,\n ],\n firstName: [\n userInfo.first_name,\n ],\n lastName: [\n userInfo.last_name,\n ],\n },\n data: payload,\n provider: this.provider,\n };\n }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaG,wCAAb,cAA2DD,oCAAAA;CACvD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQL,kBAAkB,SAASG,IAAIC,SAASC,KAAK;EAClEF,IAAIC,SAASE,eAAe;EAC5BH,IAAIC,SAASG,WAAW;EACxBJ,IAAIC,SAASI,cAAc;EAE3B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUlB,oBAAoBW,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB;IACjBC,MAAM,CACFT,SAASU,UACTV,SAASO,EAAAA;IAEbI,OAAO,CACHX,SAASW,KAAAA;IAEbC,WAAW,CACPZ,SAASa,UAAAA;IAEbC,UAAU,CACNd,SAASe,SAAAA;GAEjB;GACAC,MAAMV;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/presets/github.mjs CHANGED Viewed

@@ -9,9 +9,9 @@ import { mergeOAuth2Scopes } from "@authup/specs";
 var IdentityProviderGithubAuthenticator = class extends IdentityProviderOAuth2Authenticator {
 	constructor(ctx) {
 		ctx.provider.scope = mergeOAuth2Scopes("user:email", ctx.provider.scope);
-		ctx.provider.authorize_url = "https://github.com/login/oauth/authorize";
-		ctx.provider.token_url = "https://github.com/login/oauth/access_token";
-		ctx.provider.user_info_url = "https://api.github.com/user";
+		ctx.provider.authorizeUrl = "https://github.com/login/oauth/authorize";
+		ctx.provider.tokenUrl = "https://github.com/login/oauth/access_token";
+		ctx.provider.userInfoUrl = "https://api.github.com/user";
 		super(ctx);
 	}
 	async buildIdentityWithTokenGrantResponse(input) {

package/dist/core/identity/provider/authentication/presets/github.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"github.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderGithubAuthenticator","ctx","provider","scope","~~authorize_url~~","~~token_url~~","~~user_info_url~~","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","login","email","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/github.ts"],"sourcesContent":["/\n Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderGithubAuthenticator extends IdentityProviderOAuth2Authenticator {\n constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n ctx.provider.scope = mergeOAuth2Scopes('user:email', ctx.provider.scope);\n ctx.provider.~~authorize_url~~ = 'https://github.com/login/oauth/authorize';\n ctx.provider.~~token_url~~ = 'https://github.com/login/oauth/access_token';\n ctx.provider.~~user_info_url~~ = 'https://api.github.com/user';\n\n super(ctx);\n }\n\n protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n const userInfo = await this.client.userInfo.get({\n type: 'Bearer',\n token: input.access_token,\n });\n\n const payload = extractTokenPayload(input.access_token);\n\n return {\n id: userInfo.id,\n attributeCandidates: {\n name: [\n userInfo.login,\n userInfo.name,\n userInfo.id,\n ],\n email: [\n userInfo.email,\n ],\n },\n data: payload,\n provider: this.provider,\n };\n }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaG,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQL,kBAAkB,cAAcG,IAAIC,SAASC,KAAK;EACvEF,IAAIC,SAASE,~~gBAAgB~~;~~EAC7BH~~,IAAIC,SAASG,~~YAAY~~;~~EACzBJ~~,IAAIC,SAASI,~~gBAAgB~~;~~EAE7B~~,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUlB,oBAAoBW,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB;IACjBC,MAAM;KACFT,SAASU;KACTV,SAASS;KACTT,SAASO;;IAEbI,OAAO,CACHX,SAASW,KAAAA;GAEjB;GACAC,MAAMN;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}
1	+ {"version":3,"file":"github.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderGithubAuthenticator","ctx","provider","scope","authorizeUrl","tokenUrl","userInfoUrl","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","login","email","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/github.ts"],"sourcesContent":["/\n Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderGithubAuthenticator extends IdentityProviderOAuth2Authenticator {\n constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n ctx.provider.scope = mergeOAuth2Scopes('user:email', ctx.provider.scope);\n ctx.provider.authorizeUrl = 'https://github.com/login/oauth/authorize';\n ctx.provider.tokenUrl = 'https://github.com/login/oauth/access_token';\n ctx.provider.userInfoUrl = 'https://api.github.com/user';\n\n super(ctx);\n }\n\n protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n const userInfo = await this.client.userInfo.get({\n type: 'Bearer',\n token: input.access_token,\n });\n\n const payload = extractTokenPayload(input.access_token);\n\n return {\n id: userInfo.id,\n attributeCandidates: {\n name: [\n userInfo.login,\n userInfo.name,\n userInfo.id,\n ],\n email: [\n userInfo.email,\n ],\n },\n data: payload,\n provider: this.provider,\n };\n }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaG,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQL,kBAAkB,cAAcG,IAAIC,SAASC,KAAK;EACvEF,IAAIC,SAASE,eAAe;EAC5BH,IAAIC,SAASG,WAAW;EACxBJ,IAAIC,SAASI,cAAc;EAE3B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUlB,oBAAoBW,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB;IACjBC,MAAM;KACFT,SAASU;KACTV,SAASS;KACTT,SAASO;;IAEbI,OAAO,CACHX,SAASW,KAAAA;GAEjB;GACAC,MAAMN;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/presets/google.mjs CHANGED Viewed

@@ -9,9 +9,9 @@ import { mergeOAuth2Scopes } from "@authup/specs";
 var IdentityProviderGoogleAuthenticator = class extends IdentityProviderOAuth2Authenticator {
 	constructor(ctx) {
 		ctx.provider.scope = mergeOAuth2Scopes("openid profile email", ctx.provider.scope);
-		ctx.provider.authorize_url = "https://accounts.google.com/o/oauth2/v2/auth";
-		ctx.provider.token_url = "https://oauth2.googleapis.com/token";
-		ctx.provider.user_info_url = "https://openidconnect.googleapis.com/v1/userinfo";
+		ctx.provider.authorizeUrl = "https://accounts.google.com/o/oauth2/v2/auth";
+		ctx.provider.tokenUrl = "https://oauth2.googleapis.com/token";
+		ctx.provider.userInfoUrl = "https://openidconnect.googleapis.com/v1/userinfo";
 		super(ctx);
 	}
 	async buildIdentityWithTokenGrantResponse(input) {
@@ -23,8 +23,8 @@ var IdentityProviderGoogleAuthenticator = class extends IdentityProviderOAuth2Au
 			const idTokenPayload = extractTokenPayload(input.id_token);
 			attributeCandidates.name = [idTokenPayload.name];
 			attributeCandidates.email = [idTokenPayload.email];
-			attributeCandidates.first_name = [idTokenPayload.given_name];
-			attributeCandidates.last_name = [idTokenPayload.family_name];
+			attributeCandidates.firstName = [idTokenPayload.given_name];
+			attributeCandidates.lastName = [idTokenPayload.family_name];
 		}
 		return {
 			id: payload.sub,

package/dist/core/identity/provider/authentication/presets/google.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"google.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderGoogleAuthenticator","ctx","provider","scope","~~authorize_url~~","~~token_url~~","~~user_info_url~~","buildIdentityWithTokenGrantResponse","input","payload","access_token","attributeCandidates","id_token","idTokenPayload","name","email","~~first_name~~","given_name","~~last_name~~","family_name","id","sub","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/google.ts"],"sourcesContent":["/\n Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { User } from '@authup/core-kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderGoogleAuthenticator extends IdentityProviderOAuth2Authenticator {\n constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n ctx.provider.scope = mergeOAuth2Scopes('openid profile email', ctx.provider.scope);\n ctx.provider.~~authorize_url~~ = 'https://accounts.google.com/o/oauth2/v2/auth';\n ctx.provider.~~token_url~~ = 'https://oauth2.googleapis.com/token';\n ctx.provider.~~user_info_url~~ = 'https://openidconnect.googleapis.com/v1/userinfo';\n\n super(ctx);\n }\n\n protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n const payload = extractTokenPayload(input.access_token);\n\n const attributeCandidates : Record<keyof User, unknown[]> = {};\n\n /\n @see https://developers.google.com/identity/openid-connect/openid-connect?hl=de#server-flow\n */\n if (input.id_token) {\n const idTokenPayload = extractTokenPayload(input.id_token) as OpenIDTokenPayload;\n\n attributeCandidates.name = [\n idTokenPayload.name,\n ];\n\n attributeCandidates.email = [\n idTokenPayload.email,\n ];\n\n attributeCandidates.~~first_name~~ = [\n idTokenPayload.given_name,\n ];\n attributeCandidates.~~last_name~~ = [\n idTokenPayload.family_name,\n ];\n }\n\n return {\n id: payload.sub!,\n attributeCandidates,\n data: payload,\n provider: this.provider,\n };\n }\n}\n"],"mappings":";;;;;;;;AAgBA,IAAaG,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQL,kBAAkB,wBAAwBG,IAAIC,SAASC,KAAK;EACjFF,IAAIC,SAASE,~~gBAAgB~~;~~EAC7BH~~,IAAIC,SAASG,~~YAAY~~;~~EACzBJ~~,IAAIC,SAASI,~~gBAAgB~~;~~EAE7B~~,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,UAAUZ,oBAAoBW,MAAME,YAAY;EAEtD,MAAMC,sBAAsD,CAAC;;;KAK7D,IAAIH,MAAMI,UAAU;GAChB,MAAMC,iBAAiBhB,oBAAoBW,MAAMI,QAAQ;GAEzDD,oBAAoBG,OAAO,CACvBD,eAAeC,IAAAA;GAGnBH,oBAAoBI,QAAQ,CACxBF,eAAeE,KAAAA;GAGnBJ,oBAAoBK,~~aAAa~~,~~CAC7BH~~,eAAeI,UAAAA;GAEnBN,oBAAoBO,~~YAAY~~,~~CAC5BL~~,eAAeM,WAAAA;EAEvB;EAEA,OAAO;GACHC,IAAIX,QAAQY;GACZV;GACAW,MAAMb;GACNP,UAAU,KAAKA;EACnB;CACJ;AACJ"}
1	+ {"version":3,"file":"google.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderGoogleAuthenticator","ctx","provider","scope","authorizeUrl","tokenUrl","userInfoUrl","buildIdentityWithTokenGrantResponse","input","payload","access_token","attributeCandidates","id_token","idTokenPayload","name","email","firstName","given_name","lastName","family_name","id","sub","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/google.ts"],"sourcesContent":["/\n Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { User } from '@authup/core-kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderGoogleAuthenticator extends IdentityProviderOAuth2Authenticator {\n constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n ctx.provider.scope = mergeOAuth2Scopes('openid profile email', ctx.provider.scope);\n ctx.provider.authorizeUrl = 'https://accounts.google.com/o/oauth2/v2/auth';\n ctx.provider.tokenUrl = 'https://oauth2.googleapis.com/token';\n ctx.provider.userInfoUrl = 'https://openidconnect.googleapis.com/v1/userinfo';\n\n super(ctx);\n }\n\n protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n const payload = extractTokenPayload(input.access_token);\n\n const attributeCandidates : Record<keyof User, unknown[]> = {};\n\n /\n @see https://developers.google.com/identity/openid-connect/openid-connect?hl=de#server-flow\n */\n if (input.id_token) {\n const idTokenPayload = extractTokenPayload(input.id_token) as OpenIDTokenPayload;\n\n attributeCandidates.name = [\n idTokenPayload.name,\n ];\n\n attributeCandidates.email = [\n idTokenPayload.email,\n ];\n\n attributeCandidates.firstName = [\n idTokenPayload.given_name,\n ];\n attributeCandidates.lastName = [\n idTokenPayload.family_name,\n ];\n }\n\n return {\n id: payload.sub!,\n attributeCandidates,\n data: payload,\n provider: this.provider,\n };\n }\n}\n"],"mappings":";;;;;;;;AAgBA,IAAaG,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQL,kBAAkB,wBAAwBG,IAAIC,SAASC,KAAK;EACjFF,IAAIC,SAASE,eAAe;EAC5BH,IAAIC,SAASG,WAAW;EACxBJ,IAAIC,SAASI,cAAc;EAE3B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,UAAUZ,oBAAoBW,MAAME,YAAY;EAEtD,MAAMC,sBAAsD,CAAC;;;KAK7D,IAAIH,MAAMI,UAAU;GAChB,MAAMC,iBAAiBhB,oBAAoBW,MAAMI,QAAQ;GAEzDD,oBAAoBG,OAAO,CACvBD,eAAeC,IAAAA;GAGnBH,oBAAoBI,QAAQ,CACxBF,eAAeE,KAAAA;GAGnBJ,oBAAoBK,YAAY,CAC5BH,eAAeI,UAAAA;GAEnBN,oBAAoBO,WAAW,CAC3BL,eAAeM,WAAAA;EAEvB;EAEA,OAAO;GACHC,IAAIX,QAAQY;GACZV;GACAW,MAAMb;GACNP,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/presets/instagram.mjs CHANGED Viewed

@@ -9,9 +9,9 @@ import { mergeOAuth2Scopes } from "@authup/specs";
 var IdentityProviderInstagramAuthenticator = class extends IdentityProviderOAuth2Authenticator {
 	constructor(ctx) {
 		ctx.provider.scope = mergeOAuth2Scopes("user_profile", ctx.provider.scope);
-		ctx.provider.authorize_url = "https://api.instagram.com/oauth/authorize";
-		ctx.provider.token_url = "https://api.instagram.com/oauth/access_token";
-		ctx.provider.user_info_url = "https://graph.instagram.com/me?fields=id,username";
+		ctx.provider.authorizeUrl = "https://api.instagram.com/oauth/authorize";
+		ctx.provider.tokenUrl = "https://api.instagram.com/oauth/access_token";
+		ctx.provider.userInfoUrl = "https://graph.instagram.com/me?fields=id,username";
 		super(ctx);
 	}
 	async buildIdentityWithTokenGrantResponse(input) {

package/dist/core/identity/provider/authentication/presets/instagram.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"instagram.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderInstagramAuthenticator","ctx","provider","scope","~~authorize_url~~","~~token_url~~","~~user_info_url~~","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","username","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/instagram.ts"],"sourcesContent":["/\n Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderInstagramAuthenticator extends IdentityProviderOAuth2Authenticator {\n constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n ctx.provider.scope = mergeOAuth2Scopes('user_profile', ctx.provider.scope);\n ctx.provider.~~authorize_url~~ = 'https://api.instagram.com/oauth/authorize';\n ctx.provider.~~token_url~~ = 'https://api.instagram.com/oauth/access_token';\n ctx.provider.~~user_info_url~~ = 'https://graph.instagram.com/me?fields=id,username';\n\n super(ctx);\n }\n\n protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n const userInfo = await this.client.userInfo.get({\n type: 'Bearer',\n token: input.access_token,\n });\n\n const payload = extractTokenPayload(input.access_token);\n\n return {\n id: userInfo.id,\n attributeCandidates: {\n name: [\n userInfo.username,\n userInfo.id,\n ],\n },\n data: payload,\n provider: this.provider,\n };\n }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaG,yCAAb,cAA4DD,oCAAAA;CACxD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQL,kBAAkB,gBAAgBG,IAAIC,SAASC,KAAK;EACzEF,IAAIC,SAASE,~~gBAAgB~~;~~EAC7BH~~,IAAIC,SAASG,~~YAAY~~;~~EACzBJ~~,IAAIC,SAASI,~~gBAAgB~~;~~EAE7B~~,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUlB,oBAAoBW,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB,EACjBC,MAAM,CACFT,SAASU,UACTV,SAASO,EAAAA,EAEjB;GACAI,MAAML;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}
1	+ {"version":3,"file":"instagram.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderInstagramAuthenticator","ctx","provider","scope","authorizeUrl","tokenUrl","userInfoUrl","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","attributeCandidates","name","username","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/instagram.ts"],"sourcesContent":["/\n Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderInstagramAuthenticator extends IdentityProviderOAuth2Authenticator {\n constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n ctx.provider.scope = mergeOAuth2Scopes('user_profile', ctx.provider.scope);\n ctx.provider.authorizeUrl = 'https://api.instagram.com/oauth/authorize';\n ctx.provider.tokenUrl = 'https://api.instagram.com/oauth/access_token';\n ctx.provider.userInfoUrl = 'https://graph.instagram.com/me?fields=id,username';\n\n super(ctx);\n }\n\n protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n const userInfo = await this.client.userInfo.get({\n type: 'Bearer',\n token: input.access_token,\n });\n\n const payload = extractTokenPayload(input.access_token);\n\n return {\n id: userInfo.id,\n attributeCandidates: {\n name: [\n userInfo.username,\n userInfo.id,\n ],\n },\n data: payload,\n provider: this.provider,\n };\n }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaG,yCAAb,cAA4DD,oCAAAA;CACxD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQL,kBAAkB,gBAAgBG,IAAIC,SAASC,KAAK;EACzEF,IAAIC,SAASE,eAAe;EAC5BH,IAAIC,SAASG,WAAW;EACxBJ,IAAIC,SAASI,cAAc;EAE3B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUlB,oBAAoBW,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASO;GACbC,qBAAqB,EACjBC,MAAM,CACFT,SAASU,UACTV,SAASO,EAAAA,EAEjB;GACAI,MAAML;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/authentication/presets/paypal.mjs CHANGED Viewed

@@ -9,9 +9,9 @@ import { mergeOAuth2Scopes } from "@authup/specs";
 var IdentityProviderPaypalAuthenticator = class extends IdentityProviderOAuth2Authenticator {
 	constructor(ctx) {
 		ctx.provider.scope = mergeOAuth2Scopes("openid profile email", ctx.provider.scope);
-		ctx.provider.authorize_url = "https://www.paypal.com/signin/authorize";
-		ctx.provider.token_url = "https://api.paypal.com/v1/identity/openidconnect/tokenservice";
-		ctx.provider.user_info_url = "https://api.paypal.com/v1/oauth2/token/userinfo?schema=openid";
+		ctx.provider.authorizeUrl = "https://www.paypal.com/signin/authorize";
+		ctx.provider.tokenUrl = "https://api.paypal.com/v1/identity/openidconnect/tokenservice";
+		ctx.provider.userInfoUrl = "https://api.paypal.com/v1/oauth2/token/userinfo?schema=openid";
 		super(ctx);
 	}
 	async buildIdentityWithTokenGrantResponse(input) {

package/dist/core/identity/provider/authentication/presets/paypal.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"paypal.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderPaypalAuthenticator","ctx","provider","scope","~~authorize_url~~","~~token_url~~","~~user_info_url~~","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","user_id","attributeCandidates","name","email","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/paypal.ts"],"sourcesContent":["/\n Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderPaypalAuthenticator extends IdentityProviderOAuth2Authenticator {\n constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n ctx.provider.scope = mergeOAuth2Scopes('openid profile email', ctx.provider.scope);\n ctx.provider.~~authorize_url~~ = 'https://www.paypal.com/signin/authorize';\n ctx.provider.~~token_url~~ = 'https://api.paypal.com/v1/identity/openidconnect/tokenservice';\n ctx.provider.~~user_info_url~~ = 'https://api.paypal.com/v1/oauth2/token/userinfo?schema=openid';\n\n super(ctx);\n }\n\n protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n const userInfo = await this.client.userInfo.get({\n type: 'Bearer',\n token: input.access_token,\n });\n\n const payload = extractTokenPayload(input.access_token);\n\n return {\n id: userInfo.user_id,\n attributeCandidates: {\n name: [\n userInfo.name,\n userInfo.user_id,\n ],\n email: [\n userInfo.email,\n ],\n },\n data: payload,\n provider: this.provider,\n };\n }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaG,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQL,kBAAkB,wBAAwBG,IAAIC,SAASC,KAAK;EACjFF,IAAIC,SAASE,~~gBAAgB~~;~~EAC7BH~~,IAAIC,SAASG,~~YAAY~~;~~EACzBJ~~,IAAIC,SAASI,~~gBAAgB~~;~~EAE7B~~,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUlB,oBAAoBW,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASQ;GACbC,qBAAqB;IACjBC,MAAM,CACFV,SAASU,MACTV,SAASQ,OAAAA;IAEbG,OAAO,CACHX,SAASW,KAAAA;GAEjB;GACAC,MAAMN;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}
1	+ {"version":3,"file":"paypal.mjs","names":["extractTokenPayload","mergeOAuth2Scopes","IdentityProviderOAuth2Authenticator","IdentityProviderPaypalAuthenticator","ctx","provider","scope","authorizeUrl","tokenUrl","userInfoUrl","buildIdentityWithTokenGrantResponse","input","userInfo","client","get","type","token","access_token","payload","id","user_id","attributeCandidates","name","email","data"],"sources":["../../../../../../src/core/identity/provider/authentication/presets/paypal.ts"],"sourcesContent":["/\n Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { extractTokenPayload } from '@authup/server-kit';\nimport { mergeOAuth2Scopes } from '@authup/specs';\nimport type { TokenGrantResponse } from '@hapic/oauth2';\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport type { IdentityProviderOAuth2AuthenticatorContext } from '../protocols/index.ts';\nimport { IdentityProviderOAuth2Authenticator } from '../protocols/index.ts';\n\nexport class IdentityProviderPaypalAuthenticator extends IdentityProviderOAuth2Authenticator {\n constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n ctx.provider.scope = mergeOAuth2Scopes('openid profile email', ctx.provider.scope);\n ctx.provider.authorizeUrl = 'https://www.paypal.com/signin/authorize';\n ctx.provider.tokenUrl = 'https://api.paypal.com/v1/identity/openidconnect/tokenservice';\n ctx.provider.userInfoUrl = 'https://api.paypal.com/v1/oauth2/token/userinfo?schema=openid';\n\n super(ctx);\n }\n\n protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse): Promise<IdentityProviderIdentity> {\n const userInfo = await this.client.userInfo.get({\n type: 'Bearer',\n token: input.access_token,\n });\n\n const payload = extractTokenPayload(input.access_token);\n\n return {\n id: userInfo.user_id,\n attributeCandidates: {\n name: [\n userInfo.name,\n userInfo.user_id,\n ],\n email: [\n userInfo.email,\n ],\n },\n data: payload,\n provider: this.provider,\n };\n }\n}\n"],"mappings":";;;;;;;;AAcA,IAAaG,sCAAb,cAAyDD,oCAAAA;CACrD,YAAYE,KAAiD;EACzDA,IAAIC,SAASC,QAAQL,kBAAkB,wBAAwBG,IAAIC,SAASC,KAAK;EACjFF,IAAIC,SAASE,eAAe;EAC5BH,IAAIC,SAASG,WAAW;EACxBJ,IAAIC,SAASI,cAAc;EAE3B,MAAML,GAAAA;CACV;CAEA,MAAgBM,oCAAoCC,OAA8D;EAC9G,MAAMC,WAAW,MAAM,KAAKC,OAAOD,SAASE,IAAI;GAC5CC,MAAM;GACNC,OAAOL,MAAMM;EACjB,CAAA;EAEA,MAAMC,UAAUlB,oBAAoBW,MAAMM,YAAY;EAEtD,OAAO;GACHE,IAAIP,SAASQ;GACbC,qBAAqB;IACjBC,MAAM,CACFV,SAASU,MACTV,SAASQ,OAAAA;IAEbG,OAAO,CACHX,SAASW,KAAAA;GAEjB;GACAC,MAAMN;GACNb,UAAU,KAAKA;EACnB;CACJ;AACJ"}