npm - @authup/server-core - Versions diffs - 1.0.0-beta.53 → 1.0.0-beta.54 - Mend

@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.54

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1152) hide show

package/dist/core/entities/session/schema.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+import type { Session } from '@authup/core-kit';
+export declare const sessionSchema: import("@rapiq/core").Schema<Session, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/session/schema.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAOhD,eAAO,MAAM,aAAa,4CAwBxB,CAAC"}

package/dist/core/entities/session/schema.mjs ADDED Viewed

@@ -0,0 +1,44 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SESSION_FILTER_KEYS } from "../../authentication/session/types.mjs";
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/session/schema.ts
+const schemaMapping = { realm: EntityType.REALM };
+const sessionSchema = defineSchema({
+	name: EntityType.SESSION,
+	fields: { allowed: [
+		"id",
+		"sub",
+		"subKind",
+		"ipAddress",
+		"userAgent",
+		"expiresAt",
+		"refreshedAt",
+		"seenAt",
+		"createdAt",
+		"updatedAt",
+		"userId",
+		"clientId",
+		"realmId"
+	] },
+	filters: { allowed: [...SESSION_FILTER_KEYS] },
+	relations: {
+		allowed: ["realm"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"seenAt",
+		"expiresAt",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { sessionSchema };
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/session/schema.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","SESSION_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","sessionSchema","name","SESSION","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/session/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Session } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { SESSION_FILTER_KEYS } from '../../authentication/session/types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const sessionSchema = defineSchema<Session>({\n name: EntityType.SESSION,\n fields: {\n allowed: [\n 'id',\n 'sub',\n 'subKind',\n 'ipAddress',\n 'userAgent',\n 'expiresAt',\n 'refreshedAt',\n 'seenAt',\n 'createdAt',\n 'updatedAt',\n 'userId',\n 'clientId',\n 'realmId',\n ],\n },\n filters: { allowed: [...SESSION_FILTER_KEYS] },\n relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['seenAt', 'expiresAt', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAED,SAAS,CAAA,GAAIT,mBAAAA,EAAqB;CAC7CW,WAAW;EAAEF,SAAS,CAAC,OAAA;EAAUG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAU;EAAa;EAAa;GAAa;CACnEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}

package/dist/core/entities/session/service.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
+import type { ICondition } from '@rapiq/core';
 import type { Session } from '@authup/core-kit';
 import { AbstractEntityService } from '@authup/server-kit';
 import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
@@ -19,8 +20,18 @@ export declare class SessionService extends AbstractEntityService implements ISe
      * discriminator between the admin bulk-revoke path and self-service. An
      * unrecognized / empty filter falls through to self-service (fail-safe: a
      * typo can never trigger an unconstrained mass delete).
+     *
+     * The wire may carry either dialect (v2 expression or legacy bracket
+     * filters), so the decision decodes to the rapiq IR and inspects the
+     * condition tree instead of poking at the raw payload.
      */
     protected hasTargetFilter(query?: Record<string, any>): boolean;
+    protected hasTargetCondition(condition: ICondition): boolean;
+    /**
+     * Schemaless decode — dialect detection only. The allow-list is
+     * enforced downstream by the repository's schema-bound decode.
+     */
+    protected static queryCodec: import("@rapiq/codec-url").URLCodec;
     protected deleteManyForSelf(actor: ActorContext, currentSessionId?: string): Promise<SessionDeleteManyResult>;
     protected deleteManyByQuery(actor: ActorContext, query: Record<string, any>): Promise<SessionDeleteManyResult>;
 }

package/dist/core/entities/session/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/service.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAExE,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;~~AAErG~~,MAAM,MAAM,qBAAqB,GAAG;IAChC,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,qBAAa,cAAe,SAAQ,qBAAsB,YAAW,eAAe;IAChF,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAE7B,GAAG,EAAE,qBAAqB;IAKtC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAM7D,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;~~IAuD7C~~,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBzD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBzD,UAAU,CACZ,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,wBAA6B,GACvC,OAAO,CAAC,uBAAuB,CAAC;IAYnC~~;;;;;OAKG~~;IACH,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;~~cAY~~/C,iBAAiB,CAC7B,KAAK,EAAE,YAAY,EACnB,gBAAgB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,uBAAuB,CAAC;cAkBnB,iBAAiB,CAC7B,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,uBAAuB,CAAC;~~CAgCtC~~"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/service.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAU9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAExE,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAIrG,MAAM,MAAM,qBAAqB,GAAG;IAChC,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,qBAAa,cAAe,SAAQ,qBAAsB,YAAW,eAAe;IAChF,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAE7B,GAAG,EAAE,qBAAqB;IAKtC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAM7D,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAgF7C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBzD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBzD,UAAU,CACZ,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,wBAA6B,GACvC,OAAO,CAAC,uBAAuB,CAAC;IAYnC;;;;;;;;;OASG;IACH,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO;IAoB/D,SAAS,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO;IAa5D;;;OAGG;IACH,SAAS,CAAC,MAAM,CAAC,UAAU,sCAAoB;cAE/B,iBAAiB,CAC7B,KAAK,EAAE,YAAY,EACnB,gBAAgB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,uBAAuB,CAAC;cAkBnB,iBAAiB,CAC7B,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,uBAAuB,CAAC;CAsCtC"}

package/dist/core/entities/session/service.mjs CHANGED Viewed

@@ -3,22 +3,31 @@ import "node:url";
 import.meta.url;
 import { SESSION_FILTER_KEYS } from "../../authentication/session/types.mjs";
 import "../../authentication/index.mjs";
+import { sessionSchema } from "./schema.mjs";
+import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { isObject } from "@authup/kit";
 import { PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { AuthupError, EntityNotFoundError, ErrorCode } from "@authup/errors";
+import { and, eq, inArray, isFilter, isFilters, or } from "@rapiq/core";
+import { createURLCodec } from "@rapiq/codec-url";
 //#region src/core/entities/session/service.ts
-var SessionService = class extends AbstractEntityService {
+var SessionService = class SessionService extends AbstractEntityService {
 	repository;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
 	}
 	isOwnedBy(session, actor) {
-		return !!actor.identity && session.sub === actor.identity.data.id && session.sub_kind === actor.identity.type;
+		return !!actor.identity && session.sub === actor.identity.data.id && session.subKind === actor.identity.type;
 	}
 	async getMany(query, actor) {
+		const parsed = await decodeQuery(query, {
+			schema: sessionSchema,
+			actor
+		});
 		let canReadAll = true;
 		try {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });
@@ -26,11 +35,19 @@ var SessionService = class extends AbstractEntityService {
 			if (!actor.identity) throw e;
 			canReadAll = false;
 		}
-		if (!canReadAll) return this.repository.findMany(query, { owner: {
+		if (!canReadAll) return this.repository.findMany(parsed, { owner: {
 			sub: actor.identity.data.id,
 			subKind: actor.identity.type
 		} });
-		const { data: entities, meta } = await this.repository.findMany(query);
+		const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.SESSION_READ });
+		if (compiled.verdict !== "post") {
+			const ownership = actor.identity ? and(eq("sub", actor.identity.data.id), eq("subKind", actor.identity.type)) : null;
+			let scoped = parsed;
+			if (compiled.verdict === "deny") scoped = appendQueryConditions(parsed, ownership ?? inArray("id", []));
+			else if (compiled.verdict === "conditional") scoped = appendQueryConditions(parsed, ownership ? or(ownership, compiled.condition) : compiled.condition);
+			return this.repository.findMany(scoped);
+		}
+		const { data: entities, meta } = await this.repository.findMany(parsed);
 		const data = [];
 		let { total } = meta;
 		for (const entity of entities) {
@@ -105,14 +122,30 @@ var SessionService = class extends AbstractEntityService {
 	* discriminator between the admin bulk-revoke path and self-service. An
 	* unrecognized / empty filter falls through to self-service (fail-safe: a
 	* typo can never trigger an unconstrained mass delete).
+	*
+	* The wire may carry either dialect (v2 expression or legacy bracket
+	* filters), so the decision decodes to the rapiq IR and inspects the
+	* condition tree instead of poking at the raw payload.
 	*/ hasTargetFilter(query) {
-		const filter = query?.filter;
-		if (!isObject(filter)) return false;
-		return SESSION_FILTER_KEYS.some((key) => {
-			const value = filter[key];
-			return typeof value !== "undefined" && value !== "";
-		});
+		if (!isObject(query)) return false;
+		let parsed;
+		try {
+			parsed = SessionService.queryCodec.decode(query);
+		} catch {
+			return false;
+		}
+		if (!parsed) return false;
+		return this.hasTargetCondition(parsed.filters);
+	}
+	hasTargetCondition(condition) {
+		if (isFilters(condition)) return condition.value.some((child) => this.hasTargetCondition(child));
+		if (isFilter(condition)) return SESSION_FILTER_KEYS.includes(condition.field) && condition.value !== "";
+		return false;
 	}
+	/**
+	* Schemaless decode — dialect detection only. The allow-list is
+	* enforced downstream by the repository's schema-bound decode.
+	*/ static queryCodec = createURLCodec();
 	async deleteManyForSelf(actor, currentSessionId) {
 		const sessions = await this.repository.findAllByOwner({
 			sub: actor.identity.data.id,
@@ -128,7 +161,11 @@ var SessionService = class extends AbstractEntityService {
 	}
 	async deleteManyByQuery(actor, query) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });
-		const sessions = await this.repository.findAllByQuery(query);
+		const sessions = await this.repository.findAllByQuery(await decodeQuery(query, {
+			schema: sessionSchema,
+			parameters: ["filters"],
+			actor
+		}));
 		let count = 0;
 		for (const session of sessions) {
 			if (!this.isOwnedBy(session, actor)) try {

package/dist/core/entities/session/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","AuthupError","EntityNotFoundError","ErrorCode","isObject","PermissionName","AbstractEntityService","SESSION_FILTER_KEYS","SessionService","repository","ctx","isOwnedBy","session","actor","identity","sub","data","id","sub_kind","type","getMany","query","canReadAll","permissionEvaluator","preEvaluate","name","SESSION_READ","e","findMany","owner","subKind","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","delete","SESSION_DELETE","entityId","remove","deleteMany","options","code","IDENTITY_UNAUTHORIZED","message","hasTargetFilter","deleteManyByQuery","deleteManyForSelf","currentSessionId","filter","some","key","value","sessions","findAllByOwner","count","findAllByQuery"],"sources":["../../../../src/core/entities/session/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { AuthupError, EntityNotFoundError, ErrorCode } from '@authup/errors';\nimport { isObject } from '@authup/kit';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Session } from '@authup/core-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { ISessionRepository } from '../../authentication/index.ts';\nimport { SESSION_FILTER_KEYS } from '../../authentication/index.ts';\nimport type { ISessionService, SessionDeleteManyOptions, SessionDeleteManyResult } from './types.ts';\n\nexport type SessionServiceContext = {\n repository: ISessionRepository,\n};\n\nexport class SessionService extends AbstractEntityService implements ISessionService {\n protected repository: ISessionRepository;\n\n constructor(ctx: SessionServiceContext) {\n super();\n this.repository = ctx.repository;\n }\n\n protected isOwnedBy(session: Session, actor: ActorContext): boolean {\n return !!actor.identity &&\n session.sub === actor.identity.data.id &&\n session.sub_kind === actor.identity.type;\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Session>> {\n let canReadAll = true;\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n } catch (e) {\n if (!actor.identity) {\n throw e;\n }\n canReadAll = false;\n }\n\n if (!canReadAll) {\n // self-service: only the actor's own sessions\n return this.repository.findMany(query, {\n owner: {\n sub: actor.identity!.data.id,\n subKind: actor.identity!.type,\n },\n });\n }\n\n const { data: entities, meta } = await this.repository.findMany(query);\n\n const data: Session[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n if (this.isOwnedBy(entity, actor)) {\n data.push(entity);\n continue;\n }\n\n try {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_READ,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total,\n },\n };\n }\n\n async getOne(id: string, actor: ActorContext): Promise<Session> {\n const entity = await this.repository.findOneById(id);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (!this.isOwnedBy(entity, actor)) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_READ,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n }\n\n return entity;\n }\n\n async delete(id: string, actor: ActorContext): Promise<Session> {\n const entity = await this.repository.findOneById(id);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (!this.isOwnedBy(entity, actor)) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n }\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n\n async deleteMany(\n actor: ActorContext,\n options: SessionDeleteManyOptions = {},\n ): Promise<SessionDeleteManyResult> {\n if (!actor.identity) {\n throw new AuthupError({ code: ErrorCode.IDENTITY_UNAUTHORIZED, message: 'Authentication required.' });\n }\n\n if (this.hasTargetFilter(options.query)) {\n return this.deleteManyByQuery(actor, options.query!);\n }\n\n return this.deleteManyForSelf(actor, options.currentSessionId);\n }\n\n /\n True when the query carries at least one recognized target filter — the\n * discriminator between the admin bulk-revoke path and self-service. An\n * unrecognized / empty filter falls through to self-service (fail-safe: a\n * typo can never trigger an unconstrained mass delete).\n */\n protected hasTargetFilter(query?: Record<string, any>): boolean {\n const filter = query?.filter;\n if (!isObject(filter)) {\n return false;\n }\n\n return SESSION_FILTER_KEYS.some((key) => {\n const value = filter[key];\n return typeof value !== 'undefined' && value !== '';\n });\n }\n\n protected async deleteManyForSelf(\n actor: ActorContext,\n currentSessionId?: string,\n ): Promise<SessionDeleteManyResult> {\n const sessions = await this.repository.findAllByOwner({\n sub: actor.identity!.data.id,\n subKind: actor.identity!.type,\n });\n\n let count = 0;\n for (const session of sessions) {\n if (currentSessionId && session.id === currentSessionId) {\n continue;\n }\n await this.repository.remove(session);\n count += 1;\n }\n\n return { count };\n }\n\n protected async deleteManyByQuery(\n actor: ActorContext,\n query: Record<string, any>,\n ): Promise<SessionDeleteManyResult> {\n // Gate: an actor without SESSION_DELETE cannot force-logout anyone → 403.\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n\n const sessions = await this.repository.findAllByQuery(query);\n\n let count = 0;\n for (const session of sessions) {\n // Own sessions are always deletable by the actor (mirrors getMany).\n // Otherwise per-session realm-match: a realm_admin only reaches\n // sessions in its realm — cross-realm rows are skipped, not failed,\n // so filter breadth cannot escalate beyond the actor's reach.\n if (!this.isOwnedBy(session, actor)) {\n try {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: session,\n ...this.resourceRealmMatch(session),\n }),\n });\n } catch {\n continue;\n }\n }\n\n await this.repository.remove(session);\n count += 1;\n }\n\n return { count };\n }\n}\n"],"mappings":";;;;;;;;;;;AAsBA,IAAaS,iBAAb,cAAoCF,sBAAAA;CACtBG;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,aAAaL,MAAMC,SAASK;CAC5C;CAEA,MAAMC,QACFC,OACAR,OACgD;EAChD,IAAIS,aAAa;EACjB,IAAI;GACA,MAAMT,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqB,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAACd,MAAMC,UACP,MAAMa;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKb,WAAWmB,SAASP,OAAO,EACnCQ,OAAO;GACHd,KAAKF,MAAMC,SAAUE,KAAKC;GAC1Ba,SAASjB,MAAMC,SAAUK;EAC7B,EACJ,CAAA;EAGJ,MAAM,EAAEH,MAAMe,UAAUC,SAAS,MAAM,KAAKvB,WAAWmB,SAASP,KAAAA;EAEhE,MAAML,OAAkB,CAAA;EACxB,IAAI,EAAEiB,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAKpB,UAAUuB,QAAQrB,KAAAA,GAAQ;IAC/BG,KAAKmB,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMrB,MAAMU,oBAAoBa,SAAS;KACrCX,MAAMpB,eAAeqB;KACrBV,MAAMhB,iBAAiB;OAClBD,kBAAkBsC,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAlB,KAAKmB,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHjB;GACAgB,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAOtB,IAAYJ,OAAuC;EAC5D,MAAMqB,SAAS,MAAM,KAAKzB,WAAW+B,YAAYvB,EAAAA;EACjD,IAAI,CAACiB,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAAC,KAAKS,UAAUuB,QAAQrB,KAAAA,GAAQ;GAChC,MAAMA,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqB,aAAa,CAAA;GAChF,MAAMb,MAAMU,oBAAoBa,SAAS;IACrCX,MAAMpB,eAAeqB;IACrBV,MAAMhB,iBAAiB;MAClBD,kBAAkBsC,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMO,OAAOxB,IAAYJ,OAAuC;EAC5D,MAAMqB,SAAS,MAAM,KAAKzB,WAAW+B,YAAYvB,EAAAA;EACjD,IAAI,CAACiB,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI,CAAC,KAAKS,UAAUuB,QAAQrB,KAAAA,GAAQ;GAChC,MAAMA,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqC,eAAe,CAAA;GAClF,MAAM7B,MAAMU,oBAAoBa,SAAS;IACrCX,MAAMpB,eAAeqC;IACrB1B,MAAMhB,iBAAiB;MAClBD,kBAAkBsC,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAEjB,IAAI0B,aAAaT;EACzB,MAAM,KAAKzB,WAAWmC,OAAOV,MAAAA;EAC7BA,OAAOjB,KAAK0B;EAEZ,OAAOT;CACX;CAEA,MAAMW,WACFhC,OACAiC,UAAoC,CAAC,GACL;EAChC,IAAI,CAACjC,MAAMC,UACP,MAAM,IAAIb,YAAY;GAAE8C,MAAM5C,UAAU6C;GAAuBC,SAAS;EAA2B,CAAA;EAGvG,IAAI,KAAKC,gBAAgBJ,QAAQzB,KAAK,GAClC,OAAO,KAAK8B,kBAAkBtC,OAAOiC,QAAQzB,KAAK;EAGtD,OAAO,KAAK+B,kBAAkBvC,OAAOiC,QAAQO,gBAAgB;CACjE;;;;;;IAQA,gBAA0BhC,OAAsC;EAC5D,MAAMiC,SAASjC,OAAOiC;EACtB,IAAI,CAAClD,SAASkD,MAAAA,GACV,OAAO;EAGX,OAAO/C,oBAAoBgD,MAAMC,QAAAA;GAC7B,MAAMC,QAAQH,OAAOE;GACrB,OAAO,OAAOC,UAAU,eAAeA,UAAU;EACrD,CAAA;CACJ;CAEA,MAAgBL,kBACZvC,OACAwC,kBACgC;EAChC,MAAMK,WAAW,MAAM,KAAKjD,WAAWkD,eAAe;GAClD5C,KAAKF,MAAMC,SAAUE,KAAKC;GAC1Ba,SAASjB,MAAMC,SAAUK;EAC7B,CAAA;EAEA,IAAIyC,QAAQ;EACZ,KAAK,MAAMhD,WAAW8C,UAAU;GAC5B,IAAIL,oBAAoBzC,QAAQK,OAAOoC,kBACnC;GAEJ,MAAM,KAAK5C,WAAWmC,OAAOhC,OAAAA;GAC7BgD,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;CAEA,MAAgBT,kBACZtC,OACAQ,OACgC;EAEhC,MAAMR,MAAMU,oBAAoBC,YAAY,EAAEC,MAAMpB,eAAeqC,eAAe,CAAA;EAElF,MAAMgB,WAAW,MAAM,KAAKjD,WAAWoD,eAAexC,KAAAA;EAEtD,IAAIuC,QAAQ;EACZ,KAAK,MAAMhD,WAAW8C,UAAU;GAK5B,IAAI,CAAC,KAAK/C,UAAUC,SAASC,KAAAA,GACzB,IAAI;IACA,MAAMA,MAAMU,oBAAoBa,SAAS;KACrCX,MAAMpB,eAAeqC;KACrB1B,MAAMhB,iBAAiB;OAClBD,kBAAkBsC,aAAazB;MAChC,GAAG,KAAK0B,mBAAmB1B,OAAAA;KAC/B,CAAA;IACJ,CAAA;GACJ,QAAQ;IACJ;GACJ;GAGJ,MAAM,KAAKH,WAAWmC,OAAOhC,OAAAA;GAC7BgD,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","AuthupError","EntityNotFoundError","ErrorCode","isObject","createURLCodec","and","eq","inArray","isFilter","isFilters","or","PermissionName","AbstractEntityService","SESSION_FILTER_KEYS","appendQueryConditions","decodeQuery","sessionSchema","SessionService","repository","ctx","isOwnedBy","session","actor","identity","sub","data","id","subKind","type","getMany","query","parsed","schema","canReadAll","permissionEvaluator","preEvaluate","name","SESSION_READ","e","findMany","owner","compiled","compile","verdict","ownership","scoped","condition","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","delete","SESSION_DELETE","entityId","remove","deleteMany","options","code","IDENTITY_UNAUTHORIZED","message","hasTargetFilter","deleteManyByQuery","deleteManyForSelf","currentSessionId","queryCodec","decode","hasTargetCondition","filters","value","some","child","includes","field","sessions","findAllByOwner","count","findAllByQuery","parameters"],"sources":["../../../../src/core/entities/session/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { AuthupError, EntityNotFoundError, ErrorCode } from '@authup/errors';\nimport { isObject } from '@authup/kit';\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type { ICondition } from '@rapiq/core';\nimport {\n and, \n eq, \n inArray, \n isFilter, \n isFilters, \n or,\n} from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Session } from '@authup/core-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { ISessionRepository } from '../../authentication/index.ts';\nimport { SESSION_FILTER_KEYS } from '../../authentication/index.ts';\nimport type { ISessionService, SessionDeleteManyOptions, SessionDeleteManyResult } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { sessionSchema } from './schema.ts';\n\nexport type SessionServiceContext = {\n repository: ISessionRepository,\n};\n\nexport class SessionService extends AbstractEntityService implements ISessionService {\n protected repository: ISessionRepository;\n\n constructor(ctx: SessionServiceContext) {\n super();\n this.repository = ctx.repository;\n }\n\n protected isOwnedBy(session: Session, actor: ActorContext): boolean {\n return !!actor.identity &&\n session.sub === actor.identity.data.id &&\n session.subKind === actor.identity.type;\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Session>> {\n const parsed = await decodeQuery(query, { schema: sessionSchema, actor });\n\n let canReadAll = true;\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n } catch (e) {\n if (!actor.identity) {\n throw e;\n }\n canReadAll = false;\n }\n\n if (!canReadAll) {\n // self-service: only the actor's own sessions\n return this.repository.findMany(parsed, {\n owner: {\n sub: actor.identity!.data.id,\n subKind: actor.identity!.type,\n },\n });\n }\n\n // Compile SESSION_READ into a row condition (#3286 phase 3). Own sessions\n // are always readable, so ownership composes as an OR-alternative — the\n // whole gate runs as WHERE and pagination/totals stay exact. Only a\n // non-expressible policy falls back to the per-row loop below.\n const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.SESSION_READ });\n if (compiled.verdict !== 'post') {\n const ownership = actor.identity ?\n and(eq('sub', actor.identity.data.id), eq('subKind', actor.identity.type)) :\n null;\n\n let scoped = parsed;\n if (compiled.verdict === 'deny') {\n scoped = appendQueryConditions(parsed, ownership ?? inArray('id', []));\n } else if (compiled.verdict === 'conditional') {\n scoped = appendQueryConditions(\n parsed,\n ownership ? or(ownership, compiled.condition) : compiled.condition,\n );\n }\n\n return this.repository.findMany(scoped);\n }\n\n const { data: entities, meta } = await this.repository.findMany(parsed);\n\n const data: Session[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n if (this.isOwnedBy(entity, actor)) {\n data.push(entity);\n continue;\n }\n\n try {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_READ,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total,\n },\n };\n }\n\n async getOne(id: string, actor: ActorContext): Promise<Session> {\n const entity = await this.repository.findOneById(id);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (!this.isOwnedBy(entity, actor)) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_READ,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n }\n\n return entity;\n }\n\n async delete(id: string, actor: ActorContext): Promise<Session> {\n const entity = await this.repository.findOneById(id);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (!this.isOwnedBy(entity, actor)) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n }\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n\n async deleteMany(\n actor: ActorContext,\n options: SessionDeleteManyOptions = {},\n ): Promise<SessionDeleteManyResult> {\n if (!actor.identity) {\n throw new AuthupError({ code: ErrorCode.IDENTITY_UNAUTHORIZED, message: 'Authentication required.' });\n }\n\n if (this.hasTargetFilter(options.query)) {\n return this.deleteManyByQuery(actor, options.query!);\n }\n\n return this.deleteManyForSelf(actor, options.currentSessionId);\n }\n\n /\n True when the query carries at least one recognized target filter — the\n * discriminator between the admin bulk-revoke path and self-service. An\n * unrecognized / empty filter falls through to self-service (fail-safe: a\n * typo can never trigger an unconstrained mass delete).\n \n The wire may carry either dialect (v2 expression or legacy bracket\n * filters), so the decision decodes to the rapiq IR and inspects the\n * condition tree instead of poking at the raw payload.\n /\n protected hasTargetFilter(query?: Record<string, any>): boolean {\n if (!isObject(query)) {\n return false;\n }\n\n let parsed;\n try {\n parsed = SessionService.queryCodec.decode(query);\n } catch {\n // unreadable filter — fail-safe to self-service\n return false;\n }\n\n if (!parsed) {\n return false;\n }\n\n return this.hasTargetCondition(parsed.filters);\n }\n\n protected hasTargetCondition(condition: ICondition): boolean {\n if (isFilters(condition)) {\n return condition.value.some((child) => this.hasTargetCondition(child));\n }\n\n if (isFilter(condition)) {\n return (SESSION_FILTER_KEYS as readonly string[]).includes(condition.field) &&\n condition.value !== '';\n }\n\n return false;\n }\n\n /\n Schemaless decode — dialect detection only. The allow-list is\n * enforced downstream by the repository's schema-bound decode.\n */\n protected static queryCodec = createURLCodec();\n\n protected async deleteManyForSelf(\n actor: ActorContext,\n currentSessionId?: string,\n ): Promise<SessionDeleteManyResult> {\n const sessions = await this.repository.findAllByOwner({\n sub: actor.identity!.data.id,\n subKind: actor.identity!.type,\n });\n\n let count = 0;\n for (const session of sessions) {\n if (currentSessionId && session.id === currentSessionId) {\n continue;\n }\n await this.repository.remove(session);\n count += 1;\n }\n\n return { count };\n }\n\n protected async deleteManyByQuery(\n actor: ActorContext,\n query: Record<string, any>,\n ): Promise<SessionDeleteManyResult> {\n // Gate: an actor without SESSION_DELETE cannot force-logout anyone → 403.\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n\n const sessions = await this.repository.findAllByQuery(\n await decodeQuery(query, {\n schema: sessionSchema, \n parameters: ['filters'], \n actor, \n }),\n );\n\n let count = 0;\n for (const session of sessions) {\n // Own sessions are always deletable by the actor (mirrors getMany).\n // Otherwise per-session realm-match: a realm_admin only reaches\n // sessions in its realm — cross-realm rows are skipped, not failed,\n // so filter breadth cannot escalate beyond the actor's reach.\n if (!this.isOwnedBy(session, actor)) {\n try {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: session,\n ...this.resourceRealmMatch(session),\n }),\n });\n } catch {\n continue;\n }\n }\n\n await this.repository.remove(session);\n count += 1;\n }\n\n return { count };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkCA,IAAamB,iBAAb,MAAaA,uBAAuBL,sBAAAA;CACtBM;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,YAAYL,MAAMC,SAASK;CAC3C;CAEA,MAAMC,QACFC,OACAR,OACgD;EAChD,MAAMS,SAAS,MAAMhB,YAAYe,OAAO;GAAEE,QAAQhB;GAAeM;EAAM,CAAA;EAEvE,IAAIW,aAAa;EACjB,IAAI;GACA,MAAMX,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe0B,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAAChB,MAAMC,UACP,MAAMe;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKf,WAAWqB,SAASR,QAAQ,EACpCS,OAAO;GACHhB,KAAKF,MAAMC,SAAUE,KAAKC;GAC1BC,SAASL,MAAMC,SAAUK;EAC7B,EACJ,CAAA;EAOJ,MAAMa,WAAW,MAAMnB,MAAMY,oBAAoBQ,QAAQ,EAAEN,MAAMzB,eAAe0B,aAAa,CAAA;EAC7F,IAAII,SAASE,YAAY,QAAQ;GAC7B,MAAMC,YAAYtB,MAAMC,WACpBlB,IAAIC,GAAG,OAAOgB,MAAMC,SAASE,KAAKC,EAAE,GAAGpB,GAAG,WAAWgB,MAAMC,SAASK,IAAI,CAAA,IACxE;GAEJ,IAAIiB,SAASd;GACb,IAAIU,SAASE,YAAY,QACrBE,SAAS/B,sBAAsBiB,QAAQa,aAAarC,QAAQ,MAAM,CAAA,CAAE,CAAA;QACjE,IAAIkC,SAASE,YAAY,eAC5BE,SAAS/B,sBACLiB,QACAa,YAAYlC,GAAGkC,WAAWH,SAASK,SAAS,IAAIL,SAASK,SAAS;GAI1E,OAAO,KAAK5B,WAAWqB,SAASM,MAAAA;EACpC;EAEA,MAAM,EAAEpB,MAAMsB,UAAUC,SAAS,MAAM,KAAK9B,WAAWqB,SAASR,MAAAA;EAEhE,MAAMN,OAAkB,CAAA;EACxB,IAAI,EAAEwB,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAK3B,UAAU8B,QAAQ5B,KAAAA,GAAQ;IAC/BG,KAAK0B,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAM5B,MAAMY,oBAAoBkB,SAAS;KACrChB,MAAMzB,eAAe0B;KACrBZ,MAAM1B,iBAAiB;OAClBD,kBAAkBuD,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAzB,KAAK0B,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHxB;GACAuB,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAO7B,IAAYJ,OAAuC;EAC5D,MAAM4B,SAAS,MAAM,KAAKhC,WAAWsC,YAAY9B,EAAAA;EACjD,IAAI,CAACwB,QACD,MAAM,IAAIjD,oBAAAA;EAGd,IAAI,CAAC,KAAKmB,UAAU8B,QAAQ5B,KAAAA,GAAQ;GAChC,MAAMA,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe0B,aAAa,CAAA;GAChF,MAAMf,MAAMY,oBAAoBkB,SAAS;IACrChB,MAAMzB,eAAe0B;IACrBZ,MAAM1B,iBAAiB;MAClBD,kBAAkBuD,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMO,OAAO/B,IAAYJ,OAAuC;EAC5D,MAAM4B,SAAS,MAAM,KAAKhC,WAAWsC,YAAY9B,EAAAA;EACjD,IAAI,CAACwB,QACD,MAAM,IAAIjD,oBAAAA;EAGd,IAAI,CAAC,KAAKmB,UAAU8B,QAAQ5B,KAAAA,GAAQ;GAChC,MAAMA,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe+C,eAAe,CAAA;GAClF,MAAMpC,MAAMY,oBAAoBkB,SAAS;IACrChB,MAAMzB,eAAe+C;IACrBjC,MAAM1B,iBAAiB;MAClBD,kBAAkBuD,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAExB,IAAIiC,aAAaT;EACzB,MAAM,KAAKhC,WAAW0C,OAAOV,MAAAA;EAC7BA,OAAOxB,KAAKiC;EAEZ,OAAOT;CACX;CAEA,MAAMW,WACFvC,OACAwC,UAAoC,CAAC,GACL;EAChC,IAAI,CAACxC,MAAMC,UACP,MAAM,IAAIvB,YAAY;GAAE+D,MAAM7D,UAAU8D;GAAuBC,SAAS;EAA2B,CAAA;EAGvG,IAAI,KAAKC,gBAAgBJ,QAAQhC,KAAK,GAClC,OAAO,KAAKqC,kBAAkB7C,OAAOwC,QAAQhC,KAAK;EAGtD,OAAO,KAAKsC,kBAAkB9C,OAAOwC,QAAQO,gBAAgB;CACjE;;;;;;;;;;IAYA,gBAA0BvC,OAAsC;EAC5D,IAAI,CAAC3B,SAAS2B,KAAAA,GACV,OAAO;EAGX,IAAIC;EACJ,IAAI;GACAA,SAASd,eAAeqD,WAAWC,OAAOzC,KAAAA;EAC9C,QAAQ;GAEJ,OAAO;EACX;EAEA,IAAI,CAACC,QACD,OAAO;EAGX,OAAO,KAAKyC,mBAAmBzC,OAAO0C,OAAO;CACjD;CAEUD,mBAAmB1B,WAAgC;EACzD,IAAIrC,UAAUqC,SAAAA,GACV,OAAOA,UAAU4B,MAAMC,MAAMC,UAAU,KAAKJ,mBAAmBI,KAAAA,CAAAA;EAGnE,IAAIpE,SAASsC,SAAAA,GACT,OAAO,oBAA2C+B,SAAS/B,UAAUgC,KAAK,KACtEhC,UAAU4B,UAAU;EAG5B,OAAO;CACX;;;;IAMA,OAAiBJ,aAAalE,eAAAA;CAE9B,MAAgBgE,kBACZ9C,OACA+C,kBACgC;EAChC,MAAMU,WAAW,MAAM,KAAK7D,WAAW8D,eAAe;GAClDxD,KAAKF,MAAMC,SAAUE,KAAKC;GAC1BC,SAASL,MAAMC,SAAUK;EAC7B,CAAA;EAEA,IAAIqD,QAAQ;EACZ,KAAK,MAAM5D,WAAW0D,UAAU;GAC5B,IAAIV,oBAAoBhD,QAAQK,OAAO2C,kBACnC;GAEJ,MAAM,KAAKnD,WAAW0C,OAAOvC,OAAAA;GAC7B4D,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;CAEA,MAAgBd,kBACZ7C,OACAQ,OACgC;EAEhC,MAAMR,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe+C,eAAe,CAAA;EAElF,MAAMqB,WAAW,MAAM,KAAK7D,WAAWgE,eACnC,MAAMnE,YAAYe,OAAO;GACrBE,QAAQhB;GACRmE,YAAY,CAAC,SAAA;GACb7D;EACJ,CAAA,CAAA;EAGJ,IAAI2D,QAAQ;EACZ,KAAK,MAAM5D,WAAW0D,UAAU;GAK5B,IAAI,CAAC,KAAK3D,UAAUC,SAASC,KAAAA,GACzB,IAAI;IACA,MAAMA,MAAMY,oBAAoBkB,SAAS;KACrChB,MAAMzB,eAAe+C;KACrBjC,MAAM1B,iBAAiB;OAClBD,kBAAkBuD,aAAahC;MAChC,GAAG,KAAKiC,mBAAmBjC,OAAAA;KAC/B,CAAA;IACJ,CAAA;GACJ,QAAQ;IACJ;GACJ;GAGJ,MAAM,KAAKH,WAAW0C,OAAOvC,OAAAA;GAC7B4D,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;AACJ"}

package/dist/core/entities/session/types.d.ts CHANGED Viewed

@@ -6,7 +6,7 @@ export type SessionDeleteManyResult = {
 export type SessionDeleteManyOptions = {
     /**
      * The parsed request query. When it carries a recognized target filter
-     * (`SESSION_FILTER_KEYS`, e.g. `filter[user_id]`) the call is an admin
+     * (`SESSION_FILTER_KEYS`, e.g. `filter[userId]`) the call is an admin
      * bulk revoke; otherwise it is the self-service path.
      */
     query?: Record<string, any>;
@@ -38,7 +38,7 @@ export interface ISessionService {
      *   the actor except the current one ("log out my other devices"). No
      *   permission required.
      * - **A recognized target filter** (`SESSION_FILTER_KEYS`, e.g.
-     *   `filter[user_id]`, `filter[realm_id]`) → admin "force-logout": revoke
+     *   `filter[userId]`, `filter[realmId]`) → admin "force-logout": revoke
      *   every matching session. Requires `SESSION_DELETE`, and each session is
      *   additionally realm-matched (drop-unauthorized), so a `realm_admin` only
      *   revokes sessions in its reach and filter breadth cannot escalate.

package/dist/core/entities/trust-anchor/index.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/trust-anchor/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/trust-anchor/index.mjs CHANGED Viewed

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { trustAnchorSchema } from "./schema.mjs";
 import { TrustAnchorService } from "./service.mjs";
-export { TrustAnchorService };
+export { TrustAnchorService, trustAnchorSchema };

package/dist/core/entities/trust-anchor/schema.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+import type { TrustAnchor } from '@authup/core-kit';
+export declare const trustAnchorSchema: import("@rapiq/core").Schema<TrustAnchor, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/trust-anchor/schema.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,eAAO,MAAM,iBAAiB,gDAkB5B,CAAC"}

package/dist/core/entities/trust-anchor/schema.mjs ADDED Viewed

@@ -0,0 +1,43 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/trust-anchor/schema.ts
+const schemaMapping = { realm: EntityType.REALM };
+const trustAnchorSchema = defineSchema({
+	name: EntityType.TRUST_ANCHOR,
+	fields: { allowed: [
+		"id",
+		"name",
+		"certificate",
+		"enabled",
+		"realmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: [
+		"id",
+		"name",
+		"enabled",
+		"realmId"
+	] },
+	relations: {
+		allowed: ["realm"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"id",
+		"name",
+		"enabled",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { trustAnchorSchema };
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/trust-anchor/schema.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","trustAnchorSchema","name","TRUST_ANCHOR","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/trust-anchor/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const trustAnchorSchema = defineSchema<TrustAnchor>({\n name: EntityType.TRUST_ANCHOR,\n fields: {\n allowed: [\n 'id',\n 'name',\n 'certificate',\n 'enabled',\n 'realmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['id', 'name', 'enabled', 'realmId'] },\n relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'name', 'enabled', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,oBAAoBN,aAA0B;CACvDO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;EAAW;GAAW;CACzDE,WAAW;EAAEF,SAAS,CAAC,OAAA;EAAUG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAW;EAAa;GAAa;CACrEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}

package/dist/core/entities/trust-anchor/service.d.ts CHANGED Viewed

@@ -3,7 +3,7 @@ import { EventName, TrustAnchorValidator } from '@authup/core-kit';
 import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
 import { AbstractEntityService } from '@authup/server-kit';
 import type { EventRequestContext, IEventService } from '../event/index.ts';
-import type { ITrustAnchorRepository, ITrustAnchorService } from './types.ts';
+import type { ITrustAnchorRepository, ITrustAnchorService, TrustAnchorServiceReadOptions } from './types.ts';
 export type TrustAnchorServiceContext = {
     repository: ITrustAnchorRepository;
     eventService?: IEventService;
@@ -15,7 +15,7 @@ export declare class TrustAnchorService extends AbstractEntityService implements
     protected eventService?: IEventService;
     protected requestContext?: () => EventRequestContext | undefined;
     constructor(ctx: TrustAnchorServiceContext);
-    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<TrustAnchor>>;
+    getMany(query: Record<string, any>, actor: ActorContext, options?: TrustAnchorServiceReadOptions): Promise<EntityRepositoryFindManyResult<TrustAnchor>>;
     getOne(idOrName: string, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;
     create(data: Record<string, any>, actor: ActorContext): Promise<TrustAnchor>;
     update(idOrName: string, data: Record<string, any>, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;

package/dist/core/entities/trust-anchor/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/service.ts"],"names":[],"mappings":"~~AAQA~~,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAEH,SAAS,EAGT,oBAAoB,EACvB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,KAAK,~~EAAE~~,sBAAsB,~~EAAE~~,mBAAmB,~~EAAE~~,MAAM,YAAY,CAAC;~~AAE9E~~,MAAM,MAAM,yBAAyB,GAAG;IACpC,UAAU,EAAE,sBAAsB,CAAC;IACnC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;CAC1D,CAAC;AAQF,qBAAa,kBAAmB,SAAQ,qBAAsB,YAAW,mBAAmB;IACxF,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;IAE1C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;gBAErD,GAAG,EAAE,yBAAyB;IAQpC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,~~GACpB~~,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;~~IAgCjD~~,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAmBjB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IA6CjB,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAuCjB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IA2BvB;;;;;;OAMG;cACa,WAAW,CACvB,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,YAAY,EACnB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IA0BhB,SAAS,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;CAMtE"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAEH,SAAS,EAGT,oBAAoB,EACvB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,KAAK,EACR,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAChC,MAAM,YAAY,CAAC;AAIpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,UAAU,EAAE,sBAAsB,CAAC;IACnC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;CAC1D,CAAC;AAQF,qBAAa,kBAAmB,SAAQ,qBAAsB,YAAW,mBAAmB;IACxF,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;IAE1C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;gBAErD,GAAG,EAAE,yBAAyB;IAQpC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,6BAAkC,GAC5C,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAqDjD,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAmBjB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IA6CjB,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAuCjB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC;IA2BvB;;;;;;OAMG;cACa,WAAW,CACvB,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,YAAY,EACnB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IA0BhB,SAAS,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;CAMtE"}

package/dist/core/entities/trust-anchor/service.mjs CHANGED Viewed

@@ -1,6 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { trustAnchorSchema } from "./schema.mjs";
+import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { buildEntityDiff } from "../event/diff.mjs";
 import "../event/index.mjs";
 import { parseCertificateChain } from "../../key/certificate.mjs";
@@ -10,6 +13,7 @@ import { EntityType, EventName, EventScope, PermissionName, TrustAnchorValidator
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { EntityNotFoundError, ValidationError } from "@authup/errors";
+import { eq, inArray } from "@rapiq/core";
 //#region src/core/entities/trust-anchor/service.ts
 const PERMISSION_NAMES = [
 	PermissionName.KEY_READ,
@@ -28,9 +32,21 @@ var TrustAnchorService = class extends AbstractEntityService {
 		this.eventService = ctx.eventService;
 		this.requestContext = ctx.requestContext;
 	}
-	async getMany(query, actor) {
+	async getMany(query, actor, options = {}) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });
-		const { data: entities, meta } = await this.repository.findMany(query);
+		let parsed = await decodeQuery(query, {
+			schema: trustAnchorSchema,
+			actor
+		});
+		if (options.realmId) parsed = appendQueryConditions(parsed, eq("realmId", options.realmId));
+		const compiled = await actor.permissionEvaluator.compile({ name: PERMISSION_NAMES });
+		if (compiled.verdict === "deny") parsed = appendQueryConditions(parsed, inArray("id", []));
+		else if (compiled.verdict === "conditional") parsed = appendQueryConditions(parsed, compiled.condition);
+		const { data: entities, meta } = await this.repository.findMany(parsed);
+		if (compiled.verdict !== "post") return {
+			data: entities,
+			meta
+		};
 		const data = [];
 		let { total } = meta;
 		for (const entity of entities) try {
@@ -69,11 +85,11 @@ var TrustAnchorService = class extends AbstractEntityService {
 	async create(data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });
 		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
-		if (!validated.realm_id && actor.identity) {
+		if (!validated.realmId && actor.identity) {
 			const actorRealmId = this.getActorRealmId(actor);
-			if (actorRealmId) validated.realm_id = actorRealmId;
+			if (actorRealmId) validated.realmId = actorRealmId;
 		}
-		if (!validated.realm_id) throw new ValidationError("A realm must be specified.");
+		if (!validated.realmId) throw new ValidationError("A realm must be specified.");
 		await this.repository.validateJoinColumns(validated);
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.KEY_CREATE,
@@ -108,7 +124,7 @@ var TrustAnchorService = class extends AbstractEntityService {
 		});
 		if (validated.name && validated.name !== entity.name) await this.repository.checkUniqueness({
 			name: validated.name,
-			realm_id: entity.realm_id
+			realmId: entity.realmId
 		}, entity);
 		const previous = this.pickAuditFields(entity);
 		entity = this.repository.merge(entity, validated);
@@ -147,7 +163,7 @@ var TrustAnchorService = class extends AbstractEntityService {
 			name,
 			refType: EntityType.TRUST_ANCHOR,
 			refId: entity.id,
-			realmId: entity.realm_id ?? null,
+			realmId: entity.realmId ?? null,
 			actorType: actor.identity?.type ?? null,
 			actorId: actor.identity?.data.id ?? null,
 			actorName: actor.identity?.data.name ?? null,

package/dist/core/entities/trust-anchor/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityType","EventName","EventScope","PermissionName","TrustAnchorValidator","EntityNotFoundError","ValidationError","ValidatorGroup","AbstractEntityService","buildEntityDiff","parseCertificateChain","PERMISSION_NAMES","KEY_READ","KEY_UPDATE","KEY_DELETE","TrustAnchorService","repository","validator","eventService","requestContext","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","data","entities","meta","findMany","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","realmId","findOneByIdOrName","create","preEvaluate","KEY_CREATE","validated","run","group","CREATE","realm_id","identity","actorRealmId","getActorRealmId","validateJoinColumns","evaluate","checkUniqueness","chain","certificate","ca","enabled","save","recordEvent","CREATED","update","UPDATE","previous","pickAuditFields","merge","diff","UPDATED","Object","keys","length","delete","id","findOneBy","entityId","remove","DELETED","undefined","record","scope","ENTITY","refType","TRUST_ANCHOR","refId","actorType","type","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent"],"sources":["../../../../src/core/entities/trust-anchor/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport {\n EntityType,\n EventName,\n EventScope,\n PermissionName,\n TrustAnchorValidator,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { buildEntityDiff } from '../event/index.ts';\nimport type { EventRequestContext, IEventService } from '../event/index.ts';\nimport { parseCertificateChain } from '../../key/index.ts';\nimport type { ITrustAnchorRepository, ITrustAnchorService } from './types.ts';\n\nexport type TrustAnchorServiceContext = {\n repository: ITrustAnchorRepository,\n eventService?: IEventService,\n requestContext?: () => EventRequestContext \| undefined,\n};\n\nconst PERMISSION_NAMES = [\n PermissionName.KEY_READ,\n PermissionName.KEY_UPDATE,\n PermissionName.KEY_DELETE,\n];\n\nexport class TrustAnchorService extends AbstractEntityService implements ITrustAnchorService {\n protected repository: ITrustAnchorRepository;\n\n protected validator: TrustAnchorValidator;\n\n protected eventService?: IEventService;\n\n protected requestContext?: () => EventRequestContext \| undefined;\n\n constructor(ctx: TrustAnchorServiceContext) {\n super();\n this.repository = ctx.repository;\n this.validator = new TrustAnchorValidator();\n this.eventService = ctx.eventService;\n this.requestContext = ctx.requestContext;\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<TrustAnchor>> {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n const { data: entities, meta } = await this.repository.findMany(query);\n\n const data: TrustAnchor[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: PERMISSION_NAMES,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total,\n },\n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n realmId?: string,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n const entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluateOneOf({\n name: PERMISSION_NAMES,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n if (!validated.realm_id && actor.identity) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n if (!validated.realm_id) {\n throw new ValidationError('A realm must be specified.');\n }\n\n await this.repository.validateJoinColumns(validated);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.KEY_CREATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: validated,\n ...this.resourceRealmMatch(validated),\n }),\n });\n\n await this.repository.checkUniqueness(validated);\n\n const chain = parseCertificateChain(validated.certificate as string);\n if (!chain[0] \|\| !chain[0].ca) {\n throw new ValidationError('A trust anchor must contain a CA certificate.');\n }\n\n if (typeof validated.enabled !== 'boolean') {\n validated.enabled = true;\n }\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n await this.recordEvent(EventName.CREATED, entity, actor);\n\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realmId?: string,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });\n\n let entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.KEY_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n if (validated.name && validated.name !== entity.name) {\n await this.repository.checkUniqueness({\n name: validated.name,\n realm_id: entity.realm_id,\n }, entity);\n }\n\n const previous = this.pickAuditFields(entity);\n\n entity = this.repository.merge(entity, validated);\n entity = await this.repository.save(entity);\n\n const diff = buildEntityDiff(this.pickAuditFields(entity), previous);\n await this.recordEvent(EventName.UPDATED, entity, actor, { ...(Object.keys(diff).length > 0 ? { diff } : {}) });\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.KEY_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n await this.recordEvent(EventName.DELETED, entity, actor);\n\n return entity;\n }\n\n // ------------------------------------------------------------------\n\n /\n Metadata-only audit trail for trust-anchor lifecycle operations\n * (issue #3269) — trust anchors have no entity subscriber, so the\n * security-relevant mutations (an enabled CA anchor turns on mTLS client\n * auth for a realm) are recorded explicitly. The payload never carries\n * certificate bytes.\n */\n protected async recordEvent(\n name: `${EventName}`,\n entity: TrustAnchor,\n actor: ActorContext,\n data: Record<string, any> = {},\n ): Promise<void> {\n const requestContext = this.requestContext ?\n this.requestContext() :\n undefined;\n\n await this.eventService?.record({\n scope: EventScope.ENTITY,\n name,\n refType: EntityType.TRUST_ANCHOR,\n refId: entity.id,\n realmId: entity.realm_id ?? null,\n actorType: actor.identity?.type ?? null,\n actorId: actor.identity?.data.id ?? null,\n actorName: actor.identity?.data.name ?? null,\n requestPath: requestContext?.requestPath ?? null,\n requestMethod: requestContext?.requestMethod ?? null,\n requestIpAddress: requestContext?.requestIpAddress ?? null,\n requestUserAgent: requestContext?.requestUserAgent ?? null,\n data: {\n name: entity.name,\n enabled: entity.enabled,\n ...data,\n },\n });\n }\n\n protected pickAuditFields(entity: TrustAnchor): Record<string, any> {\n return {\n name: entity.name,\n enabled: entity.enabled,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;AA+BA,MAAMa,mBAAmB;CACrBR,eAAeS;CACfT,eAAeU;CACfV,eAAeW;;AAGnB,IAAaC,qBAAb,cAAwCP,sBAAAA;CAC1BQ;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,YAAY,IAAIb,qBAAAA;EACrB,KAAKc,eAAeE,IAAIF;EACxB,KAAKC,iBAAiBC,IAAID;CAC9B;CAEA,MAAME,QACFC,OACAC,OACoD;EACpD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMf,iBAAiB,CAAA;EAE1E,MAAM,EAAEgB,MAAMC,UAAUC,SAAS,MAAM,KAAKb,WAAWc,SAASR,KAAAA;EAEhE,MAAMK,OAAsB,CAAA;EAC5B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UACjB,IAAI;GACA,MAAML,MAAMC,oBAAoBS,cAAc;IAC1CP,MAAMf;IACNgB,MAAM5B,iBAAiB;MAClBD,kBAAkBoC,aAAaF;KAChC,GAAG,KAAKG,mBAAmBH,MAAAA;IAC/B,CAAA;GACJ,CAAA;GACAL,KAAKS,KAAKJ,MAAAA;EACd,QAAQ;GACJD,SAAS;EACb;EAGJ,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,UACAf,OACAgB,SACoB;EACpB,MAAMhB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMf,iBAAiB,CAAA;EAE1E,MAAMqB,SAAS,MAAM,KAAKhB,WAAWwB,kBAAkBF,UAAUC,OAAAA;EACjE,IAAI,CAACP,QACD,MAAM,IAAI3B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBS,cAAc;GAC1CP,MAAMf;GACNgB,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMS,OACFd,MACAJ,OACoB;EACpB,MAAMA,MAAMC,oBAAoBkB,YAAY,EAAEhB,MAAMvB,eAAewC,WAAW,CAAA;EAE9E,MAAMC,YAAY,MAAM,KAAK3B,UAAU4B,IAAIlB,MAAM,EAAEmB,OAAOvC,eAAewC,OAAO,CAAA;EAEhF,IAAI,CAACH,UAAUI,YAAYzB,MAAM0B,UAAU;GACvC,MAAMC,eAAe,KAAKC,gBAAgB5B,KAAAA;GAC1C,IAAI2B,cACAN,UAAUI,WAAWE;EAE7B;EAEA,IAAI,CAACN,UAAUI,UACX,MAAM,IAAI1C,gBAAgB,4BAAA;EAG9B,MAAM,KAAKU,WAAWoC,oBAAoBR,SAAAA;EAE1C,MAAMrB,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMvB,eAAewC;GACrBhB,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAaU;IAChC,GAAG,KAAKT,mBAAmBS,SAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAK5B,WAAWsC,gBAAgBV,SAAAA;EAEtC,MAAMW,QAAQ7C,sBAAsBkC,UAAUY,WAAW;EACzD,IAAI,CAACD,MAAM,MAAM,CAACA,MAAM,EAAE,CAACE,IACvB,MAAM,IAAInD,gBAAgB,+CAAA;EAG9B,IAAI,OAAOsC,UAAUc,YAAY,WAC7Bd,UAAUc,UAAU;EAGxB,IAAI1B,SAAS,KAAKhB,WAAWyB,OAAOG,SAAAA;EACpCZ,SAAS,MAAM,KAAKhB,WAAW2C,KAAK3B,MAAAA;EAEpC,MAAM,KAAK4B,YAAY3D,UAAU4D,SAAS7B,QAAQT,KAAAA;EAElD,OAAOS;CACX;CAEA,MAAM8B,OACFxB,UACAX,MACAJ,OACAgB,SACoB;EACpB,MAAMhB,MAAMC,oBAAoBkB,YAAY,EAAEhB,MAAMvB,eAAeU,WAAW,CAAA;EAE9E,IAAImB,SAAS,MAAM,KAAKhB,WAAWwB,kBAAkBF,UAAUC,OAAAA;EAC/D,IAAI,CAACP,QACD,MAAM,IAAI3B,oBAAAA;EAGd,MAAMuC,YAAY,MAAM,KAAK3B,UAAU4B,IAAIlB,MAAM,EAAEmB,OAAOvC,eAAewD,OAAO,CAAA;EAEhF,MAAMxC,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMvB,eAAeU;GACrBc,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAa;KAC5B,GAAGF;KACH,GAAGY;IACP;IACA,GAAG,KAAKT,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIY,UAAUlB,QAAQkB,UAAUlB,SAASM,OAAON,MAC5C,MAAM,KAAKV,WAAWsC,gBAAgB;GAClC5B,MAAMkB,UAAUlB;GAChBsB,UAAUhB,OAAOgB;EACrB,GAAGhB,MAAAA;EAGP,MAAMgC,WAAW,KAAKC,gBAAgBjC,MAAAA;EAEtCA,SAAS,KAAKhB,WAAWkD,MAAMlC,QAAQY,SAAAA;EACvCZ,SAAS,MAAM,KAAKhB,WAAW2C,KAAK3B,MAAAA;EAEpC,MAAMmC,OAAO1D,gBAAgB,KAAKwD,gBAAgBjC,MAAAA,GAASgC,QAAAA;EAC3D,MAAM,KAAKJ,YAAY3D,UAAUmE,SAASpC,QAAQT,OAAO,EAAE,GAAI8C,OAAOC,KAAKH,IAAAA,CAAAA,CAAMI,SAAS,IAAI,EAAEJ,KAAK,IAAI,CAAC,EAAG,CAAA;EAE7G,OAAOnC;CACX;CAEA,MAAMwC,OACFC,IACAlD,OACoB;EACpB,MAAMA,MAAMC,oBAAoBkB,YAAY,EAAEhB,MAAMvB,eAAeW,WAAW,CAAA;EAE9E,MAAMkB,SAAS,MAAM,KAAKhB,WAAW0D,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACzC,QACD,MAAM,IAAI3B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMvB,eAAeW;GACrBa,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,EAAEyC,IAAIE,aAAa3C;EACzB,MAAM,KAAKhB,WAAW4D,OAAO5C,MAAAA;EAC7BA,OAAOyC,KAAKE;EAEZ,MAAM,KAAKf,YAAY3D,UAAU4E,SAAS7C,QAAQT,KAAAA;EAElD,OAAOS;CACX;;;;;;;IAWA,MAAgB4B,YACZlC,MACAM,QACAT,OACAI,OAA4B,CAAC,GAChB;EACb,MAAMR,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnB2D,KAAAA;EAEJ,MAAM,KAAK5D,cAAc6D,OAAO;GAC5BC,OAAO9E,WAAW+E;GAClBvD;GACAwD,SAASlF,WAAWmF;GACpBC,OAAOpD,OAAOyC;GACdlC,SAASP,OAAOgB,YAAY;GAC5BqC,WAAW9D,MAAM0B,UAAUqC,QAAQ;GACnCC,SAAShE,MAAM0B,UAAUtB,KAAK8C,MAAM;GACpCe,WAAWjE,MAAM0B,UAAUtB,KAAKD,QAAQ;GACxC+D,aAAatE,gBAAgBsE,eAAe;GAC5CC,eAAevE,gBAAgBuE,iBAAiB;GAChDC,kBAAkBxE,gBAAgBwE,oBAAoB;GACtDC,kBAAkBzE,gBAAgByE,oBAAoB;GACtDjE,MAAM;IACFD,MAAMM,OAAON;IACbgC,SAAS1B,OAAO0B;IAChB,GAAG/B;GACP;EACJ,CAAA;CACJ;CAEUsC,gBAAgBjC,QAA0C;EAChE,OAAO;GACHN,MAAMM,OAAON;GACbgC,SAAS1B,OAAO0B;EACpB;CACJ;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","eq","inArray","EntityType","EventName","EventScope","PermissionName","TrustAnchorValidator","EntityNotFoundError","ValidationError","ValidatorGroup","AbstractEntityService","buildEntityDiff","parseCertificateChain","appendQueryConditions","decodeQuery","trustAnchorSchema","PERMISSION_NAMES","KEY_READ","KEY_UPDATE","KEY_DELETE","TrustAnchorService","repository","validator","eventService","requestContext","ctx","getMany","query","actor","options","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","realmId","compiled","compile","verdict","condition","data","entities","meta","findMany","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","findOneByIdOrName","create","preEvaluate","KEY_CREATE","validated","run","group","CREATE","identity","actorRealmId","getActorRealmId","validateJoinColumns","evaluate","checkUniqueness","chain","certificate","ca","enabled","save","recordEvent","CREATED","update","UPDATE","previous","pickAuditFields","merge","diff","UPDATED","Object","keys","length","delete","id","findOneBy","entityId","remove","DELETED","undefined","record","scope","ENTITY","refType","TRUST_ANCHOR","refId","actorType","type","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent"],"sources":["../../../../src/core/entities/trust-anchor/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { eq, inArray } from '@rapiq/core';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport {\n EntityType,\n EventName,\n EventScope,\n PermissionName,\n TrustAnchorValidator,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { buildEntityDiff } from '../event/index.ts';\nimport type { EventRequestContext, IEventService } from '../event/index.ts';\nimport { parseCertificateChain } from '../../key/index.ts';\nimport type {\n ITrustAnchorRepository, \n ITrustAnchorService, \n TrustAnchorServiceReadOptions,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { trustAnchorSchema } from './schema.ts';\n\nexport type TrustAnchorServiceContext = {\n repository: ITrustAnchorRepository,\n eventService?: IEventService,\n requestContext?: () => EventRequestContext \| undefined,\n};\n\nconst PERMISSION_NAMES = [\n PermissionName.KEY_READ,\n PermissionName.KEY_UPDATE,\n PermissionName.KEY_DELETE,\n];\n\nexport class TrustAnchorService extends AbstractEntityService implements ITrustAnchorService {\n protected repository: ITrustAnchorRepository;\n\n protected validator: TrustAnchorValidator;\n\n protected eventService?: IEventService;\n\n protected requestContext?: () => EventRequestContext \| undefined;\n\n constructor(ctx: TrustAnchorServiceContext) {\n super();\n this.repository = ctx.repository;\n this.validator = new TrustAnchorValidator();\n this.eventService = ctx.eventService;\n this.requestContext = ctx.requestContext;\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n options: TrustAnchorServiceReadOptions = {},\n ): Promise<EntityRepositoryFindManyResult<TrustAnchor>> {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n let parsed = await decodeQuery(query, { schema: trustAnchorSchema, actor });\n if (options.realmId) {\n parsed = appendQueryConditions(parsed, eq('realmId', options.realmId));\n }\n\n // Compile the read permissions against the knowns (actor identity) into a\n // row condition (issue #3286 phase 3): the authorization runs as WHERE, so\n // pagination and totals stay exact. Non-expressible policies fall back to\n // the per-row post-evaluation below.\n const compiled = await actor.permissionEvaluator.compile({ name: PERMISSION_NAMES });\n if (compiled.verdict === 'deny') {\n // no row can pass — a constant-false condition keeps the meta shape\n parsed = appendQueryConditions(parsed, inArray('id', []));\n } else if (compiled.verdict === 'conditional') {\n parsed = appendQueryConditions(parsed, compiled.condition);\n }\n\n const { data: entities, meta } = await this.repository.findMany(parsed);\n\n if (compiled.verdict !== 'post') {\n return { data: entities, meta };\n }\n\n const data: TrustAnchor[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: PERMISSION_NAMES,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total,\n },\n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n realmId?: string,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n const entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluateOneOf({\n name: PERMISSION_NAMES,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n if (!validated.realmId && actor.identity) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realmId = actorRealmId;\n }\n }\n\n if (!validated.realmId) {\n throw new ValidationError('A realm must be specified.');\n }\n\n await this.repository.validateJoinColumns(validated);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.KEY_CREATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: validated,\n ...this.resourceRealmMatch(validated),\n }),\n });\n\n await this.repository.checkUniqueness(validated);\n\n const chain = parseCertificateChain(validated.certificate as string);\n if (!chain[0] \|\| !chain[0].ca) {\n throw new ValidationError('A trust anchor must contain a CA certificate.');\n }\n\n if (typeof validated.enabled !== 'boolean') {\n validated.enabled = true;\n }\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n await this.recordEvent(EventName.CREATED, entity, actor);\n\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realmId?: string,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });\n\n let entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.KEY_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n if (validated.name && validated.name !== entity.name) {\n await this.repository.checkUniqueness({\n name: validated.name,\n realmId: entity.realmId,\n }, entity);\n }\n\n const previous = this.pickAuditFields(entity);\n\n entity = this.repository.merge(entity, validated);\n entity = await this.repository.save(entity);\n\n const diff = buildEntityDiff(this.pickAuditFields(entity), previous);\n await this.recordEvent(EventName.UPDATED, entity, actor, { ...(Object.keys(diff).length > 0 ? { diff } : {}) });\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.KEY_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n await this.recordEvent(EventName.DELETED, entity, actor);\n\n return entity;\n }\n\n // ------------------------------------------------------------------\n\n /\n Metadata-only audit trail for trust-anchor lifecycle operations\n * (issue #3269) — trust anchors have no entity subscriber, so the\n * security-relevant mutations (an enabled CA anchor turns on mTLS client\n * auth for a realm) are recorded explicitly. The payload never carries\n * certificate bytes.\n */\n protected async recordEvent(\n name: `${EventName}`,\n entity: TrustAnchor,\n actor: ActorContext,\n data: Record<string, any> = {},\n ): Promise<void> {\n const requestContext = this.requestContext ?\n this.requestContext() :\n undefined;\n\n await this.eventService?.record({\n scope: EventScope.ENTITY,\n name,\n refType: EntityType.TRUST_ANCHOR,\n refId: entity.id,\n realmId: entity.realmId ?? null,\n actorType: actor.identity?.type ?? null,\n actorId: actor.identity?.data.id ?? null,\n actorName: actor.identity?.data.name ?? null,\n requestPath: requestContext?.requestPath ?? null,\n requestMethod: requestContext?.requestMethod ?? null,\n requestIpAddress: requestContext?.requestIpAddress ?? null,\n requestUserAgent: requestContext?.requestUserAgent ?? null,\n data: {\n name: entity.name,\n enabled: entity.enabled,\n ...data,\n },\n });\n }\n\n protected pickAuditFields(entity: TrustAnchor): Record<string, any> {\n return {\n name: entity.name,\n enabled: entity.enabled,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,MAAMkB,mBAAmB;CACrBX,eAAeY;CACfZ,eAAea;CACfb,eAAec;;AAGnB,IAAaC,qBAAb,cAAwCV,sBAAAA;CAC1BW;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,YAAY,IAAIhB,qBAAAA;EACrB,KAAKiB,eAAeE,IAAIF;EACxB,KAAKC,iBAAiBC,IAAID;CAC9B;CAEA,MAAME,QACFC,OACAC,OACAC,UAAyC,CAAC,GACU;EACpD,MAAMD,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,IAAIiB,SAAS,MAAMnB,YAAYa,OAAO;GAAEO,QAAQnB;GAAmBa;EAAM,CAAA;EACzE,IAAIC,QAAQM,SACRF,SAASpB,sBAAsBoB,QAAQjC,GAAG,WAAW6B,QAAQM,OAAO,CAAA;EAOxE,MAAMC,WAAW,MAAMR,MAAME,oBAAoBO,QAAQ,EAAEL,MAAMhB,iBAAiB,CAAA;EAClF,IAAIoB,SAASE,YAAY,QAErBL,SAASpB,sBAAsBoB,QAAQhC,QAAQ,MAAM,CAAA,CAAE,CAAA;OACpD,IAAImC,SAASE,YAAY,eAC5BL,SAASpB,sBAAsBoB,QAAQG,SAASG,SAAS;EAG7D,MAAM,EAAEC,MAAMC,UAAUC,SAAS,MAAM,KAAKrB,WAAWsB,SAASV,MAAAA;EAEhE,IAAIG,SAASE,YAAY,QACrB,OAAO;GAAEE,MAAMC;GAAUC;EAAK;EAGlC,MAAMF,OAAsB,CAAA;EAC5B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UACjB,IAAI;GACA,MAAMb,MAAME,oBAAoBgB,cAAc;IAC1Cd,MAAMhB;IACNwB,MAAMzC,iBAAiB;MAClBD,kBAAkBiD,aAAaF;KAChC,GAAG,KAAKG,mBAAmBH,MAAAA;IAC/B,CAAA;GACJ,CAAA;GACAL,KAAKS,KAAKJ,MAAAA;EACd,QAAQ;GACJD,SAAS;EACb;EAGJ,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,UACAvB,OACAO,SACoB;EACpB,MAAMP,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,MAAM6B,SAAS,MAAM,KAAKxB,WAAW+B,kBAAkBD,UAAUhB,OAAAA;EACjE,IAAI,CAACU,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMqB,MAAME,oBAAoBgB,cAAc;GAC1Cd,MAAMhB;GACNwB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMQ,OACFb,MACAZ,OACoB;EACpB,MAAMA,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAekD,WAAW,CAAA;EAE9E,MAAMC,YAAY,MAAM,KAAKlC,UAAUmC,IAAIjB,MAAM,EAAEkB,OAAOjD,eAAekD,OAAO,CAAA;EAEhF,IAAI,CAACH,UAAUrB,WAAWP,MAAMgC,UAAU;GACtC,MAAMC,eAAe,KAAKC,gBAAgBlC,KAAAA;GAC1C,IAAIiC,cACAL,UAAUrB,UAAU0B;EAE5B;EAEA,IAAI,CAACL,UAAUrB,SACX,MAAM,IAAI3B,gBAAgB,4BAAA;EAG9B,MAAM,KAAKa,WAAW0C,oBAAoBP,SAAAA;EAE1C,MAAM5B,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAekD;GACrBf,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaS;IAChC,GAAG,KAAKR,mBAAmBQ,SAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKnC,WAAW4C,gBAAgBT,SAAAA;EAEtC,MAAMU,QAAQtD,sBAAsB4C,UAAUW,WAAW;EACzD,IAAI,CAACD,MAAM,MAAM,CAACA,MAAM,EAAE,CAACE,IACvB,MAAM,IAAI5D,gBAAgB,+CAAA;EAG9B,IAAI,OAAOgD,UAAUa,YAAY,WAC7Bb,UAAUa,UAAU;EAGxB,IAAIxB,SAAS,KAAKxB,WAAWgC,OAAOG,SAAAA;EACpCX,SAAS,MAAM,KAAKxB,WAAWiD,KAAKzB,MAAAA;EAEpC,MAAM,KAAK0B,YAAYpE,UAAUqE,SAAS3B,QAAQjB,KAAAA;EAElD,OAAOiB;CACX;CAEA,MAAM4B,OACFtB,UACAX,MACAZ,OACAO,SACoB;EACpB,MAAMP,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAea,WAAW,CAAA;EAE9E,IAAI2B,SAAS,MAAM,KAAKxB,WAAW+B,kBAAkBD,UAAUhB,OAAAA;EAC/D,IAAI,CAACU,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMiD,YAAY,MAAM,KAAKlC,UAAUmC,IAAIjB,MAAM,EAAEkB,OAAOjD,eAAeiE,OAAO,CAAA;EAEhF,MAAM9C,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAea;GACrBsB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAa;KAC5B,GAAGF;KACH,GAAGW;IACP;IACA,GAAG,KAAKR,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIW,UAAUxB,QAAQwB,UAAUxB,SAASa,OAAOb,MAC5C,MAAM,KAAKX,WAAW4C,gBAAgB;GAClCjC,MAAMwB,UAAUxB;GAChBG,SAASU,OAAOV;EACpB,GAAGU,MAAAA;EAGP,MAAM8B,WAAW,KAAKC,gBAAgB/B,MAAAA;EAEtCA,SAAS,KAAKxB,WAAWwD,MAAMhC,QAAQW,SAAAA;EACvCX,SAAS,MAAM,KAAKxB,WAAWiD,KAAKzB,MAAAA;EAEpC,MAAMiC,OAAOnE,gBAAgB,KAAKiE,gBAAgB/B,MAAAA,GAAS8B,QAAAA;EAC3D,MAAM,KAAKJ,YAAYpE,UAAU4E,SAASlC,QAAQjB,OAAO,EAAE,GAAIoD,OAAOC,KAAKH,IAAAA,CAAAA,CAAMI,SAAS,IAAI,EAAEJ,KAAK,IAAI,CAAC,EAAG,CAAA;EAE7G,OAAOjC;CACX;CAEA,MAAMsC,OACFC,IACAxD,OACoB;EACpB,MAAMA,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAec,WAAW,CAAA;EAE9E,MAAM0B,SAAS,MAAM,KAAKxB,WAAWgE,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACvC,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMqB,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAec;GACrBqB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,EAAEuC,IAAIE,aAAazC;EACzB,MAAM,KAAKxB,WAAWkE,OAAO1C,MAAAA;EAC7BA,OAAOuC,KAAKE;EAEZ,MAAM,KAAKf,YAAYpE,UAAUqF,SAAS3C,QAAQjB,KAAAA;EAElD,OAAOiB;CACX;;;;;;;IAWA,MAAgB0B,YACZvC,MACAa,QACAjB,OACAY,OAA4B,CAAC,GAChB;EACb,MAAMhB,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBiE,KAAAA;EAEJ,MAAM,KAAKlE,cAAcmE,OAAO;GAC5BC,OAAOvF,WAAWwF;GAClB5D;GACA6D,SAAS3F,WAAW4F;GACpBC,OAAOlD,OAAOuC;GACdjD,SAASU,OAAOV,WAAW;GAC3B6D,WAAWpE,MAAMgC,UAAUqC,QAAQ;GACnCC,SAAStE,MAAMgC,UAAUpB,KAAK4C,MAAM;GACpCe,WAAWvE,MAAMgC,UAAUpB,KAAKR,QAAQ;GACxCoE,aAAa5E,gBAAgB4E,eAAe;GAC5CC,eAAe7E,gBAAgB6E,iBAAiB;GAChDC,kBAAkB9E,gBAAgB8E,oBAAoB;GACtDC,kBAAkB/E,gBAAgB+E,oBAAoB;GACtD/D,MAAM;IACFR,MAAMa,OAAOb;IACbqC,SAASxB,OAAOwB;IAChB,GAAG7B;GACP;EACJ,CAAA;CACJ;CAEUoC,gBAAgB/B,QAA0C;EAChE,OAAO;GACHb,MAAMa,OAAOb;GACbqC,SAASxB,OAAOwB;EACpB;CACJ;AACJ"}

package/dist/core/entities/trust-anchor/types.d.ts CHANGED Viewed

@@ -4,8 +4,16 @@ export interface ITrustAnchorRepository extends IEntityRepository<TrustAnchor> {
     checkUniqueness(data: Partial<TrustAnchor>, existing?: TrustAnchor): Promise<void>;
     findOneByIdOrName(idOrName: string, realm?: string): Promise<TrustAnchor | null>;
 }
+export type TrustAnchorServiceReadOptions = {
+    /**
+     * Route-scoped realm (nested `/realms/:realmId/trust-anchors`
+     * mount) — appended onto the decoded query IR as a
+     * non-displaceable `realmId` condition.
+     */
+    realmId?: string;
+};
 export interface ITrustAnchorService {
-    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<TrustAnchor>>;
+    getMany(query: Record<string, any>, actor: ActorContext, options?: TrustAnchorServiceReadOptions): Promise<EntityRepositoryFindManyResult<TrustAnchor>>;
     getOne(idOrName: string, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;
     create(data: Record<string, any>, actor: ActorContext): Promise<TrustAnchor>;
     update(idOrName: string, data: Record<string, any>, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;

package/dist/core/entities/trust-anchor/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE1G,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB,CAAC,WAAW,CAAC;IAC1E,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnF,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,mBAAmB;IAChC,OAAO,~~CAAC~~,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,~~EAAE~~,KAAK,EAAE,YAAY,~~GAAG~~,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC,CAAC;~~IAC/G~~,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjE"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE1G,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB,CAAC,WAAW,CAAC;IAC1E,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnF,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACpF;AAED,MAAM,MAAM,6BAA6B,GAAG;IACxC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAChC,OAAO,CACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,6BAA6B,GACxC,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC,CAAC;IACxD,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjE"}

package/dist/core/entities/user/index.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/user/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/user/index.mjs CHANGED Viewed

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { userSchema } from "./schema.mjs";
 import { UserService } from "./service.mjs";
-export { UserService };
+export { UserService, userSchema };

package/dist/core/entities/user/schema.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+import type { User } from '@authup/core-kit';
+export declare const userSchema: import("@rapiq/core").Schema<User, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/user/schema.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAM7C,eAAO,MAAM,UAAU,yCAwBrB,CAAC"}