npm - @authup/server-core - Versions diffs - 1.0.0-beta.53 → 1.0.0-beta.54 - Mend

@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.54

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1152) hide show

package/dist/app/modules/provisioning/sources/default/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","ClientAuthMethod","ClientTokenBindingMethod","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","RobotCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","built_in","realm_id","extraAttributes","decision_strategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","ROBOT_NAMES_SELF_MANAGE","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","ROBOT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","CONSENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","KEY_CREATE","KEY_UPDATE","KEY_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","SESSION_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","USER_AUTHENTICATOR_CREATE","USER_AUTHENTICATOR_UPDATE","USER_AUTHENTICATOR_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","auth_method","SECRET","token_binding_method","NONE","secret","clientSystemSecret","secret_hashed","clientSystemEnabled","robotCredentialsService","robotStrategy","robotAdminSecretReset","robots","robotAdminSecret","robotAdminEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n Client, \n Permission, \n Robot, \n Role, \n Scope, \n User,\n} from '@authup/core-kit';\nimport {\n ClientAuthMethod,\n ClientTokenBindingMethod,\n PermissionName, \n REALM_MASTER_NAME, \n ROLE_ADMIN_NAME, \n ROLE_REALM_ADMIN_NAME, \n ScopeName, \n buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n ClientCredentialsService,\n RobotCredentialsService,\n UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n buildPolicies(): PolicyProvisioningEntity[] {\n return [\n {\n attributes: {\n name: SystemPolicyName.DEFAULT,\n type: BuiltInPolicyType.COMPOSITE,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },\n children: [\n {\n attributes: {\n name: SystemPolicyName.IDENTITY,\n type: BuiltInPolicyType.IDENTITY,\n built_in: true,\n realm_id: null,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.PERMISSION_BINDING,\n type: BuiltInPolicyType.PERMISSION_BINDING,\n built_in: true,\n realm_id: null,\n },\n },\n ],\n },\n // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n // Each `names` entry is what self-edit must REJECT; everything else\n // is permitted. New columns added to the entity are self-editable\n // by default — extend the denylist when adding admin-only state.\n {\n attributes: {\n name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n // FK + lifecycle\n 'active',\n 'realm_id',\n // Security-critical: a self-edit must not change the\n // client's authentication/binding method (changing the\n // auth method may clear its secret) or downgrade the\n // secret-storage format\n // (which would persist the secret in plaintext).\n 'auth_method',\n 'token_binding_method',\n 'secret_hashed',\n 'secret_encrypted',\n 'access_policy_id',\n ],\n },\n },\n {\n attributes: {\n name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n 'active',\n 'realm_id',\n 'user_id',\n ],\n },\n },\n {\n attributes: {\n name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n built_in: true,\n realm_id: null,\n },\n extraAttributes: {\n names: [\n 'active',\n 'name_locked',\n 'status',\n 'status_message',\n 'realm_id',\n ],\n },\n },\n ];\n }\n\n buildPermissions(): PermissionProvisioningEntity[] {\n const policiesByPermission: Partial<Record<string, string[]>> = {\n [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n [PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],\n [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n };\n\n return Object.values(PermissionName)\n .map((name) => {\n const entity: PermissionProvisioningEntity = {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Permission)[],\n },\n attributes: {\n name,\n built_in: true,\n },\n };\n\n const policies = policiesByPermission[name];\n if (policies) {\n entity.relations = { policies };\n }\n\n return entity;\n });\n }\n\n buildScopes(): ScopeProvisioningEntity[] {\n return Object.values(ScopeName)\n .map((name) => ({\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Scope)[],\n },\n attributes: {\n name,\n built_in: true,\n },\n }));\n }\n\n buildRoles(): RoleProvisioningEntity[] {\n return [\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_ADMIN_NAME,\n built_in: true,\n },\n relations: {\n globalPermissions: [''],\n // Global admin: unrestricted realm reach (any realm + null/global).\n globalPermissionsRealmScope: RealmScope.ANY,\n },\n },\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_REALM_ADMIN_NAME,\n built_in: true,\n },\n relations: {\n globalPermissions: ['*'],\n globalPermissionsExclude: [\n PermissionName.REALM_CREATE,\n PermissionName.REALM_UPDATE,\n PermissionName.REALM_DELETE,\n ],\n // realm_admin: own realm + null/global by default (so it can\n // read/assign global building blocks), but strictly own-realm for\n // direct entity CUD (cannot create/modify global entities).\n globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n globalPermissionsRealmScopeOverrides: {\n [RealmScope.OWN]: [\n PermissionName.CLIENT_CREATE,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n PermissionName.CONSENT_DELETE,\n PermissionName.IDENTITY_PROVIDER_CREATE,\n PermissionName.IDENTITY_PROVIDER_UPDATE,\n PermissionName.IDENTITY_PROVIDER_DELETE,\n PermissionName.KEY_CREATE,\n PermissionName.KEY_UPDATE,\n PermissionName.KEY_DELETE,\n PermissionName.PERMISSION_CREATE,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n PermissionName.ROBOT_CREATE,\n PermissionName.ROBOT_UPDATE,\n PermissionName.ROBOT_DELETE,\n PermissionName.ROLE_CREATE,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n PermissionName.SCOPE_CREATE,\n PermissionName.SCOPE_UPDATE,\n PermissionName.SCOPE_DELETE,\n PermissionName.SESSION_DELETE,\n PermissionName.USER_CREATE,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n PermissionName.USER_AUTHENTICATOR_CREATE,\n PermissionName.USER_AUTHENTICATOR_UPDATE,\n PermissionName.USER_AUTHENTICATOR_DELETE,\n ],\n },\n },\n },\n ];\n }\n\n async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n const masterRealm : RealmProvisioningEntity = {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in'],\n },\n attributes: {\n name: REALM_MASTER_NAME,\n built_in: true,\n },\n relations: {},\n };\n\n const userCredentialsService = new UserCredentialsService();\n\n let userStrategy : ProvisioningEntityStrategy<User> \| undefined;\n if (config.userAdminPasswordReset) {\n userStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['password'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.users = [\n {\n strategy: userStrategy,\n attributes: {\n name: 'admin',\n password: await userCredentialsService.protect(config.userAdminPassword),\n email: buildUserFakeEmail('admin'),\n active: config.userAdminEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n const clientCredentialsService = new ClientCredentialsService();\n\n let clientStrategy : ProvisioningEntityStrategy<Client> \| undefined;\n if (config.clientSystemSecretReset) {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in', 'auth_method', 'token_binding_method', 'secret', 'secret_hashed', 'secret_encrypted'],\n };\n } else {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['built_in', 'auth_method', 'token_binding_method'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.clients = [\n {\n strategy: clientStrategy,\n attributes: {\n built_in: true,\n auth_method: ClientAuthMethod.SECRET,\n token_binding_method: ClientTokenBindingMethod.NONE,\n name: 'system',\n secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),\n secret_hashed: false,\n active: config.clientSystemEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n const robotCredentialsService = new RobotCredentialsService();\n\n let robotStrategy : ProvisioningEntityStrategy<Robot> \| undefined;\n if (config.robotAdminSecretReset) {\n robotStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['secret'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.robots = [\n {\n strategy: robotStrategy,\n attributes: {\n name: 'system',\n secret: await robotCredentialsService.protect(config.robotAdminSecret),\n active: config.robotAdminEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n return [masterRealm];\n }\n\n async load(container: IContainer): Promise<RootProvisioningEntity> {\n const config = container.resolve(ConfigInjectionKey);\n\n return {\n policies: this.buildPolicies(),\n permissions: this.buildPermissions(),\n scopes: this.buildScopes(),\n roles: this.buildRoles(),\n realms: await this.buildRealms(config),\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA6CA,IAAaiB,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMlB,iBAAiBmB;KACvBC,MAAMtB,kBAAkBuB;KACxBC,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EAAEC,mBAAmBxB,iBAAiByB,UAAU;IACjEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMlB,iBAAiB4B;KACvBR,MAAMtB,kBAAkB8B;KACxBN,UAAU;KACVC,UAAU;IACd,EACJ,GACA,EACIN,YAAY;KACRC,MAAMlB,iBAAiB6B;KACvBT,MAAMtB,kBAAkB+B;KACxBP,UAAU;KACVC,UAAU;IACd,EACJ,CAAA;GAER;GAKA;IACIN,YAAY;KACRC,MAAMlB,iBAAiB8B;KACvBV,MAAMtB,kBAAkBiC;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAMA;KACA;KACA;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMlB,iBAAiBkC;KACvBd,MAAMtB,kBAAkBiC;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMlB,iBAAiBmC;KACvBf,MAAMtB,kBAAkBiC;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;MAER;GACJ;;CAER;CAEAG,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3DjC,eAAekC,qBAAqB,CAACtC,iBAAiBmB,SAASnB,iBAAiB8B,wBAAAA;IAChF1B,eAAemC,oBAAoB,CAACvC,iBAAiBmB,SAASnB,iBAAiBkC,uBAAAA;IAC/E9B,eAAeoC,mBAAmB,CAACxC,iBAAiBmB,SAASnB,iBAAiBmC,sBAAAA;EACnF;EAEA,OAAOM,OAAOC,OAAOtC,cAAAA,CAAAA,CAChBuC,KAAKzB,SAAAA;GACF,MAAM0B,SAAuC;IACzCC,UAAU;KACNzB,MAAMN,+BAA+BgC;KACrC7B,YAAY,CAAC,UAAA;IACjB;IACAA,YAAY;KACRC;KACAI,UAAU;IACd;GACJ;GAEA,MAAMyB,WAAWV,qBAAqBnB;GACtC,IAAI6B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAOlC,SAAAA,CAAAA,CAChBmC,KAAKzB,UAAU;GACZ2B,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC;IACAI,UAAU;GACd;EACJ,EAAA;CACR;CAEA4B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMZ;IACNgB,UAAU;GACd;GACA0B,WAAW;IACPG,mBAAmB,CAAC,GAAA;IAEpBC,6BAA6BrD,WAAWsD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMX;IACNe,UAAU;GACd;GACA0B,WAAW;IACPG,mBAAmB,CAAC,GAAA;IACpBG,0BAA0B;KACtBlD,eAAemD;KACfnD,eAAeoD;KACfpD,eAAeqD;;IAKnBL,6BAA6BrD,WAAW2D;IACxCC,sCAAsC,GACjC5D,WAAW6D,MAAM;KACdxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;KACf/E,eAAegF;KACfhF,eAAeiF;KACfjF,eAAekF;KACflF,eAAemF;KACfnF,eAAeoF;KACfpF,eAAeqF;MAEvB;GACJ;EACJ,CAAA;CAER;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1C/C,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMb;IACNiB,UAAU;GACd;GACA0B,WAAW,CAAC;EAChB;EAEA,MAAM6C,yBAAyB,IAAIjF,uBAAAA;EAEnC,IAAIkF;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACX1E,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,UAAA;EACjB;EAGJ2E,YAAY5C,YAAY4C,YAAY5C,aAAa,CAAC;EAClD4C,YAAY5C,UAAUgD,QAAQ,CAC1B;GACInD,UAAUiD;GACV7E,YAAY;IACRC,MAAM;IACN+E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAO3F,mBAAmB,OAAA;IAC1B4F,QAAQV,OAAOW;GACnB;GACAtD,WAAW,EAAEuD,aAAa,CAACjG,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAMkG,2BAA2B,IAAI9F,yBAAAA;EAErC,IAAI+F;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACbrF,MAAMN,+BAA+BgC;GACrC7B,YAAY;IAAC;IAAY;IAAe;IAAwB;IAAU;IAAiB;;EAC/F;OAEAwF,iBAAiB;GACbrF,MAAMN,+BAA+BgC;GACrC7B,YAAY;IAAC;IAAY;IAAe;;EAC5C;EAGJ2E,YAAY5C,YAAY4C,YAAY5C,aAAa,CAAC;EAClD4C,YAAY5C,UAAU2D,UAAU,CAC5B;GACI9D,UAAU4D;GACVxF,YAAY;IACRK,UAAU;IACVsF,aAAa1G,iBAAiB2G;IAC9BC,sBAAsB3G,yBAAyB4G;IAC/C7F,MAAM;IACN8F,QAAQ,MAAMR,yBAAyBN,QAAQP,OAAOsB,oBAAoB,EAAEC,eAAe,MAAM,CAAA;IACjGA,eAAe;IACfb,QAAQV,OAAOwB;GACnB;GACAnE,WAAW,EAAEuD,aAAa,CAACjG,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAM8G,0BAA0B,IAAIzG,wBAAAA;EAEpC,IAAI0G;EACJ,IAAI1B,OAAO2B,uBACPD,gBAAgB;GACZjG,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,QAAA;EACjB;EAGJ2E,YAAY5C,YAAY4C,YAAY5C,aAAa,CAAC;EAClD4C,YAAY5C,UAAUuE,SAAS,CAC3B;GACI1E,UAAUwE;GACVpG,YAAY;IACRC,MAAM;IACN8F,QAAQ,MAAMI,wBAAwBlB,QAAQP,OAAO6B,gBAAgB;IACrEnB,QAAQV,OAAO8B;GACnB;GACAzE,WAAW,EAAEuD,aAAa,CAACjG,eAAAA,EAAiB;EAChD,CAAA;EAGJ,OAAO,CAACsF,WAAAA;CACZ;CAEA,MAAM8B,KAAKC,WAAwD;EAC/D,MAAMhC,SAASgC,UAAUC,QAAQ/G,kBAAAA;EAEjC,OAAO;GACHkC,UAAU,KAAK/B,cAAa;GAC5B6G,aAAa,KAAKzF,iBAAgB;GAClC0F,QAAQ,KAAK7E,YAAW;GACxB8E,OAAO,KAAK7E,WAAU;GACtB8E,QAAQ,MAAM,KAAKtC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","ClientAuthMethod","ClientTokenBindingMethod","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","builtIn","realmId","extraAttributes","decisionStrategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","CONSENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","KEY_CREATE","KEY_UPDATE","KEY_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","SESSION_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","USER_AUTHENTICATOR_CREATE","USER_AUTHENTICATOR_UPDATE","USER_AUTHENTICATOR_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","authMethod","SECRET","tokenBindingMethod","NONE","secret","clientSystemSecret","secretHashed","clientSystemEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n Client, \n Permission, \n Role, \n Scope, \n User,\n} from '@authup/core-kit';\nimport {\n ClientAuthMethod,\n ClientTokenBindingMethod,\n PermissionName, \n REALM_MASTER_NAME, \n ROLE_ADMIN_NAME, \n ROLE_REALM_ADMIN_NAME, \n ScopeName, \n buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n ClientCredentialsService,\n UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n buildPolicies(): PolicyProvisioningEntity[] {\n return [\n {\n attributes: {\n name: SystemPolicyName.DEFAULT,\n type: BuiltInPolicyType.COMPOSITE,\n builtIn: true,\n realmId: null,\n },\n extraAttributes: { decisionStrategy: DecisionStrategy.UNANIMOUS },\n children: [\n {\n attributes: {\n name: SystemPolicyName.IDENTITY,\n type: BuiltInPolicyType.IDENTITY,\n builtIn: true,\n realmId: null,\n },\n },\n {\n attributes: {\n name: SystemPolicyName.PERMISSION_BINDING,\n type: BuiltInPolicyType.PERMISSION_BINDING,\n builtIn: true,\n realmId: null,\n },\n },\n ],\n },\n // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n // Each `names` entry is what self-edit must REJECT; everything else\n // is permitted. New columns added to the entity are self-editable\n // by default — extend the denylist when adding admin-only state.\n {\n attributes: {\n name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n builtIn: true,\n realmId: null,\n },\n extraAttributes: {\n names: [\n // FK + lifecycle\n 'active',\n 'realmId',\n // Security-critical: a self-edit must not change the\n // client's authentication/binding method (changing the\n // auth method may clear its secret) or downgrade the\n // secret-storage format\n // (which would persist the secret in plaintext).\n 'authMethod',\n 'tokenBindingMethod',\n 'secretHashed',\n 'secretEncrypted',\n 'accessPolicyId',\n ],\n },\n },\n {\n attributes: {\n name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n invert: true,\n builtIn: true,\n realmId: null,\n },\n extraAttributes: {\n names: [\n 'active',\n 'nameLocked',\n 'status',\n 'statusMessage',\n 'realmId',\n ],\n },\n },\n ];\n }\n\n buildPermissions(): PermissionProvisioningEntity[] {\n const policiesByPermission: Partial<Record<string, string[]>> = {\n [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n };\n\n return Object.values(PermissionName)\n .map((name) => {\n const entity: PermissionProvisioningEntity = {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['builtIn'] as (keyof Permission)[],\n },\n attributes: {\n name,\n builtIn: true,\n },\n };\n\n const policies = policiesByPermission[name];\n if (policies) {\n entity.relations = { policies };\n }\n\n return entity;\n });\n }\n\n buildScopes(): ScopeProvisioningEntity[] {\n return Object.values(ScopeName)\n .map((name) => ({\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['builtIn'] as (keyof Scope)[],\n },\n attributes: {\n name,\n builtIn: true,\n },\n }));\n }\n\n buildRoles(): RoleProvisioningEntity[] {\n return [\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['builtIn'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_ADMIN_NAME,\n builtIn: true,\n },\n relations: {\n globalPermissions: [''],\n // Global admin: unrestricted realm reach (any realm + null/global).\n globalPermissionsRealmScope: RealmScope.ANY,\n },\n },\n {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['builtIn'] as (keyof Role)[],\n },\n attributes: {\n name: ROLE_REALM_ADMIN_NAME,\n builtIn: true,\n },\n relations: {\n globalPermissions: ['*'],\n globalPermissionsExclude: [\n PermissionName.REALM_CREATE,\n PermissionName.REALM_UPDATE,\n PermissionName.REALM_DELETE,\n ],\n // realm_admin: own realm + null/global by default (so it can\n // read/assign global building blocks), but strictly own-realm for\n // direct entity CUD (cannot create/modify global entities).\n globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n globalPermissionsRealmScopeOverrides: {\n [RealmScope.OWN]: [\n PermissionName.CLIENT_CREATE,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n PermissionName.CONSENT_DELETE,\n PermissionName.IDENTITY_PROVIDER_CREATE,\n PermissionName.IDENTITY_PROVIDER_UPDATE,\n PermissionName.IDENTITY_PROVIDER_DELETE,\n PermissionName.KEY_CREATE,\n PermissionName.KEY_UPDATE,\n PermissionName.KEY_DELETE,\n PermissionName.PERMISSION_CREATE,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n PermissionName.ROLE_CREATE,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n PermissionName.SCOPE_CREATE,\n PermissionName.SCOPE_UPDATE,\n PermissionName.SCOPE_DELETE,\n PermissionName.SESSION_DELETE,\n PermissionName.USER_CREATE,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n PermissionName.USER_AUTHENTICATOR_CREATE,\n PermissionName.USER_AUTHENTICATOR_UPDATE,\n PermissionName.USER_AUTHENTICATOR_DELETE,\n ],\n },\n },\n },\n ];\n }\n\n async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n const masterRealm : RealmProvisioningEntity = {\n strategy: {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['builtIn'],\n },\n attributes: {\n name: REALM_MASTER_NAME,\n builtIn: true,\n },\n relations: {},\n };\n\n const userCredentialsService = new UserCredentialsService();\n\n let userStrategy : ProvisioningEntityStrategy<User> \| undefined;\n if (config.userAdminPasswordReset) {\n userStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['password'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.users = [\n {\n strategy: userStrategy,\n attributes: {\n name: 'admin',\n password: await userCredentialsService.protect(config.userAdminPassword),\n email: buildUserFakeEmail('admin'),\n active: config.userAdminEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n const clientCredentialsService = new ClientCredentialsService();\n\n let clientStrategy : ProvisioningEntityStrategy<Client> \| undefined;\n if (config.clientSystemSecretReset) {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['builtIn', 'authMethod', 'tokenBindingMethod', 'secret', 'secretHashed', 'secretEncrypted'],\n };\n } else {\n clientStrategy = {\n type: ProvisioningEntityStrategyType.MERGE,\n attributes: ['builtIn', 'authMethod', 'tokenBindingMethod'],\n };\n }\n\n masterRealm.relations = masterRealm.relations \|\| {};\n masterRealm.relations.clients = [\n {\n strategy: clientStrategy,\n attributes: {\n builtIn: true,\n authMethod: ClientAuthMethod.SECRET,\n tokenBindingMethod: ClientTokenBindingMethod.NONE,\n name: 'system',\n secret: await clientCredentialsService.protect(config.clientSystemSecret, { secretHashed: false }),\n secretHashed: false,\n active: config.clientSystemEnabled,\n },\n relations: { globalRoles: [ROLE_ADMIN_NAME] },\n },\n ];\n\n return [masterRealm];\n }\n\n async load(container: IContainer): Promise<RootProvisioningEntity> {\n const config = container.resolve(ConfigInjectionKey);\n\n return {\n policies: this.buildPolicies(),\n permissions: this.buildPermissions(),\n scopes: this.buildScopes(),\n roles: this.buildRoles(),\n realms: await this.buildRealms(config),\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;AA2CA,IAAagB,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMjB,iBAAiBkB;KACvBC,MAAMrB,kBAAkBsB;KACxBC,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EAAEC,kBAAkBvB,iBAAiBwB,UAAU;IAChEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMjB,iBAAiB2B;KACvBR,MAAMrB,kBAAkB6B;KACxBN,SAAS;KACTC,SAAS;IACb,EACJ,GACA,EACIN,YAAY;KACRC,MAAMjB,iBAAiB4B;KACvBT,MAAMrB,kBAAkB8B;KACxBP,SAAS;KACTC,SAAS;IACb,EACJ,CAAA;GAER;GAKA;IACIN,YAAY;KACRC,MAAMjB,iBAAiB6B;KACvBV,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAMA;KACA;KACA;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMjB,iBAAiBiC;KACvBd,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;MAER;GACJ;;CAER;CAEAE,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3D/B,eAAegC,qBAAqB,CAACpC,iBAAiBkB,SAASlB,iBAAiB6B,wBAAAA;IAChFzB,eAAeiC,mBAAmB,CAACrC,iBAAiBkB,SAASlB,iBAAiBiC,sBAAAA;EACnF;EAEA,OAAOK,OAAOC,OAAOnC,cAAAA,CAAAA,CAChBoC,KAAKvB,SAAAA;GACF,MAAMwB,SAAuC;IACzCC,UAAU;KACNvB,MAAMN,+BAA+B8B;KACrC3B,YAAY,CAAC,SAAA;IACjB;IACAA,YAAY;KACRC;KACAI,SAAS;IACb;GACJ;GAEA,MAAMuB,WAAWT,qBAAqBlB;GACtC,IAAI2B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAO/B,SAAAA,CAAAA,CAChBgC,KAAKvB,UAAU;GACZyB,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAA;GACjB;GACAA,YAAY;IACRC;IACAI,SAAS;GACb;EACJ,EAAA;CACR;CAEA0B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAA;GACjB;GACAA,YAAY;IACRC,MAAMX;IACNe,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAA;IAEpBC,6BAA6BlD,WAAWmD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAA;GACjB;GACAA,YAAY;IACRC,MAAMV;IACNc,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAA;IACpBG,0BAA0B;KACtB/C,eAAegD;KACfhD,eAAeiD;KACfjD,eAAekD;;IAKnBL,6BAA6BlD,WAAWwD;IACxCC,sCAAsC,GACjCzD,WAAW0D,MAAM;KACdrD,eAAesD;KACftD,eAAeuD;KACfvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;MAEvB;GACJ;EACJ,CAAA;CAER;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1C5C,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAA;GACjB;GACAA,YAAY;IACRC,MAAMZ;IACNgB,SAAS;GACb;GACAwB,WAAW,CAAC;EAChB;EAEA,MAAM0C,yBAAyB,IAAI5E,uBAAAA;EAEnC,IAAI6E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXrE,MAAMN,+BAA+B8B;GACrC3B,YAAY,CAAC,UAAA;EACjB;EAGJsE,YAAYzC,YAAYyC,YAAYzC,aAAa,CAAC;EAClDyC,YAAYzC,UAAU6C,QAAQ,CAC1B;GACIhD,UAAU8C;GACVxE,YAAY;IACRC,MAAM;IACN0E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOrF,mBAAmB,OAAA;IAC1BsF,QAAQV,OAAOW;GACnB;GACAnD,WAAW,EAAEoD,aAAa,CAAC3F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAM4F,2BAA2B,IAAIxF,yBAAAA;EAErC,IAAIyF;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACbhF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;IAAsB;IAAU;IAAgB;;EAC1F;OAEAmF,iBAAiB;GACbhF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;;EAC1C;EAGJsE,YAAYzC,YAAYyC,YAAYzC,aAAa,CAAC;EAClDyC,YAAYzC,UAAUwD,UAAU,CAC5B;GACI3D,UAAUyD;GACVnF,YAAY;IACRK,SAAS;IACTiF,YAAYpG,iBAAiBqG;IAC7BC,oBAAoBrG,yBAAyBsG;IAC7CxF,MAAM;IACNyF,QAAQ,MAAMR,yBAAyBN,QAAQP,OAAOsB,oBAAoB,EAAEC,cAAc,MAAM,CAAA;IAChGA,cAAc;IACdb,QAAQV,OAAOwB;GACnB;GACAhE,WAAW,EAAEoD,aAAa,CAAC3F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,OAAO,CAACgF,WAAAA;CACZ;CAEA,MAAMwB,KAAKC,WAAwD;EAC/D,MAAM1B,SAAS0B,UAAUC,QAAQpG,kBAAAA;EAEjC,OAAO;GACHgC,UAAU,KAAK7B,cAAa;GAC5BkG,aAAa,KAAK/E,iBAAgB;GAClCgF,QAAQ,KAAKpE,YAAW;GACxBqE,OAAO,KAAKpE,WAAU;GACtBqE,QAAQ,MAAM,KAAKhC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}

package/dist/app/modules/provisioning/sources/file/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAOlE,qBAAa,sBAAuB,YAAW,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,OAAO,EAAE,+BAA+B;IAM9C,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;~~CAmChD~~"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAOlE,qBAAa,sBAAuB,YAAW,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,OAAO,EAAE,+BAA+B;IAM9C,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;CA4ChD"}

package/dist/app/modules/provisioning/sources/file/module.mjs CHANGED Viewed

@@ -4,9 +4,10 @@ import.meta.url;
 import { RootProvisioningValidator } from "../../../../../core/provisioning/entities/root/validator.mjs";
 import "../../../../../core/provisioning/entities/index.mjs";
 import { CompositeProvisioningSource } from "../composite/module.mjs";
+import "../composite/index.mjs";
 import { ValidatorGroup, isObject } from "@authup/kit";
 import path from "node:path";
-import { load, locateMany } from "locter";
+import { locateMany, read } from "locter";
 //#region src/app/modules/provisioning/sources/file/module.ts
 const MODULE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([
 	".ts",
@@ -24,11 +25,11 @@ var FileProvisioningSource = class {
 		this.rootValidator = new RootProvisioningValidator();
 	}
 	async load() {
-		const locations = await locateMany("*.{json,yaml,yml,ts,mts,mjs,js}", { path: path.isAbsolute(this.options.cwd) ? this.options.cwd : path.join(process.cwd(), this.options.cwd) });
+		const locations = await locateMany("*.{json,yaml,yml,ts,mts,mjs,js}", { cwd: path.isAbsolute(this.options.cwd) ? this.options.cwd : path.join(process.cwd(), this.options.cwd) });
 		const compositeSource = new CompositeProvisioningSource([]);
 		const output = {};
 		for (const location of locations) {
-			const raw = await load(location);
+			const raw = await read(location);
 			const entity = typeof location.extension === "string" && MODULE_FILE_EXTENSIONS.has(location.extension.toLowerCase()) && isObject(raw) && "default" in raw ? raw.default : raw;
 			if (!isObject(entity)) throw new Error(`The provisioning file "${location.path}" must contain an object at its root.`);
 			const data = await this.rootValidator.run(entity, { group: ValidatorGroup.PROVISIONING });

package/dist/app/modules/provisioning/sources/file/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["ValidatorGroup","isObject","~~load~~","~~locateMany~~","path","RootProvisioningValidator","CompositeProvisioningSource","MODULE_FILE_EXTENSIONS","Set","FileProvisioningSource","options","rootValidator","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","isModule","extension","has","toLowerCase","entity","default","Error","data","run","group","PROVISIONING","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { ValidatorGroup, isObject } from '@authup/kit';\nimport { ~~load~~, ~~locateMany~~ } from 'locter';\nimport path from 'node:path';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\n// Extensions locter loads as an ES module namespace ({ default, ...named }),\n// as opposed to data files (json/yaml/yml) whose parsed value is returned\n// directly. Only the former should have their `default` export unwrapped.\nconst MODULE_FILE_EXTENSIONS = new Set(['.ts', '.mts', '.cts', '.js', '.mjs', '.cjs']);\n\nexport class FileProvisioningSource implements IProvisioningSource {\n protected options: FileEntitySchemaImporterOptions;\n\n protected rootValidator: RootProvisioningValidator;\n\n constructor(options: FileEntitySchemaImporterOptions) {\n this.options = options;\n\n this.rootValidator = new RootProvisioningValidator();\n }\n\n async load(): Promise<RootProvisioningEntity> {\n const cwd = path.isAbsolute(this.options.cwd) ?\n this.options.cwd :\n path.join(process.cwd(), this.options.cwd);\n\n const locations = await locateMany('.{json,yaml,yml,ts,mts,mjs,js}', { ~~path:~~ cwd });\n\n const compositeSource = new CompositeProvisioningSource([]);\n\n const output : RootProvisioningEntity = {};\n for (const location of locations) {\n const raw = await ~~load~~(location);\n // Unwrap the default export only for module files; a data file\n // (json/yaml) whose root legitimately carries a `default` key must\n // keep all of its keys.\n const isModule = typeof location.extension === 'string' &&\n MODULE_FILE_EXTENSIONS.has(location.extension.toLowerCase());\n const entity = isModule && isObject(raw) && 'default' in raw ?\n raw.default :\n raw;\n\n // Fail closed on a malformed root (top-level list/scalar, or an\n // empty file parsing to null) instead of silently provisioning\n // nothing — the same silent-skip class the loader otherwise avoids.\n if (!isObject(entity)) {\n throw new Error(`The provisioning file \"${location.path}\" must contain an object at its root.`);\n }\n\n const data = await this.rootValidator.run(entity, { group: ValidatorGroup.PROVISIONING });\n\n compositeSource.merge(output, data);\n }\n\n return output;\n }\n}\n"],"mappings":"~~;;;;;;;;;;~~AAmBA,MAAMO,yCAAyB,IAAIC,IAAI;CAAC;CAAO;CAAQ;CAAQ;CAAO;CAAQ;CAAO;AAErF,IAAaC,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,~~MAAMH~~,OAAwC;EAK1C,~~MAAMc~~,YAAY,~~MAAMb~~,WAAW,mCAAmC,~~EAAEC~~,~~MAJ5DA~~,~~KAAKS~~,WAAW,~~KAAKH~~,~~QAAQE~~,GAAG,IACxC,~~KAAKF~~,~~QAAQE~~,~~MACbR~~,~~KAAKU~~,KAAKC,QAAQH,IAAG,GAAI,~~KAAKF~~,~~QAAQE~~,GAAG,~~EAEqC~~,CAAA;~~EAElF~~,MAAMK,kBAAkB,~~IAAIX~~,4BAA4B,CAAA,CAAE;EAE1D,~~MAAMY~~,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,MAAMlB,KAAKiB,QAAAA;GAMvB,MAAMM,SAFW,OAAON,SAASG,cAAc,~~YAC3Cf~~,~~uBAAuBgB~~,IAAIJ,SAASG,UAAUE,YAAW,CAAA,~~KAClCvB~~,~~SAASmB~~,GAAAA,KAAQ,aAAaA,MACrDA,IAAIM,UACJN;GAKJ,IAAI,~~CAACnB~~,~~SAASwB~~,MAAAA,GACV,MAAM,IAAIE,MAAM,0BAA0BR,~~SAASf~~,KAAK,sCAAsC;~~GAGlG~~,~~MAAMwB~~,OAAO,MAAM,~~KAAKjB~~,~~cAAckB~~,~~IAAIJ~~,~~QAAQ~~,EAAEK,~~OAAO9B,eAAe+~~B,aAAa,CAAA;~~GAEvFd~~,gBAAgBe,MAAMd,QAAQU,IAAAA;EAClC;EAEA,OAAOV;CACX;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["ValidatorGroup","isObject","locateMany","read","path","RootProvisioningValidator","CompositeProvisioningSource","MODULE_FILE_EXTENSIONS","Set","FileProvisioningSource","options","rootValidator","load","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","isModule","extension","has","toLowerCase","entity","default","Error","data","run","group","PROVISIONING","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { ValidatorGroup, isObject } from '@authup/kit';\nimport { locateMany, read } from 'locter';\nimport path from 'node:path';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\n// Extensions locter loads as an ES module namespace ({ default, ...named }),\n// as opposed to data files (json/yaml/yml) whose parsed value is returned\n// directly. Only the former should have their `default` export unwrapped.\nconst MODULE_FILE_EXTENSIONS = new Set(['.ts', '.mts', '.cts', '.js', '.mjs', '.cjs']);\n\nexport class FileProvisioningSource implements IProvisioningSource {\n protected options: FileEntitySchemaImporterOptions;\n\n protected rootValidator: RootProvisioningValidator;\n\n constructor(options: FileEntitySchemaImporterOptions) {\n this.options = options;\n\n this.rootValidator = new RootProvisioningValidator();\n }\n\n async load(): Promise<RootProvisioningEntity> {\n const cwd = path.isAbsolute(this.options.cwd) ?\n this.options.cwd :\n path.join(process.cwd(), this.options.cwd);\n\n const locations = await locateMany('.{json,yaml,yml,ts,mts,mjs,js}', { cwd });\n\n const compositeSource = new CompositeProvisioningSource([]);\n\n const output : RootProvisioningEntity = {};\n for (const location of locations) {\n const raw = await read(location);\n // Unwrap the default export only for module files; a data file\n // (json/yaml) whose root legitimately carries a `default` key must\n // keep all of its keys.\n const isModule = typeof location.extension === 'string' &&\n MODULE_FILE_EXTENSIONS.has(location.extension.toLowerCase());\n const entity = isModule && isObject(raw) && 'default' in raw ?\n raw.default :\n raw;\n\n // Fail closed on a malformed root (top-level list/scalar, or an\n // empty file parsing to null) instead of silently provisioning\n // nothing — the same silent-skip class the loader otherwise avoids.\n if (!isObject(entity)) {\n throw new Error(`The provisioning file \"${location.path}\" must contain an object at its root.`);\n }\n\n // Provisioning files use the camelCase management vocabulary\n // (plan 073). Keys are NOT rewritten here: a blanket snake->camel\n // pass cannot tell a schema property from a data-identifier map key\n // (`clientPermissions`/`clientRoles` are keyed by client name, and\n // client names may contain underscores), so it would silently\n // corrupt those keys. Unmounted keys are stripped by the validator.\n const data = await this.rootValidator.run(\n entity as Record<string, any>,\n { group: ValidatorGroup.PROVISIONING },\n );\n\n compositeSource.merge(output, data);\n }\n\n return output;\n }\n}\n"],"mappings":";;;;;;;;;;;AAmBA,MAAMO,yCAAyB,IAAIC,IAAI;CAAC;CAAO;CAAQ;CAAQ;CAAO;CAAQ;CAAO;AAErF,IAAaC,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMO,OAAwC;EAK1C,MAAMK,YAAY,MAAMf,WAAW,mCAAmC,EAAEW,KAJ5DT,KAAKU,WAAW,KAAKJ,QAAQG,GAAG,IACxC,KAAKH,QAAQG,MACbT,KAAKW,KAAKC,QAAQH,IAAG,GAAI,KAAKH,QAAQG,GAAG,EAE+B,CAAA;EAE5E,MAAMK,kBAAkB,IAAIZ,4BAA4B,CAAA,CAAE;EAE1D,MAAMa,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,MAAMlB,KAAKiB,QAAAA;GAMvB,MAAMM,SAFW,OAAON,SAASG,cAAc,YAC3ChB,uBAAuBiB,IAAIJ,SAASG,UAAUE,YAAW,CAAA,KAClCxB,SAASoB,GAAAA,KAAQ,aAAaA,MACrDA,IAAIM,UACJN;GAKJ,IAAI,CAACpB,SAASyB,MAAAA,GACV,MAAM,IAAIE,MAAM,0BAA0BR,SAAShB,KAAK,sCAAsC;GASlG,MAAMyB,OAAO,MAAM,KAAKlB,cAAcmB,IAClCJ,QACA,EAAEK,OAAO/B,eAAegC,aAAa,CAAA;GAGzCd,gBAAgBe,MAAMd,QAAQU,IAAAA;EAClC;EAEA,OAAOV;CACX;AACJ"}

package/dist/app/modules/provisioning/sources/file/types.d.ts CHANGED Viewed

@@ -1,4 +1,6 @@
+import type { Logger } from '@authup/server-kit';
 export type FileEntitySchemaImporterOptions = {
     cwd: string;
+    logger?: Logger;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/app/modules/provisioning/sources/file/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,+BAA+B,GAAG;IAC1C,GAAG,EAAE,MAAM,CAAA;~~CACd~~,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,MAAM,+BAA+B,GAAG;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,CAAC"}

package/dist/app/modules/provisioning/sources/index.mjs CHANGED Viewed

@@ -4,6 +4,7 @@ import.meta.url;
 import { DefaultProvisioningSource } from "./default/module.mjs";
 import "./default/index.mjs";
 import { CompositeProvisioningSource } from "./composite/module.mjs";
+import "./composite/index.mjs";
 import { FileProvisioningSource } from "./file/module.mjs";
 import "./file/index.mjs";
 export { CompositeProvisioningSource, DefaultProvisioningSource, FileProvisioningSource };

package/dist/components/database/unique-entries/module.mjs CHANGED Viewed

@@ -20,12 +20,12 @@ var DatabaseUniqueEntriesComponent = class {
 	async enforceUniqueRoles() {
 		const repository = this.dataSource.getRepository(RoleEntity);
 		const queryBuilder = repository.createQueryBuilder("role");
-		queryBuilder.orderBy("role.created_at", "ASC");
+		queryBuilder.orderBy("role.createdAt", "ASC");
 		const aggregated = (await queryBuilder.getMany()).reduce((prev, curr) => {
 			const key = this.buildKey({
 				name: curr.name,
-				client_id: curr.client_id,
-				realm_id: curr.realm_id
+				clientId: curr.clientId,
+				realmId: curr.realmId
 			});
 			if (Array.isArray(prev[key])) prev[key].push(curr);
 			else prev[key] = [curr];
@@ -41,12 +41,12 @@ var DatabaseUniqueEntriesComponent = class {
 	async enforceUniquePermissions() {
 		const repository = this.dataSource.getRepository(PermissionEntity);
 		const queryBuilder = repository.createQueryBuilder("permission");
-		queryBuilder.orderBy("permission.created_at", "ASC");
+		queryBuilder.orderBy("permission.createdAt", "ASC");
 		const aggregated = (await queryBuilder.getMany()).reduce((prev, curr) => {
 			const key = this.buildKey({
 				name: curr.name,
-				client_id: curr.client_id,
-				realm_id: curr.realm_id
+				clientId: curr.clientId,
+				realmId: curr.realmId
 			});
 			if (Array.isArray(prev[key])) prev[key].push(curr);
 			else prev[key] = [curr];

package/dist/components/database/unique-entries/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["PermissionEntity","RoleEntity","DatabaseUniqueEntriesComponent","dataSource","start","enforceUniqueRoles","enforceUniquePermissions","repository","getRepository","queryBuilder","createQueryBuilder","orderBy","entities","getMany","aggregated","reduce","prev","curr","key","buildKey","name","~~client_id~~","~~realm_id~~","Array","isArray","push","keys","Object","rest","length","remove","props","map","join"],"sources":["../../../../src/components/database/unique-entries/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { DataSource } from 'typeorm';\nimport { PermissionEntity, RoleEntity } from '../../../adapters/database/domains/index.ts';\nimport type { Component } from '../../types.ts';\n\nexport class DatabaseUniqueEntriesComponent implements Component {\n protected dataSource: DataSource;\n\n constructor(dataSource: DataSource) {\n this.dataSource = dataSource;\n }\n\n /\n Thus a unique check failed for mysql driver,\n * existing duplicate entries must be removed.\n */\n async start() {\n await this.enforceUniqueRoles();\n await this.enforceUniquePermissions();\n }\n\n async enforceUniqueRoles() {\n const repository = this.dataSource.getRepository(RoleEntity);\n const queryBuilder = repository.createQueryBuilder('role');\n\n queryBuilder.orderBy('role.~~created_at~~', 'ASC');\n\n const entities = await queryBuilder.getMany();\n const aggregated = entities.reduce((prev, curr) => {\n const key = this.buildKey({\n name: curr.name,\n ~~client_id~~: curr.~~client_id~~,\n ~~realm_id~~: curr.~~realm_id~~,\n });\n\n if (Array.isArray(prev[key])) {\n prev[key].push(curr);\n } else {\n prev[key] = [curr];\n }\n\n return prev;\n }, {} as Record<string, RoleEntity[]>);\n\n const keys = Object.keys(aggregated);\n for (const key of keys) {\n const [, ...rest] = aggregated[key];\n if (rest.length === 0) {\n continue;\n }\n\n await repository.remove(rest);\n }\n }\n\n async enforceUniquePermissions() {\n const repository = this.dataSource.getRepository(PermissionEntity);\n const queryBuilder = repository.createQueryBuilder('permission');\n\n queryBuilder.orderBy('permission.~~created_at~~', 'ASC');\n\n const entities = await queryBuilder.getMany();\n const aggregated = entities.reduce((prev, curr) => {\n const key = this.buildKey({\n name: curr.name,\n ~~client_id~~: curr.~~client_id~~,\n ~~realm_id~~: curr.~~realm_id~~,\n });\n\n if (Array.isArray(prev[key])) {\n prev[key].push(curr);\n } else {\n prev[key] = [curr];\n }\n\n return prev;\n }, {} as Record<string, PermissionEntity[]>);\n\n const keys = Object.keys(aggregated);\n for (const key of keys) {\n const [, ...rest] = aggregated[key];\n if (rest.length === 0) {\n continue;\n }\n\n await repository.remove(rest);\n }\n }\n\n protected buildKey(props: Record<string, string \| null>) {\n const keys = Object.keys(props);\n\n return keys\n .map((key) => (typeof props[key] === 'string' ? props[key] : `${props[key]}`))\n .join(':');\n }\n}\n"],"mappings":";;;;;;;AAWA,IAAaE,iCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAwB;EAChC,KAAKA,aAAaA;CACtB;;;;IAMA,MAAMC,QAAQ;EACV,MAAM,KAAKC,mBAAkB;EAC7B,MAAM,KAAKC,yBAAwB;CACvC;CAEA,MAAMD,qBAAqB;EACvB,MAAME,aAAa,KAAKJ,WAAWK,cAAcP,UAAAA;EACjD,MAAMQ,eAAeF,WAAWG,mBAAmB,MAAA;EAEnDD,aAAaE,QAAQ,~~mBAAmB~~,KAAA;~~EAGxC~~,MAAMG,cAAaF,MADIH,aAAaI,QAAO,EAAA,CACfE,QAAQC,MAAMC,SAAAA;GACtC,MAAMC,MAAM,KAAKC,SAAS;IACtBC,MAAMH,KAAKG;IACXC,~~WAAWJ~~,KAAKI;~~IAChBC~~,~~UAAUL~~,KAAKK;~~GACnB~~,CAAA;GAEA,IAAIC,MAAMC,QAAQR,KAAKE,IAAI,GACvBF,KAAKE,IAAI,CAACO,KAAKR,IAAAA;QAEfD,KAAKE,OAAO,CAACD,IAAAA;GAGjB,OAAOD;EACX,GAAG,CAAC,CAAA;EAEJ,MAAMU,OAAOC,OAAOD,KAAKZ,UAAAA;EACzB,KAAK,MAAMI,OAAOQ,MAAM;GACpB,MAAM,GAAG,GAAGE,QAAQd,WAAWI;GAC/B,IAAIU,KAAKC,WAAW,GAChB;GAGJ,MAAMtB,WAAWuB,OAAOF,IAAAA;EAC5B;CACJ;CAEA,MAAMtB,2BAA2B;EAC7B,MAAMC,aAAa,KAAKJ,WAAWK,cAAcR,gBAAAA;EACjD,MAAMS,eAAeF,WAAWG,mBAAmB,YAAA;EAEnDD,aAAaE,QAAQ,~~yBAAyB~~,KAAA;~~EAG9C~~,MAAMG,cAAaF,MADIH,aAAaI,QAAO,EAAA,CACfE,QAAQC,MAAMC,SAAAA;GACtC,MAAMC,MAAM,KAAKC,SAAS;IACtBC,MAAMH,KAAKG;IACXC,~~WAAWJ~~,KAAKI;~~IAChBC~~,~~UAAUL~~,KAAKK;~~GACnB~~,CAAA;GAEA,IAAIC,MAAMC,QAAQR,KAAKE,IAAI,GACvBF,KAAKE,IAAI,CAACO,KAAKR,IAAAA;QAEfD,KAAKE,OAAO,CAACD,IAAAA;GAGjB,OAAOD;EACX,GAAG,CAAC,CAAA;EAEJ,MAAMU,OAAOC,OAAOD,KAAKZ,UAAAA;EACzB,KAAK,MAAMI,OAAOQ,MAAM;GACpB,MAAM,GAAG,GAAGE,QAAQd,WAAWI;GAC/B,IAAIU,KAAKC,WAAW,GAChB;GAGJ,MAAMtB,WAAWuB,OAAOF,IAAAA;EAC5B;CACJ;CAEUT,SAASY,OAAsC;EAGrD,OAFaJ,OAAOD,KAAKK,KAElBL,CAAAA,CACFM,KAAKd,QAAS,OAAOa,MAAMb,SAAS,WAAWa,MAAMb,OAAO,GAAGa,MAAMb,MAAM,CAAA,CAC3Ee,KAAK,GAAA;CACd;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["PermissionEntity","RoleEntity","DatabaseUniqueEntriesComponent","dataSource","start","enforceUniqueRoles","enforceUniquePermissions","repository","getRepository","queryBuilder","createQueryBuilder","orderBy","entities","getMany","aggregated","reduce","prev","curr","key","buildKey","name","clientId","realmId","Array","isArray","push","keys","Object","rest","length","remove","props","map","join"],"sources":["../../../../src/components/database/unique-entries/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { DataSource } from 'typeorm';\nimport { PermissionEntity, RoleEntity } from '../../../adapters/database/domains/index.ts';\nimport type { Component } from '../../types.ts';\n\nexport class DatabaseUniqueEntriesComponent implements Component {\n protected dataSource: DataSource;\n\n constructor(dataSource: DataSource) {\n this.dataSource = dataSource;\n }\n\n /\n Thus a unique check failed for mysql driver,\n * existing duplicate entries must be removed.\n */\n async start() {\n await this.enforceUniqueRoles();\n await this.enforceUniquePermissions();\n }\n\n async enforceUniqueRoles() {\n const repository = this.dataSource.getRepository(RoleEntity);\n const queryBuilder = repository.createQueryBuilder('role');\n\n queryBuilder.orderBy('role.createdAt', 'ASC');\n\n const entities = await queryBuilder.getMany();\n const aggregated = entities.reduce((prev, curr) => {\n const key = this.buildKey({\n name: curr.name,\n clientId: curr.clientId,\n realmId: curr.realmId,\n });\n\n if (Array.isArray(prev[key])) {\n prev[key].push(curr);\n } else {\n prev[key] = [curr];\n }\n\n return prev;\n }, {} as Record<string, RoleEntity[]>);\n\n const keys = Object.keys(aggregated);\n for (const key of keys) {\n const [, ...rest] = aggregated[key];\n if (rest.length === 0) {\n continue;\n }\n\n await repository.remove(rest);\n }\n }\n\n async enforceUniquePermissions() {\n const repository = this.dataSource.getRepository(PermissionEntity);\n const queryBuilder = repository.createQueryBuilder('permission');\n\n queryBuilder.orderBy('permission.createdAt', 'ASC');\n\n const entities = await queryBuilder.getMany();\n const aggregated = entities.reduce((prev, curr) => {\n const key = this.buildKey({\n name: curr.name,\n clientId: curr.clientId,\n realmId: curr.realmId,\n });\n\n if (Array.isArray(prev[key])) {\n prev[key].push(curr);\n } else {\n prev[key] = [curr];\n }\n\n return prev;\n }, {} as Record<string, PermissionEntity[]>);\n\n const keys = Object.keys(aggregated);\n for (const key of keys) {\n const [, ...rest] = aggregated[key];\n if (rest.length === 0) {\n continue;\n }\n\n await repository.remove(rest);\n }\n }\n\n protected buildKey(props: Record<string, string \| null>) {\n const keys = Object.keys(props);\n\n return keys\n .map((key) => (typeof props[key] === 'string' ? props[key] : `${props[key]}`))\n .join(':');\n }\n}\n"],"mappings":";;;;;;;AAWA,IAAaE,iCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAwB;EAChC,KAAKA,aAAaA;CACtB;;;;IAMA,MAAMC,QAAQ;EACV,MAAM,KAAKC,mBAAkB;EAC7B,MAAM,KAAKC,yBAAwB;CACvC;CAEA,MAAMD,qBAAqB;EACvB,MAAME,aAAa,KAAKJ,WAAWK,cAAcP,UAAAA;EACjD,MAAMQ,eAAeF,WAAWG,mBAAmB,MAAA;EAEnDD,aAAaE,QAAQ,kBAAkB,KAAA;EAGvC,MAAMG,cAAaF,MADIH,aAAaI,QAAO,EAAA,CACfE,QAAQC,MAAMC,SAAAA;GACtC,MAAMC,MAAM,KAAKC,SAAS;IACtBC,MAAMH,KAAKG;IACXC,UAAUJ,KAAKI;IACfC,SAASL,KAAKK;GAClB,CAAA;GAEA,IAAIC,MAAMC,QAAQR,KAAKE,IAAI,GACvBF,KAAKE,IAAI,CAACO,KAAKR,IAAAA;QAEfD,KAAKE,OAAO,CAACD,IAAAA;GAGjB,OAAOD;EACX,GAAG,CAAC,CAAA;EAEJ,MAAMU,OAAOC,OAAOD,KAAKZ,UAAAA;EACzB,KAAK,MAAMI,OAAOQ,MAAM;GACpB,MAAM,GAAG,GAAGE,QAAQd,WAAWI;GAC/B,IAAIU,KAAKC,WAAW,GAChB;GAGJ,MAAMtB,WAAWuB,OAAOF,IAAAA;EAC5B;CACJ;CAEA,MAAMtB,2BAA2B;EAC7B,MAAMC,aAAa,KAAKJ,WAAWK,cAAcR,gBAAAA;EACjD,MAAMS,eAAeF,WAAWG,mBAAmB,YAAA;EAEnDD,aAAaE,QAAQ,wBAAwB,KAAA;EAG7C,MAAMG,cAAaF,MADIH,aAAaI,QAAO,EAAA,CACfE,QAAQC,MAAMC,SAAAA;GACtC,MAAMC,MAAM,KAAKC,SAAS;IACtBC,MAAMH,KAAKG;IACXC,UAAUJ,KAAKI;IACfC,SAASL,KAAKK;GAClB,CAAA;GAEA,IAAIC,MAAMC,QAAQR,KAAKE,IAAI,GACvBF,KAAKE,IAAI,CAACO,KAAKR,IAAAA;QAEfD,KAAKE,OAAO,CAACD,IAAAA;GAGjB,OAAOD;EACX,GAAG,CAAC,CAAA;EAEJ,MAAMU,OAAOC,OAAOD,KAAKZ,UAAAA;EACzB,KAAK,MAAMI,OAAOQ,MAAM;GACpB,MAAM,GAAG,GAAGE,QAAQd,WAAWI;GAC/B,IAAIU,KAAKC,WAAW,GAChB;GAGJ,MAAMtB,WAAWuB,OAAOF,IAAAA;EAC5B;CACJ;CAEUT,SAASY,OAAsC;EAGrD,OAFaJ,OAAOD,KAAKK,KAElBL,CAAAA,CACFM,KAAKd,QAAS,OAAOa,MAAMb,SAAS,WAAWa,MAAMb,OAAO,GAAGa,MAAMb,MAAM,CAAA,CAC3Ee,KAAK,GAAA;CACd;AACJ"}

package/dist/components/oauth2-cleaner/module.mjs CHANGED Viewed

@@ -14,8 +14,8 @@ function createOAuth2CleanerComponent(dataSource, logger) {
 		const execute = async () => {
 			try {
 				const isoDate = (/* @__PURE__ */ new Date()).toISOString();
-				await sessionTokenRepository.delete({ expires_at: LessThan(isoDate) });
-				await sessionRepository.delete({ expires_at: LessThan(isoDate) });
+				await sessionTokenRepository.delete({ expiresAt: LessThan(isoDate) });
+				await sessionRepository.delete({ expiresAt: LessThan(isoDate) });
 			} catch (e) {
 				logger?.warn("Sweeping expired sessions failed.");
 				logger?.warn(e);

package/dist/components/oauth2-cleaner/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["cron","LessThan","SessionEntity","SessionTokenEntity","createOAuth2CleanerComponent","dataSource","logger","start","sessionRepository","getRepository","sessionTokenRepository","execute","isoDate","Date","toISOString","delete","~~expires_at~~","e","warn","schedule"],"sources":["../../../src/components/oauth2-cleaner/module.ts"],"sourcesContent":["/\n Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport cron from 'node-cron';\nimport type { Logger } from '@authup/server-kit';\nimport type { DataSource } from 'typeorm';\nimport { LessThan } from 'typeorm';\nimport { SessionEntity, SessionTokenEntity } from '../../adapters/database/domains/index.ts';\nimport type { Component } from '../types.ts';\n\nexport function createOAuth2CleanerComponent(\n dataSource: DataSource,\n logger?: Logger,\n) : Component {\n return {\n async start() {\n const sessionRepository = dataSource.getRepository(SessionEntity);\n const sessionTokenRepository = dataSource.getRepository(SessionTokenEntity);\n\n // A failed sweep must never take the process down (start() is\n // fire-and-forget → an uncaught rejection is fatal on modern\n // node); the next tick simply retries.\n const execute = async () => {\n try {\n const isoDate = new Date().toISOString();\n\n // Sweep expired session-token rows first: the auth_session_tokens\n // volume dominates (one row per access token, ~15min TTL) and a\n // deleted session cascade-drops its remaining rows anyway.\n await sessionTokenRepository\n .delete({ ~~expires_at~~: LessThan(isoDate) });\n\n await sessionRepository\n .delete({ ~~expires_at~~: LessThan(isoDate) });\n } catch (e) {\n logger?.warn('Sweeping expired sessions failed.');\n logger?.warn(e);\n }\n };\n\n await execute();\n\n cron.schedule(' * * * *', async () => {\n await execute();\n });\n },\n };\n}\n"],"mappings":";;;;;;;;;AAcA,SAAgBI,6BACZC,YACAC,QAAe;CAEf,OAAO,EACH,MAAMC,QAAAA;EACF,MAAMC,oBAAoBH,WAAWI,cAAcP,aAAAA;EACnD,MAAMQ,yBAAyBL,WAAWI,cAAcN,kBAAAA;EAKxD,MAAMQ,UAAU,YAAA;GACZ,IAAI;IACA,MAAMC,2BAAU,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;IAKtC,MAAMJ,uBACDK,OAAO,EAAEC,~~YAAYf~~,SAASW,OAAAA,EAAS,CAAA;~~IAE5C~~,MAAMJ,kBACDO,OAAO,EAAEC,~~YAAYf~~,SAASW,OAAAA,EAAS,CAAA;~~GAChD~~,SAASK,GAAG;IACRX,QAAQY,KAAK,mCAAA;IACbZ,QAAQY,KAAKD,CAAAA;GACjB;EACJ;EAEA,MAAMN,QAAAA;EAENX,KAAKmB,SAAS,aAAa,YAAA;GACvB,MAAMR,QAAAA;EACV,CAAA;CACJ,EACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["cron","LessThan","SessionEntity","SessionTokenEntity","createOAuth2CleanerComponent","dataSource","logger","start","sessionRepository","getRepository","sessionTokenRepository","execute","isoDate","Date","toISOString","delete","expiresAt","e","warn","schedule"],"sources":["../../../src/components/oauth2-cleaner/module.ts"],"sourcesContent":["/\n Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport cron from 'node-cron';\nimport type { Logger } from '@authup/server-kit';\nimport type { DataSource } from 'typeorm';\nimport { LessThan } from 'typeorm';\nimport { SessionEntity, SessionTokenEntity } from '../../adapters/database/domains/index.ts';\nimport type { Component } from '../types.ts';\n\nexport function createOAuth2CleanerComponent(\n dataSource: DataSource,\n logger?: Logger,\n) : Component {\n return {\n async start() {\n const sessionRepository = dataSource.getRepository(SessionEntity);\n const sessionTokenRepository = dataSource.getRepository(SessionTokenEntity);\n\n // A failed sweep must never take the process down (start() is\n // fire-and-forget → an uncaught rejection is fatal on modern\n // node); the next tick simply retries.\n const execute = async () => {\n try {\n const isoDate = new Date().toISOString();\n\n // Sweep expired session-token rows first: the auth_session_tokens\n // volume dominates (one row per access token, ~15min TTL) and a\n // deleted session cascade-drops its remaining rows anyway.\n await sessionTokenRepository\n .delete({ expiresAt: LessThan(isoDate) });\n\n await sessionRepository\n .delete({ expiresAt: LessThan(isoDate) });\n } catch (e) {\n logger?.warn('Sweeping expired sessions failed.');\n logger?.warn(e);\n }\n };\n\n await execute();\n\n cron.schedule(' * * * *', async () => {\n await execute();\n });\n },\n };\n}\n"],"mappings":";;;;;;;;;AAcA,SAAgBI,6BACZC,YACAC,QAAe;CAEf,OAAO,EACH,MAAMC,QAAAA;EACF,MAAMC,oBAAoBH,WAAWI,cAAcP,aAAAA;EACnD,MAAMQ,yBAAyBL,WAAWI,cAAcN,kBAAAA;EAKxD,MAAMQ,UAAU,YAAA;GACZ,IAAI;IACA,MAAMC,2BAAU,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;IAKtC,MAAMJ,uBACDK,OAAO,EAAEC,WAAWf,SAASW,OAAAA,EAAS,CAAA;IAE3C,MAAMJ,kBACDO,OAAO,EAAEC,WAAWf,SAASW,OAAAA,EAAS,CAAA;GAC/C,SAASK,GAAG;IACRX,QAAQY,KAAK,mCAAA;IACbZ,QAAQY,KAAKD,CAAAA;GACjB;EACJ;EAEA,MAAMN,QAAAA;EAENX,KAAKmB,SAAS,aAAa,YAAA;GACvB,MAAMR,QAAAA;EACV,CAAA;CACJ,EACJ;AACJ"}

package/dist/core/authentication/credential/entities/client/module.d.ts CHANGED Viewed

@@ -2,7 +2,7 @@ import { type Client } from '@authup/core-kit';
 import type { ICredentialService } from '../../types.ts';
 export declare class ClientCredentialsService implements ICredentialService<Client> {
     verify(input: string, entity: Client): Promise<boolean>;
-    protect(input: string, entity: Pick<Client, 'secret_hashed'>): Promise<string>;
+    protect(input: string, entity: Pick<Client, 'secretHashed'>): Promise<string>;
     generateSecret(): string;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/authentication/credential/entities/client/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/authentication/credential/entities/client/module.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,MAAM,EAAoB,MAAM,kBAAkB,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,qBAAa,wBAAyB,YAAW,kBAAkB,CAAC,MAAM,CAAC;IACjE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcvD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,~~eAAe~~,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;~~IAYpF~~,cAAc;CAGjB"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/authentication/credential/entities/client/module.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,MAAM,EAAoB,MAAM,kBAAkB,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,qBAAa,wBAAyB,YAAW,kBAAkB,CAAC,MAAM,CAAC;IACjE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcvD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAYnF,cAAc;CAGjB"}

package/dist/core/authentication/credential/entities/client/module.mjs CHANGED Viewed

@@ -7,12 +7,12 @@ import { compare, hash } from "@authup/server-kit";
 //#region src/core/authentication/credential/entities/client/module.ts
 var ClientCredentialsService = class {
 	async verify(input, entity) {
-		if (!entity.secret || entity.auth_method !== ClientAuthMethod.SECRET) return false;
-		if (entity.secret_hashed) return compare(input, entity.secret);
+		if (!entity.secret || entity.authMethod !== ClientAuthMethod.SECRET) return false;
+		if (entity.secretHashed) return compare(input, entity.secret);
 		return input === entity.secret;
 	}
 	async protect(input, entity) {
-		if (entity.secret_hashed) return isBCryptHash(input) ? input : hash(input);
+		if (entity.secretHashed) return isBCryptHash(input) ? input : hash(input);
 		return input;
 	}
 	generateSecret() {

package/dist/core/authentication/credential/entities/client/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["createNanoID","isBCryptHash","compare","hash","ClientAuthMethod","ClientCredentialsService","verify","input","entity","secret","~~auth_method~~","SECRET","~~secret_hashed~~","protect","generateSecret"],"sources":["../../../../../../src/core/authentication/credential/entities/client/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createNanoID, isBCryptHash } from '@authup/kit';\nimport { compare, hash } from '@authup/server-kit';\nimport { type Client, ClientAuthMethod } from '@authup/core-kit';\nimport type { ICredentialService } from '../../types.ts';\n\nexport class ClientCredentialsService implements ICredentialService<Client> {\n async verify(input: string, entity: Client): Promise<boolean> {\n if (!entity.secret \|\| entity.~~auth_method~~ !== ClientAuthMethod.SECRET) {\n return false;\n }\n\n if (entity.~~secret_hashed~~) {\n return compare(input, entity.secret);\n }\n\n // todo: secret encrypted missing (decrypt)\n\n return input === entity.secret;\n }\n\n async protect(input: string, entity: Pick<Client, '~~secret_hashed~~'>): Promise<string> {\n if (entity.~~secret_hashed~~) {\n return isBCryptHash(input) ?\n input :\n hash(input);\n }\n\n // todo: secret encrypted missing (encrypt)\n\n return input;\n }\n\n generateSecret() {\n return createNanoID(64);\n }\n}\n"],"mappings":";;;;;;;AAYA,IAAaK,2BAAb,MAAaA;CACT,MAAMC,OAAOC,OAAeC,QAAkC;EAC1D,IAAI,CAACA,OAAOC,UAAUD,OAAOE,~~gBAAgBN~~,iBAAiBO,~~QAC1D~~,OAAO;EAGX,IAAIH,OAAOI,~~eACP~~,OAAOV,QAAQK,OAAOC,OAAOC,MAAM;EAKvC,OAAOF,UAAUC,OAAOC;CAC5B;CAEA,MAAMI,QAAQN,OAAeC,~~QAAwD~~;~~EACjF~~,IAAIA,OAAOI,~~eACP~~,OAAOX,aAAaM,KAAAA,IAChBA,QACAJ,KAAKI,KAAAA;EAKb,OAAOA;CACX;CAEAO,iBAAiB;EACb,OAAOd,aAAa,EAAA;CACxB;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["createNanoID","isBCryptHash","compare","hash","ClientAuthMethod","ClientCredentialsService","verify","input","entity","secret","authMethod","SECRET","secretHashed","protect","generateSecret"],"sources":["../../../../../../src/core/authentication/credential/entities/client/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createNanoID, isBCryptHash } from '@authup/kit';\nimport { compare, hash } from '@authup/server-kit';\nimport { type Client, ClientAuthMethod } from '@authup/core-kit';\nimport type { ICredentialService } from '../../types.ts';\n\nexport class ClientCredentialsService implements ICredentialService<Client> {\n async verify(input: string, entity: Client): Promise<boolean> {\n if (!entity.secret \|\| entity.authMethod !== ClientAuthMethod.SECRET) {\n return false;\n }\n\n if (entity.secretHashed) {\n return compare(input, entity.secret);\n }\n\n // todo: secret encrypted missing (decrypt)\n\n return input === entity.secret;\n }\n\n async protect(input: string, entity: Pick<Client, 'secretHashed'>): Promise<string> {\n if (entity.secretHashed) {\n return isBCryptHash(input) ?\n input :\n hash(input);\n }\n\n // todo: secret encrypted missing (encrypt)\n\n return input;\n }\n\n generateSecret() {\n return createNanoID(64);\n }\n}\n"],"mappings":";;;;;;;AAYA,IAAaK,2BAAb,MAAaA;CACT,MAAMC,OAAOC,OAAeC,QAAkC;EAC1D,IAAI,CAACA,OAAOC,UAAUD,OAAOE,eAAeN,iBAAiBO,QACzD,OAAO;EAGX,IAAIH,OAAOI,cACP,OAAOV,QAAQK,OAAOC,OAAOC,MAAM;EAKvC,OAAOF,UAAUC,OAAOC;CAC5B;CAEA,MAAMI,QAAQN,OAAeC,QAAuD;EAChF,IAAIA,OAAOI,cACP,OAAOX,aAAaM,KAAAA,IAChBA,QACAJ,KAAKI,KAAAA;EAKb,OAAOA;CACX;CAEAO,iBAAiB;EACb,OAAOd,aAAa,EAAA;CACxB;AACJ"}

package/dist/core/authentication/credential/entities/index.d.ts CHANGED Viewed

@@ -1,4 +1,3 @@
 export * from './client/index.ts';
-export * from './robot/index.ts';
 export * from './user/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/authentication/credential/entities/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/authentication/credential/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,~~kBAAkB,CAAC;AACjC,cAAc,~~iBAAiB,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/authentication/credential/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC"}

package/dist/core/authentication/credential/entities/index.mjs CHANGED Viewed

@@ -3,8 +3,6 @@ import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "./client/module.mjs";
 import "./client/index.mjs";
-import { RobotCredentialsService } from "./robot/module.mjs";
-import "./robot/index.mjs";
 import { UserCredentialsService } from "./user/module.mjs";
 import "./user/index.mjs";
-export { ClientCredentialsService, RobotCredentialsService, UserCredentialsService };
+export { ClientCredentialsService, UserCredentialsService };

package/dist/core/authentication/credential/index.mjs CHANGED Viewed

@@ -2,7 +2,6 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "./entities/client/module.mjs";
-import { RobotCredentialsService } from "./entities/robot/module.mjs";
 import { UserCredentialsService } from "./entities/user/module.mjs";
 import "./entities/index.mjs";
-export { ClientCredentialsService, RobotCredentialsService, UserCredentialsService };
+export { ClientCredentialsService, UserCredentialsService };

package/dist/core/authentication/entities/client/module.mjs CHANGED Viewed

@@ -20,7 +20,7 @@ var ClientAuthenticator = class extends BaseCredentialsAuthenticator {
 		const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);
 		if (!identity || identity.type !== IdentityType.CLIENT) throw new EntityCredentialsInvalidError({ entity: "client" });
 		if (!identity.data.active) throw new EntityInactiveError({ entity: "client" });
-		if (identity.data.auth_method === ClientAuthMethod.SECRET) {
+		if (identity.data.authMethod === ClientAuthMethod.SECRET) {
 			if (!await this.credentialsService.verify(secret, identity.data)) throw new EntityCredentialsInvalidError({ entity: "client" });
 		} else throw OAuth2ClientError.invalid();
 		return identity.data;

package/dist/core/authentication/entities/client/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["ClientAuthMethod","IdentityType","EntityCredentialsInvalidError","EntityInactiveError","OAuth2ClientError","ClientCredentialsService","BaseCredentialsAuthenticator","ClientAuthenticator","identityResolver","credentialsService","authenticate","key","secret","realmId","identity","resolve","CLIENT","type","entity","data","active","~~auth_method~~","SECRET","verified","verify","invalid"],"sources":["../../../../../src/core/authentication/entities/client/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { ClientAuthMethod, IdentityType } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError, EntityInactiveError } from '@authup/errors';\nimport { OAuth2ClientError } from '@authup/specs';\nimport type { IIdentityResolver } from '../../../identity/index.ts';\nimport { ClientCredentialsService } from '../../credential/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../base.ts';\n\nexport class ClientAuthenticator extends BaseCredentialsAuthenticator<Client> {\n protected identityResolver : IIdentityResolver;\n\n protected credentialsService : ClientCredentialsService;\n\n constructor(identityResolver: IIdentityResolver) {\n super();\n\n this.identityResolver = identityResolver;\n this.credentialsService = new ClientCredentialsService();\n }\n\n async authenticate(key: string, secret: string, realmId?: string): Promise<Client> {\n const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);\n if (!identity \|\| identity.type !== IdentityType.CLIENT) {\n throw new EntityCredentialsInvalidError({ entity: 'client' });\n }\n\n if (!identity.data.active) {\n throw new EntityInactiveError({ entity: 'client' });\n }\n\n if (identity.data.~~auth_method~~ === ClientAuthMethod.SECRET) {\n const verified = await this.credentialsService.verify(secret, identity.data);\n if (!verified) {\n throw new EntityCredentialsInvalidError({ entity: 'client' });\n }\n } else {\n throw OAuth2ClientError.invalid();\n }\n\n return identity.data;\n }\n}\n"],"mappings":";;;;;;;;;;AAeA,IAAaO,sBAAb,cAAyCD,6BAAAA;CAC3BE;CAEAC;CAEV,YAAYD,kBAAqC;EAC7C,MAAK;EAEL,KAAKA,mBAAmBA;EACxB,KAAKC,qBAAqB,IAAIJ,yBAAAA;CAClC;CAEA,MAAMK,aAAaC,KAAaC,QAAgBC,SAAmC;EAC/E,MAAMC,WAAW,MAAM,KAAKN,iBAAiBO,QAAQd,aAAae,QAAQL,KAAKE,OAAAA;EAC/E,IAAI,CAACC,YAAYA,SAASG,SAAShB,aAAae,QAC5C,MAAM,IAAId,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAG/D,IAAI,CAACJ,SAASK,KAAKC,QACf,MAAM,IAAIjB,oBAAoB,EAAEe,QAAQ,SAAS,CAAA;EAGrD,IAAIJ,SAASK,KAAKE,~~gBAAgBrB~~,iBAAiBsB;~~OAE3C~~,CAACC,MADkB,KAAKd,mBAAmBe,OAAOZ,QAAQE,SAASK,IAAI,GAEvE,MAAM,IAAIjB,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAAA,OAG/D,MAAMd,kBAAkBqB,QAAO;EAGnC,OAAOX,SAASK;CACpB;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["ClientAuthMethod","IdentityType","EntityCredentialsInvalidError","EntityInactiveError","OAuth2ClientError","ClientCredentialsService","BaseCredentialsAuthenticator","ClientAuthenticator","identityResolver","credentialsService","authenticate","key","secret","realmId","identity","resolve","CLIENT","type","entity","data","active","authMethod","SECRET","verified","verify","invalid"],"sources":["../../../../../src/core/authentication/entities/client/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { ClientAuthMethod, IdentityType } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError, EntityInactiveError } from '@authup/errors';\nimport { OAuth2ClientError } from '@authup/specs';\nimport type { IIdentityResolver } from '../../../identity/index.ts';\nimport { ClientCredentialsService } from '../../credential/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../base.ts';\n\nexport class ClientAuthenticator extends BaseCredentialsAuthenticator<Client> {\n protected identityResolver : IIdentityResolver;\n\n protected credentialsService : ClientCredentialsService;\n\n constructor(identityResolver: IIdentityResolver) {\n super();\n\n this.identityResolver = identityResolver;\n this.credentialsService = new ClientCredentialsService();\n }\n\n async authenticate(key: string, secret: string, realmId?: string): Promise<Client> {\n const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);\n if (!identity \|\| identity.type !== IdentityType.CLIENT) {\n throw new EntityCredentialsInvalidError({ entity: 'client' });\n }\n\n if (!identity.data.active) {\n throw new EntityInactiveError({ entity: 'client' });\n }\n\n if (identity.data.authMethod === ClientAuthMethod.SECRET) {\n const verified = await this.credentialsService.verify(secret, identity.data);\n if (!verified) {\n throw new EntityCredentialsInvalidError({ entity: 'client' });\n }\n } else {\n throw OAuth2ClientError.invalid();\n }\n\n return identity.data;\n }\n}\n"],"mappings":";;;;;;;;;;AAeA,IAAaO,sBAAb,cAAyCD,6BAAAA;CAC3BE;CAEAC;CAEV,YAAYD,kBAAqC;EAC7C,MAAK;EAEL,KAAKA,mBAAmBA;EACxB,KAAKC,qBAAqB,IAAIJ,yBAAAA;CAClC;CAEA,MAAMK,aAAaC,KAAaC,QAAgBC,SAAmC;EAC/E,MAAMC,WAAW,MAAM,KAAKN,iBAAiBO,QAAQd,aAAae,QAAQL,KAAKE,OAAAA;EAC/E,IAAI,CAACC,YAAYA,SAASG,SAAShB,aAAae,QAC5C,MAAM,IAAId,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAG/D,IAAI,CAACJ,SAASK,KAAKC,QACf,MAAM,IAAIjB,oBAAoB,EAAEe,QAAQ,SAAS,CAAA;EAGrD,IAAIJ,SAASK,KAAKE,eAAerB,iBAAiBsB;OAE1C,CAACC,MADkB,KAAKd,mBAAmBe,OAAOZ,QAAQE,SAASK,IAAI,GAEvE,MAAM,IAAIjB,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAAA,OAG/D,MAAMd,kBAAkBqB,QAAO;EAGnC,OAAOX,SAASK;CACpB;AACJ"}

package/dist/core/authentication/entities/index.d.ts CHANGED Viewed

@@ -1,4 +1,3 @@
 export * from './client/index.ts';
-export * from './robot/index.ts';
 export * from './user/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/authentication/entities/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,~~kBAAkB,CAAC;AACjC,cAAc,~~iBAAiB,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC"}

package/dist/core/authentication/entities/index.mjs CHANGED Viewed

@@ -3,8 +3,6 @@ import "node:url";
 import.meta.url;
 import { ClientAuthenticator } from "./client/module.mjs";
 import "./client/index.mjs";
-import { RobotAuthenticator } from "./robot/module.mjs";
-import "./robot/index.mjs";
 import { UserAuthenticator } from "./user/module.mjs";
 import "./user/index.mjs";
-export { ClientAuthenticator, RobotAuthenticator, UserAuthenticator };
+export { ClientAuthenticator, UserAuthenticator };

package/dist/core/authentication/index.mjs CHANGED Viewed

@@ -2,12 +2,10 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "./credential/entities/client/module.mjs";
-import { RobotCredentialsService } from "./credential/entities/robot/module.mjs";
 import { UserCredentialsService } from "./credential/entities/user/module.mjs";
 import "./credential/index.mjs";
 import { BaseCredentialsAuthenticator } from "./base.mjs";
 import { ClientAuthenticator } from "./entities/client/module.mjs";
-import { RobotAuthenticator } from "./entities/robot/module.mjs";
 import { UserAuthenticator } from "./entities/user/module.mjs";
 import "./entities/index.mjs";
 import { LoginThrottleService } from "./login-throttle/service.mjs";
@@ -16,4 +14,4 @@ import { CredentialsAuthenticator } from "./module.mjs";
 import { SessionManager } from "./session/module.mjs";
 import { SESSION_FILTER_KEYS } from "./session/types.mjs";
 import "./session/index.mjs";
-export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsService, CredentialsAuthenticator, LoginThrottleService, RobotAuthenticator, RobotCredentialsService, SESSION_FILTER_KEYS, SessionManager, UserAuthenticator, UserCredentialsService };
+export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsService, CredentialsAuthenticator, LoginThrottleService, SESSION_FILTER_KEYS, SessionManager, UserAuthenticator, UserCredentialsService };

package/dist/core/authentication/session/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EACR,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAEpB,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAI7B,GAAG,EAAE,qBAAqB;IAOtC;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;~~IA2BjD~~,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAc3C,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzD;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMhD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAShD"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EACR,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAEpB,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAI7B,GAAG,EAAE,qBAAqB;IAOtC;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAuBjD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAc3C,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzD;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMhD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAShD"}

package/dist/core/authentication/session/module.mjs CHANGED Viewed

@@ -16,38 +16,35 @@ var SessionManager = class {
 	*
 	* @param input
 	*/ async create(input) {
-		input.ip_address = input.ip_address || "127.0.0.1";
-		input.user_agent = input.user_agent || "system";
-		input.expires_at = input.expires_at || new Date(Date.now() + this.options.maxAge * 1e3).toISOString();
-		switch (input.sub_kind) {
+		input.ipAddress = input.ipAddress || "127.0.0.1";
+		input.userAgent = input.userAgent || "system";
+		input.expiresAt = input.expiresAt || new Date(Date.now() + this.options.maxAge * 1e3).toISOString();
+		switch (input.subKind) {
 			case IdentityType.CLIENT:
-				input.client_id = input.sub;
-				break;
-			case IdentityType.ROBOT:
-				input.robot_id = input.sub;
+				input.clientId = input.sub;
 				break;
 			case IdentityType.USER:
-				input.user_id = input.sub;
+				input.userId = input.sub;
 				break;
 		}
 		return this.repository.save(input);
 	}
 	async ping(session) {
-		if (session.seen_at) {
-			if (new Date(session.seen_at).getTime() + 5 * 1e3 > Date.now()) return session;
+		if (session.seenAt) {
+			if (new Date(session.seenAt).getTime() + 5 * 1e3 > Date.now()) return session;
 		}
-		session.seen_at = (/* @__PURE__ */ new Date()).toISOString();
+		session.seenAt = (/* @__PURE__ */ new Date()).toISOString();
 		return this.repository.save(session);
 	}
 	async refresh(session) {
 		const now = (/* @__PURE__ */ new Date()).toISOString();
-		session.refreshed_at = now;
-		session.seen_at = now;
-		session.expires_at = new Date(Date.now() + this.options.maxAge * 1e3).toISOString();
+		session.refreshedAt = now;
+		session.seenAt = now;
+		session.expiresAt = new Date(Date.now() + this.options.maxAge * 1e3).toISOString();
 		return this.repository.save(session);
 	}
 	async markMfaVerified(session) {
-		session.mfa_at = (/* @__PURE__ */ new Date()).toISOString();
+		session.mfaAt = (/* @__PURE__ */ new Date()).toISOString();
 		return this.repository.save(session);
 	}
 	/**
@@ -62,7 +59,7 @@ var SessionManager = class {
 		await this.repository.removeById(id);
 	}
 	async verify(session) {
-		const ms = new Date(session.expires_at).getTime();
+		const ms = new Date(session.expiresAt).getTime();
 		if (Date.now() > ms) {
 			await this.repository.remove(session);
 			throw JWTError.expired();

package/dist/core/authentication/session/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","~~ip_address~~","~~user_agent~~","~~expires_at~~","Date","now","maxAge","toISOString","~~sub_kind~~","CLIENT","~~client_id~~","sub","~~ROBOT","robot_id","~~USER","~~user_id~~","save","ping","session","~~seen_at","~~seenAt","getTime","threshold","refresh","~~refreshed_at~~","markMfaVerified","~~mfa_at~~","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n ISessionManager, \n ISessionRepository, \n SessionManagerContext, \n SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n protected options: SessionManagerOptions;\n\n protected repository: ISessionRepository;\n\n // -----------------------------------------------------\n\n constructor(ctx: SessionManagerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n }\n\n // -----------------------------------------------------\n\n /\n Create/Update session\n \n @param input\n /\n async create(input: Partial<Session>): Promise<Session> {\n input.~~ip_address~~ = input.~~ip_address~~ \|\| '127.0.0.1';\n input.~~user_agent~~ = input.~~user_agent~~ \|\| 'system';\n input.~~expires_at~~ = input.~~expires_at~~ \|\| new Date(\n Date.now() + (this.options.maxAge 1_000),\n ).toISOString();\n\n switch (input.~~sub_kind~~) {\n case IdentityType.CLIENT: {\n input.~~client_id~~ = input.sub;\n break;\n }\n case IdentityType.~~ROBOT: {\n input.robot_id = input.sub;\n break;\n }\n case IdentityType.~~USER: {\n input.~~user_id~~ = input.sub;\n break;\n }\n }\n\n return this.repository.save(input);\n }\n\n // -----------------------------------------------------\n\n async ping(session: Session): Promise<Session> {\n if (session.~~seen_at~~) {\n const seenAt = new Date(session.~~seen_at~~).getTime();\n const threshold = seenAt + (5 * 1_000);\n\n if (threshold > Date.now()) {\n return session;\n }\n }\n\n session.~~seen_at~~ = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async refresh(session: Session): Promise<Session> {\n const now = new Date().toISOString();\n session.~~refreshed_at~~ = now;\n session.~~seen_at~~ = now;\n\n session.~~expires_at~~ = new Date(\n Date.now() + (this.options.maxAge * 1_000),\n ).toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async markMfaVerified(session: Session): Promise<Session> {\n session.~~mfa_at~~ = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n /*\n Verify session on token inspection/verification.\n \n @param id\n * @throws JWTError\n */\n async findOneById(id: string): Promise<Session \| null> {\n return this.repository.findOneById(id);\n }\n\n // -----------------------------------------------------\n\n async revoke(id: string): Promise<void> {\n await this.repository.removeById(id);\n }\n\n // -----------------------------------------------------\n\n async verify(session: Session): Promise<void> {\n const ms = new Date(session.~~expires_at~~).getTime();\n if (Date.now() > ms) {\n await this.repository.remove(session);\n\n // todo: better error\n throw JWTError.expired();\n }\n }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,~~aAAaD~~,MAAMC,~~cAAc~~;~~EACvCD~~,MAAME,~~aAAaF~~,MAAME,~~cAAc~~;~~EACvCF~~,MAAMG,~~aAAaH~~,MAAMG,~~cAAc~~,IAAIC,~~KACvCA~~,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,~~UAAd~~;GACI,KAAKf,aAAagB;IACdT,MAAMU,~~YAAYV~~,MAAMW;~~IACxB~~;GAEJ,KAAKlB,aAAamB;IACdZ,MAAMa,~~WAAWb~~,MAAMW;~~IACvB~~;~~GAEJ,KAAKlB,aAAaqB;IACdd,MAAMe,UAAUf,MAAMW;IACtB;~~EAER;EAEA,OAAO,KAAKd,~~WAAWmB~~,~~KAAKhB~~,KAAAA;CAChC;CAIA,~~MAAMiB~~,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC;OACO,~~IAAIf~~,~~KAAKc~~,QAAQC,~~OAAO~~,CAAA,~~CAAEE~~,~~QACvBD~~,IAAU,IAAI,~~MAEhBhB~~,KAAKC,IAAG,GACpB,~~OAAOa~~;EAAAA;EAIfA,QAAQC,~~2BAAU~~,~~IAAIf~~,KAAAA,EAAAA,CAAOG,YAAW;~~EAExC~~,OAAO,KAAKV,~~WAAWmB~~,KAAKE,OAAAA;CAChC;CAIA,~~MAAMK~~,~~QAAQL~~,SAAoC;EAC9C,~~MAAMb~~,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;~~EAClCW~~,~~QAAQM~~,~~eAAenB~~;~~EACvBa~~,QAAQC,~~UAAUd~~;~~EAElBa~~,~~QAAQf~~,~~aAAa~~,IAAIC,~~KACrBA~~,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,~~WAAWmB~~,KAAKE,OAAAA;CAChC;CAIA,~~MAAMO~~,~~gBAAgBP~~,SAAoC;EACtDA,~~QAAQQ~~,~~0BAAS~~,~~IAAItB~~,KAAAA,EAAAA,CAAOG,YAAW;~~EAEvC~~,OAAO,KAAKV,~~WAAWmB~~,KAAKE,OAAAA;CAChC;;;;;;IAUA,~~MAAMS~~,YAAYC,IAAqC;EACnD,OAAO,~~KAAK/B~~,~~WAAW8B~~,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,~~KAAK/B~~,~~WAAWiC~~,WAAWF,EAAAA;CACrC;CAIA,MAAMG,~~OAAOb~~,SAAiC;EAC1C,~~MAAMc~~,KAAK,~~IAAI5B~~,~~KAAKc~~,~~QAAQf~~,~~UAAU~~,CAAA,~~CAAEkB~~,QAAO;~~EAC/C~~,~~IAAIjB~~,KAAKC,IAAG,~~IAAK2B~~,IAAI;GACjB,MAAM,~~KAAKnC~~,~~WAAWoC~~,~~OAAOf~~,OAAAA;GAG7B,~~MAAMxB~~,~~SAASwC~~,QAAO;EAC1B;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ipAddress","userAgent","expiresAt","Date","now","maxAge","toISOString","subKind","CLIENT","clientId","sub","USER","userId","save","ping","session","seenAt","getTime","threshold","refresh","refreshedAt","markMfaVerified","mfaAt","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n ISessionManager, \n ISessionRepository, \n SessionManagerContext, \n SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n protected options: SessionManagerOptions;\n\n protected repository: ISessionRepository;\n\n // -----------------------------------------------------\n\n constructor(ctx: SessionManagerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n }\n\n // -----------------------------------------------------\n\n /\n Create/Update session\n \n @param input\n /\n async create(input: Partial<Session>): Promise<Session> {\n input.ipAddress = input.ipAddress \|\| '127.0.0.1';\n input.userAgent = input.userAgent \|\| 'system';\n input.expiresAt = input.expiresAt \|\| new Date(\n Date.now() + (this.options.maxAge 1_000),\n ).toISOString();\n\n switch (input.subKind) {\n case IdentityType.CLIENT: {\n input.clientId = input.sub;\n break;\n }\n case IdentityType.USER: {\n input.userId = input.sub;\n break;\n }\n }\n\n return this.repository.save(input);\n }\n\n // -----------------------------------------------------\n\n async ping(session: Session): Promise<Session> {\n if (session.seenAt) {\n const seenAt = new Date(session.seenAt).getTime();\n const threshold = seenAt + (5 * 1_000);\n\n if (threshold > Date.now()) {\n return session;\n }\n }\n\n session.seenAt = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async refresh(session: Session): Promise<Session> {\n const now = new Date().toISOString();\n session.refreshedAt = now;\n session.seenAt = now;\n\n session.expiresAt = new Date(\n Date.now() + (this.options.maxAge * 1_000),\n ).toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async markMfaVerified(session: Session): Promise<Session> {\n session.mfaAt = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n /*\n Verify session on token inspection/verification.\n \n @param id\n * @throws JWTError\n */\n async findOneById(id: string): Promise<Session \| null> {\n return this.repository.findOneById(id);\n }\n\n // -----------------------------------------------------\n\n async revoke(id: string): Promise<void> {\n await this.repository.removeById(id);\n }\n\n // -----------------------------------------------------\n\n async verify(session: Session): Promise<void> {\n const ms = new Date(session.expiresAt).getTime();\n if (Date.now() > ms) {\n await this.repository.remove(session);\n\n // todo: better error\n throw JWTError.expired();\n }\n }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,YAAYD,MAAMC,aAAa;EACrCD,MAAME,YAAYF,MAAME,aAAa;EACrCF,MAAMG,YAAYH,MAAMG,aAAa,IAAIC,KACrCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,SAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,WAAWV,MAAMW;IACvB;GAEJ,KAAKlB,aAAamB;IACdZ,MAAMa,SAASb,MAAMW;IACrB;EAER;EAEA,OAAO,KAAKd,WAAWiB,KAAKd,KAAAA;CAChC;CAIA,MAAMe,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC;OACO,IAAIb,KAAKY,QAAQC,MAAM,CAAA,CAAEC,QACtBD,IAAU,IAAI,MAEhBb,KAAKC,IAAG,GACpB,OAAOW;EAAAA;EAIfA,QAAQC,0BAAS,IAAIb,KAAAA,EAAAA,CAAOG,YAAW;EAEvC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMI,QAAQJ,SAAoC;EAC9C,MAAMX,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCS,QAAQK,cAAchB;EACtBW,QAAQC,SAASZ;EAEjBW,QAAQb,YAAY,IAAIC,KACpBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMM,gBAAgBN,SAAoC;EACtDA,QAAQO,yBAAQ,IAAInB,KAAAA,EAAAA,CAAOG,YAAW;EAEtC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMQ,YAAYC,IAAqC;EACnD,OAAO,KAAK5B,WAAW2B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,KAAK5B,WAAW8B,WAAWF,EAAAA;CACrC;CAIA,MAAMG,OAAOZ,SAAiC;EAC1C,MAAMa,KAAK,IAAIzB,KAAKY,QAAQb,SAAS,CAAA,CAAEe,QAAO;EAC9C,IAAId,KAAKC,IAAG,IAAKwB,IAAI;GACjB,MAAM,KAAKhC,WAAWiC,OAAOd,OAAAA;GAG7B,MAAMtB,SAASqC,QAAO;EAC1B;CACJ;AACJ"}