@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/identity/provider/authentication/protocols/ldap/module.mjs

@@ -18,11 +18,11 @@ var IdentityProviderLdapAuthenticator = class extends BaseCredentialsAuthenticat
 		this.client = ctx.clientFactory.create({
 			url: ctx.provider.url,
 			tls: ctx.provider.tls,
-			startTLS: ctx.provider.start_tls,
-			baseDn: ctx.provider.base_dn,
+			startTLS: ctx.provider.startTls,
+			baseDn: ctx.provider.baseDn,
 			user: ctx.provider.user,
 			password: ctx.provider.password,
-			userNameAttribute: ctx.provider.user_name_attribute
+			userNameAttribute: ctx.provider.userNameAttribute
 		});
 	}
 	async authenticate(name, password) {
@@ -39,8 +39,8 @@ var IdentityProviderLdapAuthenticator = class extends BaseCredentialsAuthenticat
 		const identity = {
 			id: entity.dn,
 			attributeCandidates: {
-				name: [entity[this.provider.user_name_attribute || "cn"], this.extractCnFromDn(entity.dn)],
-				email: [entity[this.provider.user_mail_attribute || "mail"]]
+				name: [entity[this.provider.userNameAttribute || "cn"], this.extractCnFromDn(entity.dn)],
+				email: [entity[this.provider.userMailAttribute || "mail"]]
 			},
 			data: entity,
 			provider: this.provider
@@ -55,7 +55,7 @@ var IdentityProviderLdapAuthenticator = class extends BaseCredentialsAuthenticat
 	}
 	async bind(user, password) {
 		if (!user) return this.client.bind();
-		if (!this.client.isDn(user)) user = `${this.provider.user_name_attribute || "cn"}=${user},${this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn)}`;
+		if (!this.client.isDn(user)) user = `${this.provider.userNameAttribute || "cn"}=${user},${this.client.resolveDn(this.provider.userBaseDn, this.provider.baseDn)}`;
 		return this.client.bind(user, password);
 	}
 	async safeBind(user, password) {
@@ -91,14 +91,14 @@ var IdentityProviderLdapAuthenticator = class extends BaseCredentialsAuthenticat
 	}
 	async findOneByName(input) {
 		let filter;
-		if (this.provider.user_filter) filter = template(this.provider.user_filter, {
+		if (this.provider.userFilter) filter = template(this.provider.userFilter, {
 			input,
-			name_attribute: this.provider.user_name_attribute || "cn",
-			mail_attribute: this.provider.user_mail_attribute || "mail",
-			display_name_attribute: this.provider.user_display_name_attribute || "cn"
+			name_attribute: this.provider.userNameAttribute || "cn",
+			mail_attribute: this.provider.userMailAttribute || "mail",
+			display_name_attribute: this.provider.userDisplayNameAttribute || "cn"
 		});
-		else if (this.provider.user_name_attribute) filter = new ldap.EqualityFilter({
-			attribute: this.provider.user_name_attribute,
+		else if (this.provider.userNameAttribute) filter = new ldap.EqualityFilter({
+			attribute: this.provider.userNameAttribute,
 			value: input
 		});
 		else filter = new ldap.OrFilter({ filters: [new ldap.EqualityFilter({
@@ -111,7 +111,7 @@ var IdentityProviderLdapAuthenticator = class extends BaseCredentialsAuthenticat
 		const entities = await this.client.search({
 			filter,
 			scope: "sub"
-		}, this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn));
+		}, this.client.resolveDn(this.provider.userBaseDn, this.provider.baseDn));
 		if (entities.length === 0) return null;
 		return entities[0];
 	}
@@ -120,27 +120,27 @@ var IdentityProviderLdapAuthenticator = class extends BaseCredentialsAuthenticat
 		return match ? match[1].trim() : void 0;
 	}
 	async findUserGroups(user) {
-		const nameAttribute = this.provider.group_name_attribute || "cn";
-		const memberAttribute = this.provider.group_member_attribute || "member";
+		const nameAttribute = this.provider.groupNameAttribute || "cn";
+		const memberAttribute = this.provider.groupMemberAttribute || "member";
 		let filter;
-		if (this.provider.group_filter) filter = template(this.provider.group_filter, {
+		if (this.provider.groupFilter) filter = template(this.provider.groupFilter, {
 			...user,
 			name_attribute: nameAttribute,
 			member_attribute: memberAttribute
 		});
 		else filter = new ldap.AndFilter({ filters: [new ldap.EqualityFilter({
 			attribute: "objectClass",
-			value: this.provider.group_class || "group"
+			value: this.provider.groupClass || "group"
 		}), new ldap.EqualityFilter({
 			attribute: memberAttribute,
-			value: user[this.provider.group_member_user_attribute || "dn"]
+			value: user[this.provider.groupMemberUserAttribute || "dn"]
 		})] });
 		const entities = await this.client.search({
 			filter,
 			scope: "sub"
-		}, this.client.resolveDn(this.provider.group_base_dn, this.provider.base_dn));
+		}, this.client.resolveDn(this.provider.groupBaseDn, this.provider.baseDn));
 		if (entities.length === 0) return [];
-		const attributeKey = this.provider.group_name_attribute || "cn";
+		const attributeKey = this.provider.groupNameAttribute || "cn";
 		const names = [];
 		for (const entity of entities) {
 			const attribute = entity[attributeKey];

package/dist/core/identity/provider/authentication/protocols/ldap/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["EntityCredentialsInvalidError","template","ldap","BaseCredentialsAuthenticator","IdentityProviderLdapAuthenticator","provider","accountManager","client","ctx","clientFactory","create","url","tls","startTLS","start_tls","baseDn","base_dn","user","password","userNameAttribute","user_name_attribute","authenticate","name","bind","safeBind","success","safeUnbind","entity","findOneByName","identity","id","dn","attributeCandidates","extractCnFromDn","email","user_mail_attribute","data","roles","findUserGroups","account","save","isDn","nameAttribute","resolveDn","user_base_dn","e","error","unbind","input","filter","user_filter","name_attribute","mail_attribute","display_name_attribute","user_display_name_attribute","EqualityFilter","attribute","value","OrFilter","filters","entities","search","scope","length","match","exec","trim","undefined","group_name_attribute","memberAttribute","group_member_attribute","group_filter","member_attribute","AndFilter","group_class","group_member_user_attribute","group_base_dn","attributeKey","names","push","Array","isArray","el"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { LdapIdentityProvider, User } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError } from '@authup/errors';\nimport type { Result } from '@authup/kit';\nimport { template } from '@authup/kit';\nimport ldap from 'ldapjs';\nimport type { Filter } from 'ldapjs';\nimport { BaseCredentialsAuthenticator } from '../../../../../authentication/index.ts';\nimport type { ILdapClient } from '../../../../../ldap/index.ts';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type { IdentityProviderLdapAuthenticatorContext } from './types.ts';\n\nexport class IdentityProviderLdapAuthenticator extends BaseCredentialsAuthenticator<User> {\n    protected provider : LdapIdentityProvider;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected client: ILdapClient;\n\n    constructor(ctx: IdentityProviderLdapAuthenticatorContext) {\n        super();\n\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n        this.client = ctx.clientFactory.create({\n            url: ctx.provider.url,\n            tls: ctx.provider.tls,\n            startTLS: ctx.provider.start_tls,\n            baseDn: ctx.provider.base_dn,\n            user: ctx.provider.user,\n            password: ctx.provider.password,\n            userNameAttribute: ctx.provider.user_name_attribute,\n        });\n    }\n\n    async authenticate(name: string, password: string) : Promise<User> {\n        let bind = await this.safeBind();\n        if (!bind.success) {\n            await this.safeUnbind();\n\n            throw new EntityCredentialsInvalidError({ entity: 'user' });\n        }\n\n        const entity = await this.findOneByName(name);\n        if (!entity) {\n            await this.safeUnbind();\n            throw new EntityCredentialsInvalidError({ entity: 'user' });\n        }\n\n        const identity : IdentityProviderIdentity = {\n            id: entity.dn,\n            attributeCandidates: {\n                name: [\n                    entity[this.provider.user_name_attribute || 'cn'],\n                    this.extractCnFromDn(entity.dn),\n                ],\n                email: [\n                    entity[this.provider.user_mail_attribute || 'mail'],\n                ],\n            },\n            data: entity,\n            provider: this.provider,\n        };\n\n        try {\n            identity.roles = await this.findUserGroups(entity);\n        } catch {\n            // todo: log event\n        }\n\n        bind = await this.safeBind(identity.id, password);\n        await this.safeUnbind();\n\n        if (!bind.success) {\n            throw new EntityCredentialsInvalidError({ entity: 'user' });\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    protected async bind(user?: string, password?: string) : Promise<void> {\n        if (!user) {\n            return this.client.bind();\n        }\n\n        if (!this.client.isDn(user)) {\n            const nameAttribute = this.provider.user_name_attribute || 'cn';\n            user = `${nameAttribute}=${user},${this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn)}`;\n        }\n\n        return this.client.bind(user, password);\n    }\n\n    protected async safeBind(user?: string, password?: string) : Promise<Result<null>> {\n        try {\n            await this.bind(user, password);\n\n            return {\n                success: true,\n                data: null, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    protected async unbind() : Promise<void> {\n        return this.client.unbind();\n    }\n\n    protected async safeUnbind() : Promise<Result<null>> {\n        try {\n            await this.unbind();\n\n            return {\n                success: true,\n                data: null, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    protected async findOneByName(input: string) : Promise<Record<string, any> | null> {\n        let filter : Filter | string;\n\n        if (this.provider.user_filter) {\n            filter = template(this.provider.user_filter, {\n                input,\n                name_attribute: this.provider.user_name_attribute || 'cn',\n                mail_attribute: this.provider.user_mail_attribute || 'mail',\n                display_name_attribute: this.provider.user_display_name_attribute || 'cn',\n            });\n        } else if (this.provider.user_name_attribute) {\n            filter = new ldap.EqualityFilter({\n                attribute: this.provider.user_name_attribute,\n                value: input,\n            });\n        } else {\n            filter = new ldap.OrFilter({\n                filters: [\n                    new ldap.EqualityFilter({\n                        attribute: 'cn',\n                        value: input,\n                    }),\n                    new ldap.EqualityFilter({\n                        attribute: 'sAMAccountName',\n                        value: input,\n                    }),\n                ],\n            });\n        }\n\n        const entities = await this.client.search({\n            filter,\n            scope: 'sub',\n        }, this.client.resolveDn(this.provider.user_base_dn, this.provider.base_dn));\n\n        if (entities.length === 0) {\n            return null;\n        }\n\n        return entities[0];\n    }\n\n    protected extractCnFromDn(dn: string) : string | undefined {\n        const match = /^cn=([^,]+)/i.exec(dn);\n        return match ? match[1].trim() : undefined;\n    }\n\n    public async findUserGroups(user: Record<string, any>) : Promise<string[]> {\n        const nameAttribute = this.provider.group_name_attribute || 'cn';\n        const memberAttribute = this.provider.group_member_attribute || 'member';\n\n        let filter : Filter | string;\n        if (this.provider.group_filter) {\n            filter = template(this.provider.group_filter, {\n                ...user,\n                name_attribute: nameAttribute,\n                member_attribute: memberAttribute,\n            });\n        } else {\n            filter = new ldap.AndFilter({\n                filters: [\n                    new ldap.EqualityFilter({\n                        attribute: 'objectClass',\n                        value: this.provider.group_class || 'group',\n                    }),\n                    new ldap.EqualityFilter({\n                        attribute: memberAttribute,\n                        value: user[this.provider.group_member_user_attribute || 'dn'],\n                    }),\n                ],\n            });\n        }\n\n        const entities = await this.client.search({\n            filter,\n            scope: 'sub',\n        }, this.client.resolveDn(this.provider.group_base_dn, this.provider.base_dn));\n\n        if (entities.length === 0) {\n            return [];\n        }\n\n        const attributeKey = this.provider.group_name_attribute || 'cn';\n        const names : string[] = [];\n        for (const entity of entities) {\n            const attribute = entity[attributeKey];\n            if (typeof attribute === 'undefined') {\n                continue;\n            }\n\n            if (typeof attribute === 'string') {\n                names.push(attribute);\n                continue;\n            }\n\n            if (Array.isArray(attribute)) {\n                names.push(...attribute.filter((el) => typeof el === 'string'));\n            }\n        }\n\n        return names;\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaI,oCAAb,cAAuDD,6BAAAA;CACzCE;CAEAC;CAEAC;CAEV,YAAYC,KAA+C;EACvD,MAAK;EAEL,KAAKF,iBAAiBE,IAAIF;EAC1B,KAAKD,WAAWG,IAAIH;EACpB,KAAKE,SAASC,IAAIC,cAAcC,OAAO;GACnCC,KAAKH,IAAIH,SAASM;GAClBC,KAAKJ,IAAIH,SAASO;GAClBC,UAAUL,IAAIH,SAASS;GACvBC,QAAQP,IAAIH,SAASW;GACrBC,MAAMT,IAAIH,SAASY;GACnBC,UAAUV,IAAIH,SAASa;GACvBC,mBAAmBX,IAAIH,SAASe;EACpC,CAAA;CACJ;CAEA,MAAMC,aAAaC,MAAcJ,UAAkC;EAC/D,IAAIK,OAAO,MAAM,KAAKC,SAAQ;EAC9B,IAAI,CAACD,KAAKE,SAAS;GACf,MAAM,KAAKC,WAAU;GAErB,MAAM,IAAI1B,8BAA8B,EAAE2B,QAAQ,OAAO,CAAA;EAC7D;EAEA,MAAMA,SAAS,MAAM,KAAKC,cAAcN,IAAAA;EACxC,IAAI,CAACK,QAAQ;GACT,MAAM,KAAKD,WAAU;GACrB,MAAM,IAAI1B,8BAA8B,EAAE2B,QAAQ,OAAO,CAAA;EAC7D;EAEA,MAAME,WAAsC;GACxCC,IAAIH,OAAOI;GACXC,qBAAqB;IACjBV,MAAM,CACFK,OAAO,KAAKtB,SAASe,uBAAuB,OAC5C,KAAKa,gBAAgBN,OAAOI,EAAE,CAAA;IAElCG,OAAO,CACHP,OAAO,KAAKtB,SAAS8B,uBAAuB,OAAA;GAEpD;GACAC,MAAMT;GACNtB,UAAU,KAAKA;EACnB;EAEA,IAAI;GACAwB,SAASQ,QAAQ,MAAM,KAAKC,eAAeX,MAAAA;EAC/C,QAAQ,CAER;EAEAJ,OAAO,MAAM,KAAKC,SAASK,SAASC,IAAIZ,QAAAA;EACxC,MAAM,KAAKQ,WAAU;EAErB,IAAI,CAACH,KAAKE,SACN,MAAM,IAAIzB,8BAA8B,EAAE2B,QAAQ,OAAO,CAAA;EAK7D,QAAOY,MAFe,KAAKjC,eAAekC,KAAKX,QAAAA,EAAAA,CAEhCZ;CACnB;CAEA,MAAgBM,KAAKN,MAAeC,UAAmC;EACnE,IAAI,CAACD,MACD,OAAO,KAAKV,OAAOgB,KAAI;EAG3B,IAAI,CAAC,KAAKhB,OAAOkC,KAAKxB,IAAAA,GAElBA,OAAO,GADe,KAAKZ,SAASe,uBAAuB,KACnC,GAAGH,KAAK,GAAG,KAAKV,OAAOoC,UAAU,KAAKtC,SAASuC,cAAc,KAAKvC,SAASW,OAAO;EAG9G,OAAO,KAAKT,OAAOgB,KAAKN,MAAMC,QAAAA;CAClC;CAEA,MAAgBM,SAASP,MAAeC,UAA2C;EAC/E,IAAI;GACA,MAAM,KAAKK,KAAKN,MAAMC,QAAAA;GAEtB,OAAO;IACHO,SAAS;IACTW,MAAM;GACV;EACJ,SAASS,GAAG;GACR,OAAO;IACHpB,SAAS;IACTqB,OAAOD;GACX;EACJ;CACJ;CAEA,MAAgBE,SAAyB;EACrC,OAAO,KAAKxC,OAAOwC,OAAM;CAC7B;CAEA,MAAgBrB,aAAqC;EACjD,IAAI;GACA,MAAM,KAAKqB,OAAM;GAEjB,OAAO;IACHtB,SAAS;IACTW,MAAM;GACV;EACJ,SAASS,GAAG;GACR,OAAO;IACHpB,SAAS;IACTqB,OAAOD;GACX;EACJ;CACJ;CAEA,MAAgBjB,cAAcoB,OAAqD;EAC/E,IAAIC;EAEJ,IAAI,KAAK5C,SAAS6C,aACdD,SAAShD,SAAS,KAAKI,SAAS6C,aAAa;GACzCF;GACAG,gBAAgB,KAAK9C,SAASe,uBAAuB;GACrDgC,gBAAgB,KAAK/C,SAAS8B,uBAAuB;GACrDkB,wBAAwB,KAAKhD,SAASiD,+BAA+B;EACzE,CAAA;OACG,IAAI,KAAKjD,SAASe,qBACrB6B,SAAS,IAAI/C,KAAKqD,eAAe;GAC7BC,WAAW,KAAKnD,SAASe;GACzBqC,OAAOT;EACX,CAAA;OAEAC,SAAS,IAAI/C,KAAKwD,SAAS,EACvBC,SAAS,CACL,IAAIzD,KAAKqD,eAAe;GACpBC,WAAW;GACXC,OAAOT;EACX,CAAA,GACA,IAAI9C,KAAKqD,eAAe;GACpBC,WAAW;GACXC,OAAOT;EACX,CAAA,CAAA,EAER,CAAA;EAGJ,MAAMY,WAAW,MAAM,KAAKrD,OAAOsD,OAAO;GACtCZ;GACAa,OAAO;EACX,GAAG,KAAKvD,OAAOoC,UAAU,KAAKtC,SAASuC,cAAc,KAAKvC,SAASW,OAAO,CAAA;EAE1E,IAAI4C,SAASG,WAAW,GACpB,OAAO;EAGX,OAAOH,SAAS;CACpB;CAEU3B,gBAAgBF,IAAiC;EACvD,MAAMiC,QAAQ,eAAeC,KAAKlC,EAAAA;EAClC,OAAOiC,QAAQA,MAAM,EAAE,CAACE,KAAI,IAAKC,KAAAA;CACrC;CAEA,MAAa7B,eAAerB,MAA+C;EACvE,MAAMyB,gBAAgB,KAAKrC,SAAS+D,wBAAwB;EAC5D,MAAMC,kBAAkB,KAAKhE,SAASiE,0BAA0B;EAEhE,IAAIrB;EACJ,IAAI,KAAK5C,SAASkE,cACdtB,SAAShD,SAAS,KAAKI,SAASkE,cAAc;GAC1C,GAAGtD;GACHkC,gBAAgBT;GAChB8B,kBAAkBH;EACtB,CAAA;OAEApB,SAAS,IAAI/C,KAAKuE,UAAU,EACxBd,SAAS,CACL,IAAIzD,KAAKqD,eAAe;GACpBC,WAAW;GACXC,OAAO,KAAKpD,SAASqE,eAAe;EACxC,CAAA,GACA,IAAIxE,KAAKqD,eAAe;GACpBC,WAAWa;GACXZ,OAAOxC,KAAK,KAAKZ,SAASsE,+BAA+B;EAC7D,CAAA,CAAA,EAER,CAAA;EAGJ,MAAMf,WAAW,MAAM,KAAKrD,OAAOsD,OAAO;GACtCZ;GACAa,OAAO;EACX,GAAG,KAAKvD,OAAOoC,UAAU,KAAKtC,SAASuE,eAAe,KAAKvE,SAASW,OAAO,CAAA;EAE3E,IAAI4C,SAASG,WAAW,GACpB,OAAO,CAAA;EAGX,MAAMc,eAAe,KAAKxE,SAAS+D,wBAAwB;EAC3D,MAAMU,QAAmB,CAAA;EACzB,KAAK,MAAMnD,UAAUiC,UAAU;GAC3B,MAAMJ,YAAY7B,OAAOkD;GACzB,IAAI,OAAOrB,cAAc,aACrB;GAGJ,IAAI,OAAOA,cAAc,UAAU;IAC/BsB,MAAMC,KAAKvB,SAAAA;IACX;GACJ;GAEA,IAAIwB,MAAMC,QAAQzB,SAAAA,GACdsB,MAAMC,KAAI,GAAIvB,UAAUP,QAAQiC,OAAO,OAAOA,OAAO,QAAA,CAAA;EAE7D;EAEA,OAAOJ;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["EntityCredentialsInvalidError","template","ldap","BaseCredentialsAuthenticator","IdentityProviderLdapAuthenticator","provider","accountManager","client","ctx","clientFactory","create","url","tls","startTLS","startTls","baseDn","user","password","userNameAttribute","authenticate","name","bind","safeBind","success","safeUnbind","entity","findOneByName","identity","id","dn","attributeCandidates","extractCnFromDn","email","userMailAttribute","data","roles","findUserGroups","account","save","isDn","nameAttribute","resolveDn","userBaseDn","e","error","unbind","input","filter","userFilter","name_attribute","mail_attribute","display_name_attribute","userDisplayNameAttribute","EqualityFilter","attribute","value","OrFilter","filters","entities","search","scope","length","match","exec","trim","undefined","groupNameAttribute","memberAttribute","groupMemberAttribute","groupFilter","member_attribute","AndFilter","groupClass","groupMemberUserAttribute","groupBaseDn","attributeKey","names","push","Array","isArray","el"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/ldap/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { LdapIdentityProvider, User } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError } from '@authup/errors';\nimport type { Result } from '@authup/kit';\nimport { template } from '@authup/kit';\nimport ldap from 'ldapjs';\nimport type { Filter } from 'ldapjs';\nimport { BaseCredentialsAuthenticator } from '../../../../../authentication/index.ts';\nimport type { ILdapClient } from '../../../../../ldap/index.ts';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type { IdentityProviderLdapAuthenticatorContext } from './types.ts';\n\nexport class IdentityProviderLdapAuthenticator extends BaseCredentialsAuthenticator<User> {\n    protected provider : LdapIdentityProvider;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected client: ILdapClient;\n\n    constructor(ctx: IdentityProviderLdapAuthenticatorContext) {\n        super();\n\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n        this.client = ctx.clientFactory.create({\n            url: ctx.provider.url,\n            tls: ctx.provider.tls,\n            startTLS: ctx.provider.startTls,\n            baseDn: ctx.provider.baseDn,\n            user: ctx.provider.user,\n            password: ctx.provider.password,\n            userNameAttribute: ctx.provider.userNameAttribute,\n        });\n    }\n\n    async authenticate(name: string, password: string) : Promise<User> {\n        let bind = await this.safeBind();\n        if (!bind.success) {\n            await this.safeUnbind();\n\n            throw new EntityCredentialsInvalidError({ entity: 'user' });\n        }\n\n        const entity = await this.findOneByName(name);\n        if (!entity) {\n            await this.safeUnbind();\n            throw new EntityCredentialsInvalidError({ entity: 'user' });\n        }\n\n        const identity : IdentityProviderIdentity = {\n            id: entity.dn,\n            attributeCandidates: {\n                name: [\n                    entity[this.provider.userNameAttribute || 'cn'],\n                    this.extractCnFromDn(entity.dn),\n                ],\n                email: [\n                    entity[this.provider.userMailAttribute || 'mail'],\n                ],\n            },\n            data: entity,\n            provider: this.provider,\n        };\n\n        try {\n            identity.roles = await this.findUserGroups(entity);\n        } catch {\n            // todo: log event\n        }\n\n        bind = await this.safeBind(identity.id, password);\n        await this.safeUnbind();\n\n        if (!bind.success) {\n            throw new EntityCredentialsInvalidError({ entity: 'user' });\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    protected async bind(user?: string, password?: string) : Promise<void> {\n        if (!user) {\n            return this.client.bind();\n        }\n\n        if (!this.client.isDn(user)) {\n            const nameAttribute = this.provider.userNameAttribute || 'cn';\n            user = `${nameAttribute}=${user},${this.client.resolveDn(this.provider.userBaseDn, this.provider.baseDn)}`;\n        }\n\n        return this.client.bind(user, password);\n    }\n\n    protected async safeBind(user?: string, password?: string) : Promise<Result<null>> {\n        try {\n            await this.bind(user, password);\n\n            return {\n                success: true,\n                data: null, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    protected async unbind() : Promise<void> {\n        return this.client.unbind();\n    }\n\n    protected async safeUnbind() : Promise<Result<null>> {\n        try {\n            await this.unbind();\n\n            return {\n                success: true,\n                data: null, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    protected async findOneByName(input: string) : Promise<Record<string, any> | null> {\n        let filter : Filter | string;\n\n        if (this.provider.userFilter) {\n            filter = template(this.provider.userFilter, {\n                input,\n                name_attribute: this.provider.userNameAttribute || 'cn',\n                mail_attribute: this.provider.userMailAttribute || 'mail',\n                display_name_attribute: this.provider.userDisplayNameAttribute || 'cn',\n            });\n        } else if (this.provider.userNameAttribute) {\n            filter = new ldap.EqualityFilter({\n                attribute: this.provider.userNameAttribute,\n                value: input,\n            });\n        } else {\n            filter = new ldap.OrFilter({\n                filters: [\n                    new ldap.EqualityFilter({\n                        attribute: 'cn',\n                        value: input,\n                    }),\n                    new ldap.EqualityFilter({\n                        attribute: 'sAMAccountName',\n                        value: input,\n                    }),\n                ],\n            });\n        }\n\n        const entities = await this.client.search({\n            filter,\n            scope: 'sub',\n        }, this.client.resolveDn(this.provider.userBaseDn, this.provider.baseDn));\n\n        if (entities.length === 0) {\n            return null;\n        }\n\n        return entities[0];\n    }\n\n    protected extractCnFromDn(dn: string) : string | undefined {\n        const match = /^cn=([^,]+)/i.exec(dn);\n        return match ? match[1].trim() : undefined;\n    }\n\n    public async findUserGroups(user: Record<string, any>) : Promise<string[]> {\n        const nameAttribute = this.provider.groupNameAttribute || 'cn';\n        const memberAttribute = this.provider.groupMemberAttribute || 'member';\n\n        let filter : Filter | string;\n        if (this.provider.groupFilter) {\n            filter = template(this.provider.groupFilter, {\n                ...user,\n                name_attribute: nameAttribute,\n                member_attribute: memberAttribute,\n            });\n        } else {\n            filter = new ldap.AndFilter({\n                filters: [\n                    new ldap.EqualityFilter({\n                        attribute: 'objectClass',\n                        value: this.provider.groupClass || 'group',\n                    }),\n                    new ldap.EqualityFilter({\n                        attribute: memberAttribute,\n                        value: user[this.provider.groupMemberUserAttribute || 'dn'],\n                    }),\n                ],\n            });\n        }\n\n        const entities = await this.client.search({\n            filter,\n            scope: 'sub',\n        }, this.client.resolveDn(this.provider.groupBaseDn, this.provider.baseDn));\n\n        if (entities.length === 0) {\n            return [];\n        }\n\n        const attributeKey = this.provider.groupNameAttribute || 'cn';\n        const names : string[] = [];\n        for (const entity of entities) {\n            const attribute = entity[attributeKey];\n            if (typeof attribute === 'undefined') {\n                continue;\n            }\n\n            if (typeof attribute === 'string') {\n                names.push(attribute);\n                continue;\n            }\n\n            if (Array.isArray(attribute)) {\n                names.push(...attribute.filter((el) => typeof el === 'string'));\n            }\n        }\n\n        return names;\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaI,oCAAb,cAAuDD,6BAAAA;CACzCE;CAEAC;CAEAC;CAEV,YAAYC,KAA+C;EACvD,MAAK;EAEL,KAAKF,iBAAiBE,IAAIF;EAC1B,KAAKD,WAAWG,IAAIH;EACpB,KAAKE,SAASC,IAAIC,cAAcC,OAAO;GACnCC,KAAKH,IAAIH,SAASM;GAClBC,KAAKJ,IAAIH,SAASO;GAClBC,UAAUL,IAAIH,SAASS;GACvBC,QAAQP,IAAIH,SAASU;GACrBC,MAAMR,IAAIH,SAASW;GACnBC,UAAUT,IAAIH,SAASY;GACvBC,mBAAmBV,IAAIH,SAASa;EACpC,CAAA;CACJ;CAEA,MAAMC,aAAaC,MAAcH,UAAkC;EAC/D,IAAII,OAAO,MAAM,KAAKC,SAAQ;EAC9B,IAAI,CAACD,KAAKE,SAAS;GACf,MAAM,KAAKC,WAAU;GAErB,MAAM,IAAIxB,8BAA8B,EAAEyB,QAAQ,OAAO,CAAA;EAC7D;EAEA,MAAMA,SAAS,MAAM,KAAKC,cAAcN,IAAAA;EACxC,IAAI,CAACK,QAAQ;GACT,MAAM,KAAKD,WAAU;GACrB,MAAM,IAAIxB,8BAA8B,EAAEyB,QAAQ,OAAO,CAAA;EAC7D;EAEA,MAAME,WAAsC;GACxCC,IAAIH,OAAOI;GACXC,qBAAqB;IACjBV,MAAM,CACFK,OAAO,KAAKpB,SAASa,qBAAqB,OAC1C,KAAKa,gBAAgBN,OAAOI,EAAE,CAAA;IAElCG,OAAO,CACHP,OAAO,KAAKpB,SAAS4B,qBAAqB,OAAA;GAElD;GACAC,MAAMT;GACNpB,UAAU,KAAKA;EACnB;EAEA,IAAI;GACAsB,SAASQ,QAAQ,MAAM,KAAKC,eAAeX,MAAAA;EAC/C,QAAQ,CAER;EAEAJ,OAAO,MAAM,KAAKC,SAASK,SAASC,IAAIX,QAAAA;EACxC,MAAM,KAAKO,WAAU;EAErB,IAAI,CAACH,KAAKE,SACN,MAAM,IAAIvB,8BAA8B,EAAEyB,QAAQ,OAAO,CAAA;EAK7D,QAAOY,MAFe,KAAK/B,eAAegC,KAAKX,QAAAA,EAAAA,CAEhCX;CACnB;CAEA,MAAgBK,KAAKL,MAAeC,UAAmC;EACnE,IAAI,CAACD,MACD,OAAO,KAAKT,OAAOc,KAAI;EAG3B,IAAI,CAAC,KAAKd,OAAOgC,KAAKvB,IAAAA,GAElBA,OAAO,GADe,KAAKX,SAASa,qBAAqB,KACjC,GAAGF,KAAK,GAAG,KAAKT,OAAOkC,UAAU,KAAKpC,SAASqC,YAAY,KAAKrC,SAASU,MAAM;EAG3G,OAAO,KAAKR,OAAOc,KAAKL,MAAMC,QAAAA;CAClC;CAEA,MAAgBK,SAASN,MAAeC,UAA2C;EAC/E,IAAI;GACA,MAAM,KAAKI,KAAKL,MAAMC,QAAAA;GAEtB,OAAO;IACHM,SAAS;IACTW,MAAM;GACV;EACJ,SAASS,GAAG;GACR,OAAO;IACHpB,SAAS;IACTqB,OAAOD;GACX;EACJ;CACJ;CAEA,MAAgBE,SAAyB;EACrC,OAAO,KAAKtC,OAAOsC,OAAM;CAC7B;CAEA,MAAgBrB,aAAqC;EACjD,IAAI;GACA,MAAM,KAAKqB,OAAM;GAEjB,OAAO;IACHtB,SAAS;IACTW,MAAM;GACV;EACJ,SAASS,GAAG;GACR,OAAO;IACHpB,SAAS;IACTqB,OAAOD;GACX;EACJ;CACJ;CAEA,MAAgBjB,cAAcoB,OAAqD;EAC/E,IAAIC;EAEJ,IAAI,KAAK1C,SAAS2C,YACdD,SAAS9C,SAAS,KAAKI,SAAS2C,YAAY;GACxCF;GACAG,gBAAgB,KAAK5C,SAASa,qBAAqB;GACnDgC,gBAAgB,KAAK7C,SAAS4B,qBAAqB;GACnDkB,wBAAwB,KAAK9C,SAAS+C,4BAA4B;EACtE,CAAA;OACG,IAAI,KAAK/C,SAASa,mBACrB6B,SAAS,IAAI7C,KAAKmD,eAAe;GAC7BC,WAAW,KAAKjD,SAASa;GACzBqC,OAAOT;EACX,CAAA;OAEAC,SAAS,IAAI7C,KAAKsD,SAAS,EACvBC,SAAS,CACL,IAAIvD,KAAKmD,eAAe;GACpBC,WAAW;GACXC,OAAOT;EACX,CAAA,GACA,IAAI5C,KAAKmD,eAAe;GACpBC,WAAW;GACXC,OAAOT;EACX,CAAA,CAAA,EAER,CAAA;EAGJ,MAAMY,WAAW,MAAM,KAAKnD,OAAOoD,OAAO;GACtCZ;GACAa,OAAO;EACX,GAAG,KAAKrD,OAAOkC,UAAU,KAAKpC,SAASqC,YAAY,KAAKrC,SAASU,MAAM,CAAA;EAEvE,IAAI2C,SAASG,WAAW,GACpB,OAAO;EAGX,OAAOH,SAAS;CACpB;CAEU3B,gBAAgBF,IAAiC;EACvD,MAAMiC,QAAQ,eAAeC,KAAKlC,EAAAA;EAClC,OAAOiC,QAAQA,MAAM,EAAE,CAACE,KAAI,IAAKC,KAAAA;CACrC;CAEA,MAAa7B,eAAepB,MAA+C;EACvE,MAAMwB,gBAAgB,KAAKnC,SAAS6D,sBAAsB;EAC1D,MAAMC,kBAAkB,KAAK9D,SAAS+D,wBAAwB;EAE9D,IAAIrB;EACJ,IAAI,KAAK1C,SAASgE,aACdtB,SAAS9C,SAAS,KAAKI,SAASgE,aAAa;GACzC,GAAGrD;GACHiC,gBAAgBT;GAChB8B,kBAAkBH;EACtB,CAAA;OAEApB,SAAS,IAAI7C,KAAKqE,UAAU,EACxBd,SAAS,CACL,IAAIvD,KAAKmD,eAAe;GACpBC,WAAW;GACXC,OAAO,KAAKlD,SAASmE,cAAc;EACvC,CAAA,GACA,IAAItE,KAAKmD,eAAe;GACpBC,WAAWa;GACXZ,OAAOvC,KAAK,KAAKX,SAASoE,4BAA4B;EAC1D,CAAA,CAAA,EAER,CAAA;EAGJ,MAAMf,WAAW,MAAM,KAAKnD,OAAOoD,OAAO;GACtCZ;GACAa,OAAO;EACX,GAAG,KAAKrD,OAAOkC,UAAU,KAAKpC,SAASqE,aAAa,KAAKrE,SAASU,MAAM,CAAA;EAExE,IAAI2C,SAASG,WAAW,GACpB,OAAO,CAAA;EAGX,MAAMc,eAAe,KAAKtE,SAAS6D,sBAAsB;EACzD,MAAMU,QAAmB,CAAA;EACzB,KAAK,MAAMnD,UAAUiC,UAAU;GAC3B,MAAMJ,YAAY7B,OAAOkD;GACzB,IAAI,OAAOrB,cAAc,aACrB;GAGJ,IAAI,OAAOA,cAAc,UAAU;IAC/BsB,MAAMC,KAAKvB,SAAAA;IACX;GACJ;GAEA,IAAIwB,MAAMC,QAAQzB,SAAAA,GACdsB,MAAMC,KAAI,GAAIvB,UAAUP,QAAQiC,OAAO,OAAOA,OAAO,QAAA,CAAA;EAE7D;EAEA,OAAOJ;CACX;AACJ"}

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { buildIdentityProviderAuthorizeCallbackPath } from "@authup/core-kit";
 import { extractTokenPayload } from "@authup/server-kit";
-import { BadRequestError } from "@authup/errors";
+import { ValidationError } from "@authup/errors";
 import { OAuth2Client } from "@hapic/oauth2";
 //#region src/core/identity/provider/authentication/protocols/oauth2/module.ts
 var IdentityProviderOAuth2Authenticator = class {
@@ -16,20 +16,20 @@ var IdentityProviderOAuth2Authenticator = class {
 		this.accountManager = ctx.accountManager;
 		this.provider = ctx.provider;
 		this.client = new OAuth2Client({ options: {
-			clientId: ctx.provider.client_id,
-			clientSecret: ctx.provider.client_secret,
+			clientId: ctx.provider.clientId,
+			clientSecret: ctx.provider.clientSecret,
 			redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,
 			scope: ctx.provider.scope || void 0,
-			authorizationEndpoint: ctx.provider.authorize_url,
-			tokenEndpoint: ctx.provider.token_url,
-			userinfoEndpoint: ctx.provider.user_info_url || void 0
+			authorizationEndpoint: ctx.provider.authorizeUrl,
+			tokenEndpoint: ctx.provider.tokenUrl,
+			userinfoEndpoint: ctx.provider.userInfoUrl || void 0
 		} });
 	}
 	buildRedirectURL(parameters = {}) {
 		try {
 			return this.client.authorize.buildURL(parameters);
 		} catch {
-			throw new BadRequestError("The identity provider is misconfigured and has an invalid or missing authorize URL.");
+			throw new ValidationError("The identity provider is misconfigured and has an invalid or missing authorize URL.");
 		}
 	}
 	async authenticate(params) {

package/dist/core/identity/provider/authentication/protocols/oauth2/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["buildIdentityProviderAuthorizeCallbackPath","BadRequestError","extractTokenPayload","OAuth2Client","IdentityProviderOAuth2Authenticator","client","options","accountManager","provider","ctx","clientId","client_id","clientSecret","client_secret","redirectUri","baseURL","id","scope","undefined","authorizationEndpoint","authorize_url","tokenEndpoint","token_url","userinfoEndpoint","user_info_url","buildRedirectURL","parameters","authorize","buildURL","authenticate","params","token","createWithAuthorizationCode","identity","buildIdentityWithTokenGrantResponse","account","save","user","safeAuthenticate","data","success","e","error","input","payload","access_token","sub","attributeCandidates","name","email"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';\nimport { buildIdentityProviderAuthorizeCallbackPath } from '@authup/core-kit';\nimport { BadRequestError } from '@authup/errors';\nimport type { Result } from '@authup/kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';\nimport { OAuth2Client } from '@hapic/oauth2';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type {\n    IOAuth2Authenticator,\n    IdentityProviderOAuth2AuthenticatorContext,\n    IdentityProviderOAuth2AuthenticatorOptions,\n    OAuth2AuthorizationCodeGrantPayload,\n} from './types.ts';\n\nexport class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {\n    protected client : OAuth2Client;\n\n    protected options : IdentityProviderOAuth2AuthenticatorOptions;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected provider : OAuth2IdentityProvider | OpenIDIdentityProvider;\n\n    //----------------------------------------------------------------------\n\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n\n        this.client = new OAuth2Client({\n            options: {\n                clientId: ctx.provider.client_id,\n                clientSecret: ctx.provider.client_secret,\n                redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,\n                scope: ctx.provider.scope || undefined,\n                authorizationEndpoint: ctx.provider.authorize_url,\n                tokenEndpoint: ctx.provider.token_url,\n                userinfoEndpoint: ctx.provider.user_info_url || undefined,\n            },\n        });\n    }\n\n    //----------------------------------------------------------------------\n\n    buildRedirectURL(parameters: Partial<AuthorizeParameters> = {}) : string {\n        try {\n            return this.client.authorize.buildURL(parameters);\n        } catch {\n            throw new BadRequestError(\n                'The identity provider is misconfigured and has an invalid or missing authorize URL.',\n            );\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    async authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User> {\n        const token = await this.client.token.createWithAuthorizationCode(params);\n\n        const identity = await this.buildIdentityWithTokenGrantResponse(token);\n        if (this.options.clientId) {\n            identity.clientId = this.options.clientId;\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    async safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>> {\n        try {\n            const data = await this.authenticate(params);\n            return {\n                success: true,\n                data, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse) : Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAuBA,IAAaI,sCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiD;EACzD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,WAAWC,IAAID;EAEpB,KAAKH,SAAS,IAAIF,aAAa,EAC3BG,SAAS;GACLI,UAAUD,IAAID,SAASG;GACvBC,cAAcH,IAAID,SAASK;GAC3BC,aAAa,GAAGL,IAAIH,QAAQS,UAAUf,2CAA2CS,IAAID,SAASQ,EAAE;GAChGC,OAAOR,IAAID,SAASS,SAASC,KAAAA;GAC7BC,uBAAuBV,IAAID,SAASY;GACpCC,eAAeZ,IAAID,SAASc;GAC5BC,kBAAkBd,IAAID,SAASgB,iBAAiBN,KAAAA;EACpD,EACJ,CAAA;CACJ;CAIAO,iBAAiBC,aAA2C,CAAC,GAAY;EACrE,IAAI;GACA,OAAO,KAAKrB,OAAOsB,UAAUC,SAASF,UAAAA;EAC1C,QAAQ;GACJ,MAAM,IAAIzB,gBACN,qFAAA;EAER;CACJ;CAIA,MAAM4B,aAAaC,QAA4D;EAC3E,MAAMC,QAAQ,MAAM,KAAK1B,OAAO0B,MAAMC,4BAA4BF,MAAAA;EAElE,MAAMG,WAAW,MAAM,KAAKC,oCAAoCH,KAAAA;EAChE,IAAI,KAAKzB,QAAQI,UACbuB,SAASvB,WAAW,KAAKJ,QAAQI;EAKrC,QAAOyB,MAFe,KAAK5B,eAAe6B,KAAKH,QAAAA,EAAAA,CAEhCI;CACnB;CAEA,MAAMC,iBAAiBR,QAAoE;EACvF,IAAI;GAEA,OAAO;IACHU,SAAS;IACTD,MAAAA,MAHe,KAAKV,aAAaC,MAAAA;GAIrC;EACJ,SAASW,GAAG;GACR,OAAO;IACHD,SAAS;IACTE,OAAOD;GACX;EACJ;CACJ;CAIA,MAAgBP,oCAAoCS,OAA+D;EAC/G,MAAMC,UAAU1C,oBAAoByC,MAAME,YAAY;EAEtD,OAAO;GACH7B,IAAI4B,QAAQE;GACZC,qBAAqB;IACjBC,MAAM,CACFJ,QAAQE,GAAAA;IAEZG,OAAO,CACHL,QAAQK,KAAAA;GAEhB;GACAV,MAAMK;GACNpC,UAAU,KAAKA;EACnB;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["buildIdentityProviderAuthorizeCallbackPath","ValidationError","extractTokenPayload","OAuth2Client","IdentityProviderOAuth2Authenticator","client","options","accountManager","provider","ctx","clientId","clientSecret","redirectUri","baseURL","id","scope","undefined","authorizationEndpoint","authorizeUrl","tokenEndpoint","tokenUrl","userinfoEndpoint","userInfoUrl","buildRedirectURL","parameters","authorize","buildURL","authenticate","params","token","createWithAuthorizationCode","identity","buildIdentityWithTokenGrantResponse","account","save","user","safeAuthenticate","data","success","e","error","input","payload","access_token","sub","attributeCandidates","name","email"],"sources":["../../../../../../../src/core/identity/provider/authentication/protocols/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';\nimport { buildIdentityProviderAuthorizeCallbackPath } from '@authup/core-kit';\nimport { ValidationError } from '@authup/errors';\nimport type { Result } from '@authup/kit';\nimport { extractTokenPayload } from '@authup/server-kit';\nimport type { AuthorizeParameters, TokenGrantResponse } from '@hapic/oauth2';\nimport { OAuth2Client } from '@hapic/oauth2';\nimport type { IIdentityProviderAccountManager } from '../../../account/index.ts';\nimport type { IdentityProviderIdentity } from '../../../types.ts';\nimport type {\n    IOAuth2Authenticator,\n    IdentityProviderOAuth2AuthenticatorContext,\n    IdentityProviderOAuth2AuthenticatorOptions,\n    OAuth2AuthorizationCodeGrantPayload,\n} from './types.ts';\n\nexport class IdentityProviderOAuth2Authenticator implements IOAuth2Authenticator<User> {\n    protected client : OAuth2Client;\n\n    protected options : IdentityProviderOAuth2AuthenticatorOptions;\n\n    protected accountManager: IIdentityProviderAccountManager;\n\n    protected provider : OAuth2IdentityProvider | OpenIDIdentityProvider;\n\n    //----------------------------------------------------------------------\n\n    constructor(ctx: IdentityProviderOAuth2AuthenticatorContext) {\n        this.options = ctx.options;\n        this.accountManager = ctx.accountManager;\n        this.provider = ctx.provider;\n\n        this.client = new OAuth2Client({\n            options: {\n                clientId: ctx.provider.clientId,\n                clientSecret: ctx.provider.clientSecret,\n                redirectUri: `${ctx.options.baseURL}${buildIdentityProviderAuthorizeCallbackPath(ctx.provider.id)}`,\n                scope: ctx.provider.scope || undefined,\n                authorizationEndpoint: ctx.provider.authorizeUrl,\n                tokenEndpoint: ctx.provider.tokenUrl,\n                userinfoEndpoint: ctx.provider.userInfoUrl || undefined,\n            },\n        });\n    }\n\n    //----------------------------------------------------------------------\n\n    buildRedirectURL(parameters: Partial<AuthorizeParameters> = {}) : string {\n        try {\n            return this.client.authorize.buildURL(parameters);\n        } catch {\n            throw new ValidationError(\n                'The identity provider is misconfigured and has an invalid or missing authorize URL.',\n            );\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    async authenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<User> {\n        const token = await this.client.token.createWithAuthorizationCode(params);\n\n        const identity = await this.buildIdentityWithTokenGrantResponse(token);\n        if (this.options.clientId) {\n            identity.clientId = this.options.clientId;\n        }\n\n        const account = await this.accountManager.save(identity);\n\n        return account.user;\n    }\n\n    async safeAuthenticate(params: OAuth2AuthorizationCodeGrantPayload): Promise<Result<User>> {\n        try {\n            const data = await this.authenticate(params);\n            return {\n                success: true,\n                data, \n            };\n        } catch (e) {\n            return {\n                success: false,\n                error: e as Error, \n            };\n        }\n    }\n\n    //----------------------------------------------------------------------\n\n    protected async buildIdentityWithTokenGrantResponse(input: TokenGrantResponse) : Promise<IdentityProviderIdentity> {\n        const payload = extractTokenPayload(input.access_token);\n\n        return {\n            id: payload.sub!,\n            attributeCandidates: {\n                name: [\n                    payload.sub,\n                ],\n                email: [\n                    payload.email,\n                ],\n            },\n            data: payload,\n            provider: this.provider,\n        };\n    }\n}\n"],"mappings":";;;;;;;;AAuBA,IAAaI,sCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiD;EACzD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,WAAWC,IAAID;EAEpB,KAAKH,SAAS,IAAIF,aAAa,EAC3BG,SAAS;GACLI,UAAUD,IAAID,SAASE;GACvBC,cAAcF,IAAID,SAASG;GAC3BC,aAAa,GAAGH,IAAIH,QAAQO,UAAUb,2CAA2CS,IAAID,SAASM,EAAE;GAChGC,OAAON,IAAID,SAASO,SAASC,KAAAA;GAC7BC,uBAAuBR,IAAID,SAASU;GACpCC,eAAeV,IAAID,SAASY;GAC5BC,kBAAkBZ,IAAID,SAASc,eAAeN,KAAAA;EAClD,EACJ,CAAA;CACJ;CAIAO,iBAAiBC,aAA2C,CAAC,GAAY;EACrE,IAAI;GACA,OAAO,KAAKnB,OAAOoB,UAAUC,SAASF,UAAAA;EAC1C,QAAQ;GACJ,MAAM,IAAIvB,gBACN,qFAAA;EAER;CACJ;CAIA,MAAM0B,aAAaC,QAA4D;EAC3E,MAAMC,QAAQ,MAAM,KAAKxB,OAAOwB,MAAMC,4BAA4BF,MAAAA;EAElE,MAAMG,WAAW,MAAM,KAAKC,oCAAoCH,KAAAA;EAChE,IAAI,KAAKvB,QAAQI,UACbqB,SAASrB,WAAW,KAAKJ,QAAQI;EAKrC,QAAOuB,MAFe,KAAK1B,eAAe2B,KAAKH,QAAAA,EAAAA,CAEhCI;CACnB;CAEA,MAAMC,iBAAiBR,QAAoE;EACvF,IAAI;GAEA,OAAO;IACHU,SAAS;IACTD,MAAAA,MAHe,KAAKV,aAAaC,MAAAA;GAIrC;EACJ,SAASW,GAAG;GACR,OAAO;IACHD,SAAS;IACTE,OAAOD;GACX;EACJ;CACJ;CAIA,MAAgBP,oCAAoCS,OAA+D;EAC/G,MAAMC,UAAUxC,oBAAoBuC,MAAME,YAAY;EAEtD,OAAO;GACH7B,IAAI4B,QAAQE;GACZC,qBAAqB;IACjBC,MAAM,CACFJ,QAAQE,GAAAA;IAEZG,OAAO,CACHL,QAAQK,KAAAA;GAEhB;GACAV,MAAMK;GACNlC,UAAU,KAAKA;EACnB;CACJ;AACJ"}

package/dist/core/identity/provider/mapper/attributes/module.mjs

@@ -15,9 +15,9 @@ var IdentityProviderAttributeMapper = class extends IdentityProviderAccountBaseM
 		for (const entity of entities) {
 			const [operation, value] = this.resolve(identity, entity);
 			items.push({
-				key: entity.target_name,
-				value: entity.target_value ? entity.target_value : value,
-				realmId: entity.provider_realm_id,
+				key: entity.targetName,
+				value: entity.targetValue ? entity.targetValue : value,
+				realmId: entity.providerRealmId,
 				operation
 			});
 		}

package/dist/core/identity/provider/mapper/attributes/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderAttributeMapper","repository","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","value","resolve","push","key","target_name","target_value","realmId","provider_realm_id"],"sources":["../../../../../../src/core/identity/provider/mapper/attributes/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderAttributeMappingRepository } from './types.ts';\n\nexport class IdentityProviderAttributeMapper extends IdentityProviderAccountBaseMapper {\n    protected repository: IIdentityProviderAttributeMappingRepository;\n\n    constructor(repository: IIdentityProviderAttributeMappingRepository) {\n        super();\n\n        this.repository = repository;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.repository.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation, value] = this.resolve(identity, entity);\n\n            items.push({\n                key: entity.target_name,\n                value: entity.target_value ? entity.target_value : value,\n                realmId: entity.provider_realm_id,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;;;;AAWA,IAAaC,kCAAb,cAAqDD,kCAAAA;CACvCE;CAEV,YAAYA,YAAyD;EACjE,MAAK;EAEL,KAAKA,aAAaA;CACtB;CAEA,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,WAAWI,iBAAiBF,SAASG,SAASC,EAAE;EAE5E,MAAMC,QAA0C,CAAA;EAChD,KAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,WAAWC,SAAS,KAAKC,QAAQT,UAAUM,MAAAA;GAElDD,MAAMK,KAAK;IACPC,KAAKL,OAAOM;IACZJ,OAAOF,OAAOO,eAAeP,OAAOO,eAAeL;IACnDM,SAASR,OAAOS;IAChBR;GACJ,CAAA;EACJ;EAEA,OAAOF;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderAttributeMapper","repository","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","value","resolve","push","key","targetName","targetValue","realmId","providerRealmId"],"sources":["../../../../../../src/core/identity/provider/mapper/attributes/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderAttributeMappingRepository } from './types.ts';\n\nexport class IdentityProviderAttributeMapper extends IdentityProviderAccountBaseMapper {\n    protected repository: IIdentityProviderAttributeMappingRepository;\n\n    constructor(repository: IIdentityProviderAttributeMappingRepository) {\n        super();\n\n        this.repository = repository;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.repository.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation, value] = this.resolve(identity, entity);\n\n            items.push({\n                key: entity.targetName,\n                value: entity.targetValue ? entity.targetValue : value,\n                realmId: entity.providerRealmId,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;;;;AAWA,IAAaC,kCAAb,cAAqDD,kCAAAA;CACvCE;CAEV,YAAYA,YAAyD;EACjE,MAAK;EAEL,KAAKA,aAAaA;CACtB;CAEA,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,WAAWI,iBAAiBF,SAASG,SAASC,EAAE;EAE5E,MAAMC,QAA0C,CAAA;EAChD,KAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,WAAWC,SAAS,KAAKC,QAAQT,UAAUM,MAAAA;GAElDD,MAAMK,KAAK;IACPC,KAAKL,OAAOM;IACZJ,OAAOF,OAAOO,cAAcP,OAAOO,cAAcL;IACjDM,SAASR,OAAOS;IAChBR;GACJ,CAAA;EACJ;EAEA,OAAOF;CACX;AACJ"}

package/dist/core/identity/provider/mapper/base.mjs

@@ -9,7 +9,7 @@ import { getJWTClaimByPattern } from "@authup/specs";
 var IdentityProviderAccountBaseMapper = class {
 	resolve(identity, mapping) {
 		let operation;
-		if (mapping.synchronization_mode === IdentityProviderMappingSyncMode.ONCE && identity.operation === IdentityProviderIdentityOperation.UPDATE) {
+		if (mapping.synchronizationMode === IdentityProviderMappingSyncMode.ONCE && identity.operation === IdentityProviderIdentityOperation.UPDATE) {
 			operation = IdentityProviderMapperOperation.NONE;
 			return [operation];
 		}
@@ -17,7 +17,7 @@ var IdentityProviderAccountBaseMapper = class {
 			operation = IdentityProviderMapperOperation.CREATE;
 			return [operation];
 		}
-		const value = getJWTClaimByPattern(identity.data, mapping.name, mapping.value, mapping.value_is_regex);
+		const value = getJWTClaimByPattern(identity.data, mapping.name, mapping.value, mapping.valueIsRegex);
 		if (value.length === 0) operation = IdentityProviderMapperOperation.DELETE;
 		else operation = IdentityProviderMapperOperation.CREATE;
 		return [operation, value];

package/dist/core/identity/provider/mapper/base.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"base.mjs","names":["IdentityProviderMappingSyncMode","getJWTClaimByPattern","IdentityProviderIdentityOperation","IdentityProviderMapperOperation","IdentityProviderAccountBaseMapper","resolve","identity","mapping","operation","synchronization_mode","ONCE","UPDATE","NONE","name","value","CREATE","data","value_is_regex","length","DELETE"],"sources":["../../../../../src/core/identity/provider/mapper/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderBaseMapping } from '@authup/core-kit';\nimport { IdentityProviderMappingSyncMode } from '@authup/core-kit';\nimport { getJWTClaimByPattern } from '@authup/specs';\nimport { IdentityProviderIdentityOperation } from '../constants.ts';\nimport type { IdentityProviderIdentity } from '../types.ts';\nimport { IdentityProviderMapperOperation } from './constants.ts';\nimport type { IIdentityProviderMapper, IdentityProviderMapperElement } from './types.ts';\n\nexport abstract class IdentityProviderAccountBaseMapper implements IIdentityProviderMapper {\n    protected resolve(\n        identity: IdentityProviderIdentity,\n        mapping: IdentityProviderBaseMapping,\n    ) : [IdentityProviderMapperOperation, unknown] | [IdentityProviderMapperOperation] {\n        let operation : IdentityProviderMapperOperation;\n        if (\n            mapping.synchronization_mode === IdentityProviderMappingSyncMode.ONCE &&\n            identity.operation === IdentityProviderIdentityOperation.UPDATE\n        ) {\n            operation = IdentityProviderMapperOperation.NONE;\n\n            return [operation];\n        }\n\n        if (!mapping.name || !mapping.value) {\n            operation = IdentityProviderMapperOperation.CREATE;\n\n            return [operation];\n        }\n\n        const value = getJWTClaimByPattern(\n            identity.data,\n            mapping.name,\n            mapping.value,\n            mapping.value_is_regex,\n        );\n\n        if (value.length === 0) {\n            operation = IdentityProviderMapperOperation.DELETE;\n        } else {\n            operation = IdentityProviderMapperOperation.CREATE;\n        }\n\n        return [operation, value];\n    }\n\n    abstract execute(\n        identity: IdentityProviderIdentity\n    ): Promise<IdentityProviderMapperElement[]>;\n}\n"],"mappings":";;;;;;;;AAeA,IAAsBI,oCAAtB,MAAsBA;CACRC,QACNC,UACAC,SAC+E;EAC/E,IAAIC;EACJ,IACID,QAAQE,yBAAyBT,gCAAgCU,QACjEJ,SAASE,cAAcN,kCAAkCS,QAC3D;GACEH,YAAYL,gCAAgCS;GAE5C,OAAO,CAACJ,SAAAA;EACZ;EAEA,IAAI,CAACD,QAAQM,QAAQ,CAACN,QAAQO,OAAO;GACjCN,YAAYL,gCAAgCY;GAE5C,OAAO,CAACP,SAAAA;EACZ;EAEA,MAAMM,QAAQb,qBACVK,SAASU,MACTT,QAAQM,MACRN,QAAQO,OACRP,QAAQU,cAAc;EAG1B,IAAIH,MAAMI,WAAW,GACjBV,YAAYL,gCAAgCgB;OAE5CX,YAAYL,gCAAgCY;EAGhD,OAAO,CAACP,WAAWM,KAAAA;CACvB;AAKJ"}
+{"version":3,"file":"base.mjs","names":["IdentityProviderMappingSyncMode","getJWTClaimByPattern","IdentityProviderIdentityOperation","IdentityProviderMapperOperation","IdentityProviderAccountBaseMapper","resolve","identity","mapping","operation","synchronizationMode","ONCE","UPDATE","NONE","name","value","CREATE","data","valueIsRegex","length","DELETE"],"sources":["../../../../../src/core/identity/provider/mapper/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderBaseMapping } from '@authup/core-kit';\nimport { IdentityProviderMappingSyncMode } from '@authup/core-kit';\nimport { getJWTClaimByPattern } from '@authup/specs';\nimport { IdentityProviderIdentityOperation } from '../constants.ts';\nimport type { IdentityProviderIdentity } from '../types.ts';\nimport { IdentityProviderMapperOperation } from './constants.ts';\nimport type { IIdentityProviderMapper, IdentityProviderMapperElement } from './types.ts';\n\nexport abstract class IdentityProviderAccountBaseMapper implements IIdentityProviderMapper {\n    protected resolve(\n        identity: IdentityProviderIdentity,\n        mapping: IdentityProviderBaseMapping,\n    ) : [IdentityProviderMapperOperation, unknown] | [IdentityProviderMapperOperation] {\n        let operation : IdentityProviderMapperOperation;\n        if (\n            mapping.synchronizationMode === IdentityProviderMappingSyncMode.ONCE &&\n            identity.operation === IdentityProviderIdentityOperation.UPDATE\n        ) {\n            operation = IdentityProviderMapperOperation.NONE;\n\n            return [operation];\n        }\n\n        if (!mapping.name || !mapping.value) {\n            operation = IdentityProviderMapperOperation.CREATE;\n\n            return [operation];\n        }\n\n        const value = getJWTClaimByPattern(\n            identity.data,\n            mapping.name,\n            mapping.value,\n            mapping.valueIsRegex,\n        );\n\n        if (value.length === 0) {\n            operation = IdentityProviderMapperOperation.DELETE;\n        } else {\n            operation = IdentityProviderMapperOperation.CREATE;\n        }\n\n        return [operation, value];\n    }\n\n    abstract execute(\n        identity: IdentityProviderIdentity\n    ): Promise<IdentityProviderMapperElement[]>;\n}\n"],"mappings":";;;;;;;;AAeA,IAAsBI,oCAAtB,MAAsBA;CACRC,QACNC,UACAC,SAC+E;EAC/E,IAAIC;EACJ,IACID,QAAQE,wBAAwBT,gCAAgCU,QAChEJ,SAASE,cAAcN,kCAAkCS,QAC3D;GACEH,YAAYL,gCAAgCS;GAE5C,OAAO,CAACJ,SAAAA;EACZ;EAEA,IAAI,CAACD,QAAQM,QAAQ,CAACN,QAAQO,OAAO;GACjCN,YAAYL,gCAAgCY;GAE5C,OAAO,CAACP,SAAAA;EACZ;EAEA,MAAMM,QAAQb,qBACVK,SAASU,MACTT,QAAQM,MACRN,QAAQO,OACRP,QAAQU,YAAY;EAGxB,IAAIH,MAAMI,WAAW,GACjBV,YAAYL,gCAAgCgB;OAE5CX,YAAYL,gCAAgCY;EAGhD,OAAO,CAACP,WAAWM,KAAAA;CACvB;AAKJ"}

package/dist/core/identity/provider/mapper/permission/module.mjs

@@ -15,8 +15,8 @@ var IdentityProviderPermissionMapper = class extends IdentityProviderAccountBase
 		for (const entity of entities) {
 			const [operation] = this.resolve(identity, entity);
 			items.push({
-				value: entity.permission_id,
-				realmId: entity.permission_realm_id,
+				value: entity.permissionId,
+				realmId: entity.permissionRealmId,
 				operation
 			});
 		}

package/dist/core/identity/provider/mapper/permission/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderPermissionMapper","repository","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","resolve","push","value","permission_id","realmId","permission_realm_id"],"sources":["../../../../../../src/core/identity/provider/mapper/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderPermissionMappingRepository } from './types.ts';\n\nexport class IdentityProviderPermissionMapper extends IdentityProviderAccountBaseMapper {\n    protected repository: IIdentityProviderPermissionMappingRepository;\n\n    constructor(repository: IIdentityProviderPermissionMappingRepository) {\n        super();\n\n        this.repository = repository;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.repository.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation] = this.resolve(identity, entity);\n\n            items.push({\n                value: entity.permission_id,\n                realmId: entity.permission_realm_id,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,mCAAb,cAAsDD,kCAAAA;CACxCE;CAEV,YAAYA,YAA0D;EAClE,MAAK;EAEL,KAAKA,aAAaA;CACtB;CAEA,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,WAAWI,iBAAiBF,SAASG,SAASC,EAAE;EAE5E,MAAMC,QAA0C,CAAA;EAChD,KAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,aAAa,KAAKC,QAAQR,UAAUM,MAAAA;GAE3CD,MAAMI,KAAK;IACPC,OAAOJ,OAAOK;IACdC,SAASN,OAAOO;IAChBN;GACJ,CAAA;EACJ;EAEA,OAAOF;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderPermissionMapper","repository","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","resolve","push","value","permissionId","realmId","permissionRealmId"],"sources":["../../../../../../src/core/identity/provider/mapper/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderPermissionMappingRepository } from './types.ts';\n\nexport class IdentityProviderPermissionMapper extends IdentityProviderAccountBaseMapper {\n    protected repository: IIdentityProviderPermissionMappingRepository;\n\n    constructor(repository: IIdentityProviderPermissionMappingRepository) {\n        super();\n\n        this.repository = repository;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.repository.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation] = this.resolve(identity, entity);\n\n            items.push({\n                value: entity.permissionId,\n                realmId: entity.permissionRealmId,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,mCAAb,cAAsDD,kCAAAA;CACxCE;CAEV,YAAYA,YAA0D;EAClE,MAAK;EAEL,KAAKA,aAAaA;CACtB;CAEA,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,WAAWI,iBAAiBF,SAASG,SAASC,EAAE;EAE5E,MAAMC,QAA0C,CAAA;EAChD,KAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,aAAa,KAAKC,QAAQR,UAAUM,MAAAA;GAE3CD,MAAMI,KAAK;IACPC,OAAOJ,OAAOK;IACdC,SAASN,OAAOO;IAChBN;GACJ,CAAA;EACJ;EAEA,OAAOF;CACX;AACJ"}

package/dist/core/identity/provider/mapper/role/module.mjs

@@ -15,8 +15,8 @@ var IdentityProviderRoleMapper = class extends IdentityProviderAccountBaseMapper
 		for (const entity of entities) {
 			const [operation] = this.resolve(identity, entity);
 			items.push({
-				value: entity.role_id,
-				realmId: entity.role_realm_id,
+				value: entity.roleId,
+				realmId: entity.roleRealmId,
 				operation
 			});
 		}

package/dist/core/identity/provider/mapper/role/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderRoleMapper","finder","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","resolve","push","value","role_id","realmId","role_realm_id"],"sources":["../../../../../../src/core/identity/provider/mapper/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderRoleMappingFinder } from './types.ts';\n\nexport class IdentityProviderRoleMapper extends IdentityProviderAccountBaseMapper {\n    protected finder: IIdentityProviderRoleMappingFinder;\n\n    constructor(finder: IIdentityProviderRoleMappingFinder) {\n        super();\n\n        this.finder = finder;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.finder.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation] = this.resolve(identity, entity);\n\n            items.push({\n                value: entity.role_id,\n                realmId: entity.role_realm_id,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,6BAAb,cAAgDD,kCAAAA;CAClCE;CAEV,YAAYA,QAA4C;EACpD,MAAK;EAEL,KAAKA,SAASA;CAClB;CAEA,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,OAAOI,iBAAiBF,SAASG,SAASC,EAAE;EAExE,MAAMC,QAA0C,CAAA;EAChD,KAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,aAAa,KAAKC,QAAQR,UAAUM,MAAAA;GAE3CD,MAAMI,KAAK;IACPC,OAAOJ,OAAOK;IACdC,SAASN,OAAOO;IAChBN;GACJ,CAAA;EACJ;EAEA,OAAOF;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityProviderAccountBaseMapper","IdentityProviderRoleMapper","finder","execute","identity","entities","findByProviderId","provider","id","items","entity","operation","resolve","push","value","roleId","realmId","roleRealmId"],"sources":["../../../../../../src/core/identity/provider/mapper/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderIdentity } from '../../types.ts';\nimport { IdentityProviderAccountBaseMapper } from '../base.ts';\nimport type { IdentityProviderMapperElement } from '../types.ts';\nimport type { IIdentityProviderRoleMappingFinder } from './types.ts';\n\nexport class IdentityProviderRoleMapper extends IdentityProviderAccountBaseMapper {\n    protected finder: IIdentityProviderRoleMappingFinder;\n\n    constructor(finder: IIdentityProviderRoleMappingFinder) {\n        super();\n\n        this.finder = finder;\n    }\n\n    async execute(identity: IdentityProviderIdentity): Promise<IdentityProviderMapperElement[]> {\n        const entities = await this.finder.findByProviderId(identity.provider.id);\n\n        const items : IdentityProviderMapperElement[] = [];\n        for (const entity of entities) {\n            const [operation] = this.resolve(identity, entity);\n\n            items.push({\n                value: entity.roleId,\n                realmId: entity.roleRealmId,\n                operation,\n            });\n        }\n\n        return items;\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,6BAAb,cAAgDD,kCAAAA;CAClCE;CAEV,YAAYA,QAA4C;EACpD,MAAK;EAEL,KAAKA,SAASA;CAClB;CAEA,MAAMC,QAAQC,UAA8E;EACxF,MAAMC,WAAW,MAAM,KAAKH,OAAOI,iBAAiBF,SAASG,SAASC,EAAE;EAExE,MAAMC,QAA0C,CAAA;EAChD,KAAK,MAAMC,UAAUL,UAAU;GAC3B,MAAM,CAACM,aAAa,KAAKC,QAAQR,UAAUM,MAAAA;GAE3CD,MAAMI,KAAK;IACPC,OAAOJ,OAAOK;IACdC,SAASN,OAAOO;IAChBN;GACJ,CAAA;EACJ;EAEA,OAAOF;CACX;AACJ"}

package/dist/core/identity/registration/error.d.ts

@@ -1,6 +1,6 @@
-import { BadRequestError } from '@authup/errors';
+import { ValidationError } from '@authup/errors';
 export declare const REGISTRATION_DISABLED_ERROR_INSTANCE: unique symbol;
-export declare class RegistrationDisabledError extends BadRequestError {
+export declare class RegistrationDisabledError extends ValidationError {
     constructor();
 }
 //# sourceMappingURL=error.d.ts.map

package/dist/core/identity/registration/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/error.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAA6B,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,oCAAoC,eAA8D,CAAC;AAEhH,qBAAa,yBAA0B,SAAQ,eAAe;;CAQ7D"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/error.ts"],"names":[],"mappings":"AAOA,OAAO,EAAa,eAAe,EAAkB,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,oCAAoC,eAA8D,CAAC;AAEhH,qBAAa,yBAA0B,SAAQ,eAAe;;CAQ7D"}

package/dist/core/identity/registration/error.mjs

@@ -1,10 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { BadRequestError, ErrorCode, markInstanceof } from "@authup/errors";
+import { ErrorCode, ValidationError, markInstanceof } from "@authup/errors";
 //#region src/core/identity/registration/error.ts
 const REGISTRATION_DISABLED_ERROR_INSTANCE = Symbol.for("@authup/server-core/RegistrationDisabledError");
-var RegistrationDisabledError = class extends BadRequestError {
+var RegistrationDisabledError = class extends ValidationError {
 	constructor() {
 		super({
 			code: ErrorCode.REGISTRATION_DISABLED,

package/dist/core/identity/registration/error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error.mjs","names":["BadRequestError","ErrorCode","markInstanceof","REGISTRATION_DISABLED_ERROR_INSTANCE","Symbol","for","RegistrationDisabledError","code","REGISTRATION_DISABLED","message"],"sources":["../../../../src/core/identity/registration/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BadRequestError, ErrorCode, markInstanceof } from '@authup/errors';\n\nexport const REGISTRATION_DISABLED_ERROR_INSTANCE = Symbol.for('@authup/server-core/RegistrationDisabledError');\n\nexport class RegistrationDisabledError extends BadRequestError {\n    constructor() {\n        super({\n            code: ErrorCode.REGISTRATION_DISABLED,\n            message: 'User registration is not enabled.',\n        });\n        markInstanceof(this, REGISTRATION_DISABLED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaG,uCAAuCC,OAAOC,IAAI,+CAAA;AAE/D,IAAaC,4BAAb,cAA+CN,gBAAAA;CAC3C,cAAc;EACV,MAAM;GACFO,MAAMN,UAAUO;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,oCAAAA;CACzB;AACJ"}
+{"version":3,"file":"error.mjs","names":["ErrorCode","ValidationError","markInstanceof","REGISTRATION_DISABLED_ERROR_INSTANCE","Symbol","for","RegistrationDisabledError","code","REGISTRATION_DISABLED","message"],"sources":["../../../../src/core/identity/registration/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode, ValidationError, markInstanceof } from '@authup/errors';\n\nexport const REGISTRATION_DISABLED_ERROR_INSTANCE = Symbol.for('@authup/server-core/RegistrationDisabledError');\n\nexport class RegistrationDisabledError extends ValidationError {\n    constructor() {\n        super({\n            code: ErrorCode.REGISTRATION_DISABLED,\n            message: 'User registration is not enabled.',\n        });\n        markInstanceof(this, REGISTRATION_DISABLED_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaG,uCAAuCC,OAAOC,IAAI,+CAAA;AAE/D,IAAaC,4BAAb,cAA+CL,gBAAAA;CAC3C,cAAc;EACV,MAAM;GACFM,MAAMP,UAAUQ;GAChBC,SAAS;EACb,CAAA;EACAP,eAAe,MAAMC,oCAAAA;CACzB;AACJ"}

package/dist/core/identity/registration/service.d.ts

@@ -1,6 +1,6 @@
 import type { IRegistrationService, RegistrationResult, RegistrationServiceContext, RegistrationServiceOptions } from './types.ts';
 import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
-import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';
 import type { IdentityWorkflowContext } from '../types.ts';
 export declare class RegistrationService implements IRegistrationService {
     protected options: RegistrationServiceOptions;
@@ -8,6 +8,7 @@ export declare class RegistrationService implements IRegistrationService {
     protected mailTemplateRenderer: IMailTemplateRenderer;
     protected repository: IUserRepository;
     protected realmRepository: IRealmRepository;
+    protected eventService?: IEventService;
     constructor(ctx: RegistrationServiceContext);
     register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult>;
     activate(data: {

package/dist/core/identity/registration/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/service.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAEtD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,0BAA0B;IAQrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAyDnG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAczD"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/service.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;IAElC,SAAS,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAEtD,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;gBAE3B,GAAG,EAAE,0BAA0B;IASrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoEnG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAyBzD"}

package/dist/core/identity/registration/service.mjs

@@ -6,10 +6,10 @@ import { MailTemplateName } from "../../mail/template/types.mjs";
 import "../../mail/index.mjs";
 import { RegistrationDisabledError } from "./error.mjs";
 import { createNanoID } from "@authup/kit";
-import { UserValidator } from "@authup/core-kit";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
-import { Container } from "validup";
+import { EventName, EventRefType, EventScope, IdentityType, UserValidator } from "@authup/core-kit";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
 import { randomBytes } from "node:crypto";
+import { Container } from "validup";
 //#region src/core/identity/registration/service.ts
 var RegistrationService = class {
 	options;
@@ -17,12 +17,14 @@ var RegistrationService = class {
 	mailTemplateRenderer;
 	repository;
 	realmRepository;
+	eventService;
 	constructor(ctx) {
 		this.options = ctx.options;
 		this.mailClient = ctx.mailClient;
 		this.mailTemplateRenderer = ctx.mailTemplateRenderer;
 		this.repository = ctx.repository;
 		this.realmRepository = ctx.realmRepository;
+		this.eventService = ctx.eventService;
 	}
 	async register(data, context) {
 		if (!this.options.registrationEnabled) throw new RegistrationDisabledError();
@@ -32,7 +34,7 @@ var RegistrationService = class {
 				"email",
 				"name",
 				"password",
-				"realm_id"
+				"realmId"
 			],
 			passwordMinLength: this.options.passwordMinLength
 		}));
@@ -40,20 +42,20 @@ var RegistrationService = class {
 		await this.repository.validateJoinColumns(validated);
 		if (this.options.emailVerificationEnabled) {
 			validated.active = false;
-			validated.activate_hash = randomBytes(32).toString("hex");
+			validated.activateHash = randomBytes(32).toString("hex");
 		} else validated.active = true;
 		const entity = this.repository.create(validated);
 		const credentialsService = new UserCredentialsService();
 		entity.password = entity.password || createNanoID(64);
 		entity.password = await credentialsService.protect(entity.password);
-		entity.realm_id = (await this.realmRepository.resolve(entity.realm_id, true)).id;
+		entity.realmId = (await this.realmRepository.resolve(entity.realmId, true)).id;
 		await this.repository.save(entity);
 		if (this.options.emailVerificationEnabled) try {
-			const activateUrl = this.options.publicUrl ? `${this.options.publicUrl.replace(/\/+$/, "")}/activate?token=${entity.activate_hash}` : void 0;
+			const activateUrl = this.options.publicUrl ? `${this.options.publicUrl.replace(/\/+$/, "")}/activate?token=${entity.activateHash}` : void 0;
 			const mail = await this.mailTemplateRenderer.render({
 				template: MailTemplateName.REGISTRATION_ACTIVATION,
 				params: {
-					code: entity.activate_hash,
+					code: entity.activateHash,
 					url: activateUrl
 				},
 				locale: context?.locale
@@ -64,18 +66,38 @@ var RegistrationService = class {
 			});
 		} catch {
 			await this.repository.remove(entity);
-			throw new BadRequestError("Registration failed. Could not send activation email.");
+			throw new ValidationError("Registration failed. Could not send activation email.");
 		}
+		await this.eventService?.record({
+			scope: EventScope.IDENTITY,
+			name: EventName.REGISTER,
+			refType: EventRefType.USER,
+			refId: entity.id,
+			actorType: IdentityType.USER,
+			actorId: entity.id,
+			actorName: entity.name,
+			realmId: entity.realmId
+		});
 		return { active: entity.active };
 	}
 	async activate(data) {
-		const entity = await this.repository.findOneBy({ activate_hash: data.token });
+		const entity = await this.repository.findOneBy({ activateHash: data.token });
 		if (!entity) throw new EntityNotFoundError();
 		const merged = this.repository.merge(entity, {
 			active: true,
-			activate_hash: null
+			activateHash: null
 		});
 		await this.repository.save(merged);
+		await this.eventService?.record({
+			scope: EventScope.IDENTITY,
+			name: EventName.ACCOUNT_ACTIVATED,
+			refType: EventRefType.USER,
+			refId: merged.id,
+			actorType: IdentityType.USER,
+			actorId: merged.id,
+			actorName: merged.name,
+			realmId: merged.realmId
+		});
 	}
 };
 //#endregion

package/dist/core/identity/registration/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["UserValidator","createNanoID","BadRequestError","EntityNotFoundError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","MailTemplateName","RegistrationService","options","mailClient","mailTemplateRenderer","repository","realmRepository","ctx","register","data","context","registrationEnabled","validator","mount","pathsToInclude","passwordMinLength","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","activateUrl","publicUrl","replace","undefined","mail","render","template","REGISTRATION_ACTIVATION","params","code","url","locale","send","to","email","remove","activate","findOneBy","token","merged","merge"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserValidator } from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n    }\n\n    async register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({\n            pathsToInclude: ['email', 'name', 'password', 'realm_id'],\n            passwordMinLength: this.options.passwordMinLength,\n        }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                const activateUrl = this.options.publicUrl ?\n                    `${this.options.publicUrl.replace(/\\/+$/, '')}/activate?token=${entity.activate_hash}` :\n                    undefined;\n\n                const mail = await this.mailTemplateRenderer.render({\n                    template: MailTemplateName.REGISTRATION_ACTIVATION,\n                    params: { code: entity.activate_hash!, url: activateUrl },\n                    locale: context?.locale,\n                });\n\n                await this.mailClient.send({\n                    to: entity.email,\n                    ...mail,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new BadRequestError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAyBA,IAAaS,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKL,UAAUK,IAAIL;EACnB,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,SAASC,MAA2BC,SAAgE;EACtG,IAAI,CAAC,KAAKR,QAAQS,qBACd,MAAM,IAAIf,0BAAAA;EAGd,MAAMgB,YAAY,IAAId,UAAU,CAAC,CAAA;EACjCc,UAAUC,MAAM,IAAIrB,cAAc;GAC9BsB,gBAAgB;IAAC;IAAS;IAAQ;IAAY;;GAC9CC,mBAAmB,KAAKb,QAAQa;EACpC,CAAA,CAAA;EACA,MAAMC,YAAY,MAAMJ,UAAUK,IAAIR,MAAM,EAAES,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKb,WAAWc,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKd,QAAQkB,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,gBAAgBzB,YAAY,EAAA,CAAA,CAAI0B,SAAS,KAAA;EACvD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKnB,WAAWoB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAI3B,uBAAAA;EAC/ByB,OAAOG,WAAWH,OAAOG,YAAYlC,aAAa,EAAA;EAClD+B,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,YAAWF,MADE,KAAKvB,gBAAgBwB,QAAQN,OAAOO,UAAU,IAAA,EAAA,CAC1CC;EAExB,MAAM,KAAK3B,WAAW4B,KAAKT,MAAAA;EAE3B,IAAI,KAAKtB,QAAQkB,0BACb,IAAI;GACA,MAAMc,cAAc,KAAKhC,QAAQiC,YAC7B,GAAG,KAAKjC,QAAQiC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,kBAAkBZ,OAAOF,kBACvEe,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKlC,qBAAqBmC,OAAO;IAChDC,UAAUxC,iBAAiByC;IAC3BC,QAAQ;KAAEC,MAAMnB,OAAOF;KAAgBsB,KAAKV;IAAY;IACxDW,QAAQnC,SAASmC;GACrB,CAAA;GAEA,MAAM,KAAK1C,WAAW2C,KAAK;IACvBC,IAAIvB,OAAOwB;IACX,GAAGV;GACP,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKjC,WAAW4C,OAAOzB,MAAAA;GAC7B,MAAM,IAAI9B,gBAAgB,uDAAA;EAC9B;EAGJ,OAAO,EAAE2B,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAM6B,SAASzC,MAAwC;EACnD,MAAMe,SAAS,MAAM,KAAKnB,WAAW8C,UAAU,EAAE7B,eAAeb,KAAK2C,MAAM,CAAA;EAE3E,IAAI,CAAC5B,QACD,MAAM,IAAI7B,oBAAAA;EAGd,MAAM0D,SAAS,KAAKhD,WAAWiD,MAAM9B,QAAQ;GACzCH,QAAQ;GACRC,eAAe;EACnB,CAAA;EAEA,MAAM,KAAKjB,WAAW4B,KAAKoB,MAAAA;CAC/B;AACJ"}
+{"version":3,"file":"service.mjs","names":["EventName","EventRefType","EventScope","IdentityType","UserValidator","createNanoID","EntityNotFoundError","ValidationError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","MailTemplateName","RegistrationService","options","mailClient","mailTemplateRenderer","repository","realmRepository","eventService","ctx","register","data","context","registrationEnabled","validator","mount","pathsToInclude","passwordMinLength","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activateHash","toString","entity","create","credentialsService","password","protect","realm","resolve","realmId","id","save","activateUrl","publicUrl","replace","undefined","mail","render","template","REGISTRATION_ACTIVATION","params","code","url","locale","send","to","email","remove","record","scope","IDENTITY","name","REGISTER","refType","USER","refId","actorType","actorId","actorName","activate","findOneBy","token","merged","merge","ACCOUNT_ACTIVATED"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    UserValidator,\n} from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected eventService?: IEventService;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.eventService = ctx.eventService;\n    }\n\n    async register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({\n            pathsToInclude: ['email', 'name', 'password', 'realmId'],\n            passwordMinLength: this.options.passwordMinLength,\n        }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activateHash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realmId, true);\n        entity.realmId = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                const activateUrl = this.options.publicUrl ?\n                    `${this.options.publicUrl.replace(/\\/+$/, '')}/activate?token=${entity.activateHash}` :\n                    undefined;\n\n                const mail = await this.mailTemplateRenderer.render({\n                    template: MailTemplateName.REGISTRATION_ACTIVATION,\n                    params: { code: entity.activateHash!, url: activateUrl },\n                    locale: context?.locale,\n                });\n\n                await this.mailClient.send({\n                    to: entity.email,\n                    ...mail,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new ValidationError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.REGISTER,\n            refType: EventRefType.USER,\n            refId: entity.id,\n            actorType: IdentityType.USER,\n            actorId: entity.id,\n            actorName: entity.name,\n            realmId: entity.realmId,\n        });\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activateHash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activateHash: null,\n        });\n\n        await this.repository.save(merged);\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.ACCOUNT_ACTIVATED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realmId,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AA+BA,IAAaa,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKN,UAAUM,IAAIN;EACnB,KAAKC,aAAaK,IAAIL;EACtB,KAAKC,uBAAuBI,IAAIJ;EAChC,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,SAASC,MAA2BC,SAAgE;EACtG,IAAI,CAAC,KAAKT,QAAQU,qBACd,MAAM,IAAIhB,0BAAAA;EAGd,MAAMiB,YAAY,IAAIf,UAAU,CAAC,CAAA;EACjCe,UAAUC,MAAM,IAAItB,cAAc;GAC9BuB,gBAAgB;IAAC;IAAS;IAAQ;IAAY;;GAC9CC,mBAAmB,KAAKd,QAAQc;EACpC,CAAA,CAAA;EACA,MAAMC,YAAY,MAAMJ,UAAUK,IAAIR,MAAM,EAAES,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKd,WAAWe,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKf,QAAQmB,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,eAAe1B,YAAY,EAAA,CAAA,CAAI2B,SAAS,KAAA;EACtD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKpB,WAAWqB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAI5B,uBAAAA;EAC/B0B,OAAOG,WAAWH,OAAOG,YAAYnC,aAAa,EAAA;EAClDgC,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,WAAUF,MADG,KAAKxB,gBAAgByB,QAAQN,OAAOO,SAAS,IAAA,EAAA,CAC1CC;EAEvB,MAAM,KAAK5B,WAAW6B,KAAKT,MAAAA;EAE3B,IAAI,KAAKvB,QAAQmB,0BACb,IAAI;GACA,MAAMc,cAAc,KAAKjC,QAAQkC,YAC7B,GAAG,KAAKlC,QAAQkC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,kBAAkBZ,OAAOF,iBACvEe,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKnC,qBAAqBoC,OAAO;IAChDC,UAAUzC,iBAAiB0C;IAC3BC,QAAQ;KAAEC,MAAMnB,OAAOF;KAAesB,KAAKV;IAAY;IACvDW,QAAQnC,SAASmC;GACrB,CAAA;GAEA,MAAM,KAAK3C,WAAW4C,KAAK;IACvBC,IAAIvB,OAAOwB;IACX,GAAGV;GACP,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKlC,WAAW6C,OAAOzB,MAAAA;GAC7B,MAAM,IAAI9B,gBAAgB,uDAAA;EAC9B;EAGJ,MAAM,KAAKY,cAAc4C,OAAO;GAC5BC,OAAO9D,WAAW+D;GAClBC,MAAMlE,UAAUmE;GAChBC,SAASnE,aAAaoE;GACtBC,OAAOjC,OAAOQ;GACd0B,WAAWpE,aAAakE;GACxBG,SAASnC,OAAOQ;GAChB4B,WAAWpC,OAAO6B;GAClBtB,SAASP,OAAOO;EACpB,CAAA;EAEA,OAAO,EAAEV,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAMwC,SAASpD,MAAwC;EACnD,MAAMe,SAAS,MAAM,KAAKpB,WAAW0D,UAAU,EAAExC,cAAcb,KAAKsD,MAAM,CAAA;EAE1E,IAAI,CAACvC,QACD,MAAM,IAAI/B,oBAAAA;EAGd,MAAMuE,SAAS,KAAK5D,WAAW6D,MAAMzC,QAAQ;GACzCH,QAAQ;GACRC,cAAc;EAClB,CAAA;EAEA,MAAM,KAAKlB,WAAW6B,KAAK+B,MAAAA;EAE3B,MAAM,KAAK1D,cAAc4C,OAAO;GAC5BC,OAAO9D,WAAW+D;GAClBC,MAAMlE,UAAU+E;GAChBX,SAASnE,aAAaoE;GACtBC,OAAOO,OAAOhC;GACd0B,WAAWpE,aAAakE;GACxBG,SAASK,OAAOhC;GAChB4B,WAAWI,OAAOX;GAClBtB,SAASiC,OAAOjC;EACpB,CAAA;CACJ;AACJ"}

package/dist/core/identity/registration/types.d.ts

@@ -1,5 +1,5 @@
 import type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';
-import type { IRealmRepository, IUserRepository } from '../../entities/index.ts';
+import type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';
 import type { IdentityWorkflowContext } from '../types.ts';
 export type RegistrationServiceOptions = {
     registrationEnabled?: boolean;
@@ -13,6 +13,7 @@ export type RegistrationServiceContext = {
     mailTemplateRenderer: IMailTemplateRenderer;
     repository: IUserRepository;
     realmRepository: IRealmRepository;
+    eventService?: IEventService;
 };
 export type RegistrationResult = {
     active: boolean;

package/dist/core/identity/registration/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,0BAA0B,GAAG;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/registration/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,0BAA0B,GAAG;IACrC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;IAClC,YAAY,CAAC,EAAE,aAAa,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpG,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}