@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.54

package/dist/core/entities/client-role/service.mjs

@@ -1,6 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { clientRoleSchema } from "./schema.mjs";
+import { decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { ValidatorGroup } from "@authup/kit";
 import { ClientRoleValidator, PermissionName } from "@authup/core-kit";
 import { JunctionEntityService } from "@authup/server-kit";
@@ -8,7 +11,7 @@ import { BuiltInPolicyType, PermissionError, definePolicyData } from "@authup/ac
 import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/client-role/service.ts
 var ClientRoleService = class extends JunctionEntityService {
-	ownerRealmKey = "client_realm_id";
+	ownerRealmKey = "clientRealmId";
 	repository;
 	identityPermissionProvider;
 	validator;
@@ -24,7 +27,10 @@ var ClientRoleService = class extends JunctionEntityService {
 			PermissionName.CLIENT_ROLE_UPDATE,
 			PermissionName.CLIENT_ROLE_DELETE
 		] });
-		return this.repository.findMany(query);
+		return this.repository.findMany(await decodeQuery(query, {
+			schema: clientRoleSchema,
+			actor
+		}));
 	}
 	async getOne(id, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -41,19 +47,19 @@ var ClientRoleService = class extends JunctionEntityService {
 		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
 		await this.repository.validateJoinColumns(validated);
 		if (await this.repository.findOneBy({
-			role_id: validated.role_id,
-			client_id: validated.client_id
+			roleId: validated.roleId,
+			clientId: validated.clientId
 		})) throw new EntityConflictError({ entity: "client-role" });
-		if (validated.role) validated.role_realm_id = validated.role.realm_id;
-		if (validated.client) validated.client_realm_id = validated.client.realm_id;
+		if (validated.role) validated.roleRealmId = validated.role.realmId;
+		if (validated.client) validated.clientRealmId = validated.client.realmId;
 		if (validated.role && actor.identity) {
 			if (!await this.identityPermissionProvider.isSuperset({
 				type: actor.identity.type,
 				id: actor.identity.data.id
 			}, {
 				type: "role",
-				id: validated.role_id,
-				clientId: validated.role.client_id
+				id: validated.roleId,
+				clientId: validated.role.clientId
 			})) throw new PermissionError({ message: "You don't own the required permissions." });
 		}
 		await actor.permissionEvaluator.evaluate({

package/dist/core/entities/client-role/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientRoleValidator","PermissionName","JunctionEntityService","ClientRoleService","ownerRealmKey","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_ROLE_READ","CLIENT_ROLE_UPDATE","CLIENT_ROLE_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_ROLE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","role_id","client_id","role","role_realm_id","realm_id","client","client_realm_id","identity","hasPermissions","isSuperset","type","clientId","message","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientRoleValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientRole } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IClientRoleRepository, IClientRoleService } from './types.ts';\n\nexport type ClientRoleServiceContext = {\n    repository: IClientRoleRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientRoleService extends JunctionEntityService implements IClientRoleService {\n    protected readonly ownerRealmKey = 'client_realm_id';\n\n    protected repository: IClientRoleRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: ClientRoleValidator;\n\n    constructor(ctx: ClientRoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new ClientRoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<ClientRole>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_ROLE_READ,\n                PermissionName.CLIENT_ROLE_UPDATE,\n                PermissionName.CLIENT_ROLE_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientRole> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_ROLE_READ,\n                PermissionName.CLIENT_ROLE_UPDATE,\n                PermissionName.CLIENT_ROLE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            role_id: validated.role_id,\n            client_id: validated.client_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'client-role' });\n        }\n\n        if (validated.role) {\n            validated.role_realm_id = validated.role.realm_id;\n        }\n\n        if (validated.client) {\n            validated.client_realm_id = validated.client.realm_id;\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.role_id,\n                    clientId: validated.role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n            }\n        }\n\n        // Stamp the owner (client) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_ROLE_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (client) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_ROLE_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAsBA,IAAaS,oBAAb,cAAuCD,sBAAAA;CAChBE,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIP,oBAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,IACAT,OACmB;EACnB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,OAAOuB;CACX;CAEA,MAAME,OACFC,MACAb,OACmB;EACnB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMb,eAAeyB,mBAAmB,CAAA;EAEtF,MAAMC,YAAY,MAAM,KAAKpB,UAAUqB,IAAIJ,MAAM,EAAEK,OAAO9B,eAAe+B,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWiB,UAAU;GAC7CW,SAASN,UAAUM;GACnBC,WAAWP,UAAUO;EACzB,CAAA,GAEI,MAAM,IAAIrC,oBAAoB,EAAEwB,QAAQ,cAAc,CAAA;EAG1D,IAAIM,UAAUQ,MACVR,UAAUS,gBAAgBT,UAAUQ,KAAKE;EAG7C,IAAIV,UAAUW,QACVX,UAAUY,kBAAkBZ,UAAUW,OAAOD;EAGjD,IAAIV,UAAUQ,QAAQxB,MAAM6B;OAYpB,CAACC,MAXwB,KAAKnC,2BAA2BoC,WACzD;IACIC,MAAMhC,MAAM6B,SAASG;IACrBvB,IAAIT,MAAM6B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIO,UAAUM;IACdW,UAAUjB,UAAUQ,KAAKD;GAC7B,CAAA,GAGA,MAAM,IAAIvC,gBAAgB,EAAEkD,SAAS,0CAA2C,CAAA;EAAA;EAKxF,MAAMlC,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMb,eAAeyB;GACrBF,MAAM5B,iBAAiB;KAClBF,kBAAkBqD,aAAa,KAAKC,mBAAmBrB,SAAAA;KACvDjC,kBAAkBuD,cAAc,KAAKC,sBAAsBvB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKhB,WAAWkB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKhB,WAAW8C,KAAK9B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM+B,OACFhC,IACAT,OACmB;EACnB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMb,eAAegB,mBAAmB,CAAA;EAEtF,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAId,MAAMa,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMb,eAAegB;GACrBO,MAAM5B,iBAAiB;KAClBF,kBAAkBqD,aAAa,KAAKC,mBAAmB3B,MAAAA;KACvD3B,kBAAkBuD,cAAc,KAAKC,sBAAsB7B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIiC,aAAahC;EACzB,MAAM,KAAKhB,WAAWiD,OAAOjC,MAAAA;EAC7BA,OAAOD,KAAKiC;EAEZ,OAAOhC;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientRoleValidator","PermissionName","JunctionEntityService","decodeQuery","clientRoleSchema","ClientRoleService","ownerRealmKey","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_ROLE_READ","CLIENT_ROLE_UPDATE","CLIENT_ROLE_DELETE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_ROLE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","roleId","clientId","role","roleRealmId","realmId","client","clientRealmId","identity","hasPermissions","isSuperset","type","message","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientRoleValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientRole } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IClientRoleRepository, IClientRoleService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientRoleSchema } from './schema.ts';\n\nexport type ClientRoleServiceContext = {\n    repository: IClientRoleRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientRoleService extends JunctionEntityService implements IClientRoleService {\n    protected readonly ownerRealmKey = 'clientRealmId';\n\n    protected repository: IClientRoleRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: ClientRoleValidator;\n\n    constructor(ctx: ClientRoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new ClientRoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<ClientRole>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_ROLE_READ,\n                PermissionName.CLIENT_ROLE_UPDATE,\n                PermissionName.CLIENT_ROLE_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: clientRoleSchema, actor }));\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientRole> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_ROLE_READ,\n                PermissionName.CLIENT_ROLE_UPDATE,\n                PermissionName.CLIENT_ROLE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            roleId: validated.roleId,\n            clientId: validated.clientId,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'client-role' });\n        }\n\n        if (validated.role) {\n            validated.roleRealmId = validated.role.realmId;\n        }\n\n        if (validated.client) {\n            validated.clientRealmId = validated.client.realmId;\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.roleId,\n                    clientId: validated.role.clientId,\n                },\n            );\n            if (!hasPermissions) {\n                throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n            }\n        }\n\n        // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_ROLE_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_ROLE_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAwBA,IAAaW,oBAAb,cAAuCH,sBAAAA;CAChBI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIT,oBAAAA;CACzB;CAEA,MAAMW,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYS,OAAO;GAAES,QAAQjB;GAAkBS;EAAM,CAAA,CAAA;CAC/F;CAEA,MAAMS,OACFC,IACAV,OACmB;EACnB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAd,OACmB;EACnB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMf,eAAe4B,mBAAmB,CAAA;EAEtF,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAOjC,eAAekC,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,QAAQN,UAAUM;GAClBC,UAAUP,UAAUO;EACxB,CAAA,GAEI,MAAM,IAAIxC,oBAAoB,EAAE2B,QAAQ,cAAc,CAAA;EAG1D,IAAIM,UAAUQ,MACVR,UAAUS,cAAcT,UAAUQ,KAAKE;EAG3C,IAAIV,UAAUW,QACVX,UAAUY,gBAAgBZ,UAAUW,OAAOD;EAG/C,IAAIV,UAAUQ,QAAQzB,MAAM8B;OAYpB,CAACC,MAXwB,KAAKpC,2BAA2BqC,WACzD;IACIC,MAAMjC,MAAM8B,SAASG;IACrBvB,IAAIV,MAAM8B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIO,UAAUM;IACdC,UAAUP,UAAUQ,KAAKD;GAC7B,CAAA,GAGA,MAAM,IAAI1C,gBAAgB,EAAEoD,SAAS,0CAA2C,CAAA;EAAA;EAKxF,MAAMlC,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMf,eAAe4B;GACrBF,MAAM/B,iBAAiB;KAClBF,kBAAkBuD,aAAa,KAAKC,mBAAmBpB,SAAAA;KACvDpC,kBAAkByD,cAAc,KAAKC,sBAAsBtB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAW8C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAV,OACmB;EACnB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMf,eAAekB,mBAAmB,CAAA;EAEtF,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAId,MAAMe,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMf,eAAekB;GACrBQ,MAAM/B,iBAAiB;KAClBF,kBAAkBuD,aAAa,KAAKC,mBAAmB1B,MAAAA;KACvD9B,kBAAkByD,cAAc,KAAKC,sBAAsB5B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIgC,aAAa/B;EACzB,MAAM,KAAKjB,WAAWiD,OAAOhC,MAAAA;EAC7BA,OAAOD,KAAKgC;EAEZ,OAAO/B;CACX;AACJ"}

package/dist/core/entities/client-scope/index.d.ts

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/client-scope/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/client-scope/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { clientScopeSchema } from "./schema.mjs";
 import { ClientScopeService } from "./service.mjs";
-export { ClientScopeService };
+export { ClientScopeService, clientScopeSchema };

package/dist/core/entities/client-scope/schema.d.ts

@@ -0,0 +1,3 @@
+import type { ClientScope } from '@authup/core-kit';
+export declare const clientScopeSchema: import("@rapiq/core").Schema<ClientScope, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/client-scope/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,eAAO,MAAM,iBAAiB,gDAiB5B,CAAC"}

package/dist/core/entities/client-scope/schema.mjs

@@ -0,0 +1,37 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/client-scope/schema.ts
+const schemaMapping = {
+	client: EntityType.CLIENT,
+	scope: EntityType.SCOPE
+};
+const clientScopeSchema = defineSchema({
+	name: EntityType.CLIENT_SCOPE,
+	fields: { default: [
+		"id",
+		"default",
+		"clientId",
+		"clientRealmId",
+		"scopeId",
+		"scopeRealmId"
+	] },
+	filters: { allowed: [
+		"clientId",
+		"scopeId",
+		"default"
+	] },
+	relations: {
+		allowed: ["client", "scope"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { clientScopeSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/client-scope/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","scope","SCOPE","clientScopeSchema","name","CLIENT_SCOPE","fields","default","filters","allowed","relations","validate","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-scope/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientScope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, scope: EntityType.SCOPE };\n\nexport const clientScopeSchema = defineSchema<ClientScope>({\n    name: EntityType.CLIENT_SCOPE,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'default',\n            'clientId',\n            'clientRealmId',\n            'scopeId',\n            'scopeRealmId',\n        ],\n    },\n    filters: { allowed: ['clientId', 'scopeId', 'default'] },\n    relations: { allowed: ['client', 'scope'], validate: createRelationsReadGate(schemaMapping) },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,OAAOL,WAAWM;AAAM;AAE3E,MAAaC,oBAAoBR,aAA0B;CACvDS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAY;EAAW;GAAW;CACvDC,WAAW;EAAED,SAAS,CAAC,UAAU,OAAA;EAAUE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC5Fc,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}

package/dist/core/entities/client-scope/service.d.ts

@@ -7,7 +7,7 @@ export type ClientScopeServiceContext = {
     repository: IClientScopeRepository;
 };
 export declare class ClientScopeService extends JunctionEntityService implements IClientScopeService {
-    protected readonly ownerRealmKey = "client_realm_id";
+    protected readonly ownerRealmKey = "clientRealmId";
     protected repository: IClientScopeRepository;
     protected validator: ClientScopeValidator;
     constructor(ctx: ClientScopeServiceContext);

package/dist/core/entities/client-scope/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,oBAAoB,EAAkB,MAAM,kBAAkB,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,MAAM,yBAAyB,GAAG;IACpC,UAAU,EAAE,sBAAsB,CAAC;CACtC,CAAC;AAEF,qBAAa,kBAAmB,SAAQ,qBAAsB,YAAW,mBAAmB;IACxF,SAAS,CAAC,QAAQ,CAAC,aAAa,qBAAqB;IAErD,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,GAAG,EAAE,yBAAyB;IAMpC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAajD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IAkBjB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IAsCjB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;CAuB1B"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,oBAAoB,EAAkB,MAAM,kBAAkB,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAI9E,MAAM,MAAM,yBAAyB,GAAG;IACpC,UAAU,EAAE,sBAAsB,CAAC;CACtC,CAAC;AAEF,qBAAa,kBAAmB,SAAQ,qBAAsB,YAAW,mBAAmB;IACxF,SAAS,CAAC,QAAQ,CAAC,aAAa,mBAAmB;IAEnD,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,GAAG,EAAE,yBAAyB;IAMpC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAajD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IAkBjB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IAsCjB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;CAuB1B"}

package/dist/core/entities/client-scope/service.mjs

@@ -1,6 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { clientScopeSchema } from "./schema.mjs";
+import { decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { ValidatorGroup } from "@authup/kit";
 import { ClientScopeValidator, PermissionName } from "@authup/core-kit";
 import { JunctionEntityService } from "@authup/server-kit";
@@ -8,7 +11,7 @@ import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/client-scope/service.ts
 var ClientScopeService = class extends JunctionEntityService {
-	ownerRealmKey = "client_realm_id";
+	ownerRealmKey = "clientRealmId";
 	repository;
 	validator;
 	constructor(ctx) {
@@ -23,7 +26,10 @@ var ClientScopeService = class extends JunctionEntityService {
 			PermissionName.CLIENT_UPDATE,
 			PermissionName.CLIENT_DELETE
 		] });
-		return this.repository.findMany(query);
+		return this.repository.findMany(await decodeQuery(query, {
+			schema: clientScopeSchema,
+			actor
+		}));
 	}
 	async getOne(id, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -41,11 +47,11 @@ var ClientScopeService = class extends JunctionEntityService {
 		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
 		await this.repository.validateJoinColumns(validated);
 		if (await this.repository.findOneBy({
-			client_id: validated.client_id,
-			scope_id: validated.scope_id
+			clientId: validated.clientId,
+			scopeId: validated.scopeId
 		})) throw new EntityConflictError({ entity: "client-scope" });
-		if (validated.client) validated.client_realm_id = validated.client.realm_id;
-		if (validated.scope) validated.scope_realm_id = validated.scope.realm_id;
+		if (validated.client) validated.clientRealmId = validated.client.realmId;
+		if (validated.scope) validated.scopeRealmId = validated.scope.realmId;
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.CLIENT_SCOPE_CREATE,
 			data: definePolicyData({

package/dist/core/entities/client-scope/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientScopeValidator","PermissionName","JunctionEntityService","ClientScopeService","ownerRealmKey","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_SCOPE_READ","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_SCOPE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","client_id","scope_id","client","client_realm_id","realm_id","scope","scope_realm_id","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","CLIENT_SCOPE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/client-scope/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientScopeValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientScope } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IClientScopeRepository, IClientScopeService } from './types.ts';\n\nexport type ClientScopeServiceContext = {\n    repository: IClientScopeRepository;\n};\n\nexport class ClientScopeService extends JunctionEntityService implements IClientScopeService {\n    protected readonly ownerRealmKey = 'client_realm_id';\n\n    protected repository: IClientScopeRepository;\n\n    protected validator: ClientScopeValidator;\n\n    constructor(ctx: ClientScopeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new ClientScopeValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<ClientScope>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_SCOPE_READ,\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_SCOPE_READ,\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            client_id: validated.client_id,\n            scope_id: validated.scope_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'client-scope' });\n        }\n\n        if (validated.client) {\n            validated.client_realm_id = validated.client.realm_id;\n        }\n\n        if (validated.scope) {\n            validated.scope_realm_id = validated.scope.realm_id;\n        }\n\n        // Stamp the owner (client) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_SCOPE_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (client) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_SCOPE_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaQ,qBAAb,cAAwCD,sBAAAA;CACjBE,gBAAgB;CAEzBC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIN,qBAAAA;CACzB;CAEA,MAAMQ,QACFC,OACAC,OACoD;EACpD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAST,KAAAA;CACpC;CAEA,MAAMU,OACFC,IACAV,OACoB;EACpB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFZ,eAAea;GACfb,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,OAAOuB;CACX;CAEA,MAAME,OACFC,MACAd,OACoB;EACpB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAeyB,oBAAoB,CAAA;EAEvF,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAO9B,eAAe+B,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWiB,UAAU;GAC7CW,WAAWN,UAAUM;GACrBC,UAAUP,UAAUO;EACxB,CAAA,GAEI,MAAM,IAAIrC,oBAAoB,EAAEwB,QAAQ,eAAe,CAAA;EAG3D,IAAIM,UAAUQ,QACVR,UAAUS,kBAAkBT,UAAUQ,OAAOE;EAGjD,IAAIV,UAAUW,OACVX,UAAUY,iBAAiBZ,UAAUW,MAAMD;EAI/C,MAAM3B,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMZ,eAAeyB;GACrBF,MAAM5B,iBAAiB;KAClBD,kBAAkB8C,aAAa,KAAKC,mBAAmBf,SAAAA;KACvDhC,kBAAkBgD,cAAc,KAAKC,sBAAsBjB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKhB,WAAWkB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKhB,WAAWwC,KAAKxB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMyB,OACF1B,IACAV,OACoB;EACpB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMZ,eAAe8C,oBAAoB,CAAA;EAEvF,MAAM1B,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAId,MAAMY,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMZ,eAAe8C;GACrBvB,MAAM5B,iBAAiB;KAClBD,kBAAkB8C,aAAa,KAAKC,mBAAmBrB,MAAAA;KACvD1B,kBAAkBgD,cAAc,KAAKC,sBAAsBvB,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI4B,aAAa3B;EACzB,MAAM,KAAKhB,WAAW4C,OAAO5B,MAAAA;EAC7BA,OAAOD,KAAK4B;EAEZ,OAAO3B;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientScopeValidator","PermissionName","JunctionEntityService","decodeQuery","clientScopeSchema","ClientScopeService","ownerRealmKey","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_SCOPE_READ","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_SCOPE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","clientId","scopeId","client","clientRealmId","realmId","scope","scopeRealmId","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","CLIENT_SCOPE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/client-scope/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientScopeValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientScope } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IClientScopeRepository, IClientScopeService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientScopeSchema } from './schema.ts';\n\nexport type ClientScopeServiceContext = {\n    repository: IClientScopeRepository;\n};\n\nexport class ClientScopeService extends JunctionEntityService implements IClientScopeService {\n    protected readonly ownerRealmKey = 'clientRealmId';\n\n    protected repository: IClientScopeRepository;\n\n    protected validator: ClientScopeValidator;\n\n    constructor(ctx: ClientScopeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new ClientScopeValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<ClientScope>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_SCOPE_READ,\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: clientScopeSchema, actor }));\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.CLIENT_SCOPE_READ,\n                PermissionName.CLIENT_READ,\n                PermissionName.CLIENT_UPDATE,\n                PermissionName.CLIENT_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            clientId: validated.clientId,\n            scopeId: validated.scopeId,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'client-scope' });\n        }\n\n        if (validated.client) {\n            validated.clientRealmId = validated.client.realmId;\n        }\n\n        if (validated.scope) {\n            validated.scopeRealmId = validated.scope.realmId;\n        }\n\n        // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_SCOPE_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<ClientScope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_SCOPE_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAsBA,IAAaU,qBAAb,cAAwCH,sBAAAA;CACjBI,gBAAgB;CAEzBC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIR,qBAAAA;CACzB;CAEA,MAAMU,QACFC,OACAC,OACoD;EACpD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYQ,OAAO;GAAEU,QAAQjB;GAAmBQ;EAAM,CAAA,CAAA;CAChG;CAEA,MAAMU,OACFC,IACAX,OACoB;EACpB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAf,OACoB;EACpB,MAAMA,MAAMC,oBAAoBe,YAAY,EAAEb,MAAMd,eAAe4B,oBAAoB,CAAA;EAEvF,MAAMC,YAAY,MAAM,KAAKtB,UAAUuB,IAAIJ,MAAM,EAAEK,OAAOjC,eAAekC,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,UAAUN,UAAUM;GACpBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIxC,oBAAoB,EAAE2B,QAAQ,eAAe,CAAA;EAG3D,IAAIM,UAAUQ,QACVR,UAAUS,gBAAgBT,UAAUQ,OAAOE;EAG/C,IAAIV,UAAUW,OACVX,UAAUY,eAAeZ,UAAUW,MAAMD;EAI7C,MAAM5B,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMd,eAAe4B;GACrBF,MAAM/B,iBAAiB;KAClBD,kBAAkBiD,aAAa,KAAKC,mBAAmBf,SAAAA;KACvDnC,kBAAkBmD,cAAc,KAAKC,sBAAsBjB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMyB,OACF1B,IACAX,OACoB;EACpB,MAAMA,MAAMC,oBAAoBe,YAAY,EAAEb,MAAMd,eAAeiD,oBAAoB,CAAA;EAEvF,MAAM1B,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAId,MAAMc,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMd,eAAeiD;GACrBvB,MAAM/B,iBAAiB;KAClBD,kBAAkBiD,aAAa,KAAKC,mBAAmBrB,MAAAA;KACvD7B,kBAAkBmD,cAAc,KAAKC,sBAAsBvB,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI4B,aAAa3B;EACzB,MAAM,KAAKjB,WAAW6C,OAAO5B,MAAAA;EAC7BA,OAAOD,KAAK4B;EAEZ,OAAO3B;CACX;AACJ"}

package/dist/core/entities/consent/index.d.ts

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/consent/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/consent/index.mjs

@@ -2,5 +2,6 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH } from "./types.mjs";
+import { consentSchema } from "./schema.mjs";
 import { ConsentService } from "./service.mjs";
-export { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ConsentService };
+export { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ConsentService, consentSchema };

package/dist/core/entities/consent/schema.d.ts

@@ -0,0 +1,3 @@
+import type { Consent } from '@authup/core-kit';
+export declare const consentSchema: import("@rapiq/core").Schema<Consent, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/consent/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAOhD,eAAO,MAAM,aAAa,4CA2BxB,CAAC"}

package/dist/core/entities/consent/schema.mjs

@@ -0,0 +1,40 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { CONSENT_FILTER_KEYS } from "./types.mjs";
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/consent/schema.ts
+const schemaMapping = { realm: EntityType.REALM };
+const consentSchema = defineSchema({
+	name: EntityType.CONSENT,
+	fields: { default: [
+		"id",
+		"clientId",
+		"realmId",
+		"userId",
+		"sub",
+		"subKind",
+		"scope",
+		"expiresAt",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: [...CONSENT_FILTER_KEYS] },
+	relations: {
+		allowed: ["realm"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"createdAt",
+		"updatedAt",
+		"scope"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { consentSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/consent/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","CONSENT_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","consentSchema","name","CONSENT","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/consent/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Consent } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { CONSENT_FILTER_KEYS } from './types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const consentSchema = defineSchema<Consent>({\n    name: EntityType.CONSENT,\n    fields: {\n        // `default` (not just `allowed`) so the adapter adds an explicit\n        // per-column SELECT: it populates expressionMap.selects, which\n        // applyRealmScopeSelect dedupes against. Without it the default\n        // \"select all\" is implicit (empty selects) and the force-select\n        // re-adds consent.sub — a duplicate `consent_sub` alias that\n        // mysql rejects under the client join (see helpers.ts).\n        default: [\n            'id',\n            'clientId',\n            'realmId',\n            'userId',\n            'sub',\n            'subKind',\n            'scope',\n            'expiresAt',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: [...CONSENT_FILTER_KEYS] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['createdAt', 'updatedAt', 'scope'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,QAAQ,EAOJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAEC,SAAS,CAAA,GAAIX,mBAAAA,EAAqB;CAC7CY,WAAW;EAAED,SAAS,CAAC,OAAA;EAAUE,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EAAEH,SAAS;EAAC;EAAa;EAAa;GAAS;CACrDI,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}

package/dist/core/entities/consent/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAIvF,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,eAAe,EAClB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,qBAAqB,GAAG;IAChC,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,qBAAa,cAAe,SAAQ,qBAAsB,YAAW,eAAe;IAChF,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAE7B,GAAG,EAAE,qBAAqB;IAKtC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAMnE,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,GAAG,MAAM,EAAE;IAYnE,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,yBAA8B,GACxC,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAwD7C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,yBAA8B,GAAG,OAAO,CAAC,OAAO,CAAC;IAsBlG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,yBAA8B,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBlG,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAchD,UAAU,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;CAclE"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/service.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAIvF,OAAO,KAAK,EACR,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,eAAe,EAClB,MAAM,YAAY,CAAC;AAIpB,MAAM,MAAM,qBAAqB,GAAG;IAChC,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,qBAAa,cAAe,SAAQ,qBAAsB,YAAW,eAAe;IAChF,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAE7B,GAAG,EAAE,qBAAqB;IAKtC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAMnE,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,GAAG,MAAM,EAAE;IAYnE,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,yBAA8B,GACxC,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAiF7C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,yBAA8B,GAAG,OAAO,CAAC,OAAO,CAAC;IAsBlG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,yBAA8B,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBlG,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAchD,UAAU,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;CAclE"}

package/dist/core/entities/consent/service.mjs

@@ -2,11 +2,15 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import "./types.mjs";
+import { consentSchema } from "./schema.mjs";
+import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { EntityNotFoundError } from "@authup/errors";
 import { unwrapOAuth2Scope } from "@authup/specs";
+import { and, eq, inArray, or } from "@rapiq/core";
 //#region src/core/entities/consent/service.ts
 var ConsentService = class extends AbstractEntityService {
 	repository;
@@ -15,13 +19,17 @@ var ConsentService = class extends AbstractEntityService {
 		this.repository = ctx.repository;
 	}
 	isOwnedBy(consent, actor) {
-		return !!actor.identity && consent.sub === actor.identity.data.id && consent.sub_kind === actor.identity.type;
+		return !!actor.identity && consent.sub === actor.identity.data.id && consent.subKind === actor.identity.type;
 	}
 	normalizeScopeTokens(scope) {
 		const tokens = unwrapOAuth2Scope(scope ?? []).filter((token) => token.length > 0 && token.length <= 128);
 		return Array.from(new Set(tokens));
 	}
 	async getMany(query, actor, options = {}) {
+		const parsed = await decodeQuery(query, {
+			schema: consentSchema,
+			actor
+		});
 		let canReadAll = true;
 		try {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });
@@ -29,14 +37,22 @@ var ConsentService = class extends AbstractEntityService {
 			if (!actor.identity) throw e;
 			canReadAll = false;
 		}
-		if (!canReadAll) return this.repository.findMany(query, {
+		if (!canReadAll) return this.repository.findMany(parsed, {
 			owner: {
 				sub: actor.identity.data.id,
 				subKind: actor.identity.type
 			},
 			...options.realmId ? { realmId: options.realmId } : {}
 		});
-		const { data: entities, meta } = await this.repository.findMany(query, { ...options.realmId ? { realmId: options.realmId } : {} });
+		const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.CONSENT_READ });
+		if (compiled.verdict !== "post") {
+			const ownership = actor.identity ? and(eq("sub", actor.identity.data.id), eq("subKind", actor.identity.type)) : null;
+			let scoped = parsed;
+			if (compiled.verdict === "deny") scoped = appendQueryConditions(parsed, ownership ?? inArray("id", []));
+			else if (compiled.verdict === "conditional") scoped = appendQueryConditions(parsed, ownership ? or(ownership, compiled.condition) : compiled.condition);
+			return this.repository.findMany(scoped, { ...options.realmId ? { realmId: options.realmId } : {} });
+		}
+		const { data: entities, meta } = await this.repository.findMany(parsed, { ...options.realmId ? { realmId: options.realmId } : {} });
 		const data = [];
 		let { total } = meta;
 		for (const entity of entities) {
@@ -67,7 +83,7 @@ var ConsentService = class extends AbstractEntityService {
 	}
 	async getOne(id, actor, options = {}) {
 		const entity = await this.repository.findOneById(id);
-		if (!entity || options.realmId && entity.realm_id !== options.realmId) throw new EntityNotFoundError();
+		if (!entity || options.realmId && entity.realmId !== options.realmId) throw new EntityNotFoundError();
 		if (!this.isOwnedBy(entity, actor)) {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });
 			await actor.permissionEvaluator.evaluate({
@@ -82,7 +98,7 @@ var ConsentService = class extends AbstractEntityService {
 	}
 	async delete(id, actor, options = {}) {
 		const entity = await this.repository.findOneById(id);
-		if (!entity || options.realmId && entity.realm_id !== options.realmId) throw new EntityNotFoundError();
+		if (!entity || options.realmId && entity.realmId !== options.realmId) throw new EntityNotFoundError();
 		if (!this.isOwnedBy(entity, actor)) {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_DELETE });
 			await actor.permissionEvaluator.evaluate({
@@ -113,7 +129,7 @@ var ConsentService = class extends AbstractEntityService {
 		if (tokens.length === 0) return true;
 		const rows = await this.repository.findAllBySubjectClient(input.clientId, input.owner);
 		const now = (/* @__PURE__ */ new Date()).toISOString();
-		return tokens.every((token) => rows.some((row) => row.scope === token && (row.expires_at === null || row.expires_at > now)));
+		return tokens.every((token) => rows.some((row) => row.scope === token && (row.expiresAt === null || row.expiresAt > now)));
 	}
 };
 //#endregion

package/dist/core/entities/consent/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityNotFoundError","PermissionName","unwrapOAuth2Scope","AbstractEntityService","CONSENT_SCOPE_MAX_LENGTH","ConsentService","repository","ctx","isOwnedBy","consent","actor","identity","sub","data","id","sub_kind","type","normalizeScopeTokens","scope","tokens","filter","token","length","Array","from","Set","getMany","query","options","canReadAll","permissionEvaluator","preEvaluate","name","CONSENT_READ","e","findMany","owner","subKind","realmId","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","realm_id","delete","CONSENT_DELETE","entityId","remove","record","input","insertMissing","clientId","scopes","isCovering","rows","findAllBySubjectClient","now","Date","toISOString","every","some","row","expires_at"],"sources":["../../../../src/core/entities/consent/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Consent } from '@authup/core-kit';\nimport { unwrapOAuth2Scope } from '@authup/specs';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport {\n    CONSENT_SCOPE_MAX_LENGTH,\n} from './types.ts';\nimport type {\n    ConsentCoveringInput,\n    ConsentRecordInput,\n    ConsentServiceReadOptions,\n    IConsentRepository,\n    IConsentService,\n} from './types.ts';\n\nexport type ConsentServiceContext = {\n    repository: IConsentRepository,\n};\n\nexport class ConsentService extends AbstractEntityService implements IConsentService {\n    protected repository: IConsentRepository;\n\n    constructor(ctx: ConsentServiceContext) {\n        super();\n        this.repository = ctx.repository;\n    }\n\n    protected isOwnedBy(consent: Consent, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            consent.sub === actor.identity.data.id &&\n            consent.sub_kind === actor.identity.type;\n    }\n\n    protected normalizeScopeTokens(scope: string | string[] | null): string[] {\n        const tokens = unwrapOAuth2Scope(scope ?? [])\n            // Drop empty tokens and any token that does not fit the scope\n            // column (varchar 128). An over-long token — only reachable via a\n            // non-standard scope riding the `global` verifier bypass — is\n            // simply not persisted (never remembered), rather than aborting\n            // the whole write and losing the sibling tokens ordered after it.\n            .filter((token) => token.length > 0 && token.length <= CONSENT_SCOPE_MAX_LENGTH);\n\n        return Array.from(new Set(tokens));\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: ConsentServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Consent>> {\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own consents\n            return this.repository.findMany(query, {\n                owner: {\n                    sub: actor.identity!.data.id,\n                    subKind: actor.identity!.type,\n                },\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(query, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n\n        const data: Consent[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CONSENT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext, options: ConsentServiceReadOptions = {}): Promise<Consent> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realm_id !== options.realmId)) {\n            // A realm mismatch on the nested mount fails as not-found (no\n            // cross-realm existence oracle).\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.CONSENT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n\n    async delete(id: string, actor: ActorContext, options: ConsentServiceReadOptions = {}): Promise<Consent> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realm_id !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_DELETE });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.CONSENT_DELETE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    async record(input: ConsentRecordInput): Promise<void> {\n        const tokens = this.normalizeScopeTokens(input.scope);\n        if (tokens.length === 0) {\n            return;\n        }\n\n        await this.repository.insertMissing({\n            clientId: input.clientId,\n            realmId: input.realmId,\n            owner: input.owner,\n            scopes: tokens,\n        });\n    }\n\n    async isCovering(input: ConsentCoveringInput): Promise<boolean> {\n        const tokens = this.normalizeScopeTokens(input.scope);\n        if (tokens.length === 0) {\n            return true;\n        }\n\n        const rows = await this.repository.findAllBySubjectClient(input.clientId, input.owner);\n        const now = new Date().toISOString();\n\n        return tokens.every((token) => rows.some(\n            (row) => row.scope === token &&\n                (row.expires_at === null || row.expires_at > now),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;AA6BA,IAAaO,iBAAb,cAAoCF,sBAAAA;CACtBG;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,aAAaL,MAAMC,SAASK;CAC5C;CAEUC,qBAAqBC,OAA2C;EACtE,MAAMC,SAASjB,kBAAkBgB,SAAS,CAAA,CAAE,CACxC,CAKCE,QAAQC,UAAUA,MAAMC,SAAS,KAAKD,MAAMC,UAAAA,GAAUlB;EAE3D,OAAOmB,MAAMC,KAAK,IAAIC,IAAIN,MAAAA,CAAAA;CAC9B;CAEA,MAAMO,QACFC,OACAjB,OACAkB,UAAqC,CAAC,GACU;EAChD,IAAIC,aAAa;EACjB,IAAI;GACA,MAAMnB,MAAMoB,oBAAoBC,YAAY,EAAEC,MAAM/B,eAAegC,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAACxB,MAAMC,UACP,MAAMuB;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKvB,WAAW6B,SAASR,OAAO;GACnCS,OAAO;IACHxB,KAAKF,MAAMC,SAAUE,KAAKC;IAC1BuB,SAAS3B,MAAMC,SAAUK;GAC7B;GACA,GAAIY,QAAQU,UAAU,EAAEA,SAASV,QAAQU,QAAQ,IAAI,CAAC;EAC1D,CAAA;EAGJ,MAAM,EAAEzB,MAAM0B,UAAUC,SAAS,MAAM,KAAKlC,WAAW6B,SAASR,OAAO,EAAE,GAAIC,QAAQU,UAAU,EAAEA,SAASV,QAAQU,QAAQ,IAAI,CAAC,EAAG,CAAA;EAElI,MAAMzB,OAAkB,CAAA;EACxB,IAAI,EAAE4B,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAK/B,UAAUkC,QAAQhC,KAAAA,GAAQ;IAC/BG,KAAK8B,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMhC,MAAMoB,oBAAoBc,SAAS;KACrCZ,MAAM/B,eAAegC;KACrBpB,MAAMd,iBAAiB;OAClBD,kBAAkB+C,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACA7B,KAAK8B,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACH5B;GACA2B,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAOjC,IAAYJ,OAAqBkB,UAAqC,CAAC,GAAqB;EACrG,MAAMc,SAAS,MAAM,KAAKpC,WAAW0C,YAAYlC,EAAAA;EACjD,IAAI,CAAC4B,UAAWd,QAAQU,WAAWI,OAAOO,aAAarB,QAAQU,SAG3D,MAAM,IAAItC,oBAAAA;EAGd,IAAI,CAAC,KAAKQ,UAAUkC,QAAQhC,KAAAA,GAAQ;GAChC,MAAMA,MAAMoB,oBAAoBC,YAAY,EAAEC,MAAM/B,eAAegC,aAAa,CAAA;GAChF,MAAMvB,MAAMoB,oBAAoBc,SAAS;IACrCZ,MAAM/B,eAAegC;IACrBpB,MAAMd,iBAAiB;MAClBD,kBAAkB+C,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMQ,OAAOpC,IAAYJ,OAAqBkB,UAAqC,CAAC,GAAqB;EACrG,MAAMc,SAAS,MAAM,KAAKpC,WAAW0C,YAAYlC,EAAAA;EACjD,IAAI,CAAC4B,UAAWd,QAAQU,WAAWI,OAAOO,aAAarB,QAAQU,SAC3D,MAAM,IAAItC,oBAAAA;EAGd,IAAI,CAAC,KAAKQ,UAAUkC,QAAQhC,KAAAA,GAAQ;GAChC,MAAMA,MAAMoB,oBAAoBC,YAAY,EAAEC,MAAM/B,eAAekD,eAAe,CAAA;GAClF,MAAMzC,MAAMoB,oBAAoBc,SAAS;IACrCZ,MAAM/B,eAAekD;IACrBtC,MAAMd,iBAAiB;MAClBD,kBAAkB+C,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAE5B,IAAIsC,aAAaV;EACzB,MAAM,KAAKpC,WAAW+C,OAAOX,MAAAA;EAC7BA,OAAO5B,KAAKsC;EAEZ,OAAOV;CACX;CAEA,MAAMY,OAAOC,OAA0C;EACnD,MAAMpC,SAAS,KAAKF,qBAAqBsC,MAAMrC,KAAK;EACpD,IAAIC,OAAOG,WAAW,GAClB;EAGJ,MAAM,KAAKhB,WAAWkD,cAAc;GAChCC,UAAUF,MAAME;GAChBnB,SAASiB,MAAMjB;GACfF,OAAOmB,MAAMnB;GACbsB,QAAQvC;EACZ,CAAA;CACJ;CAEA,MAAMwC,WAAWJ,OAA+C;EAC5D,MAAMpC,SAAS,KAAKF,qBAAqBsC,MAAMrC,KAAK;EACpD,IAAIC,OAAOG,WAAW,GAClB,OAAO;EAGX,MAAMsC,OAAO,MAAM,KAAKtD,WAAWuD,uBAAuBN,MAAME,UAAUF,MAAMnB,KAAK;EACrF,MAAM0B,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAElC,OAAO7C,OAAO8C,OAAO5C,UAAUuC,KAAKM,MAC/BC,QAAQA,IAAIjD,UAAUG,UAClB8C,IAAIC,eAAe,QAAQD,IAAIC,aAAaN,IAAE,CAAA;CAE3D;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","and","eq","inArray","or","EntityNotFoundError","PermissionName","unwrapOAuth2Scope","AbstractEntityService","CONSENT_SCOPE_MAX_LENGTH","appendQueryConditions","decodeQuery","consentSchema","ConsentService","repository","ctx","isOwnedBy","consent","actor","identity","sub","data","id","subKind","type","normalizeScopeTokens","scope","tokens","filter","token","length","Array","from","Set","getMany","query","options","parsed","schema","canReadAll","permissionEvaluator","preEvaluate","name","CONSENT_READ","e","findMany","owner","realmId","compiled","compile","verdict","ownership","scoped","condition","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","delete","CONSENT_DELETE","entityId","remove","record","input","insertMissing","clientId","scopes","isCovering","rows","findAllBySubjectClient","now","Date","toISOString","every","some","row","expiresAt"],"sources":["../../../../src/core/entities/consent/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    and, \n    eq, \n    inArray, \n    or,\n} from '@rapiq/core';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Consent } from '@authup/core-kit';\nimport { unwrapOAuth2Scope } from '@authup/specs';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport {\n    CONSENT_SCOPE_MAX_LENGTH,\n} from './types.ts';\nimport type {\n    ConsentCoveringInput,\n    ConsentRecordInput,\n    ConsentServiceReadOptions,\n    IConsentRepository,\n    IConsentService,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { consentSchema } from './schema.ts';\n\nexport type ConsentServiceContext = {\n    repository: IConsentRepository,\n};\n\nexport class ConsentService extends AbstractEntityService implements IConsentService {\n    protected repository: IConsentRepository;\n\n    constructor(ctx: ConsentServiceContext) {\n        super();\n        this.repository = ctx.repository;\n    }\n\n    protected isOwnedBy(consent: Consent, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            consent.sub === actor.identity.data.id &&\n            consent.subKind === actor.identity.type;\n    }\n\n    protected normalizeScopeTokens(scope: string | string[] | null): string[] {\n        const tokens = unwrapOAuth2Scope(scope ?? [])\n            // Drop empty tokens and any token that does not fit the scope\n            // column (varchar 128). An over-long token — only reachable via a\n            // non-standard scope riding the `global` verifier bypass — is\n            // simply not persisted (never remembered), rather than aborting\n            // the whole write and losing the sibling tokens ordered after it.\n            .filter((token) => token.length > 0 && token.length <= CONSENT_SCOPE_MAX_LENGTH);\n\n        return Array.from(new Set(tokens));\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: ConsentServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Consent>> {\n        const parsed = await decodeQuery(query, { schema: consentSchema, actor });\n\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own consents\n            return this.repository.findMany(parsed, {\n                owner: {\n                    sub: actor.identity!.data.id,\n                    subKind: actor.identity!.type,\n                },\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        // Compile CONSENT_READ into a row condition (#3286 phase 3). Own rows are\n        // always readable, so ownership composes as an OR-alternative — the whole\n        // gate runs as WHERE and pagination/totals stay exact. A non-expressible\n        // policy falls back to the per-row loop below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.CONSENT_READ });\n        if (compiled.verdict !== 'post') {\n            const ownership = actor.identity ?\n                and(eq('sub', actor.identity.data.id), eq('subKind', actor.identity.type)) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, ownership ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    ownership ? or(ownership, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(parsed, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n\n        const data: Consent[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CONSENT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext, options: ConsentServiceReadOptions = {}): Promise<Consent> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realmId !== options.realmId)) {\n            // A realm mismatch on the nested mount fails as not-found (no\n            // cross-realm existence oracle).\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.CONSENT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n\n    async delete(id: string, actor: ActorContext, options: ConsentServiceReadOptions = {}): Promise<Consent> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realmId !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CONSENT_DELETE });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.CONSENT_DELETE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    async record(input: ConsentRecordInput): Promise<void> {\n        const tokens = this.normalizeScopeTokens(input.scope);\n        if (tokens.length === 0) {\n            return;\n        }\n\n        await this.repository.insertMissing({\n            clientId: input.clientId,\n            realmId: input.realmId,\n            owner: input.owner,\n            scopes: tokens,\n        });\n    }\n\n    async isCovering(input: ConsentCoveringInput): Promise<boolean> {\n        const tokens = this.normalizeScopeTokens(input.scope);\n        if (tokens.length === 0) {\n            return true;\n        }\n\n        const rows = await this.repository.findAllBySubjectClient(input.clientId, input.owner);\n        const now = new Date().toISOString();\n\n        return tokens.every((token) => rows.some(\n            (row) => row.scope === token &&\n                (row.expiresAt === null || row.expiresAt > now),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AAqCA,IAAac,iBAAb,cAAoCL,sBAAAA;CACtBM;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,YAAYL,MAAMC,SAASK;CAC3C;CAEUC,qBAAqBC,OAA2C;EACtE,MAAMC,SAASpB,kBAAkBmB,SAAS,CAAA,CAAE,CACxC,CAKCE,QAAQC,UAAUA,MAAMC,SAAS,KAAKD,MAAMC,UAAAA,GAAUrB;EAE3D,OAAOsB,MAAMC,KAAK,IAAIC,IAAIN,MAAAA,CAAAA;CAC9B;CAEA,MAAMO,QACFC,OACAjB,OACAkB,UAAqC,CAAC,GACU;EAChD,MAAMC,SAAS,MAAM1B,YAAYwB,OAAO;GAAEG,QAAQ1B;GAAeM;EAAM,CAAA;EAEvE,IAAIqB,aAAa;EACjB,IAAI;GACA,MAAMrB,MAAMsB,oBAAoBC,YAAY,EAAEC,MAAMpC,eAAeqC,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAAC1B,MAAMC,UACP,MAAMyB;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKzB,WAAW+B,SAASR,QAAQ;GACpCS,OAAO;IACH1B,KAAKF,MAAMC,SAAUE,KAAKC;IAC1BC,SAASL,MAAMC,SAAUK;GAC7B;GACA,GAAIY,QAAQW,UAAU,EAAEA,SAASX,QAAQW,QAAQ,IAAI,CAAC;EAC1D,CAAA;EAOJ,MAAMC,WAAW,MAAM9B,MAAMsB,oBAAoBS,QAAQ,EAAEP,MAAMpC,eAAeqC,aAAa,CAAA;EAC7F,IAAIK,SAASE,YAAY,QAAQ;GAC7B,MAAMC,YAAYjC,MAAMC,WACpBlB,IAAIC,GAAG,OAAOgB,MAAMC,SAASE,KAAKC,EAAE,GAAGpB,GAAG,WAAWgB,MAAMC,SAASK,IAAI,CAAA,IACxE;GAEJ,IAAI4B,SAASf;GACb,IAAIW,SAASE,YAAY,QACrBE,SAAS1C,sBAAsB2B,QAAQc,aAAahD,QAAQ,MAAM,CAAA,CAAE,CAAA;QACjE,IAAI6C,SAASE,YAAY,eAC5BE,SAAS1C,sBACL2B,QACAc,YAAY/C,GAAG+C,WAAWH,SAASK,SAAS,IAAIL,SAASK,SAAS;GAI1E,OAAO,KAAKvC,WAAW+B,SAASO,QAAQ,EAAE,GAAIhB,QAAQW,UAAU,EAAEA,SAASX,QAAQW,QAAQ,IAAI,CAAC,EAAG,CAAA;EACvG;EAEA,MAAM,EAAE1B,MAAMiC,UAAUC,SAAS,MAAM,KAAKzC,WAAW+B,SAASR,QAAQ,EAAE,GAAID,QAAQW,UAAU,EAAEA,SAASX,QAAQW,QAAQ,IAAI,CAAC,EAAG,CAAA;EAEnI,MAAM1B,OAAkB,CAAA;EACxB,IAAI,EAAEmC,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAKtC,UAAUyC,QAAQvC,KAAAA,GAAQ;IAC/BG,KAAKqC,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMvC,MAAMsB,oBAAoBmB,SAAS;KACrCjB,MAAMpC,eAAeqC;KACrBtB,MAAMrB,iBAAiB;OAClBD,kBAAkB6D,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACApC,KAAKqC,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHnC;GACAkC,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAOxC,IAAYJ,OAAqBkB,UAAqC,CAAC,GAAqB;EACrG,MAAMqB,SAAS,MAAM,KAAK3C,WAAWiD,YAAYzC,EAAAA;EACjD,IAAI,CAACmC,UAAWrB,QAAQW,WAAWU,OAAOV,YAAYX,QAAQW,SAG1D,MAAM,IAAI1C,oBAAAA;EAGd,IAAI,CAAC,KAAKW,UAAUyC,QAAQvC,KAAAA,GAAQ;GAChC,MAAMA,MAAMsB,oBAAoBC,YAAY,EAAEC,MAAMpC,eAAeqC,aAAa,CAAA;GAChF,MAAMzB,MAAMsB,oBAAoBmB,SAAS;IACrCjB,MAAMpC,eAAeqC;IACrBtB,MAAMrB,iBAAiB;MAClBD,kBAAkB6D,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMO,OAAO1C,IAAYJ,OAAqBkB,UAAqC,CAAC,GAAqB;EACrG,MAAMqB,SAAS,MAAM,KAAK3C,WAAWiD,YAAYzC,EAAAA;EACjD,IAAI,CAACmC,UAAWrB,QAAQW,WAAWU,OAAOV,YAAYX,QAAQW,SAC1D,MAAM,IAAI1C,oBAAAA;EAGd,IAAI,CAAC,KAAKW,UAAUyC,QAAQvC,KAAAA,GAAQ;GAChC,MAAMA,MAAMsB,oBAAoBC,YAAY,EAAEC,MAAMpC,eAAe2D,eAAe,CAAA;GAClF,MAAM/C,MAAMsB,oBAAoBmB,SAAS;IACrCjB,MAAMpC,eAAe2D;IACrB5C,MAAMrB,iBAAiB;MAClBD,kBAAkB6D,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAEnC,IAAI4C,aAAaT;EACzB,MAAM,KAAK3C,WAAWqD,OAAOV,MAAAA;EAC7BA,OAAOnC,KAAK4C;EAEZ,OAAOT;CACX;CAEA,MAAMW,OAAOC,OAA0C;EACnD,MAAM1C,SAAS,KAAKF,qBAAqB4C,MAAM3C,KAAK;EACpD,IAAIC,OAAOG,WAAW,GAClB;EAGJ,MAAM,KAAKhB,WAAWwD,cAAc;GAChCC,UAAUF,MAAME;GAChBxB,SAASsB,MAAMtB;GACfD,OAAOuB,MAAMvB;GACb0B,QAAQ7C;EACZ,CAAA;CACJ;CAEA,MAAM8C,WAAWJ,OAA+C;EAC5D,MAAM1C,SAAS,KAAKF,qBAAqB4C,MAAM3C,KAAK;EACpD,IAAIC,OAAOG,WAAW,GAClB,OAAO;EAGX,MAAM4C,OAAO,MAAM,KAAK5D,WAAW6D,uBAAuBN,MAAME,UAAUF,MAAMvB,KAAK;EACrF,MAAM8B,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAElC,OAAOnD,OAAOoD,OAAOlD,UAAU6C,KAAKM,MAC/BC,QAAQA,IAAIvD,UAAUG,UAClBoD,IAAIC,cAAc,QAAQD,IAAIC,YAAYN,IAAE,CAAA;CAEzD;AACJ"}

package/dist/core/entities/consent/types.d.ts

@@ -1,4 +1,5 @@
 import type { Consent } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
 import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
 export type ConsentOwner = {
     sub: string;
@@ -15,7 +16,7 @@ export declare const CONSENT_SCOPE_MAX_LENGTH = 128;
  * Filter keys a consent list query may target. Shared by the repository's
  * rapiq `filters.allowed` so service and adapter can never drift.
  */
-export declare const CONSENT_FILTER_KEYS: readonly ["id", "client_id", "realm_id", "sub", "sub_kind", "scope"];
+export declare const CONSENT_FILTER_KEYS: readonly ["id", "clientId", "realmId", "sub", "subKind", "scope"];
 export type ConsentFindManyOptions = {
     /**
      * Force the result to a single subject (self-service). Applied as a
@@ -47,7 +48,7 @@ export type ConsentCoveringInput = {
     scope: string | string[] | null;
 };
 export interface IConsentRepository {
-    findMany(query: Record<string, any>, options?: ConsentFindManyOptions): Promise<EntityRepositoryFindManyResult<Consent>>;
+    findMany(query: IQuery, options?: ConsentFindManyOptions): Promise<EntityRepositoryFindManyResult<Consent>>;
     findOneById(id: string): Promise<Consent | null>;
     /**
      * Covering-lookup source — query-cached

package/dist/core/entities/consent/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,MAAM,YAAY,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,sEAOtB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;OAIG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAElF;;;OAGG;IACH,aAAa,CAAC,KAAK,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,YAAY,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAA;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElB,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhJ;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/F;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/F;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,MAAM,YAAY,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,mEAOtB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5G,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;OAIG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAElF;;;OAGG;IACH,aAAa,CAAC,KAAK,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,YAAY,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAA;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElB,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhJ;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/F;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/F;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D"}

package/dist/core/entities/consent/types.mjs

@@ -13,10 +13,10 @@ import.meta.url;
 * rapiq `filters.allowed` so service and adapter can never drift.
 */ const CONSENT_FILTER_KEYS = [
 	"id",
-	"client_id",
-	"realm_id",
+	"clientId",
+	"realmId",
 	"sub",
-	"sub_kind",
+	"subKind",
 	"scope"
 ];
 //#endregion

package/dist/core/entities/consent/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":["CONSENT_SCOPE_MAX_LENGTH","CONSENT_FILTER_KEYS"],"sources":["../../../../src/core/entities/consent/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type ConsentOwner = {\n    sub: string,\n    subKind: string,\n};\n\n/**\n * Max length of a single stored scope token — must equal the\n * `auth_consents.scope` column width (varchar 128). A longer token (only\n * reachable via a non-standard scope riding the `global` verifier bypass) is\n * dropped at normalization rather than overflowing the column.\n */\nexport const CONSENT_SCOPE_MAX_LENGTH = 128;\n\n/**\n * Filter keys a consent list query may target. Shared by the repository's\n * rapiq `filters.allowed` so service and adapter can never drift.\n */\nexport const CONSENT_FILTER_KEYS = [\n    'id',\n    'client_id',\n    'realm_id',\n    'sub',\n    'sub_kind',\n    'scope',\n] as const;\n\nexport type ConsentFindManyOptions = {\n    /**\n     * Force the result to a single subject (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    owner?: ConsentOwner,\n    /**\n     * Restrict the result to a single realm (the `/realms/:realmId/consents`\n     * nested mount). Mandatory WHERE, not overridable by a rapiq filter.\n     */\n    realmId?: string,\n};\n\nexport type ConsentServiceReadOptions = {\n    realmId?: string,\n};\n\nexport type ConsentRecordInput = {\n    clientId: string,\n    realmId: string,\n    owner: ConsentOwner,\n    /**\n     * Raw scope representation(s) — normalized to lowercase tokens via\n     * `unwrapOAuth2Scope` before persistence.\n     */\n    scope: string | string[] | null,\n};\n\nexport type ConsentCoveringInput = {\n    clientId: string,\n    owner: ConsentOwner,\n    scope: string | string[] | null,\n};\n\nexport interface IConsentRepository {\n    findMany(query: Record<string, any>, options?: ConsentFindManyOptions): Promise<EntityRepositoryFindManyResult<Consent>>;\n\n    findOneById(id: string): Promise<Consent | null>;\n\n    /**\n     * Covering-lookup source — query-cached\n     * (`CachePrefix.CONSENT_COVERING`, 60s), invalidated by the\n     * `ConsentEntitySubscriber` on insert/update/remove.\n     */\n    findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]>;\n\n    /**\n     * Union/keep: insert one row per missing scope token, never touching\n     * existing rows. Race-safe under the 4-column unique index.\n     */\n    insertMissing(input: {\n        clientId: string, \n        realmId: string, \n        owner: ConsentOwner, \n        scopes: string[] \n    }): Promise<void>;\n\n    remove(entity: Consent): Promise<void>;\n}\n\nexport interface IConsentService {\n    /**\n     * List consents. An actor without `CONSENT_READ` is scoped to its own\n     * rows (self-service); an actor with `CONSENT_READ` sees every row its\n     * realm reach permits.\n     */\n    getMany(query: Record<string, any>, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<EntityRepositoryFindManyResult<Consent>>;\n\n    /**\n     * Read a single consent by id. Own rows need no permission.\n     */\n    getOne(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;\n\n    /**\n     * Revoke (delete) a single consent by id. Own rows need no permission.\n     */\n    delete(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;\n\n    /**\n     * Flow integration (POST /authorize approval) — no permission checks:\n     * the subject consents to its own grant. Inputs are server-derived\n     * (verifier-stamped client/realm, token-derived subject), never raw\n     * client input.\n     */\n    record(input: ConsentRecordInput): Promise<void>;\n\n    /**\n     * Strict covering: every requested token has an unexpired row.\n     */\n    isCovering(input: ConsentCoveringInput): Promise<boolean>;\n}\n"],"mappings":";;;;;;;;;GAqBA,MAAaA,2BAA2B;;;;GAMxC,MAAaC,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA"}
+{"version":3,"file":"types.mjs","names":["CONSENT_SCOPE_MAX_LENGTH","CONSENT_FILTER_KEYS"],"sources":["../../../../src/core/entities/consent/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type ConsentOwner = {\n    sub: string,\n    subKind: string,\n};\n\n/**\n * Max length of a single stored scope token — must equal the\n * `auth_consents.scope` column width (varchar 128). A longer token (only\n * reachable via a non-standard scope riding the `global` verifier bypass) is\n * dropped at normalization rather than overflowing the column.\n */\nexport const CONSENT_SCOPE_MAX_LENGTH = 128;\n\n/**\n * Filter keys a consent list query may target. Shared by the repository's\n * rapiq `filters.allowed` so service and adapter can never drift.\n */\nexport const CONSENT_FILTER_KEYS = [\n    'id',\n    'clientId',\n    'realmId',\n    'sub',\n    'subKind',\n    'scope',\n] as const;\n\nexport type ConsentFindManyOptions = {\n    /**\n     * Force the result to a single subject (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    owner?: ConsentOwner,\n    /**\n     * Restrict the result to a single realm (the `/realms/:realmId/consents`\n     * nested mount). Mandatory WHERE, not overridable by a rapiq filter.\n     */\n    realmId?: string,\n};\n\nexport type ConsentServiceReadOptions = {\n    realmId?: string,\n};\n\nexport type ConsentRecordInput = {\n    clientId: string,\n    realmId: string,\n    owner: ConsentOwner,\n    /**\n     * Raw scope representation(s) — normalized to lowercase tokens via\n     * `unwrapOAuth2Scope` before persistence.\n     */\n    scope: string | string[] | null,\n};\n\nexport type ConsentCoveringInput = {\n    clientId: string,\n    owner: ConsentOwner,\n    scope: string | string[] | null,\n};\n\nexport interface IConsentRepository {\n    findMany(query: IQuery, options?: ConsentFindManyOptions): Promise<EntityRepositoryFindManyResult<Consent>>;\n\n    findOneById(id: string): Promise<Consent | null>;\n\n    /**\n     * Covering-lookup source — query-cached\n     * (`CachePrefix.CONSENT_COVERING`, 60s), invalidated by the\n     * `ConsentEntitySubscriber` on insert/update/remove.\n     */\n    findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]>;\n\n    /**\n     * Union/keep: insert one row per missing scope token, never touching\n     * existing rows. Race-safe under the 4-column unique index.\n     */\n    insertMissing(input: {\n        clientId: string, \n        realmId: string, \n        owner: ConsentOwner, \n        scopes: string[] \n    }): Promise<void>;\n\n    remove(entity: Consent): Promise<void>;\n}\n\nexport interface IConsentService {\n    /**\n     * List consents. An actor without `CONSENT_READ` is scoped to its own\n     * rows (self-service); an actor with `CONSENT_READ` sees every row its\n     * realm reach permits.\n     */\n    getMany(query: Record<string, any>, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<EntityRepositoryFindManyResult<Consent>>;\n\n    /**\n     * Read a single consent by id. Own rows need no permission.\n     */\n    getOne(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;\n\n    /**\n     * Revoke (delete) a single consent by id. Own rows need no permission.\n     */\n    delete(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;\n\n    /**\n     * Flow integration (POST /authorize approval) — no permission checks:\n     * the subject consents to its own grant. Inputs are server-derived\n     * (verifier-stamped client/realm, token-derived subject), never raw\n     * client input.\n     */\n    record(input: ConsentRecordInput): Promise<void>;\n\n    /**\n     * Strict covering: every requested token has an unexpired row.\n     */\n    isCovering(input: ConsentCoveringInput): Promise<boolean>;\n}\n"],"mappings":";;;;;;;;;GAsBA,MAAaA,2BAA2B;;;;GAMxC,MAAaC,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA"}