@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.54

package/dist/core/entities/user-permission/service.mjs

@@ -1,6 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { userPermissionSchema } from "./schema.mjs";
+import { decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { applyJunctionCreateGrant, buildJunctionUpdateData } from "../../identity/permission/junction-grant.mjs";
 import { ValidatorGroup } from "@authup/kit";
 import { PermissionName, UserPermissionValidator } from "@authup/core-kit";
@@ -9,7 +12,7 @@ import { BuiltInPolicyType, RealmScope, definePolicyData } from "@authup/access"
 import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/user-permission/service.ts
 var UserPermissionService = class extends JunctionEntityService {
-	ownerRealmKey = "user_realm_id";
+	ownerRealmKey = "userRealmId";
 	repository;
 	permissionRepository;
 	identityPermissionProvider;
@@ -27,7 +30,10 @@ var UserPermissionService = class extends JunctionEntityService {
 			PermissionName.USER_PERMISSION_DELETE,
 			PermissionName.USER_PERMISSION_READ
 		] });
-		return this.repository.findMany(query);
+		return this.repository.findMany(await decodeQuery(query, {
+			schema: userPermissionSchema,
+			actor
+		}));
 	}
 	async getOne(id, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -44,26 +50,26 @@ var UserPermissionService = class extends JunctionEntityService {
 		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
 		await this.repository.validateJoinColumns(validated);
 		if (await this.repository.findOneBy({
-			permission_id: validated.permission_id,
-			user_id: validated.user_id
+			permissionId: validated.permissionId,
+			userId: validated.userId
 		})) throw new EntityConflictError({ entity: "user-permission" });
 		if (validated.permission) {
-			validated.permission_realm_id = validated.permission.realm_id;
+			validated.permissionRealmId = validated.permission.realmId;
 			await actor.permissionEvaluator.preEvaluate({
 				name: validated.permission.name,
-				realmId: validated.permission.realm_id,
-				clientId: validated.permission.client_id
+				realmId: validated.permission.realmId,
+				clientId: validated.permission.clientId
 			});
 		}
-		if (validated.user) validated.user_realm_id = validated.user.realm_id;
+		if (validated.user) validated.userRealmId = validated.user.realmId;
 		if (validated.permission && actor.identity) applyJunctionCreateGrant(validated, await this.identityPermissionProvider.resolveJunctionGrant({
 			type: actor.identity.type,
 			id: actor.identity.data.id
 		}, {
 			name: validated.permission.name,
-			realmId: validated.permission.realm_id,
-			clientId: validated.permission.client_id,
-			realmScope: validated.realm_scope ?? RealmScope.OWN
+			realmId: validated.permission.realmId,
+			clientId: validated.permission.clientId,
+			realmScope: validated.realmScope ?? RealmScope.OWN
 		}));
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_PERMISSION_CREATE,
@@ -81,11 +87,11 @@ var UserPermissionService = class extends JunctionEntityService {
 		const entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
 		const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });
-		const permission = await this.permissionRepository.findOneById(entity.permission_id);
+		const permission = await this.permissionRepository.findOneById(entity.permissionId);
 		if (permission) await actor.permissionEvaluator.preEvaluate({
 			name: permission.name,
-			realmId: permission.realm_id,
-			clientId: permission.client_id
+			realmId: permission.realmId,
+			clientId: permission.clientId
 		});
 		let actorScope = RealmScope.ANY;
 		let actorPolicyFree = true;
@@ -96,9 +102,9 @@ var UserPermissionService = class extends JunctionEntityService {
 				id: actor.identity.data.id
 			}, {
 				name: permission.name,
-				realmId: permission.realm_id,
-				clientId: permission.client_id,
-				realmScope: validated.realm_scope ?? entity.realm_scope
+				realmId: permission.realmId,
+				clientId: permission.clientId,
+				realmScope: validated.realmScope ?? entity.realmScope
 			});
 			actorScope = grant.realmScope;
 			actorPolicyFree = !grant.policy;
@@ -106,7 +112,7 @@ var UserPermissionService = class extends JunctionEntityService {
 		} else if (actor.identity) actorScope = RealmScope.OWN;
 		const updateData = buildJunctionUpdateData({
 			data: validated,
-			existingScope: entity.realm_scope,
+			existingScope: entity.realmScope,
 			actorScope,
 			actorPolicyFree,
 			actorPolicyId

package/dist/core/entities/user-permission/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","UserPermissionValidator","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","UserPermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_PERMISSION_CREATE","USER_PERMISSION_DELETE","USER_PERMISSION_READ","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permission_id","user_id","permission","permission_realm_id","realm_id","realmId","clientId","client_id","user","user_realm_id","identity","grant","resolveJunctionGrant","type","realmScope","realm_scope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","USER_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/user-permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    BuiltInPolicyType,\n    RealmScope,\n    definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, UserPermissionValidator } from '@authup/core-kit';\nimport type { Permission, UserPermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IUserPermissionRepository, IUserPermissionService } from './types.ts';\n\nexport type UserPermissionServiceContext = {\n    repository: IUserPermissionRepository;\n    permissionRepository: IEntityRepository<Permission>;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserPermissionService extends JunctionEntityService implements IUserPermissionService {\n    protected readonly ownerRealmKey = 'user_realm_id';\n\n    protected repository: IUserPermissionRepository;\n\n    protected permissionRepository: IEntityRepository<Permission>;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: UserPermissionValidator;\n\n    constructor(ctx: UserPermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.permissionRepository = ctx.permissionRepository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new UserPermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserPermission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_PERMISSION_CREATE,\n                PermissionName.USER_PERMISSION_DELETE,\n                PermissionName.USER_PERMISSION_READ,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_PERMISSION_CREATE,\n                PermissionName.USER_PERMISSION_DELETE,\n                PermissionName.USER_PERMISSION_READ,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            permission_id: validated.permission_id,\n            user_id: validated.user_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'user-permission' });\n        }\n\n        if (validated.permission) {\n            validated.permission_realm_id = validated.permission.realm_id;\n\n            await actor.permissionEvaluator.preEvaluate({\n                name: validated.permission.name,\n                realmId: validated.permission.realm_id,\n                clientId: validated.permission.client_id,\n            });\n        }\n\n        if (validated.user) {\n            validated.user_realm_id = validated.user.realm_id;\n        }\n\n        if (validated.permission && actor.identity) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    name: validated.permission.name,\n                    realmId: validated.permission.realm_id,\n                    clientId: validated.permission.client_id,\n                    realmScope: validated.realm_scope ?? RealmScope.OWN,\n                },\n            );\n\n            applyJunctionCreateGrant(validated, grant);\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        const permission = await this.permissionRepository.findOneById(entity.permission_id);\n        if (permission) {\n            // Member-permission gate: an actor may only modify a binding for a permission it\n            // holds (mirrors create()).\n            await actor.permissionEvaluator.preEvaluate({\n                name: permission.name,\n                realmId: permission.realm_id,\n                clientId: permission.client_id,\n            });\n        }\n\n        let actorScope: `${RealmScope}` = RealmScope.ANY;\n        let actorPolicyFree = true;\n        let actorPolicyId: string | null = null;\n        if (actor.identity && permission) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                { type: actor.identity.type, id: actor.identity.data.id },\n                {\n                    name: permission.name,\n                    realmId: permission.realm_id,\n                    clientId: permission.client_id,\n                    realmScope: validated.realm_scope ?? entity.realm_scope,\n                },\n            );\n            actorScope = grant.realmScope;\n            actorPolicyFree = !grant.policy;\n            actorPolicyId = grant.policy ? grant.policy.id : null;\n        } else if (actor.identity) {\n            actorScope = RealmScope.OWN;\n        }\n\n        const updateData = buildJunctionUpdateData({\n            data: validated,\n            existingScope: entity.realm_scope,\n            actorScope,\n            actorPolicyFree,\n            actorPolicyId,\n        });\n\n        await this.repository.validateJoinColumns(updateData);\n\n        const merged = this.repository.merge(entity, updateData);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n            }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;AA4BA,IAAaW,wBAAb,cAA2CD,sBAAAA;CACpBE,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIT,wBAAAA;CACzB;CAEA,MAAMW,QACFC,OACAC,OACuD;EACvD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFjB,eAAekB;GACflB,eAAemB;GACfnB,eAAeoB;IAEvB,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFjB,eAAekB;GACflB,eAAemB;GACfnB,eAAeoB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMjB,eAAekB,uBAAuB,CAAA;EAE1F,MAAMW,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOhC,eAAeiC,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWkB,UAAU;GAC7CU,eAAeN,UAAUM;GACzBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIvC,oBAAoB,EAAE2B,QAAQ,kBAAkB,CAAA;EAG9D,IAAIK,UAAUQ,YAAY;GACtBR,UAAUS,sBAAsBT,UAAUQ,WAAWE;GAErD,MAAMzB,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMY,UAAUQ,WAAWpB;IAC3BuB,SAASX,UAAUQ,WAAWE;IAC9BE,UAAUZ,UAAUQ,WAAWK;GACnC,CAAA;EACJ;EAEA,IAAIb,UAAUc,MACVd,UAAUe,gBAAgBf,UAAUc,KAAKJ;EAG7C,IAAIV,UAAUQ,cAAcvB,MAAM+B,UAc9B3C,yBAAyB2B,WAAWiB,MAbhB,KAAKrC,2BAA2BsC,qBAChD;GACIC,MAAMlC,MAAM+B,SAASG;GACrBzB,IAAIT,MAAM+B,SAASlB,KAAKJ;EAC5B,GACA;GACIN,MAAMY,UAAUQ,WAAWpB;GAC3BuB,SAASX,UAAUQ,WAAWE;GAC9BE,UAAUZ,UAAUQ,WAAWK;GAC/BO,YAAYpB,UAAUqB,eAAevD,WAAWwD;EACpD,CAAA,CAGgCL;EAGxC,MAAMhC,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAekB;GACrBS,MAAM/B,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBzB,SAAAA;KACvDnC,kBAAkB6D,cAAc,KAAKC,sBAAsB3B,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKjB,WAAWmB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKjB,WAAWkD,KAAKjC,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMkC,OACFnC,IACAI,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMjB,eAAe2D,uBAAuB,CAAA;EAE1F,MAAMnC,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,MAAM+B,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOhC,eAAe6D,OAAO,CAAA;EAEhF,MAAMvB,aAAa,MAAM,KAAK7B,qBAAqBqD,YAAYrC,OAAOW,aAAa;EACnF,IAAIE,YAGA,MAAMvB,MAAMC,oBAAoBa,YAAY;GACxCX,MAAMoB,WAAWpB;GACjBuB,SAASH,WAAWE;GACpBE,UAAUJ,WAAWK;EACzB,CAAA;EAGJ,IAAIoB,aAA8BnE,WAAWoE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAInD,MAAM+B,YAAYR,YAAY;GAC9B,MAAMS,QAAQ,MAAM,KAAKrC,2BAA2BsC,qBAChD;IAAEC,MAAMlC,MAAM+B,SAASG;IAAMzB,IAAIT,MAAM+B,SAASlB,KAAKJ;GAAG,GACxD;IACIN,MAAMoB,WAAWpB;IACjBuB,SAASH,WAAWE;IACpBE,UAAUJ,WAAWK;IACrBO,YAAYpB,UAAUqB,eAAe1B,OAAO0B;GAChD,CAAA;GAEJY,aAAahB,MAAMG;GACnBe,kBAAkB,CAAClB,MAAMoB;GACzBD,gBAAgBnB,MAAMoB,SAASpB,MAAMoB,OAAO3C,KAAK;EACrD,OAAO,IAAIT,MAAM+B,UACbiB,aAAanE,WAAWwD;EAG5B,MAAMgB,aAAahE,wBAAwB;GACvCwB,MAAME;GACNuC,eAAe5C,OAAO0B;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAK1D,WAAW0B,oBAAoBkC,UAAAA;EAE1C,MAAME,SAAS,KAAK9D,WAAW+D,MAAM9C,QAAQ2C,UAAAA;EAE7C,MAAMrD,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAe2D;GACrBhC,MAAM/B,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBe,MAAAA;KACvD3E,kBAAkB6D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK9D,WAAWkD,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACFhD,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMjB,eAAemB,uBAAuB,CAAA;EAE1F,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,MAAMgB,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAemB;GACrBQ,MAAM/B,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmB9B,MAAAA;KACvD9B,kBAAkB6D,cAAc,KAAKC,sBAAsBhC,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIiD,aAAahD;EACzB,MAAM,KAAKjB,WAAWkE,OAAOjD,MAAAA;EAC7BA,OAAOD,KAAKiD;EAEZ,OAAOhD;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","UserPermissionValidator","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","decodeQuery","userPermissionSchema","UserPermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_PERMISSION_CREATE","USER_PERMISSION_DELETE","USER_PERMISSION_READ","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permissionId","userId","permission","permissionRealmId","realmId","clientId","user","userRealmId","identity","grant","resolveJunctionGrant","type","realmScope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","USER_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/user-permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    BuiltInPolicyType,\n    RealmScope,\n    definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, UserPermissionValidator } from '@authup/core-kit';\nimport type { Permission, UserPermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IUserPermissionRepository, IUserPermissionService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { userPermissionSchema } from './schema.ts';\n\nexport type UserPermissionServiceContext = {\n    repository: IUserPermissionRepository;\n    permissionRepository: IEntityRepository<Permission>;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserPermissionService extends JunctionEntityService implements IUserPermissionService {\n    protected readonly ownerRealmKey = 'userRealmId';\n\n    protected repository: IUserPermissionRepository;\n\n    protected permissionRepository: IEntityRepository<Permission>;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: UserPermissionValidator;\n\n    constructor(ctx: UserPermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.permissionRepository = ctx.permissionRepository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new UserPermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserPermission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_PERMISSION_CREATE,\n                PermissionName.USER_PERMISSION_DELETE,\n                PermissionName.USER_PERMISSION_READ,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: userPermissionSchema, actor }));\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_PERMISSION_CREATE,\n                PermissionName.USER_PERMISSION_DELETE,\n                PermissionName.USER_PERMISSION_READ,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            permissionId: validated.permissionId,\n            userId: validated.userId,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'user-permission' });\n        }\n\n        if (validated.permission) {\n            validated.permissionRealmId = validated.permission.realmId;\n\n            await actor.permissionEvaluator.preEvaluate({\n                name: validated.permission.name,\n                realmId: validated.permission.realmId,\n                clientId: validated.permission.clientId,\n            });\n        }\n\n        if (validated.user) {\n            validated.userRealmId = validated.user.realmId;\n        }\n\n        if (validated.permission && actor.identity) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    name: validated.permission.name,\n                    realmId: validated.permission.realmId,\n                    clientId: validated.permission.clientId,\n                    realmScope: validated.realmScope ?? RealmScope.OWN,\n                },\n            );\n\n            applyJunctionCreateGrant(validated, grant);\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        const permission = await this.permissionRepository.findOneById(entity.permissionId);\n        if (permission) {\n            // Member-permission gate: an actor may only modify a binding for a permission it\n            // holds (mirrors create()).\n            await actor.permissionEvaluator.preEvaluate({\n                name: permission.name,\n                realmId: permission.realmId,\n                clientId: permission.clientId,\n            });\n        }\n\n        let actorScope: `${RealmScope}` = RealmScope.ANY;\n        let actorPolicyFree = true;\n        let actorPolicyId: string | null = null;\n        if (actor.identity && permission) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                { type: actor.identity.type, id: actor.identity.data.id },\n                {\n                    name: permission.name,\n                    realmId: permission.realmId,\n                    clientId: permission.clientId,\n                    realmScope: validated.realmScope ?? entity.realmScope,\n                },\n            );\n            actorScope = grant.realmScope;\n            actorPolicyFree = !grant.policy;\n            actorPolicyId = grant.policy ? grant.policy.id : null;\n        } else if (actor.identity) {\n            actorScope = RealmScope.OWN;\n        }\n\n        const updateData = buildJunctionUpdateData({\n            data: validated,\n            existingScope: entity.realmScope,\n            actorScope,\n            actorPolicyFree,\n            actorPolicyId,\n        });\n\n        await this.repository.validateJoinColumns(updateData);\n\n        const merged = this.repository.merge(entity, updateData);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n            }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserPermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_PERMISSION_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AA8BA,IAAaa,wBAAb,cAA2CH,sBAAAA;CACpBI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIX,wBAAAA;CACzB;CAEA,MAAMa,QACFC,OACAC,OACuD;EACvD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFnB,eAAeoB;GACfpB,eAAeqB;GACfrB,eAAesB;IAEvB,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAAS,MAAMlB,YAAYU,OAAO;GAAES,QAAQlB;GAAsBU;EAAM,CAAA,CAAA;CACnG;CAEA,MAAMS,OACFC,IACAV,OACuB;EACvB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFnB,eAAeoB;GACfpB,eAAeqB;GACfrB,eAAesB;IAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKlB,WAAWmB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI7B,oBAAAA;EAGd,OAAO6B;CACX;CAEA,MAAME,OACFC,MACAd,OACuB;EACvB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMnB,eAAeoB,uBAAuB,CAAA;EAE1F,MAAMY,YAAY,MAAM,KAAKpB,UAAUqB,IAAIH,MAAM,EAAEI,OAAOnC,eAAeoC,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWmB,UAAU;GAC7CU,cAAcN,UAAUM;GACxBC,QAAQP,UAAUO;EACtB,CAAA,GAEI,MAAM,IAAI1C,oBAAoB,EAAE8B,QAAQ,kBAAkB,CAAA;EAG9D,IAAIK,UAAUQ,YAAY;GACtBR,UAAUS,oBAAoBT,UAAUQ,WAAWE;GAEnD,MAAM1B,MAAMC,oBAAoBc,YAAY;IACxCZ,MAAMa,UAAUQ,WAAWrB;IAC3BuB,SAASV,UAAUQ,WAAWE;IAC9BC,UAAUX,UAAUQ,WAAWG;GACnC,CAAA;EACJ;EAEA,IAAIX,UAAUY,MACVZ,UAAUa,cAAcb,UAAUY,KAAKF;EAG3C,IAAIV,UAAUQ,cAAcxB,MAAM8B,UAc9B5C,yBAAyB8B,WAAWe,MAbhB,KAAKpC,2BAA2BqC,qBAChD;GACIC,MAAMjC,MAAM8B,SAASG;GACrBvB,IAAIV,MAAM8B,SAAShB,KAAKJ;EAC5B,GACA;GACIP,MAAMa,UAAUQ,WAAWrB;GAC3BuB,SAASV,UAAUQ,WAAWE;GAC9BC,UAAUX,UAAUQ,WAAWG;GAC/BO,YAAYlB,UAAUkB,cAAcvD,WAAWwD;EACnD,CAAA,CAGgCJ;EAGxC,MAAM/B,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAeoB;GACrBU,MAAMlC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBtB,SAAAA;KACvDtC,kBAAkB6D,cAAc,KAAKC,sBAAsBxB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKlB,WAAWoB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKlB,WAAWgD,KAAK9B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM+B,OACFhC,IACAI,MACAd,OACuB;EACvB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMnB,eAAe2D,uBAAuB,CAAA;EAE1F,MAAMhC,SAAS,MAAM,KAAKlB,WAAWmB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI7B,oBAAAA;EAGd,MAAMkC,YAAY,MAAM,KAAKpB,UAAUqB,IAAIH,MAAM,EAAEI,OAAOnC,eAAe6D,OAAO,CAAA;EAEhF,MAAMpB,aAAa,MAAM,KAAK9B,qBAAqBmD,YAAYlC,OAAOW,YAAY;EAClF,IAAIE,YAGA,MAAMxB,MAAMC,oBAAoBc,YAAY;GACxCZ,MAAMqB,WAAWrB;GACjBuB,SAASF,WAAWE;GACpBC,UAAUH,WAAWG;EACzB,CAAA;EAGJ,IAAImB,aAA8BnE,WAAWoE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAIjD,MAAM8B,YAAYN,YAAY;GAC9B,MAAMO,QAAQ,MAAM,KAAKpC,2BAA2BqC,qBAChD;IAAEC,MAAMjC,MAAM8B,SAASG;IAAMvB,IAAIV,MAAM8B,SAAShB,KAAKJ;GAAG,GACxD;IACIP,MAAMqB,WAAWrB;IACjBuB,SAASF,WAAWE;IACpBC,UAAUH,WAAWG;IACrBO,YAAYlB,UAAUkB,cAAcvB,OAAOuB;GAC/C,CAAA;GAEJY,aAAaf,MAAMG;GACnBc,kBAAkB,CAACjB,MAAMmB;GACzBD,gBAAgBlB,MAAMmB,SAASnB,MAAMmB,OAAOxC,KAAK;EACrD,OAAO,IAAIV,MAAM8B,UACbgB,aAAanE,WAAWwD;EAG5B,MAAMgB,aAAahE,wBAAwB;GACvC2B,MAAME;GACNoC,eAAezC,OAAOuB;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAKxD,WAAW2B,oBAAoB+B,UAAAA;EAE1C,MAAME,SAAS,KAAK5D,WAAW6D,MAAM3C,QAAQwC,UAAAA;EAE7C,MAAMnD,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAe2D;GACrB7B,MAAMlC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBe,MAAAA;KACvD3E,kBAAkB6D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK5D,WAAWgD,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACF7C,IACAV,OACuB;EACvB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMnB,eAAeqB,uBAAuB,CAAA;EAE1F,MAAMM,SAAS,MAAM,KAAKlB,WAAWmB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI7B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAeqB;GACrBS,MAAMlC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmB3B,MAAAA;KACvDjC,kBAAkB6D,cAAc,KAAKC,sBAAsB7B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI8C,aAAa7C;EACzB,MAAM,KAAKlB,WAAWgE,OAAO9C,MAAAA;EAC7BA,OAAOD,KAAK8C;EAEZ,OAAO7C;CACX;AACJ"}

package/dist/core/entities/user-role/index.d.ts

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/user-role/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/user-role/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { userRoleSchema } from "./schema.mjs";
 import { UserRoleService } from "./service.mjs";
-export { UserRoleService };
+export { UserRoleService, userRoleSchema };

package/dist/core/entities/user-role/schema.d.ts

@@ -0,0 +1,3 @@
+import type { UserRole } from '@authup/core-kit';
+export declare const userRoleSchema: import("@rapiq/core").Schema<UserRole, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/user-role/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAMjD,eAAO,MAAM,cAAc,6CAqBzB,CAAC"}

package/dist/core/entities/user-role/schema.mjs

@@ -0,0 +1,39 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/user-role/schema.ts
+const schemaMapping = {
+	user: EntityType.USER,
+	role: EntityType.ROLE
+};
+const userRoleSchema = defineSchema({
+	name: EntityType.USER_ROLE,
+	fields: { default: [
+		"id",
+		"roleId",
+		"roleRealmId",
+		"userId",
+		"userRealmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: ["roleId", "userId"] },
+	relations: {
+		allowed: ["user", "role"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"id",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { userRoleSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/user-role/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","user","USER","role","ROLE","userRoleSchema","name","USER_ROLE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user-role/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { UserRole } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { user: EntityType.USER, role: EntityType.ROLE };\n\nexport const userRoleSchema = defineSchema<UserRole>({\n    name: EntityType.USER_ROLE,\n    // `default` pins an explicit root projection: an include= decodes the\n    // relation's fields, and the adapter's select-replace would otherwise\n    // drop every root column (incl. the id the DISTINCT wrapper needs).\n    fields: {\n        default: [\n            'id',\n            'roleId',\n            'roleRealmId',\n            'userId',\n            'userRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['roleId', 'userId'] },\n    relations: { allowed: ['user', 'role'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,MAAML,WAAWM;AAAK;AAErE,MAAaC,iBAAiBR,aAAuB;CACjDS,MAAMR,WAAWS;CAIjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAEC,SAAS,CAAC,UAAU,QAAA,EAAU;CACzCC,WAAW;EAAED,SAAS,CAAC,QAAQ,MAAA;EAASE,UAAUd,wBAAwBC,aAAAA;CAAe;CACzFc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;GAAa;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/user-role/service.d.ts

@@ -9,7 +9,7 @@ export type UserRoleServiceContext = {
     identityPermissionProvider: IIdentityPermissionProvider;
 };
 export declare class UserRoleService extends JunctionEntityService implements IUserRoleService {
-    protected readonly ownerRealmKey = "user_realm_id";
+    protected readonly ownerRealmKey = "userRealmId";
     protected repository: IUserRoleRepository;
     protected identityPermissionProvider: IIdentityPermissionProvider;
     protected validator: UserRoleValidator;

package/dist/core/entities/user-role/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,MAAM,sBAAsB,GAAG;IACjC,UAAU,EAAE,mBAAmB,CAAC;IAChC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,eAAgB,SAAQ,qBAAsB,YAAW,gBAAgB;IAClF,SAAS,CAAC,QAAQ,CAAC,aAAa,mBAAmB;IAEnD,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAE1C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,iBAAiB,CAAC;gBAE3B,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IAY9C,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAiBd,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAuDd,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;CAuBvB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-role/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAIxE,MAAM,MAAM,sBAAsB,GAAG;IACjC,UAAU,EAAE,mBAAmB,CAAC;IAChC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,qBAAa,eAAgB,SAAQ,qBAAsB,YAAW,gBAAgB;IAClF,SAAS,CAAC,QAAQ,CAAC,aAAa,iBAAiB;IAEjD,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAE1C,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;IAElE,SAAS,CAAC,SAAS,EAAE,iBAAiB,CAAC;gBAE3B,GAAG,EAAE,sBAAsB;IAOjC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IAY9C,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAiBd,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;IAuDd,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,CAAC;CAuBvB"}

package/dist/core/entities/user-role/service.mjs

@@ -1,6 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { userRoleSchema } from "./schema.mjs";
+import { decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { ValidatorGroup } from "@authup/kit";
 import { PermissionName, UserRoleValidator } from "@authup/core-kit";
 import { JunctionEntityService } from "@authup/server-kit";
@@ -8,7 +11,7 @@ import { BuiltInPolicyType, PermissionError, definePolicyData } from "@authup/ac
 import { EntityConflictError, EntityNotFoundError } from "@authup/errors";
 //#region src/core/entities/user-role/service.ts
 var UserRoleService = class extends JunctionEntityService {
-	ownerRealmKey = "user_realm_id";
+	ownerRealmKey = "userRealmId";
 	repository;
 	identityPermissionProvider;
 	validator;
@@ -24,7 +27,10 @@ var UserRoleService = class extends JunctionEntityService {
 			PermissionName.USER_ROLE_CREATE,
 			PermissionName.USER_ROLE_UPDATE
 		] });
-		return this.repository.findMany(query);
+		return this.repository.findMany(await decodeQuery(query, {
+			schema: userRoleSchema,
+			actor
+		}));
 	}
 	async getOne(id, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
@@ -41,19 +47,19 @@ var UserRoleService = class extends JunctionEntityService {
 		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
 		await this.repository.validateJoinColumns(validated);
 		if (await this.repository.findOneBy({
-			role_id: validated.role_id,
-			user_id: validated.user_id
+			roleId: validated.roleId,
+			userId: validated.userId
 		})) throw new EntityConflictError({ entity: "user-role" });
-		if (validated.role) validated.role_realm_id = validated.role.realm_id;
-		if (validated.user) validated.user_realm_id = validated.user.realm_id;
+		if (validated.role) validated.roleRealmId = validated.role.realmId;
+		if (validated.user) validated.userRealmId = validated.user.realmId;
 		if (validated.role && actor.identity) {
 			if (!await this.identityPermissionProvider.isSuperset({
 				type: actor.identity.type,
 				id: actor.identity.data.id
 			}, {
 				type: "role",
-				id: validated.role_id,
-				clientId: validated.role.client_id
+				id: validated.roleId,
+				clientId: validated.role.clientId
 			})) throw new PermissionError({ message: "You don't own the required permissions." });
 		}
 		await actor.permissionEvaluator.evaluate({

package/dist/core/entities/user-role/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","UserRoleValidator","JunctionEntityService","UserRoleService","ownerRealmKey","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_ROLE_READ","USER_ROLE_CREATE","USER_ROLE_UPDATE","findMany","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","role_id","user_id","role","role_realm_id","realm_id","user","user_realm_id","identity","hasPermissions","isSuperset","type","clientId","client_id","message","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","USER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/user-role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, UserRoleValidator } from '@authup/core-kit';\nimport type { UserRole } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IUserRoleRepository, IUserRoleService } from './types.ts';\n\nexport type UserRoleServiceContext = {\n    repository: IUserRoleRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserRoleService extends JunctionEntityService implements IUserRoleService {\n    protected readonly ownerRealmKey = 'user_realm_id';\n\n    protected repository: IUserRoleRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: UserRoleValidator;\n\n    constructor(ctx: UserRoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new UserRoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserRole>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        return this.repository.findMany(query);\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            role_id: validated.role_id,\n            user_id: validated.user_id,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'user-role' });\n        }\n\n        if (validated.role) {\n            validated.role_realm_id = validated.role.realm_id;\n        }\n\n        if (validated.user) {\n            validated.user_realm_id = validated.user.realm_id;\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.role_id,\n                    clientId: validated.role.client_id,\n                },\n            );\n            if (!hasPermissions) {\n                throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n            }\n        }\n\n        // Stamp the owner (user) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (user) realm so the realm_scope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;AAsBA,IAAaS,kBAAb,cAAqCD,sBAAAA;CACdE,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;EACrC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIN,kBAAAA;CACzB;CAEA,MAAMQ,QACFC,OACAC,OACiD;EACjD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAASR,KAAAA;CACpC;CAEA,MAAMS,OACFC,IACAT,OACiB;EACjB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;IAEvB,CAAA;EAEA,MAAMI,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAGd,OAAOuB;CACX;CAEA,MAAME,OACFC,MACAb,OACiB;EACjB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAegB,iBAAiB,CAAA;EAEpF,MAAMU,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAO7B,eAAe8B,OAAO,CAAA;EAEhF,MAAM,KAAKxB,WAAWyB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK1B,WAAWiB,UAAU;GAC7CU,SAASN,UAAUM;GACnBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIpC,oBAAoB,EAAEwB,QAAQ,YAAY,CAAA;EAGxD,IAAIK,UAAUQ,MACVR,UAAUS,gBAAgBT,UAAUQ,KAAKE;EAG7C,IAAIV,UAAUW,MACVX,UAAUY,gBAAgBZ,UAAUW,KAAKD;EAG7C,IAAIV,UAAUQ,QAAQvB,MAAM4B;OAYpB,CAACC,MAXwB,KAAKlC,2BAA2BmC,WACzD;IACIC,MAAM/B,MAAM4B,SAASG;IACrBtB,IAAIT,MAAM4B,SAASf,KAAKJ;GAC5B,GACA;IACIsB,MAAM;IACNtB,IAAIM,UAAUM;IACdW,UAAUjB,UAAUQ,KAAKU;GAC7B,CAAA,GAGA,MAAM,IAAIjD,gBAAgB,EAAEkD,SAAS,0CAA2C,CAAA;EAAA;EAKxF,MAAMlC,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMd,eAAegB;GACrBQ,MAAM5B,iBAAiB;KAClBF,kBAAkBqD,aAAa,KAAKC,mBAAmBtB,SAAAA;KACvDhC,kBAAkBuD,cAAc,KAAKC,sBAAsBxB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKhB,WAAWkB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKhB,WAAW8C,KAAK9B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM+B,OACFhC,IACAT,OACiB;EACjB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMd,eAAeqD,iBAAiB,CAAA;EAEpF,MAAMhC,SAAS,MAAM,KAAKhB,WAAWiB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIvB,oBAAAA;EAId,MAAMa,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMd,eAAeqD;GACrB7B,MAAM5B,iBAAiB;KAClBF,kBAAkBqD,aAAa,KAAKC,mBAAmB3B,MAAAA;KACvD3B,kBAAkBuD,cAAc,KAAKC,sBAAsB7B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIkC,aAAajC;EACzB,MAAM,KAAKhB,WAAWkD,OAAOlC,MAAAA;EAC7BA,OAAOD,KAAKkC;EAEZ,OAAOjC;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","UserRoleValidator","JunctionEntityService","decodeQuery","userRoleSchema","UserRoleService","ownerRealmKey","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_ROLE_READ","USER_ROLE_CREATE","USER_ROLE_UPDATE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","roleId","userId","role","roleRealmId","realmId","user","userRealmId","identity","hasPermissions","isSuperset","type","clientId","message","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","USER_ROLE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/user-role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, UserRoleValidator } from '@authup/core-kit';\nimport type { UserRole } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IUserRoleRepository, IUserRoleService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { userRoleSchema } from './schema.ts';\n\nexport type UserRoleServiceContext = {\n    repository: IUserRoleRepository;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class UserRoleService extends JunctionEntityService implements IUserRoleService {\n    protected readonly ownerRealmKey = 'userRealmId';\n\n    protected repository: IUserRoleRepository;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: UserRoleValidator;\n\n    constructor(ctx: UserRoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new UserRoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserRole>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: userRoleSchema, actor }));\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_ROLE_READ,\n                PermissionName.USER_ROLE_CREATE,\n                PermissionName.USER_ROLE_UPDATE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            roleId: validated.roleId,\n            userId: validated.userId,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'user-role' });\n        }\n\n        if (validated.role) {\n            validated.roleRealmId = validated.role.realmId;\n        }\n\n        if (validated.user) {\n            validated.userRealmId = validated.user.realmId;\n        }\n\n        if (validated.role && actor.identity) {\n            const hasPermissions = await this.identityPermissionProvider.isSuperset(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    type: 'role',\n                    id: validated.roleId,\n                    clientId: validated.role.clientId,\n                },\n            );\n            if (!hasPermissions) {\n                throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n            }\n        }\n\n        // Stamp the owner (user) realm so the realmScope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserRole> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        // Stamp the owner (user) realm so the realmScope factor gates cross-realm writes.\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_ROLE_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAwBA,IAAaW,kBAAb,cAAqCH,sBAAAA;CACdI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEV,YAAYC,KAA6B;EACrC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIR,kBAAAA;CACzB;CAEA,MAAMU,QACFC,OACAC,OACiD;EACjD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYS,OAAO;GAAES,QAAQjB;GAAgBS;EAAM,CAAA,CAAA;CAC7F;CAEA,MAAMS,OACFC,IACAV,OACiB;EACjB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;IAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAd,OACiB;EACjB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMhB,eAAekB,iBAAiB,CAAA;EAEpF,MAAMW,YAAY,MAAM,KAAKpB,UAAUqB,IAAIH,MAAM,EAAEI,OAAOhC,eAAeiC,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWkB,UAAU;GAC7CU,QAAQN,UAAUM;GAClBC,QAAQP,UAAUO;EACtB,CAAA,GAEI,MAAM,IAAIvC,oBAAoB,EAAE2B,QAAQ,YAAY,CAAA;EAGxD,IAAIK,UAAUQ,MACVR,UAAUS,cAAcT,UAAUQ,KAAKE;EAG3C,IAAIV,UAAUW,MACVX,UAAUY,cAAcZ,UAAUW,KAAKD;EAG3C,IAAIV,UAAUQ,QAAQxB,MAAM6B;OAYpB,CAACC,MAXwB,KAAKnC,2BAA2BoC,WACzD;IACIC,MAAMhC,MAAM6B,SAASG;IACrBtB,IAAIV,MAAM6B,SAASf,KAAKJ;GAC5B,GACA;IACIsB,MAAM;IACNtB,IAAIM,UAAUM;IACdW,UAAUjB,UAAUQ,KAAKS;GAC7B,CAAA,GAGA,MAAM,IAAInD,gBAAgB,EAAEoD,SAAS,0CAA2C,CAAA;EAAA;EAKxF,MAAMlC,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMhB,eAAekB;GACrBS,MAAM/B,iBAAiB;KAClBF,kBAAkBuD,aAAa,KAAKC,mBAAmBrB,SAAAA;KACvDnC,kBAAkByD,cAAc,KAAKC,sBAAsBvB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKjB,WAAWmB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKjB,WAAW8C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAV,OACiB;EACjB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMhB,eAAeuD,iBAAiB,CAAA;EAEpF,MAAM/B,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAId,MAAMe,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMhB,eAAeuD;GACrB5B,MAAM/B,iBAAiB;KAClBF,kBAAkBuD,aAAa,KAAKC,mBAAmB1B,MAAAA;KACvD9B,kBAAkByD,cAAc,KAAKC,sBAAsB5B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIiC,aAAahC;EACzB,MAAM,KAAKjB,WAAWkD,OAAOjC,MAAAA;EAC7BA,OAAOD,KAAKiC;EAEZ,OAAOhC;CACX;AACJ"}

package/dist/core/identity/entities/index.d.ts

@@ -1,4 +1,3 @@
 export * from './client/index.ts';
 export * from './user/index.ts';
-export * from './robot/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/identity/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC"}

package/dist/core/identity/password-recovery/service.mjs

@@ -34,25 +34,25 @@ var PasswordRecoveryService = class {
 		if (!this.options.passwordRecoveryEnabled) throw new PasswordRecoveryDisabledError();
 		if (!this.options.emailVerificationEnabled) throw new EmailVerificationRequiredError("Email verification is not enabled, but required to reset a password.");
 		const validated = await this.runForgotPasswordValidator(data);
-		const realm = await this.realmRepository.resolve(validated.realm_id, true);
+		const realm = await this.realmRepository.resolve(validated.realmId, true);
 		const where = {
 			...validated.name ? { name: validated.name } : {},
 			...validated.email ? { email: validated.email } : {},
-			realm_id: realm.id
+			realmId: realm.id
 		};
 		const entity = await this.repository.findOneByWithEmail(where);
 		if (!entity) throw new EntityNotFoundError();
 		const merged = this.repository.merge(entity, {
-			reset_expires: new Date(Date.now() + 1e3 * 60 * 30).toISOString(),
-			reset_hash: randomBytes(32).toString("hex")
+			resetExpires: new Date(Date.now() + 1e3 * 60 * 30).toISOString(),
+			resetHash: randomBytes(32).toString("hex")
 		});
 		await this.repository.save(merged);
 		try {
-			const resetUrl = this.options.publicUrl ? `${this.options.publicUrl.replace(/\/+$/, "")}/password-reset?token=${encodeURIComponent(merged.reset_hash)}&realm_id=${encodeURIComponent(entity.realm_id)}` : void 0;
+			const resetUrl = this.options.publicUrl ? `${this.options.publicUrl.replace(/\/+$/, "")}/password-reset?token=${encodeURIComponent(merged.resetHash)}&realmId=${encodeURIComponent(entity.realmId)}` : void 0;
 			const mail = await this.mailTemplateRenderer.render({
 				template: MailTemplateName.PASSWORD_RESET,
 				params: {
-					code: merged.reset_hash,
+					code: merged.resetHash,
 					url: resetUrl,
 					expiresInMinutes: 30
 				},
@@ -64,8 +64,8 @@ var PasswordRecoveryService = class {
 			});
 		} catch {
 			this.repository.merge(merged, {
-				reset_hash: null,
-				reset_expires: null
+				resetHash: null,
+				resetExpires: null
 			});
 			await this.repository.save(merged);
 			throw new ValidationError("Password recovery failed. Could not send reset email.");
@@ -78,29 +78,29 @@ var PasswordRecoveryService = class {
 			actorType: IdentityType.USER,
 			actorId: merged.id,
 			actorName: merged.name,
-			realmId: merged.realm_id
+			realmId: merged.realmId
 		});
-		return { reset_expires: merged.reset_expires };
+		return { resetExpires: merged.resetExpires };
 	}
 	async resetPassword(data) {
 		if (!this.options.passwordRecoveryEnabled) throw new PasswordRecoveryDisabledError();
 		const validated = await this.runResetPasswordValidator(data);
 		await this.repository.validateJoinColumns(validated);
-		const realm = await this.realmRepository.resolve(validated.realm_id, true);
+		const realm = await this.realmRepository.resolve(validated.realmId, true);
 		const where = {
 			...validated.name ? { name: validated.name } : {},
 			...validated.email ? { email: validated.email } : {},
-			reset_hash: validated.token,
-			realm_id: realm.id
+			resetHash: validated.token,
+			realmId: realm.id
 		};
 		const entity = await this.repository.findOneBy(where);
 		if (!entity) throw new EntityNotFoundError();
-		if (!entity.reset_expires || new Date(entity.reset_expires) < /* @__PURE__ */ new Date()) throw new ResetTokenExpiredError();
+		if (!entity.resetExpires || new Date(entity.resetExpires) < /* @__PURE__ */ new Date()) throw new ResetTokenExpiredError();
 		const hashedPassword = await new UserCredentialsService().protect(validated.password);
 		const merged = this.repository.merge(entity, {
-			reset_at: (/* @__PURE__ */ new Date()).toISOString(),
-			reset_hash: null,
-			reset_expires: null,
+			resetAt: (/* @__PURE__ */ new Date()).toISOString(),
+			resetHash: null,
+			resetExpires: null,
 			password: hashedPassword
 		});
 		await this.repository.save(merged);
@@ -112,9 +112,9 @@ var PasswordRecoveryService = class {
 			actorType: IdentityType.USER,
 			actorId: merged.id,
 			actorName: merged.name,
-			realmId: merged.realm_id
+			realmId: merged.realmId
 		});
-		return { reset_at: merged.reset_at };
+		return { resetAt: merged.resetAt };
 	}
 	async runForgotPasswordValidator(data) {
 		const validator = new Container({});
@@ -122,7 +122,7 @@ var PasswordRecoveryService = class {
 		oneOfContainer.mount("email", createValidator(z.string().trim().toLowerCase().email().regex(/^[^A-Z]+$/, { message: "Email must be lowercase." })));
 		oneOfContainer.mount("name", createValidator(z.string().trim().toLowerCase().min(1)));
 		validator.mount(oneOfContainer);
-		validator.mount("realm_id", { optional: true }, createValidator(z.uuid().nullable()));
+		validator.mount("realmId", { optional: true }, createValidator(z.uuid().nullable()));
 		return validator.run(data);
 	}
 	async runResetPasswordValidator(data) {
@@ -131,7 +131,7 @@ var PasswordRecoveryService = class {
 		oneOfContainer.mount("email", createValidator(z.string().trim().toLowerCase().email().regex(/^[^A-Z]+$/, { message: "Email must be lowercase." })));
 		oneOfContainer.mount("name", createValidator(z.string().trim().toLowerCase().min(1)));
 		validator.mount(oneOfContainer);
-		validator.mount("realm_id", { optional: true }, createValidator(z.uuid().nullable()));
+		validator.mount("realmId", { optional: true }, createValidator(z.uuid().nullable()));
 		validator.mount("token", createValidator(z.string().min(3).max(256)));
 		validator.mount("password", createValidator(z.string().min(this.options.passwordMinLength ?? USER_PASSWORD_MIN_LENGTH).max(USER_PASSWORD_MAX_LENGTH)));
 		return validator.run(data);

package/dist/core/identity/password-recovery/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["EventName","EventRefType","EventScope","IdentityType","USER_PASSWORD_MAX_LENGTH","USER_PASSWORD_MIN_LENGTH","EntityNotFoundError","ValidationError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidator","randomBytes","Container","z","UserCredentialsService","MailTemplateName","PASSWORD_RESET_EXPIRES_IN_MINUTES","PasswordRecoveryService","options","repository","realmRepository","mailClient","mailTemplateRenderer","eventService","ctx","forgotPassword","data","context","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realm_id","where","name","email","id","entity","findOneByWithEmail","merged","merge","reset_expires","Date","now","toISOString","reset_hash","toString","save","resetUrl","publicUrl","replace","encodeURIComponent","undefined","mail","render","template","PASSWORD_RESET","params","code","url","expiresInMinutes","locale","send","to","record","scope","IDENTITY","PASSWORD_RESET_REQUESTED","refType","USER","refId","actorType","actorId","actorName","realmId","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","reset_at","PASSWORD_RESET_COMPLETED","validator","oneOfContainer","oneOf","mount","string","trim","toLowerCase","regex","message","min","optional","uuid","nullable","run","max","passwordMinLength"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    USER_PASSWORD_MAX_LENGTH,\n    USER_PASSWORD_MIN_LENGTH,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidator } from '@validup/zod';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IPasswordRecoveryService,\n    PasswordForgotResult,\n    PasswordRecoveryServiceContext,\n    PasswordRecoveryServiceOptions,\n    PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\nimport { PASSWORD_RESET_EXPIRES_IN_MINUTES } from './constants.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n    protected options: PasswordRecoveryServiceOptions;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected eventService?: IEventService;\n\n    constructor(ctx: PasswordRecoveryServiceContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.eventService = ctx.eventService;\n    }\n\n    async forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        if (!this.options.emailVerificationEnabled) {\n            throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n        }\n\n        const validated = await this.runForgotPasswordValidator(data);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneByWithEmail(where);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            reset_expires: new Date(\n                Date.now() + (1000 * 60 * PASSWORD_RESET_EXPIRES_IN_MINUTES),\n            ).toISOString(),\n            reset_hash: randomBytes(32).toString('hex'),\n        });\n\n        await this.repository.save(merged);\n\n        try {\n            // realm_id MUST ride the link: resetPassword resolves the realm\n            // from the request and filters the lookup by it, so a realm-less\n            // link resolves to the master realm and never matches a\n            // non-master user.\n            const resetUrl = this.options.publicUrl ?\n                `${this.options.publicUrl.replace(/\\/+$/, '')}/password-reset` +\n                `?token=${encodeURIComponent(merged.reset_hash!)}` +\n                `&realm_id=${encodeURIComponent(entity.realm_id)}` :\n                undefined;\n\n            const mail = await this.mailTemplateRenderer.render({\n                template: MailTemplateName.PASSWORD_RESET,\n                params: {\n                    code: merged.reset_hash!,\n                    url: resetUrl,\n                    expiresInMinutes: PASSWORD_RESET_EXPIRES_IN_MINUTES,\n                },\n                locale: context?.locale,\n            });\n\n            await this.mailClient.send({\n                to: entity.email,\n                ...mail,\n            });\n        } catch {\n            this.repository.merge(merged, {\n                reset_hash: null,\n                reset_expires: null,\n            });\n            await this.repository.save(merged);\n\n            throw new ValidationError('Password recovery failed. Could not send reset email.');\n        }\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.PASSWORD_RESET_REQUESTED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realm_id,\n        });\n\n        return { reset_expires: merged.reset_expires! };\n    }\n\n    async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        const validated = await this.runResetPasswordValidator(data);\n\n        await this.repository.validateJoinColumns(validated);\n\n        const realm = await this.realmRepository.resolve(validated.realm_id, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            reset_hash: validated.token,\n            realm_id: realm.id,\n        };\n\n        const entity = await this.repository.findOneBy(where);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!entity.reset_expires || new Date(entity.reset_expires) < new Date()) {\n            throw new ResetTokenExpiredError();\n        }\n\n        const credentialsService = new UserCredentialsService();\n        const hashedPassword = await credentialsService.protect(validated.password);\n\n        const merged = this.repository.merge(entity, {\n            reset_at: new Date().toISOString(),\n            reset_hash: null,\n            reset_expires: null,\n            password: hashedPassword,\n        });\n\n        await this.repository.save(merged);\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.PASSWORD_RESET_COMPLETED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realm_id,\n        });\n\n        return { reset_at: merged.reset_at! };\n    }\n\n    private async runForgotPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        return validator.run(data);\n    }\n\n    private async runResetPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realm_id',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        validator.mount(\n            'token',\n            createValidator(z.string().min(3).max(256)),\n        );\n\n        validator.mount(\n            'password',\n            createValidator(\n                z.string()\n                    .min(this.options.passwordMinLength ?? USER_PASSWORD_MIN_LENGTH)\n                    .max(USER_PASSWORD_MAX_LENGTH),\n            ),\n        );\n\n        return validator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAqCA,IAAakB,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,UAAUM,IAAIN;EACnB,KAAKC,aAAaK,IAAIL;EACtB,KAAKC,kBAAkBI,IAAIJ;EAC3B,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,uBAAuBE,IAAIF;EAChC,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,eAAeC,MAA2BC,SAAkE;EAC9G,IAAI,CAAC,KAAKT,QAAQU,yBACd,MAAM,IAAIrB,8BAAAA;EAGd,IAAI,CAAC,KAAKW,QAAQW,0BACd,MAAM,IAAIrB,+BAA+B,sEAAA;EAG7C,MAAMsB,YAAY,MAAM,KAAKC,2BAA2BL,IAAAA;EAExD,MAAMM,QAAQ,MAAM,KAAKZ,gBAAgBa,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKpB,WAAWqB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAIlC,oBAAAA;EAGd,MAAMoC,SAAS,KAAKtB,WAAWuB,MAAMH,QAAQ;GACzCI,eAAe,IAAIC,KACfA,KAAKC,IAAG,IAAM,MAAO,KAAA,EAAK7B,CAAAA,CAC5B8B,YAAW;GACbC,YAAYpC,YAAY,EAAA,CAAA,CAAIqC,SAAS,KAAA;EACzC,CAAA;EAEA,MAAM,KAAK7B,WAAW8B,KAAKR,MAAAA;EAE3B,IAAI;GAKA,MAAMS,WAAW,KAAKhC,QAAQiC,YAC1B,GAAG,KAAKjC,QAAQiC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,wBACpCC,mBAAmBZ,OAAOM,UAAU,EAAA,YACjCM,mBAAmBd,OAAOL,QAAQ,MAC/CoB,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKjC,qBAAqBkC,OAAO;IAChDC,UAAU1C,iBAAiB2C;IAC3BC,QAAQ;KACJC,MAAMnB,OAAOM;KACbc,KAAKX;KACLY,kBAAAA;IACJ;IACAC,QAAQpC,SAASoC;GACrB,CAAA;GAEA,MAAM,KAAK1C,WAAW2C,KAAK;IACvBC,IAAI1B,OAAOF;IACX,GAAGkB;GACP,CAAA;EACJ,QAAQ;GACJ,KAAKpC,WAAWuB,MAAMD,QAAQ;IAC1BM,YAAY;IACZJ,eAAe;GACnB,CAAA;GACA,MAAM,KAAKxB,WAAW8B,KAAKR,MAAAA;GAE3B,MAAM,IAAInC,gBAAgB,uDAAA;EAC9B;EAEA,MAAM,KAAKiB,cAAc2C,OAAO;GAC5BC,OAAOlE,WAAWmE;GAClBhC,MAAMrC,UAAUsE;GAChBC,SAAStE,aAAauE;GACtBC,OAAO/B,OAAOH;GACdmC,WAAWvE,aAAaqE;GACxBG,SAASjC,OAAOH;GAChBqC,WAAWlC,OAAOL;GAClBwC,SAASnC,OAAOP;EACpB,CAAA;EAEA,OAAO,EAAES,eAAeF,OAAOE,cAAe;CAClD;CAEA,MAAMkC,cAAcnD,MAAyD;EACzE,IAAI,CAAC,KAAKR,QAAQU,yBACd,MAAM,IAAIrB,8BAAAA;EAGd,MAAMuB,YAAY,MAAM,KAAKgD,0BAA0BpD,IAAAA;EAEvD,MAAM,KAAKP,WAAW4D,oBAAoBjD,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKZ,gBAAgBa,QAAQH,UAAUI,UAAU,IAAA;EAErE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,YAAYjB,UAAUkD;GACtB9C,UAAUF,MAAMM;EACpB;EAEA,MAAMC,SAAS,MAAM,KAAKpB,WAAW8D,UAAU9C,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAIlC,oBAAAA;EAGd,IAAI,CAACkC,OAAOI,iBAAiB,IAAIC,KAAKL,OAAOI,aAAa,oBAAI,IAAIC,KAAAA,GAC9D,MAAM,IAAInC,uBAAAA;EAId,MAAM0E,iBAAiB,MAAMD,IADEpE,uBACFoE,CAAAA,CAAmBE,QAAQtD,UAAUuD,QAAQ;EAE1E,MAAM5C,SAAS,KAAKtB,WAAWuB,MAAMH,QAAQ;GACzC+C,2BAAU,IAAI1C,KAAAA,EAAAA,CAAOE,YAAW;GAChCC,YAAY;GACZJ,eAAe;GACf0C,UAAUF;EACd,CAAA;EAEA,MAAM,KAAKhE,WAAW8B,KAAKR,MAAAA;EAE3B,MAAM,KAAKlB,cAAc2C,OAAO;GAC5BC,OAAOlE,WAAWmE;GAClBhC,MAAMrC,UAAUwF;GAChBjB,SAAStE,aAAauE;GACtBC,OAAO/B,OAAOH;GACdmC,WAAWvE,aAAaqE;GACxBG,SAASjC,OAAOH;GAChBqC,WAAWlC,OAAOL;GAClBwC,SAASnC,OAAOP;EACpB,CAAA;EAEA,OAAO,EAAEoD,UAAU7C,OAAO6C,SAAU;CACxC;CAEA,MAAcvD,2BAA2BL,MAA2B;EAChE,MAAM8D,YAAY,IAAI5E,UAAe,CAAC,CAAA;EAEtC,MAAM6E,iBAAiB,IAAI7E,UAAU,EAAE8E,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MACX,SACAjF,gBACIG,EAAE+E,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXzD,MAAK,CAAA,CACL0D,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAItEP,eAAeE,MACX,QACAjF,gBAAgBG,EAAE+E,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjBxF,gBAAgBG,EAAEsF,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrC,OAAOZ,UAAUa,IAAI3E,IAAAA;CACzB;CAEA,MAAcoD,0BAA0BpD,MAA2B;EAC/D,MAAM8D,YAAY,IAAI5E,UAAe,CAAC,CAAA;EAEtC,MAAM6E,iBAAiB,IAAI7E,UAAU,EAAE8E,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACAjF,gBACIG,EAAE+E,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXzD,MAAK,CAAA,CACL0D,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAGtEP,eAAeE,MACX,QACAjF,gBAAgBG,EAAE+E,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,YACA,EAAEO,UAAU,KAAK,GACjBxF,gBAAgBG,EAAEsF,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrCZ,UAAUG,MACN,SACAjF,gBAAgBG,EAAE+E,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1Cd,UAAUG,MACN,YACAjF,gBACIG,EAAE+E,OAAM,CAAA,CACHK,IAAI,KAAK/E,QAAQqF,qBAAqBnG,wBAAAA,CAAAA,CACtCkG,IAAInG,wBAAAA,CAAAA,CAAAA;EAIjB,OAAOqF,UAAUa,IAAI3E,IAAAA;CACzB;AACJ"}
+{"version":3,"file":"service.mjs","names":["EventName","EventRefType","EventScope","IdentityType","USER_PASSWORD_MAX_LENGTH","USER_PASSWORD_MIN_LENGTH","EntityNotFoundError","ValidationError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidator","randomBytes","Container","z","UserCredentialsService","MailTemplateName","PASSWORD_RESET_EXPIRES_IN_MINUTES","PasswordRecoveryService","options","repository","realmRepository","mailClient","mailTemplateRenderer","eventService","ctx","forgotPassword","data","context","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realmId","where","name","email","id","entity","findOneByWithEmail","merged","merge","resetExpires","Date","now","toISOString","resetHash","toString","save","resetUrl","publicUrl","replace","encodeURIComponent","undefined","mail","render","template","PASSWORD_RESET","params","code","url","expiresInMinutes","locale","send","to","record","scope","IDENTITY","PASSWORD_RESET_REQUESTED","refType","USER","refId","actorType","actorId","actorName","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","resetAt","PASSWORD_RESET_COMPLETED","validator","oneOfContainer","oneOf","mount","string","trim","toLowerCase","regex","message","min","optional","uuid","nullable","run","max","passwordMinLength"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    USER_PASSWORD_MAX_LENGTH,\n    USER_PASSWORD_MIN_LENGTH,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidator } from '@validup/zod';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IPasswordRecoveryService,\n    PasswordForgotResult,\n    PasswordRecoveryServiceContext,\n    PasswordRecoveryServiceOptions,\n    PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\nimport { PASSWORD_RESET_EXPIRES_IN_MINUTES } from './constants.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n    protected options: PasswordRecoveryServiceOptions;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected eventService?: IEventService;\n\n    constructor(ctx: PasswordRecoveryServiceContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.eventService = ctx.eventService;\n    }\n\n    async forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        if (!this.options.emailVerificationEnabled) {\n            throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n        }\n\n        const validated = await this.runForgotPasswordValidator(data);\n\n        const realm = await this.realmRepository.resolve(validated.realmId, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            realmId: realm.id,\n        };\n\n        const entity = await this.repository.findOneByWithEmail(where);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            resetExpires: new Date(\n                Date.now() + (1000 * 60 * PASSWORD_RESET_EXPIRES_IN_MINUTES),\n            ).toISOString(),\n            resetHash: randomBytes(32).toString('hex'),\n        });\n\n        await this.repository.save(merged);\n\n        try {\n            // realmId MUST ride the link: resetPassword resolves the realm\n            // from the request and filters the lookup by it, so a realm-less\n            // link resolves to the master realm and never matches a\n            // non-master user.\n            const resetUrl = this.options.publicUrl ?\n                `${this.options.publicUrl.replace(/\\/+$/, '')}/password-reset` +\n                `?token=${encodeURIComponent(merged.resetHash!)}` +\n                `&realmId=${encodeURIComponent(entity.realmId)}` :\n                undefined;\n\n            const mail = await this.mailTemplateRenderer.render({\n                template: MailTemplateName.PASSWORD_RESET,\n                params: {\n                    code: merged.resetHash!,\n                    url: resetUrl,\n                    expiresInMinutes: PASSWORD_RESET_EXPIRES_IN_MINUTES,\n                },\n                locale: context?.locale,\n            });\n\n            await this.mailClient.send({\n                to: entity.email,\n                ...mail,\n            });\n        } catch {\n            this.repository.merge(merged, {\n                resetHash: null,\n                resetExpires: null,\n            });\n            await this.repository.save(merged);\n\n            throw new ValidationError('Password recovery failed. Could not send reset email.');\n        }\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.PASSWORD_RESET_REQUESTED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realmId,\n        });\n\n        return { resetExpires: merged.resetExpires! };\n    }\n\n    async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        const validated = await this.runResetPasswordValidator(data);\n\n        await this.repository.validateJoinColumns(validated);\n\n        const realm = await this.realmRepository.resolve(validated.realmId, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            resetHash: validated.token,\n            realmId: realm.id,\n        };\n\n        const entity = await this.repository.findOneBy(where);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!entity.resetExpires || new Date(entity.resetExpires) < new Date()) {\n            throw new ResetTokenExpiredError();\n        }\n\n        const credentialsService = new UserCredentialsService();\n        const hashedPassword = await credentialsService.protect(validated.password);\n\n        const merged = this.repository.merge(entity, {\n            resetAt: new Date().toISOString(),\n            resetHash: null,\n            resetExpires: null,\n            password: hashedPassword,\n        });\n\n        await this.repository.save(merged);\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.PASSWORD_RESET_COMPLETED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realmId,\n        });\n\n        return { resetAt: merged.resetAt! };\n    }\n\n    private async runForgotPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realmId',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        return validator.run(data);\n    }\n\n    private async runResetPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realmId',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        validator.mount(\n            'token',\n            createValidator(z.string().min(3).max(256)),\n        );\n\n        validator.mount(\n            'password',\n            createValidator(\n                z.string()\n                    .min(this.options.passwordMinLength ?? USER_PASSWORD_MIN_LENGTH)\n                    .max(USER_PASSWORD_MAX_LENGTH),\n            ),\n        );\n\n        return validator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAqCA,IAAakB,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,UAAUM,IAAIN;EACnB,KAAKC,aAAaK,IAAIL;EACtB,KAAKC,kBAAkBI,IAAIJ;EAC3B,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,uBAAuBE,IAAIF;EAChC,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,eAAeC,MAA2BC,SAAkE;EAC9G,IAAI,CAAC,KAAKT,QAAQU,yBACd,MAAM,IAAIrB,8BAAAA;EAGd,IAAI,CAAC,KAAKW,QAAQW,0BACd,MAAM,IAAIrB,+BAA+B,sEAAA;EAG7C,MAAMsB,YAAY,MAAM,KAAKC,2BAA2BL,IAAAA;EAExD,MAAMM,QAAQ,MAAM,KAAKZ,gBAAgBa,QAAQH,UAAUI,SAAS,IAAA;EAEpE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,SAASF,MAAMM;EACnB;EAEA,MAAMC,SAAS,MAAM,KAAKpB,WAAWqB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAIlC,oBAAAA;EAGd,MAAMoC,SAAS,KAAKtB,WAAWuB,MAAMH,QAAQ;GACzCI,cAAc,IAAIC,KACdA,KAAKC,IAAG,IAAM,MAAO,KAAA,EAAK7B,CAAAA,CAC5B8B,YAAW;GACbC,WAAWpC,YAAY,EAAA,CAAA,CAAIqC,SAAS,KAAA;EACxC,CAAA;EAEA,MAAM,KAAK7B,WAAW8B,KAAKR,MAAAA;EAE3B,IAAI;GAKA,MAAMS,WAAW,KAAKhC,QAAQiC,YAC1B,GAAG,KAAKjC,QAAQiC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,wBACpCC,mBAAmBZ,OAAOM,SAAS,EAAA,WACjCM,mBAAmBd,OAAOL,OAAO,MAC7CoB,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKjC,qBAAqBkC,OAAO;IAChDC,UAAU1C,iBAAiB2C;IAC3BC,QAAQ;KACJC,MAAMnB,OAAOM;KACbc,KAAKX;KACLY,kBAAAA;IACJ;IACAC,QAAQpC,SAASoC;GACrB,CAAA;GAEA,MAAM,KAAK1C,WAAW2C,KAAK;IACvBC,IAAI1B,OAAOF;IACX,GAAGkB;GACP,CAAA;EACJ,QAAQ;GACJ,KAAKpC,WAAWuB,MAAMD,QAAQ;IAC1BM,WAAW;IACXJ,cAAc;GAClB,CAAA;GACA,MAAM,KAAKxB,WAAW8B,KAAKR,MAAAA;GAE3B,MAAM,IAAInC,gBAAgB,uDAAA;EAC9B;EAEA,MAAM,KAAKiB,cAAc2C,OAAO;GAC5BC,OAAOlE,WAAWmE;GAClBhC,MAAMrC,UAAUsE;GAChBC,SAAStE,aAAauE;GACtBC,OAAO/B,OAAOH;GACdmC,WAAWvE,aAAaqE;GACxBG,SAASjC,OAAOH;GAChBqC,WAAWlC,OAAOL;GAClBF,SAASO,OAAOP;EACpB,CAAA;EAEA,OAAO,EAAES,cAAcF,OAAOE,aAAc;CAChD;CAEA,MAAMiC,cAAclD,MAAyD;EACzE,IAAI,CAAC,KAAKR,QAAQU,yBACd,MAAM,IAAIrB,8BAAAA;EAGd,MAAMuB,YAAY,MAAM,KAAK+C,0BAA0BnD,IAAAA;EAEvD,MAAM,KAAKP,WAAW2D,oBAAoBhD,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKZ,gBAAgBa,QAAQH,UAAUI,SAAS,IAAA;EAEpE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,WAAWjB,UAAUiD;GACrB7C,SAASF,MAAMM;EACnB;EAEA,MAAMC,SAAS,MAAM,KAAKpB,WAAW6D,UAAU7C,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAIlC,oBAAAA;EAGd,IAAI,CAACkC,OAAOI,gBAAgB,IAAIC,KAAKL,OAAOI,YAAY,oBAAI,IAAIC,KAAAA,GAC5D,MAAM,IAAInC,uBAAAA;EAId,MAAMyE,iBAAiB,MAAMD,IADEnE,uBACFmE,CAAAA,CAAmBE,QAAQrD,UAAUsD,QAAQ;EAE1E,MAAM3C,SAAS,KAAKtB,WAAWuB,MAAMH,QAAQ;GACzC8C,0BAAS,IAAIzC,KAAAA,EAAAA,CAAOE,YAAW;GAC/BC,WAAW;GACXJ,cAAc;GACdyC,UAAUF;EACd,CAAA;EAEA,MAAM,KAAK/D,WAAW8B,KAAKR,MAAAA;EAE3B,MAAM,KAAKlB,cAAc2C,OAAO;GAC5BC,OAAOlE,WAAWmE;GAClBhC,MAAMrC,UAAUuF;GAChBhB,SAAStE,aAAauE;GACtBC,OAAO/B,OAAOH;GACdmC,WAAWvE,aAAaqE;GACxBG,SAASjC,OAAOH;GAChBqC,WAAWlC,OAAOL;GAClBF,SAASO,OAAOP;EACpB,CAAA;EAEA,OAAO,EAAEmD,SAAS5C,OAAO4C,QAAS;CACtC;CAEA,MAActD,2BAA2BL,MAA2B;EAChE,MAAM6D,YAAY,IAAI3E,UAAe,CAAC,CAAA;EAEtC,MAAM4E,iBAAiB,IAAI5E,UAAU,EAAE6E,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MACX,SACAhF,gBACIG,EAAE8E,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXxD,MAAK,CAAA,CACLyD,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAItEP,eAAeE,MACX,QACAhF,gBAAgBG,EAAE8E,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,WACA,EAAEO,UAAU,KAAK,GACjBvF,gBAAgBG,EAAEqF,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrC,OAAOZ,UAAUa,IAAI1E,IAAAA;CACzB;CAEA,MAAcmD,0BAA0BnD,MAA2B;EAC/D,MAAM6D,YAAY,IAAI3E,UAAe,CAAC,CAAA;EAEtC,MAAM4E,iBAAiB,IAAI5E,UAAU,EAAE6E,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACAhF,gBACIG,EAAE8E,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXxD,MAAK,CAAA,CACLyD,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAGtEP,eAAeE,MACX,QACAhF,gBAAgBG,EAAE8E,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,WACA,EAAEO,UAAU,KAAK,GACjBvF,gBAAgBG,EAAEqF,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrCZ,UAAUG,MACN,SACAhF,gBAAgBG,EAAE8E,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1Cd,UAAUG,MACN,YACAhF,gBACIG,EAAE8E,OAAM,CAAA,CACHK,IAAI,KAAK9E,QAAQoF,qBAAqBlG,wBAAAA,CAAAA,CACtCiG,IAAIlG,wBAAAA,CAAAA,CAAAA;EAIjB,OAAOoF,UAAUa,IAAI1E,IAAAA;CACzB;AACJ"}

package/dist/core/identity/password-recovery/types.d.ts

@@ -16,10 +16,10 @@ export type PasswordRecoveryServiceContext = {
     eventService?: IEventService;
 };
 export type PasswordForgotResult = {
-    reset_expires: string;
+    resetExpires: string;
 };
 export type PasswordResetResult = {
-    reset_at: string;
+    resetAt: string;
 };
 export interface IPasswordRecoveryService {
     forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult>;

package/dist/core/identity/password-recovery/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,8BAA8B,GAAG;IACzC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;IAClC,YAAY,CAAC,EAAE,aAAa,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/password-recovery/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,MAAM,8BAA8B,GAAG;IACzC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,EAAE,8BAA8B,CAAC;IACxC,UAAU,EAAE,WAAW,CAAC;IACxB,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;IAClC,YAAY,CAAC,EAAE,aAAa,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,YAAY,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5G,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1E"}