@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.54

package/dist/core/identity/permission/checker/service.mjs

@@ -20,7 +20,7 @@ var PermissionCheckerService = class {
 			if (realm) {
 				const realmId = await this.ctx.realmRepository.resolveId(realm);
 				if (!realmId) throw new EntityNotFoundError();
-				criteria.realm_id = realmId;
+				criteria.realmId = realmId;
 			}
 		}
 		const entity = await this.ctx.repository.findOneBy(criteria);
@@ -28,7 +28,7 @@ var PermissionCheckerService = class {
 		const input = { ...data };
 		if (typeof input[BuiltInPolicyType.IDENTITY] === "undefined") input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);
 		const attributes = input[BuiltInPolicyType.ATTRIBUTES];
-		if (attributes && hasOwnProperty(attributes, "realm_id")) input[BuiltInPolicyType.REALM_MATCH] = attributes.realm_id ?? null;
+		if (attributes && hasOwnProperty(attributes, "realmId")) input[BuiltInPolicyType.REALM_MATCH] = attributes.realmId ?? null;
 		const evaluationContext = {
 			name: entity.name,
 			data: definePolicyData(input)

package/dist/core/identity/permission/checker/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionEvaluator","definePolicyData","hasOwnProperty","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PermissionCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","name","realmId","realmRepository","resolveId","realm_id","entity","repository","findOneBy","input","IDENTITY","identity","attributes","ATTRIBUTES","REALM_MATCH","evaluationContext","evaluator","provider","permissionProvider","policyEngine","identityPermissionProvider","has","evaluate","preEvaluate","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/permission/checker/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PermissionEvaluationContext } from '@authup/access';\nimport { BuiltInPolicyType, PermissionEvaluator, definePolicyData } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { hasOwnProperty, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../identity-policy-data.ts';\nimport type {\n    IPermissionCheckerService,\n    PermissionCheckerServiceContext,\n} from './types.ts';\n\nexport class PermissionCheckerService implements IPermissionCheckerService {\n    protected ctx: PermissionCheckerServiceContext;\n\n    constructor(ctx: PermissionCheckerServiceContext) {\n        this.ctx = ctx;\n    }\n\n    async check(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<void> {\n        let criteria: Record<string, any>;\n        if (isUUID(idOrName)) {\n            criteria = { id: idOrName };\n        } else {\n            criteria = { name: idOrName };\n\n            if (realm) {\n                const realmId = await this.ctx.realmRepository.resolveId(realm);\n                if (!realmId) {\n                    throw new EntityNotFoundError();\n                }\n                criteria.realm_id = realmId;\n            }\n        }\n\n        const entity = await this.ctx.repository.findOneBy(criteria);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const input = { ...data };\n        if (typeof input[BuiltInPolicyType.IDENTITY] === 'undefined') {\n            input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n        }\n        // Surface the resource realm to the realm_scope reach factor (realm-match scope mode).\n        // Only when the body carries an ATTRIBUTES realm — so a realm-less check still rides\n        // the preEvaluate path below and neutral-passes.\n        const attributes = input[BuiltInPolicyType.ATTRIBUTES] as Record<string, any> | undefined;\n        if (attributes && hasOwnProperty(attributes, 'realm_id')) {\n            input[BuiltInPolicyType.REALM_MATCH] = attributes.realm_id ?? null;\n        }\n\n        const evaluationContext: PermissionEvaluationContext = {\n            name: entity.name,\n            data: definePolicyData(input),\n        };\n\n        const evaluator = new PermissionEvaluator({\n            provider: this.ctx.permissionProvider,\n            policyEngine: new PolicyEngine(this.ctx.identityPermissionProvider),\n        });\n\n        if (\n            evaluationContext.data &&\n            evaluationContext.data.has(BuiltInPolicyType.ATTRIBUTES)\n        ) {\n            await evaluator.evaluate(evaluationContext);\n        } else {\n            await evaluator.preEvaluate(evaluationContext);\n        }\n    }\n\n    async safeCheck(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Result<null>> {\n        try {\n            await this.check(idOrName, data, actor, realm);\n            return { success: true, data: null };\n        } catch (e) {\n            return { success: false, error: normalizeError(e) };\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaS,2BAAb,MAAaA;CACCC;CAEV,YAAYA,KAAsC;EAC9C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACHI,WAAW,EAAEE,MAAMN,SAAS;GAE5B,IAAIG,OAAO;IACP,MAAMI,UAAU,MAAM,KAAKT,IAAIU,gBAAgBC,UAAUN,KAAAA;IACzD,IAAI,CAACI,SACD,MAAM,IAAId,oBAAAA;IAEdW,SAASM,WAAWH;GACxB;EACJ;EAEA,MAAMI,SAAS,MAAM,KAAKb,IAAIc,WAAWC,UAAUT,QAAAA;EACnD,IAAI,CAACO,QACD,MAAM,IAAIlB,oBAAAA;EAGd,MAAMqB,QAAQ,EAAE,GAAGb,KAAK;EACxB,IAAI,OAAOa,MAAM1B,kBAAkB2B,cAAc,aAC7CD,MAAM1B,kBAAkB2B,YAAYnB,qBAAqBM,MAAMc,QAAQ;EAK3E,MAAMC,aAAaH,MAAM1B,kBAAkB8B;EAC3C,IAAID,cAAc1B,eAAe0B,YAAY,UAAA,GACzCH,MAAM1B,kBAAkB+B,eAAeF,WAAWP,YAAY;EAGlE,MAAMU,oBAAiD;GACnDd,MAAMK,OAAOL;GACbL,MAAMX,iBAAiBwB,KAAAA;EAC3B;EAEA,MAAMO,YAAY,IAAIhC,oBAAoB;GACtCiC,UAAU,KAAKxB,IAAIyB;GACnBC,cAAc,IAAI7B,eAAa,KAAKG,IAAI2B,0BAA0B;EACtE,CAAA;EAEA,IACIL,kBAAkBnB,QAClBmB,kBAAkBnB,KAAKyB,IAAItC,kBAAkB8B,UAAU,GAEvD,MAAMG,UAAUM,SAASP,iBAAAA;OAEzB,MAAMC,UAAUO,YAAYR,iBAAAA;CAEpC;CAEA,MAAMS,UACF7B,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAE2B,SAAS;IAAM7B,MAAM;GAAK;EACvC,SAAS8B,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAOtC,eAAeqC,CAAAA;GAAG;EACtD;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionEvaluator","definePolicyData","hasOwnProperty","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PermissionCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","name","realmId","realmRepository","resolveId","entity","repository","findOneBy","input","IDENTITY","identity","attributes","ATTRIBUTES","REALM_MATCH","evaluationContext","evaluator","provider","permissionProvider","policyEngine","identityPermissionProvider","has","evaluate","preEvaluate","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/permission/checker/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PermissionEvaluationContext } from '@authup/access';\nimport { BuiltInPolicyType, PermissionEvaluator, definePolicyData } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { hasOwnProperty, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../identity-policy-data.ts';\nimport type {\n    IPermissionCheckerService,\n    PermissionCheckerServiceContext,\n} from './types.ts';\n\nexport class PermissionCheckerService implements IPermissionCheckerService {\n    protected ctx: PermissionCheckerServiceContext;\n\n    constructor(ctx: PermissionCheckerServiceContext) {\n        this.ctx = ctx;\n    }\n\n    async check(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<void> {\n        let criteria: Record<string, any>;\n        if (isUUID(idOrName)) {\n            criteria = { id: idOrName };\n        } else {\n            criteria = { name: idOrName };\n\n            if (realm) {\n                const realmId = await this.ctx.realmRepository.resolveId(realm);\n                if (!realmId) {\n                    throw new EntityNotFoundError();\n                }\n                criteria.realmId = realmId;\n            }\n        }\n\n        const entity = await this.ctx.repository.findOneBy(criteria);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const input = { ...data };\n        if (typeof input[BuiltInPolicyType.IDENTITY] === 'undefined') {\n            input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n        }\n        // Surface the resource realm to the realm_scope reach factor (realm-match scope mode).\n        // Only when the body carries an ATTRIBUTES realm — so a realm-less check still rides\n        // the preEvaluate path below and neutral-passes.\n        const attributes = input[BuiltInPolicyType.ATTRIBUTES] as Record<string, any> | undefined;\n        if (attributes && hasOwnProperty(attributes, 'realmId')) {\n            input[BuiltInPolicyType.REALM_MATCH] = attributes.realmId ?? null;\n        }\n\n        const evaluationContext: PermissionEvaluationContext = {\n            name: entity.name,\n            data: definePolicyData(input),\n        };\n\n        const evaluator = new PermissionEvaluator({\n            provider: this.ctx.permissionProvider,\n            policyEngine: new PolicyEngine(this.ctx.identityPermissionProvider),\n        });\n\n        if (\n            evaluationContext.data &&\n            evaluationContext.data.has(BuiltInPolicyType.ATTRIBUTES)\n        ) {\n            await evaluator.evaluate(evaluationContext);\n        } else {\n            await evaluator.preEvaluate(evaluationContext);\n        }\n    }\n\n    async safeCheck(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Result<null>> {\n        try {\n            await this.check(idOrName, data, actor, realm);\n            return { success: true, data: null };\n        } catch (e) {\n            return { success: false, error: normalizeError(e) };\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaS,2BAAb,MAAaA;CACCC;CAEV,YAAYA,KAAsC;EAC9C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACHI,WAAW,EAAEE,MAAMN,SAAS;GAE5B,IAAIG,OAAO;IACP,MAAMI,UAAU,MAAM,KAAKT,IAAIU,gBAAgBC,UAAUN,KAAAA;IACzD,IAAI,CAACI,SACD,MAAM,IAAId,oBAAAA;IAEdW,SAASG,UAAUA;GACvB;EACJ;EAEA,MAAMG,SAAS,MAAM,KAAKZ,IAAIa,WAAWC,UAAUR,QAAAA;EACnD,IAAI,CAACM,QACD,MAAM,IAAIjB,oBAAAA;EAGd,MAAMoB,QAAQ,EAAE,GAAGZ,KAAK;EACxB,IAAI,OAAOY,MAAMzB,kBAAkB0B,cAAc,aAC7CD,MAAMzB,kBAAkB0B,YAAYlB,qBAAqBM,MAAMa,QAAQ;EAK3E,MAAMC,aAAaH,MAAMzB,kBAAkB6B;EAC3C,IAAID,cAAczB,eAAeyB,YAAY,SAAA,GACzCH,MAAMzB,kBAAkB8B,eAAeF,WAAWT,WAAW;EAGjE,MAAMY,oBAAiD;GACnDb,MAAMI,OAAOJ;GACbL,MAAMX,iBAAiBuB,KAAAA;EAC3B;EAEA,MAAMO,YAAY,IAAI/B,oBAAoB;GACtCgC,UAAU,KAAKvB,IAAIwB;GACnBC,cAAc,IAAI5B,eAAa,KAAKG,IAAI0B,0BAA0B;EACtE,CAAA;EAEA,IACIL,kBAAkBlB,QAClBkB,kBAAkBlB,KAAKwB,IAAIrC,kBAAkB6B,UAAU,GAEvD,MAAMG,UAAUM,SAASP,iBAAAA;OAEzB,MAAMC,UAAUO,YAAYR,iBAAAA;CAEpC;CAEA,MAAMS,UACF5B,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAE0B,SAAS;IAAM5B,MAAM;GAAK;EACvC,SAAS6B,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAOrC,eAAeoC,CAAAA;GAAG;EACtD;CACJ;AACJ"}

package/dist/core/identity/permission/identity-policy-data.mjs

@@ -8,9 +8,9 @@ function toIdentityPolicyData(identity) {
 	const { type, data } = identity;
 	let clientId;
 	if (type === IdentityType.CLIENT) clientId = data.id;
-	else if ("client_id" in data) clientId = data.client_id ?? null;
+	else if ("clientId" in data) clientId = data.clientId ?? null;
 	else clientId = null;
-	let realmId = data.realm_id ?? null;
+	let realmId = data.realmId ?? null;
 	if (!realmId && data.realm && data.realm.id) realmId = data.realm.id ?? null;
 	return {
 		type,

package/dist/core/identity/permission/identity-policy-data.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"identity-policy-data.mjs","names":["IdentityType","toIdentityPolicyData","identity","undefined","type","data","clientId","CLIENT","id","client_id","realmId","realm_id","realm","realmName","name"],"sources":["../../../../src/core/identity/permission/identity-policy-data.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityPolicyData } from '@authup/access';\nimport { IdentityType } from '@authup/core-kit';\nimport type { Identity } from '@authup/core-kit';\n\nexport function toIdentityPolicyData(identity: Identity | undefined): IdentityPolicyData | undefined {\n    if (!identity) {\n        return undefined;\n    }\n\n    const { type, data } = identity;\n\n    let clientId: string | null;\n    if (type === IdentityType.CLIENT) {\n        clientId = data.id;\n    } else if ('client_id' in data) {\n        clientId = data.client_id ?? null;\n    } else {\n        clientId = null;\n    }\n\n    let realmId: string | null = data.realm_id ?? null;\n    if (!realmId && data.realm && data.realm.id) {\n        realmId = data.realm.id ?? null;\n    }\n\n    return {\n        type,\n        id: data.id,\n        clientId,\n        realmId,\n        realmName: data.realm?.name ?? null,\n    };\n}\n"],"mappings":";;;;;AAWA,SAAgBC,qBAAqBC,UAA8B;CAC/D,IAAI,CAACA,UACD;CAGJ,MAAM,EAAEE,MAAMC,SAASH;CAEvB,IAAII;CACJ,IAAIF,SAASJ,aAAaO,QACtBD,WAAWD,KAAKG;MACb,IAAI,eAAeH,MACtBC,WAAWD,KAAKI,aAAa;MAE7BH,WAAW;CAGf,IAAII,UAAyBL,KAAKM,YAAY;CAC9C,IAAI,CAACD,WAAWL,KAAKO,SAASP,KAAKO,MAAMJ,IACrCE,UAAUL,KAAKO,MAAMJ,MAAM;CAG/B,OAAO;EACHJ;EACAI,IAAIH,KAAKG;EACTF;EACAI;EACAG,WAAWR,KAAKO,OAAOE,QAAQ;CACnC;AACJ"}
+{"version":3,"file":"identity-policy-data.mjs","names":["IdentityType","toIdentityPolicyData","identity","undefined","type","data","clientId","CLIENT","id","realmId","realm","realmName","name"],"sources":["../../../../src/core/identity/permission/identity-policy-data.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityPolicyData } from '@authup/access';\nimport { IdentityType } from '@authup/core-kit';\nimport type { Identity } from '@authup/core-kit';\n\nexport function toIdentityPolicyData(identity: Identity | undefined): IdentityPolicyData | undefined {\n    if (!identity) {\n        return undefined;\n    }\n\n    const { type, data } = identity;\n\n    let clientId: string | null;\n    if (type === IdentityType.CLIENT) {\n        clientId = data.id;\n    } else if ('clientId' in data) {\n        clientId = data.clientId ?? null;\n    } else {\n        clientId = null;\n    }\n\n    let realmId: string | null = data.realmId ?? null;\n    if (!realmId && data.realm && data.realm.id) {\n        realmId = data.realm.id ?? null;\n    }\n\n    return {\n        type,\n        id: data.id,\n        clientId,\n        realmId,\n        realmName: data.realm?.name ?? null,\n    };\n}\n"],"mappings":";;;;;AAWA,SAAgBC,qBAAqBC,UAA8B;CAC/D,IAAI,CAACA,UACD;CAGJ,MAAM,EAAEE,MAAMC,SAASH;CAEvB,IAAII;CACJ,IAAIF,SAASJ,aAAaO,QACtBD,WAAWD,KAAKG;MACb,IAAI,cAAcH,MACrBC,WAAWD,KAAKC,YAAY;MAE5BA,WAAW;CAGf,IAAIG,UAAyBJ,KAAKI,WAAW;CAC7C,IAAI,CAACA,WAAWJ,KAAKK,SAASL,KAAKK,MAAMF,IACrCC,UAAUJ,KAAKK,MAAMF,MAAM;CAG/B,OAAO;EACHJ;EACAI,IAAIH,KAAKG;EACTF;EACAG;EACAE,WAAWN,KAAKK,OAAOE,QAAQ;CACnC;AACJ"}

package/dist/core/identity/permission/junction-grant.d.ts

@@ -2,7 +2,7 @@ import { RealmScope } from '@authup/access';
 import type { ResolveJunctionGrantResult } from './types.ts';
 /**
  * The privilege-escalation boundary for permission-binding junctions, shared verbatim by
- * role/user/client/robot-permission. Kept in ONE place (rather than copied into each service)
+ * role/user/client-permission. Kept in ONE place (rather than copied into each service)
  * so the fail-closed cap/inherit rule is audited and changed once — see #3160 / #3158 / #3159,
  * which each had to patch this rule across all four services.
  *
@@ -12,9 +12,9 @@ import type { ResolveJunctionGrantResult } from './types.ts';
 /**
  * Cap a junction CREATE to the actor's request-relative selected grant and inherit its policy.
  *
- * - `realm_scope` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).
+ * - `realmScope` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).
  * - The policy follows the grant: only a genuinely unrestricted actor (an UNCAPPED `any` reach
- *   AND no policy) may keep an explicitly-requested `policy_id`; any restricted/policy-bound
+ *   AND no policy) may keep an explicitly-requested `policyId`; any restricted/policy-bound
  *   actor inherits its own grant's policy (it can neither attach an unowned policy nor detach to
  *   widen). The check reads `grant.realmScope` UNCAPPED precisely to distinguish that case — the
  *   grant is returned uncapped by `resolveJunctionGrant` for exactly this reason.
@@ -35,13 +35,13 @@ export type BuildJunctionUpdateDataInput = {
     actorPolicyId: string | null;
 };
 /**
- * Build the `{ realm_scope?, policy_id? }` delta for a junction UPDATE, capped to the actor's
+ * Build the `{ realmScope?, policyId? }` delta for a junction UPDATE, capped to the actor's
  * request-relative grant.
  *
- * - An unrestricted (`any`, policy-free) actor may set/clear `policy_id` explicitly and is never
+ * - An unrestricted (`any`, policy-free) actor may set/clear `policyId` explicitly and is never
  *   narrowed.
  * - A restricted/policy-bound actor that touches the binding inherits its own grant's policy AND
- *   has the reach re-capped — including the EXISTING `realm_scope` when the update omits it, so a
+ *   has the reach re-capped — including the EXISTING `realmScope` when the update omits it, so a
  *   policy-only edit cannot leave a wider pre-existing reach standing (fail-OPEN otherwise: the
  *   persisted binding must always be dominated by a grant the actor really holds — #3160).
  */

package/dist/core/identity/permission/junction-grant.mjs

@@ -6,7 +6,7 @@ import { RealmScope, minRealmScope } from "@authup/access";
 //#region src/core/identity/permission/junction-grant.ts
 /**
 * The privilege-escalation boundary for permission-binding junctions, shared verbatim by
-* role/user/client/robot-permission. Kept in ONE place (rather than copied into each service)
+* role/user/client-permission. Kept in ONE place (rather than copied into each service)
 * so the fail-closed cap/inherit rule is audited and changed once — see #3160 / #3158 / #3159,
 * which each had to patch this rule across all four services.
 *
@@ -15,39 +15,39 @@ import { RealmScope, minRealmScope } from "@authup/access";
 */ /**
 * Cap a junction CREATE to the actor's request-relative selected grant and inherit its policy.
 *
-* - `realm_scope` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).
+* - `realmScope` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).
 * - The policy follows the grant: only a genuinely unrestricted actor (an UNCAPPED `any` reach
-*   AND no policy) may keep an explicitly-requested `policy_id`; any restricted/policy-bound
+*   AND no policy) may keep an explicitly-requested `policyId`; any restricted/policy-bound
 *   actor inherits its own grant's policy (it can neither attach an unowned policy nor detach to
 *   widen). The check reads `grant.realmScope` UNCAPPED precisely to distinguish that case — the
 *   grant is returned uncapped by `resolveJunctionGrant` for exactly this reason.
 *
 * Mutates `validated` in place (mirrors the surrounding service style).
 */ function applyJunctionCreateGrant(validated, grant) {
-	validated.realm_scope = minRealmScope([validated.realm_scope ?? RealmScope.OWN, grant.realmScope]);
-	if (grant.realmScope !== RealmScope.ANY || grant.policy) validated.policy_id = grant.policy ? grant.policy.id : null;
+	validated.realmScope = minRealmScope([validated.realmScope ?? RealmScope.OWN, grant.realmScope]);
+	if (grant.realmScope !== RealmScope.ANY || grant.policy) validated.policyId = grant.policy ? grant.policy.id : null;
 }
 /**
-* Build the `{ realm_scope?, policy_id? }` delta for a junction UPDATE, capped to the actor's
+* Build the `{ realmScope?, policyId? }` delta for a junction UPDATE, capped to the actor's
 * request-relative grant.
 *
-* - An unrestricted (`any`, policy-free) actor may set/clear `policy_id` explicitly and is never
+* - An unrestricted (`any`, policy-free) actor may set/clear `policyId` explicitly and is never
 *   narrowed.
 * - A restricted/policy-bound actor that touches the binding inherits its own grant's policy AND
-*   has the reach re-capped — including the EXISTING `realm_scope` when the update omits it, so a
+*   has the reach re-capped — including the EXISTING `realmScope` when the update omits it, so a
 *   policy-only edit cannot leave a wider pre-existing reach standing (fail-OPEN otherwise: the
 *   persisted binding must always be dominated by a grant the actor really holds — #3160).
 */ function buildJunctionUpdateData(input) {
 	const { data, existingScope, actorScope, actorPolicyFree, actorPolicyId } = input;
 	const updateData = {};
-	const touchesScope = hasOwnProperty(data, "realm_scope");
-	const touchesPolicy = hasOwnProperty(data, "policy_id");
-	if (touchesScope) updateData.realm_scope = minRealmScope([data.realm_scope, actorScope]);
+	const touchesScope = hasOwnProperty(data, "realmScope");
+	const touchesPolicy = hasOwnProperty(data, "policyId");
+	if (touchesScope) updateData.realmScope = minRealmScope([data.realmScope, actorScope]);
 	if (actorScope === RealmScope.ANY && actorPolicyFree) {
-		if (touchesPolicy) updateData.policy_id = data.policy_id;
+		if (touchesPolicy) updateData.policyId = data.policyId;
 	} else if (touchesScope || touchesPolicy) {
-		updateData.policy_id = actorPolicyId;
-		if (!touchesScope) updateData.realm_scope = minRealmScope([existingScope, actorScope]);
+		updateData.policyId = actorPolicyId;
+		if (!touchesScope) updateData.realmScope = minRealmScope([existingScope, actorScope]);
 	}
 	return updateData;
 }

package/dist/core/identity/permission/junction-grant.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"junction-grant.mjs","names":["RealmScope","minRealmScope","hasOwnProperty","applyJunctionCreateGrant","validated","grant","realm_scope","OWN","realmScope","ANY","policy","policy_id","id","buildJunctionUpdateData","input","data","existingScope","actorScope","actorPolicyFree","actorPolicyId","updateData","touchesScope","touchesPolicy"],"sources":["../../../../src/core/identity/permission/junction-grant.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { RealmScope, minRealmScope } from '@authup/access';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { ResolveJunctionGrantResult } from './types.ts';\n\n/**\n * The privilege-escalation boundary for permission-binding junctions, shared verbatim by\n * role/user/client/robot-permission. Kept in ONE place (rather than copied into each service)\n * so the fail-closed cap/inherit rule is audited and changed once — see #3160 / #3158 / #3159,\n * which each had to patch this rule across all four services.\n *\n * It depends on a server-core type (`ResolveJunctionGrantResult`) and so cannot live on the\n * generic `JunctionEntityService` in `@authup/server-kit` (that would invert the layering).\n */\n\n/**\n * Cap a junction CREATE to the actor's request-relative selected grant and inherit its policy.\n *\n * - `realm_scope` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).\n * - The policy follows the grant: only a genuinely unrestricted actor (an UNCAPPED `any` reach\n *   AND no policy) may keep an explicitly-requested `policy_id`; any restricted/policy-bound\n *   actor inherits its own grant's policy (it can neither attach an unowned policy nor detach to\n *   widen). The check reads `grant.realmScope` UNCAPPED precisely to distinguish that case — the\n *   grant is returned uncapped by `resolveJunctionGrant` for exactly this reason.\n *\n * Mutates `validated` in place (mirrors the surrounding service style).\n */\nexport function applyJunctionCreateGrant(\n    validated: Record<string, any>,\n    grant: ResolveJunctionGrantResult,\n): void {\n    validated.realm_scope = minRealmScope([validated.realm_scope ?? RealmScope.OWN, grant.realmScope]);\n\n    if (grant.realmScope !== RealmScope.ANY || grant.policy) {\n        validated.policy_id = grant.policy ? grant.policy.id : null;\n    }\n}\n\nexport type BuildJunctionUpdateDataInput = {\n    /** The validated update payload (UPDATE group) — presence of a key signals caller intent. */\n    data: Record<string, any>,\n    /** The persisted junction's current reach (used to re-cap a policy-only edit). */\n    existingScope: `${RealmScope}`,\n    /** The actor's UNCAPPED selected reach for this permission (`any` for system context). */\n    actorScope: `${RealmScope}`,\n    /** Whether the actor's selected grant carries no policy. */\n    actorPolicyFree: boolean,\n    /** The id of the actor's selected grant policy (null when policy-free). */\n    actorPolicyId: string | null,\n};\n\n/**\n * Build the `{ realm_scope?, policy_id? }` delta for a junction UPDATE, capped to the actor's\n * request-relative grant.\n *\n * - An unrestricted (`any`, policy-free) actor may set/clear `policy_id` explicitly and is never\n *   narrowed.\n * - A restricted/policy-bound actor that touches the binding inherits its own grant's policy AND\n *   has the reach re-capped — including the EXISTING `realm_scope` when the update omits it, so a\n *   policy-only edit cannot leave a wider pre-existing reach standing (fail-OPEN otherwise: the\n *   persisted binding must always be dominated by a grant the actor really holds — #3160).\n */\nexport function buildJunctionUpdateData(input: BuildJunctionUpdateDataInput): Record<string, any> {\n    const {\n        data, \n        existingScope, \n        actorScope, \n        actorPolicyFree, \n        actorPolicyId,\n    } = input;\n\n    const updateData: Record<string, any> = {};\n\n    const touchesScope = hasOwnProperty(data, 'realm_scope');\n    const touchesPolicy = hasOwnProperty(data, 'policy_id');\n\n    // CAP to the actor's ceiling — a restricted actor may narrow but never widen.\n    // (`data` is the validated UPDATE payload, so realm_scope is already a valid enum value;\n    // minRealmScope additionally normalizes any out-of-band input fail-closed to `own`.)\n    if (touchesScope) {\n        updateData.realm_scope = minRealmScope([data.realm_scope as `${RealmScope}`, actorScope]);\n    }\n\n    if (actorScope === RealmScope.ANY && actorPolicyFree) {\n        if (touchesPolicy) {\n            updateData.policy_id = data.policy_id;\n        }\n    } else if (touchesScope || touchesPolicy) {\n        updateData.policy_id = actorPolicyId;\n\n        if (!touchesScope) {\n            updateData.realm_scope = minRealmScope([existingScope, actorScope]);\n        }\n    }\n\n    return updateData;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;GAiCA,SAAgBG,yBACZC,WACAC,OAAiC;CAEjCD,UAAUE,cAAcL,cAAc,CAACG,UAAUE,eAAeN,WAAWO,KAAKF,MAAMG,UAAAA,CAAW;CAEjG,IAAIH,MAAMG,eAAeR,WAAWS,OAAOJ,MAAMK,QAC7CN,UAAUO,YAAYN,MAAMK,SAASL,MAAMK,OAAOE,KAAK;AAE/D;;;;;;;;;;;GA0BA,SAAgBC,wBAAwBC,OAAmC;CACvE,MAAM,EACFC,MACAC,eACAC,YACAC,iBACAC,kBACAL;CAEJ,MAAMM,aAAkC,CAAC;CAEzC,MAAMC,eAAenB,eAAea,MAAM,aAAA;CAC1C,MAAMO,gBAAgBpB,eAAea,MAAM,WAAA;CAK3C,IAAIM,cACAD,WAAWd,cAAcL,cAAc,CAACc,KAAKT,aAAgCW,UAAAA,CAAW;CAG5F,IAAIA,eAAejB,WAAWS,OAAOS;MAC7BI,eACAF,WAAWT,YAAYI,KAAKJ;CAAAA,OAE7B,IAAIU,gBAAgBC,eAAe;EACtCF,WAAWT,YAAYQ;EAEvB,IAAI,CAACE,cACDD,WAAWd,cAAcL,cAAc,CAACe,eAAeC,UAAAA,CAAW;CAE1E;CAEA,OAAOG;AACX"}
+{"version":3,"file":"junction-grant.mjs","names":["RealmScope","minRealmScope","hasOwnProperty","applyJunctionCreateGrant","validated","grant","realmScope","OWN","ANY","policy","policyId","id","buildJunctionUpdateData","input","data","existingScope","actorScope","actorPolicyFree","actorPolicyId","updateData","touchesScope","touchesPolicy"],"sources":["../../../../src/core/identity/permission/junction-grant.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { RealmScope, minRealmScope } from '@authup/access';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { ResolveJunctionGrantResult } from './types.ts';\n\n/**\n * The privilege-escalation boundary for permission-binding junctions, shared verbatim by\n * role/user/client-permission. Kept in ONE place (rather than copied into each service)\n * so the fail-closed cap/inherit rule is audited and changed once — see #3160 / #3158 / #3159,\n * which each had to patch this rule across all four services.\n *\n * It depends on a server-core type (`ResolveJunctionGrantResult`) and so cannot live on the\n * generic `JunctionEntityService` in `@authup/server-kit` (that would invert the layering).\n */\n\n/**\n * Cap a junction CREATE to the actor's request-relative selected grant and inherit its policy.\n *\n * - `realmScope` is capped to the actor's selected reach (`min(requested, grant.realmScope)`).\n * - The policy follows the grant: only a genuinely unrestricted actor (an UNCAPPED `any` reach\n *   AND no policy) may keep an explicitly-requested `policyId`; any restricted/policy-bound\n *   actor inherits its own grant's policy (it can neither attach an unowned policy nor detach to\n *   widen). The check reads `grant.realmScope` UNCAPPED precisely to distinguish that case — the\n *   grant is returned uncapped by `resolveJunctionGrant` for exactly this reason.\n *\n * Mutates `validated` in place (mirrors the surrounding service style).\n */\nexport function applyJunctionCreateGrant(\n    validated: Record<string, any>,\n    grant: ResolveJunctionGrantResult,\n): void {\n    validated.realmScope = minRealmScope([validated.realmScope ?? RealmScope.OWN, grant.realmScope]);\n\n    if (grant.realmScope !== RealmScope.ANY || grant.policy) {\n        validated.policyId = grant.policy ? grant.policy.id : null;\n    }\n}\n\nexport type BuildJunctionUpdateDataInput = {\n    /** The validated update payload (UPDATE group) — presence of a key signals caller intent. */\n    data: Record<string, any>,\n    /** The persisted junction's current reach (used to re-cap a policy-only edit). */\n    existingScope: `${RealmScope}`,\n    /** The actor's UNCAPPED selected reach for this permission (`any` for system context). */\n    actorScope: `${RealmScope}`,\n    /** Whether the actor's selected grant carries no policy. */\n    actorPolicyFree: boolean,\n    /** The id of the actor's selected grant policy (null when policy-free). */\n    actorPolicyId: string | null,\n};\n\n/**\n * Build the `{ realmScope?, policyId? }` delta for a junction UPDATE, capped to the actor's\n * request-relative grant.\n *\n * - An unrestricted (`any`, policy-free) actor may set/clear `policyId` explicitly and is never\n *   narrowed.\n * - A restricted/policy-bound actor that touches the binding inherits its own grant's policy AND\n *   has the reach re-capped — including the EXISTING `realmScope` when the update omits it, so a\n *   policy-only edit cannot leave a wider pre-existing reach standing (fail-OPEN otherwise: the\n *   persisted binding must always be dominated by a grant the actor really holds — #3160).\n */\nexport function buildJunctionUpdateData(input: BuildJunctionUpdateDataInput): Record<string, any> {\n    const {\n        data, \n        existingScope, \n        actorScope, \n        actorPolicyFree, \n        actorPolicyId,\n    } = input;\n\n    const updateData: Record<string, any> = {};\n\n    const touchesScope = hasOwnProperty(data, 'realmScope');\n    const touchesPolicy = hasOwnProperty(data, 'policyId');\n\n    // CAP to the actor's ceiling — a restricted actor may narrow but never widen.\n    // (`data` is the validated UPDATE payload, so realmScope is already a valid enum value;\n    // minRealmScope additionally normalizes any out-of-band input fail-closed to `own`.)\n    if (touchesScope) {\n        updateData.realmScope = minRealmScope([data.realmScope as `${RealmScope}`, actorScope]);\n    }\n\n    if (actorScope === RealmScope.ANY && actorPolicyFree) {\n        if (touchesPolicy) {\n            updateData.policyId = data.policyId;\n        }\n    } else if (touchesScope || touchesPolicy) {\n        updateData.policyId = actorPolicyId;\n\n        if (!touchesScope) {\n            updateData.realmScope = minRealmScope([existingScope, actorScope]);\n        }\n    }\n\n    return updateData;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;GAiCA,SAAgBG,yBACZC,WACAC,OAAiC;CAEjCD,UAAUE,aAAaL,cAAc,CAACG,UAAUE,cAAcN,WAAWO,KAAKF,MAAMC,UAAAA,CAAW;CAE/F,IAAID,MAAMC,eAAeN,WAAWQ,OAAOH,MAAMI,QAC7CL,UAAUM,WAAWL,MAAMI,SAASJ,MAAMI,OAAOE,KAAK;AAE9D;;;;;;;;;;;GA0BA,SAAgBC,wBAAwBC,OAAmC;CACvE,MAAM,EACFC,MACAC,eACAC,YACAC,iBACAC,kBACAL;CAEJ,MAAMM,aAAkC,CAAC;CAEzC,MAAMC,eAAelB,eAAeY,MAAM,YAAA;CAC1C,MAAMO,gBAAgBnB,eAAeY,MAAM,UAAA;CAK3C,IAAIM,cACAD,WAAWb,aAAaL,cAAc,CAACa,KAAKR,YAA+BU,UAAAA,CAAW;CAG1F,IAAIA,eAAehB,WAAWQ,OAAOS;MAC7BI,eACAF,WAAWT,WAAWI,KAAKJ;CAAAA,OAE5B,IAAIU,gBAAgBC,eAAe;EACtCF,WAAWT,WAAWQ;EAEtB,IAAI,CAACE,cACDD,WAAWb,aAAaL,cAAc,CAACc,eAAeC,UAAAA,CAAW;CAEzE;CAEA,OAAOG;AACX"}

package/dist/core/identity/permission/module.d.ts

@@ -1,6 +1,5 @@
 import type { IdentityPolicyData, PermissionPolicyBinding } from '@authup/access';
 import type { IClientRepository } from '../../entities/client/types.ts';
-import type { IRobotRepository } from '../../entities/robot/types.ts';
 import type { IRoleRepository } from '../../entities/role/types.ts';
 import type { IUserRepository } from '../../entities/user/types.ts';
 import type { IIdentityRoleProvider } from '../role/types.ts';
@@ -9,7 +8,6 @@ export declare class IdentityPermissionProvider implements IIdentityPermissionPr
     protected clientRepository: IClientRepository;
     protected userRepository: IUserRepository;
     protected roleRepository: IRoleRepository;
-    protected robotRepository: IRobotRepository;
     protected roleProvider: IIdentityRoleProvider;
     constructor(ctx: IdentityPermissionProviderContext);
     isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData): Promise<boolean>;
@@ -17,7 +15,6 @@ export declare class IdentityPermissionProvider implements IIdentityPermissionPr
     getFor(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
     getForClient(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
     getForUser(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
-    getForRobot(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
     getForRole(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
     private combineWithRoleBindings;
     private reduceBindingsByIdentityClient;

package/dist/core/identity/permission/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,kBAAkB,EAElB,uBAAuB,EAC1B,MAAM,gBAAgB,CAAC;AAWxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EACR,2BAA2B,EAC3B,iCAAiC,EACjC,0BAA0B,EAC1B,4BAA4B,EAC/B,MAAM,YAAY,CAAC;AAEpB,qBAAa,0BAA2B,YAAW,2BAA2B;IAC1E,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,YAAY,EAAE,qBAAqB,CAAC;gBAElC,GAAG,EAAE,iCAAiC;IAQ5C,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,OAAO,CAAC;IAgCpF,oBAAoB,CACtB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,4BAA4B,GACtC,OAAO,CAAC,0BAA0B,CAAC;IA6DhC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAmBzE,YAAY,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAO/E,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAQ7E,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAQ9E,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YAKrE,uBAAuB;IAmBrC,OAAO,CAAC,8BAA8B;CAUzC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,kBAAkB,EAElB,uBAAuB,EAC1B,MAAM,gBAAgB,CAAC;AAWxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EACR,2BAA2B,EAC3B,iCAAiC,EACjC,0BAA0B,EAC1B,4BAA4B,EAC/B,MAAM,YAAY,CAAC;AAEpB,qBAAa,0BAA2B,YAAW,2BAA2B;IAC1E,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,YAAY,EAAE,qBAAqB,CAAC;gBAElC,GAAG,EAAE,iCAAiC;IAO5C,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,OAAO,CAAC;IAgCpF,oBAAoB,CACtB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,4BAA4B,GACtC,OAAO,CAAC,0BAA0B,CAAC;IA6DhC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAgBzE,YAAY,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAO/E,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAQ7E,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YAKrE,uBAAuB;IAmBrC,OAAO,CAAC,8BAA8B;CAUzC"}

package/dist/core/identity/permission/module.mjs

@@ -8,13 +8,11 @@ var IdentityPermissionProvider = class {
 	clientRepository;
 	userRepository;
 	roleRepository;
-	robotRepository;
 	roleProvider;
 	constructor(ctx) {
 		this.clientRepository = ctx.clientRepository;
 		this.userRepository = ctx.userRepository;
 		this.roleRepository = ctx.roleRepository;
-		this.robotRepository = ctx.robotRepository;
 		this.roleProvider = ctx.roleProvider;
 	}
 	async isSuperset(parent, child) {
@@ -31,10 +29,10 @@ var IdentityPermissionProvider = class {
 		const matching = (await this.getFor(identity)).filter((b) => {
 			if (b.permission.name !== options.name) return false;
 			if (typeof options.realmId !== "undefined") {
-				if ((b.permission.realm_id ?? null) !== (options.realmId ?? null)) return false;
+				if ((b.permission.realmId ?? null) !== (options.realmId ?? null)) return false;
 			}
 			if (typeof options.clientId !== "undefined") {
-				if ((b.permission.client_id ?? null) !== (options.clientId ?? null)) return false;
+				if ((b.permission.clientId ?? null) !== (options.clientId ?? null)) return false;
 			}
 			return true;
 		});
@@ -49,14 +47,13 @@ var IdentityPermissionProvider = class {
 		}
 		return {
 			policy,
-			realmScope: selected.realm_scope
+			realmScope: selected.realmScope
 		};
 	}
 	async getFor(identity) {
 		switch (identity.type) {
 			case "client": return this.getForClient(identity);
 			case "user": return this.getForUser(identity);
-			case "robot": return this.getForRobot(identity);
 			case "role": return this.getForRole(identity);
 		}
 		return [];
@@ -67,9 +64,6 @@ var IdentityPermissionProvider = class {
 	async getForUser(identity) {
 		return this.combineWithRoleBindings(this.userRepository.getBoundPermissions(identity.id).then((data) => this.reduceBindingsByIdentityClient(data, identity)), identity);
 	}
-	async getForRobot(identity) {
-		return this.combineWithRoleBindings(this.robotRepository.getBoundPermissions(identity.id).then((data) => this.reduceBindingsByIdentityClient(data, identity)), identity);
-	}
 	async getForRole(identity) {
 		return this.roleRepository.getBoundPermissions(identity.id).then((data) => this.reduceBindingsByIdentityClient(data, identity));
 	}
@@ -81,19 +75,19 @@ var IdentityPermissionProvider = class {
 	}
 	reduceBindingsByIdentityClient(bindings, identity) {
 		if (!identity.clientId) return bindings;
-		return bindings.filter((binding) => binding.permission.client_id === identity.clientId);
+		return bindings.filter((binding) => binding.permission.clientId === identity.clientId);
 	}
 };
 /**
 * Select the held grant that confers the least-restrictive junction for `requested` reach.
 *
 * Each grant is ranked by the reach it can actually confer for THIS request — its own
-* `realm_scope` capped to `requested` — so a lower-scoped policy-free grant beats a
+* `realmScope` capped to `requested` — so a lower-scoped policy-free grant beats a
 * higher-scoped policy-bound grant when both cap to the same requested reach (the mixed-grant
 * fix, #3160). On equal capped reach, a policy-free grant wins (least restrictive). The
 * ORIGINAL (uncapped) grant is returned: the consumer applies the `min` cap itself, and its
-* uncapped `realm_scope`/`policy` drive the "actor is unrestricted-any?" check that decides
-* whether an explicitly-requested `policy_id` may stand.
+* uncapped `realmScope`/`policy` drive the "actor is unrestricted-any?" check that decides
+* whether an explicitly-requested `policyId` may stand.
 *
 * The ordering is TOTAL and deterministic (independent of grant/repository order): ties between
 * two policy-bound grants on equal capped reach are broken by higher uncapped reach, then a
@@ -103,10 +97,10 @@ var IdentityPermissionProvider = class {
 	return grants.reduce((best, grant) => isGrantPreferred(grant, best, requested) ? grant : best);
 }
 /** True when `candidate` is a strictly better propagation source than `incumbent` for `requested`. */ function isGrantPreferred(candidate, incumbent, requested) {
-	const byCapped = compareRealmScope(minRealmScope([candidate.realm_scope, requested]), minRealmScope([incumbent.realm_scope, requested]));
+	const byCapped = compareRealmScope(minRealmScope([candidate.realmScope, requested]), minRealmScope([incumbent.realmScope, requested]));
 	if (byCapped !== 0) return byCapped > 0;
 	if (!candidate.policy !== !incumbent.policy) return !candidate.policy;
-	const byUncapped = compareRealmScope(candidate.realm_scope, incumbent.realm_scope);
+	const byUncapped = compareRealmScope(candidate.realmScope, incumbent.realmScope);
 	if (byUncapped !== 0) return byUncapped > 0;
 	const candidateId = candidate.policy && isPolicy(candidate.policy) ? candidate.policy.id : void 0;
 	const incumbentId = incumbent.policy && isPolicy(incumbent.policy) ? incumbent.policy.id : void 0;

package/dist/core/identity/permission/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["RealmScope","aggregatePermissionPolicyBindings","compareRealmScope","grantDominates","isPermissionPolicyBindingEqual","minRealmScope","isPolicy","IdentityPermissionProvider","clientRepository","userRepository","roleRepository","robotRepository","roleProvider","ctx","isSuperset","parent","child","parentAggregated","getFor","childAggregated","childItem","parentItem","find","p","childGrant","grants","dominated","some","parentGrant","resolveJunctionGrant","identity","options","bindings","matching","filter","b","permission","name","realmId","realm_id","clientId","client_id","length","realmScope","OWN","flatMap","item","requested","selected","selectGrantForRequest","policy","NONE","realm_scope","type","getForClient","getForUser","getForRobot","getForRole","combineWithRoleBindings","getBoundPermissions","id","then","data","reduceBindingsByIdentityClient","bindingsPromise","roles","Promise","all","getRolesFor","roleBindings","getBoundPermissionsForMany","binding","reduce","best","grant","isGrantPreferred","candidate","incumbent","byCapped","byUncapped","candidateId","undefined","incumbentId"],"sources":["../../../../src/core/identity/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    IdentityPolicyData,\n    PermissionGrant,\n    PermissionPolicyBinding,\n} from '@authup/access';\nimport {\n    RealmScope,\n    aggregatePermissionPolicyBindings,\n    compareRealmScope,\n    grantDominates,\n    isPermissionPolicyBindingEqual,\n    minRealmScope,\n} from '@authup/access';\nimport type { Policy } from '@authup/core-kit';\nimport { isPolicy } from '@authup/core-kit';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IRoleRepository } from '../../entities/role/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider } from '../role/types.ts';\nimport type {\n    IIdentityPermissionProvider,\n    IdentityPermissionProviderContext,\n    ResolveJunctionGrantResult,\n    ResolveJunctionPolicyOptions,\n} from './types.ts';\n\nexport class IdentityPermissionProvider implements IIdentityPermissionProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected roleRepository: IRoleRepository;\n\n    protected robotRepository: IRobotRepository;\n\n    protected roleProvider: IIdentityRoleProvider;\n\n    constructor(ctx: IdentityPermissionProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.robotRepository = ctx.robotRepository;\n        this.roleProvider = ctx.roleProvider;\n    }\n\n    async isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData) : Promise<boolean> {\n        const parentAggregated = aggregatePermissionPolicyBindings(await this.getFor(parent));\n        const childAggregated = aggregatePermissionPolicyBindings(await this.getFor(child));\n\n        for (const childItem of childAggregated) {\n            const parentItem = parentAggregated.find(\n                (p) => isPermissionPolicyBindingEqual(p, childItem),\n            );\n\n            if (!parentItem) {\n                return false;\n            }\n\n            // Disjunction-aware superset: EVERY child grant must be dominated by SOME parent\n            // grant (reach >= AND the parent's policy provably covers the child's — see\n            // grantDominates). A child grant the parent cannot match — an unconditional `any`\n            // the parent only holds policy-gated, or a policy the parent does not itself hold\n            // (#3159) — fails the check; the actor cannot assign more than it holds.\n            for (const childGrant of childItem.grants) {\n                const dominated = parentItem.grants.some(\n                    (parentGrant) => grantDominates(parentGrant, childGrant),\n                );\n\n                if (!dominated) {\n                    return false;\n                }\n            }\n        }\n\n        return true;\n    }\n\n    async resolveJunctionGrant(\n        identity: IdentityPolicyData,\n        options: ResolveJunctionPolicyOptions,\n    ): Promise<ResolveJunctionGrantResult> {\n        const bindings = await this.getFor(identity);\n        const matching = bindings.filter((b) => {\n            if (b.permission.name !== options.name) {\n                return false;\n            }\n\n            if (typeof options.realmId !== 'undefined') {\n                if ((b.permission.realm_id ?? null) !== (options.realmId ?? null)) {\n                    return false;\n                }\n            }\n\n            if (typeof options.clientId !== 'undefined') {\n                if ((b.permission.client_id ?? null) !== (options.clientId ?? null)) {\n                    return false;\n                }\n            }\n\n            return true;\n        });\n\n        if (matching.length === 0) {\n            return { realmScope: RealmScope.OWN };\n        }\n\n        // Consider EVERY matching grant (a caller omitting realmId/clientId may leave more\n        // than one permission-key group); combined with the total ordering in\n        // selectGrantForRequest, the selection never depends on grant/repository order.\n        const grants = aggregatePermissionPolicyBindings(matching)\n            .flatMap((item) => item.grants);\n        if (grants.length === 0) {\n            return { realmScope: RealmScope.OWN };\n        }\n\n        // Select the actor's grant RELATIVE to the requested reach (#3160): the grant that\n        // confers the least-restrictive junction once capped to `realmScope` (highest capped\n        // reach, policy-free preferred on a tie) — NOT a global \"ceiling\". A mixed-grant actor\n        // (e.g. own+no-policy and any+policy) thus propagates its policy-free own grant for an\n        // own request instead of inheriting the wider grant's policy. The selected grant is\n        // returned UNCAPPED so the consumer's own cap (`min(requested, realmScope)`) and its\n        // \"actor is unrestricted-any?\" check (which honours an explicit policy_id) still hold.\n        const requested = options.realmScope ?? RealmScope.OWN;\n        const selected = selectGrantForRequest(grants, requested);\n\n        let policy: Policy | undefined;\n        if (selected.policy) {\n            // The selected grant is policy-restricted but its policy is not a propagatable\n            // Policy (e.g. a composite with no id). Fail CLOSED: a `none` reach blocks\n            // propagation rather than silently dropping the restriction and widening to an\n            // unrestricted grant.\n            if (!isPolicy(selected.policy)) {\n                return { realmScope: RealmScope.NONE };\n            }\n\n            policy = selected.policy;\n        }\n\n        return { policy, realmScope: selected.realm_scope };\n    }\n\n    async getFor(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.getForClient(identity);\n            }\n            case 'user': {\n                return this.getForUser(identity);\n            }\n            case 'robot': {\n                return this.getForRobot(identity);\n            }\n            case 'role': {\n                return this.getForRole(identity);\n            }\n        }\n\n        return [];\n    }\n\n    async getForClient(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.combineWithRoleBindings(\n            this.clientRepository.getBoundPermissions(identity.id),\n            identity,\n        );\n    }\n\n    async getForUser(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.combineWithRoleBindings(\n            this.userRepository.getBoundPermissions(identity.id)\n                .then((data) => this.reduceBindingsByIdentityClient(data, identity)),\n            identity,\n        );\n    }\n\n    async getForRobot(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.combineWithRoleBindings(\n            this.robotRepository.getBoundPermissions(identity.id)\n                .then((data) => this.reduceBindingsByIdentityClient(data, identity)),\n            identity,\n        );\n    }\n\n    async getForRole(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.roleRepository.getBoundPermissions(identity.id)\n            .then((data) => this.reduceBindingsByIdentityClient(data, identity));\n    }\n\n    private async combineWithRoleBindings(\n        bindingsPromise: Promise<PermissionPolicyBinding[]>,\n        identity: IdentityPolicyData,\n    ): Promise<PermissionPolicyBinding[]> {\n        const [bindings, roles] = await Promise.all([\n            bindingsPromise,\n            this.roleProvider.getRolesFor(identity),\n        ]);\n        const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);\n        if (roleBindings.length === 0) {\n            return bindings;\n        }\n\n        return [\n            ...bindings,\n            ...roleBindings,\n        ];\n    }\n\n    private reduceBindingsByIdentityClient(\n        bindings: PermissionPolicyBinding[],\n        identity: IdentityPolicyData,\n    ): PermissionPolicyBinding[] {\n        if (!identity.clientId) {\n            return bindings;\n        }\n\n        return bindings.filter((binding) => binding.permission.client_id === identity.clientId);\n    }\n}\n\n/**\n * Select the held grant that confers the least-restrictive junction for `requested` reach.\n *\n * Each grant is ranked by the reach it can actually confer for THIS request — its own\n * `realm_scope` capped to `requested` — so a lower-scoped policy-free grant beats a\n * higher-scoped policy-bound grant when both cap to the same requested reach (the mixed-grant\n * fix, #3160). On equal capped reach, a policy-free grant wins (least restrictive). The\n * ORIGINAL (uncapped) grant is returned: the consumer applies the `min` cap itself, and its\n * uncapped `realm_scope`/`policy` drive the \"actor is unrestricted-any?\" check that decides\n * whether an explicitly-requested `policy_id` may stand.\n *\n * The ordering is TOTAL and deterministic (independent of grant/repository order): ties between\n * two policy-bound grants on equal capped reach are broken by higher uncapped reach, then a\n * propagatable policy (one with an id) over an id-less composite that would fail closed, then\n * lexicographic policy id.\n */\nfunction selectGrantForRequest(\n    grants: PermissionGrant[],\n    requested: `${RealmScope}`,\n): PermissionGrant {\n    return grants.reduce((best, grant) => (isGrantPreferred(grant, best, requested) ? grant : best));\n}\n\n/** True when `candidate` is a strictly better propagation source than `incumbent` for `requested`. */\nfunction isGrantPreferred(\n    candidate: PermissionGrant,\n    incumbent: PermissionGrant,\n    requested: `${RealmScope}`,\n): boolean {\n    const byCapped = compareRealmScope(\n        minRealmScope([candidate.realm_scope, requested]),\n        minRealmScope([incumbent.realm_scope, requested]),\n    );\n    if (byCapped !== 0) {\n        return byCapped > 0;\n    }\n\n    // Least restrictive: a policy-free grant beats a policy-bound one on equal capped reach.\n    if (!candidate.policy !== !incumbent.policy) {\n        return !candidate.policy;\n    }\n\n    // Deterministic tie-break for two policy-bound grants on equal capped reach.\n    const byUncapped = compareRealmScope(candidate.realm_scope, incumbent.realm_scope);\n    if (byUncapped !== 0) {\n        return byUncapped > 0;\n    }\n\n    // Prefer a propagatable policy (has an id) over an id-less composite that would fail closed.\n    const candidateId = candidate.policy && isPolicy(candidate.policy) ? candidate.policy.id : undefined;\n    const incumbentId = incumbent.policy && isPolicy(incumbent.policy) ? incumbent.policy.id : undefined;\n    if (candidateId !== incumbentId) {\n        if (typeof candidateId === 'undefined') {\n            return false;\n        }\n        if (typeof incumbentId === 'undefined') {\n            return true;\n        }\n        return candidateId < incumbentId;\n    }\n\n    return false;\n}\n"],"mappings":";;;;;;AAkCA,IAAaO,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKL,mBAAmBK,IAAIL;EAC5B,KAAKC,iBAAiBI,IAAIJ;EAC1B,KAAKC,iBAAiBG,IAAIH;EAC1B,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,WAAWC,QAA4BC,OAA8C;EACvF,MAAMC,mBAAmBhB,kCAAkC,MAAM,KAAKiB,OAAOH,MAAAA,CAAAA;EAC7E,MAAMI,kBAAkBlB,kCAAkC,MAAM,KAAKiB,OAAOF,KAAAA,CAAAA;EAE5E,KAAK,MAAMI,aAAaD,iBAAiB;GACrC,MAAME,aAAaJ,iBAAiBK,MAC/BC,MAAMnB,+BAA+BmB,GAAGH,SAAAA,CAAAA;GAG7C,IAAI,CAACC,YACD,OAAO;GAQX,KAAK,MAAMG,cAAcJ,UAAUK,QAK/B,IAAI,CAJcJ,WAAWI,OAAOE,MAC/BC,gBAAgBzB,eAAeyB,aAAaJ,UAAAA,CAG5CE,GACD,OAAO;EAGnB;EAEA,OAAO;CACX;CAEA,MAAMG,qBACFC,UACAC,SACmC;EAEnC,MAAME,YAAWD,MADM,KAAKd,OAAOY,QAAAA,EAAAA,CACTI,QAAQC,MAAAA;GAC9B,IAAIA,EAAEC,WAAWC,SAASN,QAAQM,MAC9B,OAAO;GAGX,IAAI,OAAON,QAAQO,YAAY;SACtBH,EAAEC,WAAWG,YAAY,WAAWR,QAAQO,WAAW,OACxD,OAAO;GAAA;GAIf,IAAI,OAAOP,QAAQS,aAAa;SACvBL,EAAEC,WAAWK,aAAa,WAAWV,QAAQS,YAAY,OAC1D,OAAO;GAAA;GAIf,OAAO;EACX,CAAA;EAEA,IAAIP,SAASS,WAAW,GACpB,OAAO,EAAEC,YAAY3C,WAAW4C,IAAI;EAMxC,MAAMnB,SAASxB,kCAAkCgC,QAAAA,CAAAA,CAC5CY,SAASC,SAASA,KAAKrB,MAAM;EAClC,IAAIA,OAAOiB,WAAW,GAClB,OAAO,EAAEC,YAAY3C,WAAW4C,IAAI;EAWxC,MAAMI,WAAWC,sBAAsBxB,QADrBM,QAAQY,cAAc3C,WAAW4C,GACJG;EAE/C,IAAIG;EACJ,IAAIF,SAASE,QAAQ;GAKjB,IAAI,CAAC5C,SAAS0C,SAASE,MAAM,GACzB,OAAO,EAAEP,YAAY3C,WAAWmD,KAAK;GAGzCD,SAASF,SAASE;EACtB;EAEA,OAAO;GAAEA;GAAQP,YAAYK,SAASI;EAAY;CACtD;CAEA,MAAMlC,OAAOY,UAAmE;EAC5E,QAAQA,SAASuB,MAAjB;GACI,KAAK,UACD,OAAO,KAAKC,aAAaxB,QAAAA;GAE7B,KAAK,QACD,OAAO,KAAKyB,WAAWzB,QAAAA;GAE3B,KAAK,SACD,OAAO,KAAK0B,YAAY1B,QAAAA;GAE5B,KAAK,QACD,OAAO,KAAK2B,WAAW3B,QAAAA;EAE/B;EAEA,OAAO,CAAA;CACX;CAEA,MAAMwB,aAAaxB,UAAmE;EAClF,OAAO,KAAK4B,wBACR,KAAKlD,iBAAiBmD,oBAAoB7B,SAAS8B,EAAE,GACrD9B,QAAAA;CAER;CAEA,MAAMyB,WAAWzB,UAAmE;EAChF,OAAO,KAAK4B,wBACR,KAAKjD,eAAekD,oBAAoB7B,SAAS8B,EAAE,CAAA,CAC9CC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAMhC,QAAAA,CAAAA,GAC9DA,QAAAA;CAER;CAEA,MAAM0B,YAAY1B,UAAmE;EACjF,OAAO,KAAK4B,wBACR,KAAK/C,gBAAgBgD,oBAAoB7B,SAAS8B,EAAE,CAAA,CAC/CC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAMhC,QAAAA,CAAAA,GAC9DA,QAAAA;CAER;CAEA,MAAM2B,WAAW3B,UAAmE;EAChF,OAAO,KAAKpB,eAAeiD,oBAAoB7B,SAAS8B,EAAE,CAAA,CACrDC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAMhC,QAAAA,CAAAA;CAClE;CAEA,MAAc4B,wBACVM,iBACAlC,UACkC;EAClC,MAAM,CAACE,UAAUiC,SAAS,MAAMC,QAAQC,IAAI,CACxCH,iBACA,KAAKpD,aAAawD,YAAYtC,QAAAA,CAAAA,CACjC;EACD,MAAMuC,eAAe,MAAM,KAAK3D,eAAe4D,2BAA2BL,KAAAA;EAC1E,IAAII,aAAa3B,WAAW,GACxB,OAAOV;EAGX,OAAO,CAAA,GACAA,UAAAA,GACAqC,YAAAA;CAEX;CAEQN,+BACJ/B,UACAF,UACyB;EACzB,IAAI,CAACA,SAASU,UACV,OAAOR;EAGX,OAAOA,SAASE,QAAQqC,YAAYA,QAAQnC,WAAWK,cAAcX,SAASU,QAAQ;CAC1F;AACJ;;;;;;;;;;;;;;;;GAkBA,SAASS,sBACLxB,QACAsB,WAA0B;CAE1B,OAAOtB,OAAO+C,QAAQC,MAAMC,UAAWC,iBAAiBD,OAAOD,MAAM1B,SAAAA,IAAa2B,QAAQD,IAAAA;AAC9F;uGAGA,SAASE,iBACLC,WACAC,WACA9B,WAA0B;CAE1B,MAAM+B,WAAW5E,kBACbG,cAAc,CAACuE,UAAUxB,aAAaL,SAAAA,CAAU,GAChD1C,cAAc,CAACwE,UAAUzB,aAAaL,SAAAA,CAAU,CAAA;CAEpD,IAAI+B,aAAa,GACb,OAAOA,WAAW;CAItB,IAAI,CAACF,UAAU1B,WAAW,CAAC2B,UAAU3B,QACjC,OAAO,CAAC0B,UAAU1B;CAItB,MAAM6B,aAAa7E,kBAAkB0E,UAAUxB,aAAayB,UAAUzB,WAAW;CACjF,IAAI2B,eAAe,GACf,OAAOA,aAAa;CAIxB,MAAMC,cAAcJ,UAAU1B,UAAU5C,SAASsE,UAAU1B,MAAM,IAAI0B,UAAU1B,OAAOU,KAAKqB,KAAAA;CAC3F,MAAMC,cAAcL,UAAU3B,UAAU5C,SAASuE,UAAU3B,MAAM,IAAI2B,UAAU3B,OAAOU,KAAKqB,KAAAA;CAC3F,IAAID,gBAAgBE,aAAa;EAC7B,IAAI,OAAOF,gBAAgB,aACvB,OAAO;EAEX,IAAI,OAAOE,gBAAgB,aACvB,OAAO;EAEX,OAAOF,cAAcE;CACzB;CAEA,OAAO;AACX"}
+{"version":3,"file":"module.mjs","names":["RealmScope","aggregatePermissionPolicyBindings","compareRealmScope","grantDominates","isPermissionPolicyBindingEqual","minRealmScope","isPolicy","IdentityPermissionProvider","clientRepository","userRepository","roleRepository","roleProvider","ctx","isSuperset","parent","child","parentAggregated","getFor","childAggregated","childItem","parentItem","find","p","childGrant","grants","dominated","some","parentGrant","resolveJunctionGrant","identity","options","bindings","matching","filter","b","permission","name","realmId","clientId","length","realmScope","OWN","flatMap","item","requested","selected","selectGrantForRequest","policy","NONE","type","getForClient","getForUser","getForRole","combineWithRoleBindings","getBoundPermissions","id","then","data","reduceBindingsByIdentityClient","bindingsPromise","roles","Promise","all","getRolesFor","roleBindings","getBoundPermissionsForMany","binding","reduce","best","grant","isGrantPreferred","candidate","incumbent","byCapped","byUncapped","candidateId","undefined","incumbentId"],"sources":["../../../../src/core/identity/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    IdentityPolicyData,\n    PermissionGrant,\n    PermissionPolicyBinding,\n} from '@authup/access';\nimport {\n    RealmScope,\n    aggregatePermissionPolicyBindings,\n    compareRealmScope,\n    grantDominates,\n    isPermissionPolicyBindingEqual,\n    minRealmScope,\n} from '@authup/access';\nimport type { Policy } from '@authup/core-kit';\nimport { isPolicy } from '@authup/core-kit';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRoleRepository } from '../../entities/role/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider } from '../role/types.ts';\nimport type {\n    IIdentityPermissionProvider,\n    IdentityPermissionProviderContext,\n    ResolveJunctionGrantResult,\n    ResolveJunctionPolicyOptions,\n} from './types.ts';\n\nexport class IdentityPermissionProvider implements IIdentityPermissionProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected roleRepository: IRoleRepository;\n\n    protected roleProvider: IIdentityRoleProvider;\n\n    constructor(ctx: IdentityPermissionProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.roleProvider = ctx.roleProvider;\n    }\n\n    async isSuperset(parent: IdentityPolicyData, child: IdentityPolicyData) : Promise<boolean> {\n        const parentAggregated = aggregatePermissionPolicyBindings(await this.getFor(parent));\n        const childAggregated = aggregatePermissionPolicyBindings(await this.getFor(child));\n\n        for (const childItem of childAggregated) {\n            const parentItem = parentAggregated.find(\n                (p) => isPermissionPolicyBindingEqual(p, childItem),\n            );\n\n            if (!parentItem) {\n                return false;\n            }\n\n            // Disjunction-aware superset: EVERY child grant must be dominated by SOME parent\n            // grant (reach >= AND the parent's policy provably covers the child's — see\n            // grantDominates). A child grant the parent cannot match — an unconditional `any`\n            // the parent only holds policy-gated, or a policy the parent does not itself hold\n            // (#3159) — fails the check; the actor cannot assign more than it holds.\n            for (const childGrant of childItem.grants) {\n                const dominated = parentItem.grants.some(\n                    (parentGrant) => grantDominates(parentGrant, childGrant),\n                );\n\n                if (!dominated) {\n                    return false;\n                }\n            }\n        }\n\n        return true;\n    }\n\n    async resolveJunctionGrant(\n        identity: IdentityPolicyData,\n        options: ResolveJunctionPolicyOptions,\n    ): Promise<ResolveJunctionGrantResult> {\n        const bindings = await this.getFor(identity);\n        const matching = bindings.filter((b) => {\n            if (b.permission.name !== options.name) {\n                return false;\n            }\n\n            if (typeof options.realmId !== 'undefined') {\n                if ((b.permission.realmId ?? null) !== (options.realmId ?? null)) {\n                    return false;\n                }\n            }\n\n            if (typeof options.clientId !== 'undefined') {\n                if ((b.permission.clientId ?? null) !== (options.clientId ?? null)) {\n                    return false;\n                }\n            }\n\n            return true;\n        });\n\n        if (matching.length === 0) {\n            return { realmScope: RealmScope.OWN };\n        }\n\n        // Consider EVERY matching grant (a caller omitting realmId/clientId may leave more\n        // than one permission-key group); combined with the total ordering in\n        // selectGrantForRequest, the selection never depends on grant/repository order.\n        const grants = aggregatePermissionPolicyBindings(matching)\n            .flatMap((item) => item.grants);\n        if (grants.length === 0) {\n            return { realmScope: RealmScope.OWN };\n        }\n\n        // Select the actor's grant RELATIVE to the requested reach (#3160): the grant that\n        // confers the least-restrictive junction once capped to `realmScope` (highest capped\n        // reach, policy-free preferred on a tie) — NOT a global \"ceiling\". A mixed-grant actor\n        // (e.g. own+no-policy and any+policy) thus propagates its policy-free own grant for an\n        // own request instead of inheriting the wider grant's policy. The selected grant is\n        // returned UNCAPPED so the consumer's own cap (`min(requested, realmScope)`) and its\n        // \"actor is unrestricted-any?\" check (which honours an explicit policyId) still hold.\n        const requested = options.realmScope ?? RealmScope.OWN;\n        const selected = selectGrantForRequest(grants, requested);\n\n        let policy: Policy | undefined;\n        if (selected.policy) {\n            // The selected grant is policy-restricted but its policy is not a propagatable\n            // Policy (e.g. a composite with no id). Fail CLOSED: a `none` reach blocks\n            // propagation rather than silently dropping the restriction and widening to an\n            // unrestricted grant.\n            if (!isPolicy(selected.policy)) {\n                return { realmScope: RealmScope.NONE };\n            }\n\n            policy = selected.policy;\n        }\n\n        return { policy, realmScope: selected.realmScope };\n    }\n\n    async getFor(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.getForClient(identity);\n            }\n            case 'user': {\n                return this.getForUser(identity);\n            }\n            case 'role': {\n                return this.getForRole(identity);\n            }\n        }\n\n        return [];\n    }\n\n    async getForClient(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.combineWithRoleBindings(\n            this.clientRepository.getBoundPermissions(identity.id),\n            identity,\n        );\n    }\n\n    async getForUser(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.combineWithRoleBindings(\n            this.userRepository.getBoundPermissions(identity.id)\n                .then((data) => this.reduceBindingsByIdentityClient(data, identity)),\n            identity,\n        );\n    }\n\n    async getForRole(identity: IdentityPolicyData) : Promise<PermissionPolicyBinding[]> {\n        return this.roleRepository.getBoundPermissions(identity.id)\n            .then((data) => this.reduceBindingsByIdentityClient(data, identity));\n    }\n\n    private async combineWithRoleBindings(\n        bindingsPromise: Promise<PermissionPolicyBinding[]>,\n        identity: IdentityPolicyData,\n    ): Promise<PermissionPolicyBinding[]> {\n        const [bindings, roles] = await Promise.all([\n            bindingsPromise,\n            this.roleProvider.getRolesFor(identity),\n        ]);\n        const roleBindings = await this.roleRepository.getBoundPermissionsForMany(roles);\n        if (roleBindings.length === 0) {\n            return bindings;\n        }\n\n        return [\n            ...bindings,\n            ...roleBindings,\n        ];\n    }\n\n    private reduceBindingsByIdentityClient(\n        bindings: PermissionPolicyBinding[],\n        identity: IdentityPolicyData,\n    ): PermissionPolicyBinding[] {\n        if (!identity.clientId) {\n            return bindings;\n        }\n\n        return bindings.filter((binding) => binding.permission.clientId === identity.clientId);\n    }\n}\n\n/**\n * Select the held grant that confers the least-restrictive junction for `requested` reach.\n *\n * Each grant is ranked by the reach it can actually confer for THIS request — its own\n * `realmScope` capped to `requested` — so a lower-scoped policy-free grant beats a\n * higher-scoped policy-bound grant when both cap to the same requested reach (the mixed-grant\n * fix, #3160). On equal capped reach, a policy-free grant wins (least restrictive). The\n * ORIGINAL (uncapped) grant is returned: the consumer applies the `min` cap itself, and its\n * uncapped `realmScope`/`policy` drive the \"actor is unrestricted-any?\" check that decides\n * whether an explicitly-requested `policyId` may stand.\n *\n * The ordering is TOTAL and deterministic (independent of grant/repository order): ties between\n * two policy-bound grants on equal capped reach are broken by higher uncapped reach, then a\n * propagatable policy (one with an id) over an id-less composite that would fail closed, then\n * lexicographic policy id.\n */\nfunction selectGrantForRequest(\n    grants: PermissionGrant[],\n    requested: `${RealmScope}`,\n): PermissionGrant {\n    return grants.reduce((best, grant) => (isGrantPreferred(grant, best, requested) ? grant : best));\n}\n\n/** True when `candidate` is a strictly better propagation source than `incumbent` for `requested`. */\nfunction isGrantPreferred(\n    candidate: PermissionGrant,\n    incumbent: PermissionGrant,\n    requested: `${RealmScope}`,\n): boolean {\n    const byCapped = compareRealmScope(\n        minRealmScope([candidate.realmScope, requested]),\n        minRealmScope([incumbent.realmScope, requested]),\n    );\n    if (byCapped !== 0) {\n        return byCapped > 0;\n    }\n\n    // Least restrictive: a policy-free grant beats a policy-bound one on equal capped reach.\n    if (!candidate.policy !== !incumbent.policy) {\n        return !candidate.policy;\n    }\n\n    // Deterministic tie-break for two policy-bound grants on equal capped reach.\n    const byUncapped = compareRealmScope(candidate.realmScope, incumbent.realmScope);\n    if (byUncapped !== 0) {\n        return byUncapped > 0;\n    }\n\n    // Prefer a propagatable policy (has an id) over an id-less composite that would fail closed.\n    const candidateId = candidate.policy && isPolicy(candidate.policy) ? candidate.policy.id : undefined;\n    const incumbentId = incumbent.policy && isPolicy(incumbent.policy) ? incumbent.policy.id : undefined;\n    if (candidateId !== incumbentId) {\n        if (typeof candidateId === 'undefined') {\n            return false;\n        }\n        if (typeof incumbentId === 'undefined') {\n            return true;\n        }\n        return candidateId < incumbentId;\n    }\n\n    return false;\n}\n"],"mappings":";;;;;;AAiCA,IAAaO,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKJ,mBAAmBI,IAAIJ;EAC5B,KAAKC,iBAAiBG,IAAIH;EAC1B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,WAAWC,QAA4BC,OAA8C;EACvF,MAAMC,mBAAmBf,kCAAkC,MAAM,KAAKgB,OAAOH,MAAAA,CAAAA;EAC7E,MAAMI,kBAAkBjB,kCAAkC,MAAM,KAAKgB,OAAOF,KAAAA,CAAAA;EAE5E,KAAK,MAAMI,aAAaD,iBAAiB;GACrC,MAAME,aAAaJ,iBAAiBK,MAC/BC,MAAMlB,+BAA+BkB,GAAGH,SAAAA,CAAAA;GAG7C,IAAI,CAACC,YACD,OAAO;GAQX,KAAK,MAAMG,cAAcJ,UAAUK,QAK/B,IAAI,CAJcJ,WAAWI,OAAOE,MAC/BC,gBAAgBxB,eAAewB,aAAaJ,UAAAA,CAG5CE,GACD,OAAO;EAGnB;EAEA,OAAO;CACX;CAEA,MAAMG,qBACFC,UACAC,SACmC;EAEnC,MAAME,YAAWD,MADM,KAAKd,OAAOY,QAAAA,EAAAA,CACTI,QAAQC,MAAAA;GAC9B,IAAIA,EAAEC,WAAWC,SAASN,QAAQM,MAC9B,OAAO;GAGX,IAAI,OAAON,QAAQO,YAAY;SACtBH,EAAEC,WAAWE,WAAW,WAAWP,QAAQO,WAAW,OACvD,OAAO;GAAA;GAIf,IAAI,OAAOP,QAAQQ,aAAa;SACvBJ,EAAEC,WAAWG,YAAY,WAAWR,QAAQQ,YAAY,OACzD,OAAO;GAAA;GAIf,OAAO;EACX,CAAA;EAEA,IAAIN,SAASO,WAAW,GACpB,OAAO,EAAEC,YAAYxC,WAAWyC,IAAI;EAMxC,MAAMjB,SAASvB,kCAAkC+B,QAAAA,CAAAA,CAC5CU,SAASC,SAASA,KAAKnB,MAAM;EAClC,IAAIA,OAAOe,WAAW,GAClB,OAAO,EAAEC,YAAYxC,WAAWyC,IAAI;EAWxC,MAAMI,WAAWC,sBAAsBtB,QADrBM,QAAQU,cAAcxC,WAAWyC,GACJG;EAE/C,IAAIG;EACJ,IAAIF,SAASE,QAAQ;GAKjB,IAAI,CAACzC,SAASuC,SAASE,MAAM,GACzB,OAAO,EAAEP,YAAYxC,WAAWgD,KAAK;GAGzCD,SAASF,SAASE;EACtB;EAEA,OAAO;GAAEA;GAAQP,YAAYK,SAASL;EAAW;CACrD;CAEA,MAAMvB,OAAOY,UAAmE;EAC5E,QAAQA,SAASoB,MAAjB;GACI,KAAK,UACD,OAAO,KAAKC,aAAarB,QAAAA;GAE7B,KAAK,QACD,OAAO,KAAKsB,WAAWtB,QAAAA;GAE3B,KAAK,QACD,OAAO,KAAKuB,WAAWvB,QAAAA;EAE/B;EAEA,OAAO,CAAA;CACX;CAEA,MAAMqB,aAAarB,UAAmE;EAClF,OAAO,KAAKwB,wBACR,KAAK7C,iBAAiB8C,oBAAoBzB,SAAS0B,EAAE,GACrD1B,QAAAA;CAER;CAEA,MAAMsB,WAAWtB,UAAmE;EAChF,OAAO,KAAKwB,wBACR,KAAK5C,eAAe6C,oBAAoBzB,SAAS0B,EAAE,CAAA,CAC9CC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAM5B,QAAAA,CAAAA,GAC9DA,QAAAA;CAER;CAEA,MAAMuB,WAAWvB,UAAmE;EAChF,OAAO,KAAKnB,eAAe4C,oBAAoBzB,SAAS0B,EAAE,CAAA,CACrDC,MAAMC,SAAS,KAAKC,+BAA+BD,MAAM5B,QAAAA,CAAAA;CAClE;CAEA,MAAcwB,wBACVM,iBACA9B,UACkC;EAClC,MAAM,CAACE,UAAU6B,SAAS,MAAMC,QAAQC,IAAI,CACxCH,iBACA,KAAKhD,aAAaoD,YAAYlC,QAAAA,CAAAA,CACjC;EACD,MAAMmC,eAAe,MAAM,KAAKtD,eAAeuD,2BAA2BL,KAAAA;EAC1E,IAAII,aAAazB,WAAW,GACxB,OAAOR;EAGX,OAAO,CAAA,GACAA,UAAAA,GACAiC,YAAAA;CAEX;CAEQN,+BACJ3B,UACAF,UACyB;EACzB,IAAI,CAACA,SAASS,UACV,OAAOP;EAGX,OAAOA,SAASE,QAAQiC,YAAYA,QAAQ/B,WAAWG,aAAaT,SAASS,QAAQ;CACzF;AACJ;;;;;;;;;;;;;;;;GAkBA,SAASQ,sBACLtB,QACAoB,WAA0B;CAE1B,OAAOpB,OAAO2C,QAAQC,MAAMC,UAAWC,iBAAiBD,OAAOD,MAAMxB,SAAAA,IAAayB,QAAQD,IAAAA;AAC9F;uGAGA,SAASE,iBACLC,WACAC,WACA5B,WAA0B;CAE1B,MAAM6B,WAAWvE,kBACbG,cAAc,CAACkE,UAAU/B,YAAYI,SAAAA,CAAU,GAC/CvC,cAAc,CAACmE,UAAUhC,YAAYI,SAAAA,CAAU,CAAA;CAEnD,IAAI6B,aAAa,GACb,OAAOA,WAAW;CAItB,IAAI,CAACF,UAAUxB,WAAW,CAACyB,UAAUzB,QACjC,OAAO,CAACwB,UAAUxB;CAItB,MAAM2B,aAAaxE,kBAAkBqE,UAAU/B,YAAYgC,UAAUhC,UAAU;CAC/E,IAAIkC,eAAe,GACf,OAAOA,aAAa;CAIxB,MAAMC,cAAcJ,UAAUxB,UAAUzC,SAASiE,UAAUxB,MAAM,IAAIwB,UAAUxB,OAAOQ,KAAKqB,KAAAA;CAC3F,MAAMC,cAAcL,UAAUzB,UAAUzC,SAASkE,UAAUzB,MAAM,IAAIyB,UAAUzB,OAAOQ,KAAKqB,KAAAA;CAC3F,IAAID,gBAAgBE,aAAa;EAC7B,IAAI,OAAOF,gBAAgB,aACvB,OAAO;EAEX,IAAI,OAAOE,gBAAgB,aACvB,OAAO;EAEX,OAAOF,cAAcE;CACzB;CAEA,OAAO;AACX"}

package/dist/core/identity/permission/types.d.ts

@@ -1,7 +1,6 @@
 import type { Policy } from '@authup/core-kit';
 import type { IdentityPolicyData, PermissionPolicyBinding, RealmScope } from '@authup/access';
 import type { IClientRepository } from '../../entities/client/types.ts';
-import type { IRobotRepository } from '../../entities/robot/types.ts';
 import type { IRoleRepository } from '../../entities/role/types.ts';
 import type { IUserRepository } from '../../entities/user/types.ts';
 import type { IIdentityRoleProvider } from '../role/types.ts';
@@ -38,7 +37,6 @@ export interface IIdentityPermissionProvider {
 export type IdentityPermissionProviderContext = {
     clientRepository: IClientRepository;
     userRepository: IUserRepository;
-    robotRepository: IRobotRepository;
     roleRepository: IRoleRepository;
     roleProvider: IIdentityRoleProvider;
 };

package/dist/core/identity/permission/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EACR,kBAAkB,EAClB,uBAAuB,EACvB,UAAU,EACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9D,MAAM,MAAM,4BAA4B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC;CAChC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,WAAW,2BAA2B;IACxC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACzE,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAClI;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC5C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,eAAe,EAAE,gBAAgB,CAAC;IAClC,cAAc,EAAE,eAAe,CAAC;IAChC,YAAY,EAAE,qBAAqB,CAAC;CACvC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EACR,kBAAkB,EAClB,uBAAuB,EACvB,UAAU,EACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9D,MAAM,MAAM,4BAA4B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC;CAChC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,WAAW,2BAA2B;IACxC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACzE,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAClI;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC5C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,cAAc,EAAE,eAAe,CAAC;IAChC,YAAY,EAAE,qBAAqB,CAAC;CACvC,CAAC"}

package/dist/core/identity/policy/checker/service.mjs

@@ -20,7 +20,7 @@ var PolicyCheckerService = class {
 			if (realm) {
 				const realmId = await this.ctx.realmRepository.resolveId(realm);
 				if (!realmId) throw new EntityNotFoundError();
-				criteria.realm_id = realmId;
+				criteria.realmId = realmId;
 			}
 		}
 		const entity = await this.ctx.repository.findOneBy(criteria);

package/dist/core/identity/policy/checker/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","definePolicyEvaluationContext","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PolicyCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","name","realmId","realmRepository","resolveId","realm_id","entity","repository","findOneBy","input","IDENTITY","identity","engine","identityPermissionProvider","evaluateOrFail","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/policy/checker/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData, definePolicyEvaluationContext } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../../permission/identity-policy-data.ts';\nimport type {\n    IPolicyCheckerService,\n    PolicyCheckerServiceContext,\n} from './types.ts';\n\nexport class PolicyCheckerService implements IPolicyCheckerService {\n    protected ctx: PolicyCheckerServiceContext;\n\n    constructor(ctx: PolicyCheckerServiceContext) {\n        this.ctx = ctx;\n    }\n\n    async check(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<void> {\n        let criteria: Record<string, any>;\n        if (isUUID(idOrName)) {\n            criteria = { id: idOrName };\n        } else {\n            criteria = { name: idOrName };\n\n            if (realm) {\n                const realmId = await this.ctx.realmRepository.resolveId(realm);\n                if (!realmId) {\n                    throw new EntityNotFoundError();\n                }\n                criteria.realm_id = realmId;\n            }\n        }\n\n        const entity = await this.ctx.repository.findOneBy(criteria);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const input = { ...data };\n        if (\n            !input[BuiltInPolicyType.IDENTITY] &&\n            input[BuiltInPolicyType.IDENTITY] !== null\n        ) {\n            input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n        }\n\n        const engine = new PolicyEngine(this.ctx.identityPermissionProvider);\n        await engine.evaluateOrFail(\n            entity,\n            definePolicyEvaluationContext({ data: new PolicyData(input) }),\n        );\n    }\n\n    async safeCheck(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Result<null>> {\n        try {\n            await this.check(idOrName, data, actor, realm);\n            return { success: true, data: null };\n        } catch (e) {\n            return { success: false, error: normalizeError(e) };\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaQ,uBAAb,MAAaA;CACCC;CAEV,YAAYA,KAAkC;EAC1C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACHI,WAAW,EAAEE,MAAMN,SAAS;GAE5B,IAAIG,OAAO;IACP,MAAMI,UAAU,MAAM,KAAKT,IAAIU,gBAAgBC,UAAUN,KAAAA;IACzD,IAAI,CAACI,SACD,MAAM,IAAId,oBAAAA;IAEdW,SAASM,WAAWH;GACxB;EACJ;EAEA,MAAMI,SAAS,MAAM,KAAKb,IAAIc,WAAWC,UAAUT,QAAAA;EACnD,IAAI,CAACO,QACD,MAAM,IAAIlB,oBAAAA;EAGd,MAAMqB,QAAQ,EAAE,GAAGb,KAAK;EACxB,IACI,CAACa,MAAMzB,kBAAkB0B,aACzBD,MAAMzB,kBAAkB0B,cAAc,MAEtCD,MAAMzB,kBAAkB0B,YAAYnB,qBAAqBM,MAAMc,QAAQ;EAI3E,MAAMC,IADatB,eAAa,KAAKG,IAAIoB,0BACnCD,CAAAA,CAAOE,eACTR,QACApB,8BAA8B,EAAEU,MAAM,IAAIX,WAAWwB,KAAAA,EAAO,CAAA,CAAA;CAEpE;CAEA,MAAMM,UACFpB,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAEkB,SAAS;IAAMpB,MAAM;GAAK;EACvC,SAASqB,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAO7B,eAAe4B,CAAAA;GAAG;EACtD;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PolicyData","definePolicyEvaluationContext","isUUID","EntityNotFoundError","normalizeError","PolicyEngine","toIdentityPolicyData","PolicyCheckerService","ctx","check","idOrName","data","actor","realm","criteria","id","name","realmId","realmRepository","resolveId","entity","repository","findOneBy","input","IDENTITY","identity","engine","identityPermissionProvider","evaluateOrFail","safeCheck","success","e","error"],"sources":["../../../../../src/core/identity/policy/checker/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PolicyData, definePolicyEvaluationContext } from '@authup/access';\nimport type { Result } from '@authup/kit';\nimport { isUUID } from '@authup/kit';\nimport { EntityNotFoundError, normalizeError } from '@authup/errors';\nimport type { ActorContext } from '@authup/server-kit';\nimport { PolicyEngine } from '../../../security/policy/engine.ts';\nimport { toIdentityPolicyData } from '../../permission/identity-policy-data.ts';\nimport type {\n    IPolicyCheckerService,\n    PolicyCheckerServiceContext,\n} from './types.ts';\n\nexport class PolicyCheckerService implements IPolicyCheckerService {\n    protected ctx: PolicyCheckerServiceContext;\n\n    constructor(ctx: PolicyCheckerServiceContext) {\n        this.ctx = ctx;\n    }\n\n    async check(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<void> {\n        let criteria: Record<string, any>;\n        if (isUUID(idOrName)) {\n            criteria = { id: idOrName };\n        } else {\n            criteria = { name: idOrName };\n\n            if (realm) {\n                const realmId = await this.ctx.realmRepository.resolveId(realm);\n                if (!realmId) {\n                    throw new EntityNotFoundError();\n                }\n                criteria.realmId = realmId;\n            }\n        }\n\n        const entity = await this.ctx.repository.findOneBy(criteria);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const input = { ...data };\n        if (\n            !input[BuiltInPolicyType.IDENTITY] &&\n            input[BuiltInPolicyType.IDENTITY] !== null\n        ) {\n            input[BuiltInPolicyType.IDENTITY] = toIdentityPolicyData(actor.identity);\n        }\n\n        const engine = new PolicyEngine(this.ctx.identityPermissionProvider);\n        await engine.evaluateOrFail(\n            entity,\n            definePolicyEvaluationContext({ data: new PolicyData(input) }),\n        );\n    }\n\n    async safeCheck(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Result<null>> {\n        try {\n            await this.check(idOrName, data, actor, realm);\n            return { success: true, data: null };\n        } catch (e) {\n            return { success: false, error: normalizeError(e) };\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaQ,uBAAb,MAAaA;CACCC;CAEV,YAAYA,KAAkC;EAC1C,KAAKA,MAAMA;CACf;CAEA,MAAMC,MACFC,UACAC,MACAC,OACAC,OACa;EACb,IAAIC;EACJ,IAAIZ,OAAOQ,QAAAA,GACPI,WAAW,EAAEC,IAAIL,SAAS;OACvB;GACHI,WAAW,EAAEE,MAAMN,SAAS;GAE5B,IAAIG,OAAO;IACP,MAAMI,UAAU,MAAM,KAAKT,IAAIU,gBAAgBC,UAAUN,KAAAA;IACzD,IAAI,CAACI,SACD,MAAM,IAAId,oBAAAA;IAEdW,SAASG,UAAUA;GACvB;EACJ;EAEA,MAAMG,SAAS,MAAM,KAAKZ,IAAIa,WAAWC,UAAUR,QAAAA;EACnD,IAAI,CAACM,QACD,MAAM,IAAIjB,oBAAAA;EAGd,MAAMoB,QAAQ,EAAE,GAAGZ,KAAK;EACxB,IACI,CAACY,MAAMxB,kBAAkByB,aACzBD,MAAMxB,kBAAkByB,cAAc,MAEtCD,MAAMxB,kBAAkByB,YAAYlB,qBAAqBM,MAAMa,QAAQ;EAI3E,MAAMC,IADarB,eAAa,KAAKG,IAAImB,0BACnCD,CAAAA,CAAOE,eACTR,QACAnB,8BAA8B,EAAEU,MAAM,IAAIX,WAAWuB,KAAAA,EAAO,CAAA,CAAA;CAEpE;CAEA,MAAMM,UACFnB,UACAC,MACAC,OACAC,OACqB;EACrB,IAAI;GACA,MAAM,KAAKJ,MAAMC,UAAUC,MAAMC,OAAOC,KAAAA;GACxC,OAAO;IAAEiB,SAAS;IAAMnB,MAAM;GAAK;EACvC,SAASoB,GAAG;GACR,OAAO;IAAED,SAAS;IAAOE,OAAO5B,eAAe2B,CAAAA;GAAG;EACtD;CACJ;AACJ"}

package/dist/core/identity/provider/account/module.mjs

@@ -36,13 +36,13 @@ var IdentityProviderAccountManager = class {
 		identity.operation = IdentityProviderIdentityOperation.CREATE;
 		const user = await this.saveUser(identity);
 		account = await this.repository.save({
-			provider_id: identity.provider.id,
-			provider_user_id: identity.id,
-			provider_user_name: user.name,
-			provider_realm_id: identity.provider.realm_id,
+			providerId: identity.provider.id,
+			providerUserId: identity.id,
+			providerUserName: user.name,
+			providerRealmId: identity.provider.realmId,
 			user,
-			user_id: user.id,
-			user_realm_id: user.realm_id
+			userId: user.id,
+			userRealmId: user.realmId
 		});
 		await this.saveRoles(identity, account.user);
 		await this.savePermissions(identity, account.user);
@@ -53,10 +53,10 @@ var IdentityProviderAccountManager = class {
 		const entity = {};
 		for (const attribute of attributes) if (attribute.key && attribute.operation === IdentityProviderMapperOperation.CREATE) entity[attribute.key] = attribute.value;
 		if (!user) {
-			entity.realm_id = identity.provider.realm_id;
+			entity.realmId = identity.provider.realmId;
 			entity.active = true;
-			entity.name_locked = true;
-			entity.client_id = identity.clientId || null;
+			entity.nameLocked = true;
+			entity.clientId = identity.clientId || null;
 		}
 		const attributesSelf = await this.validateAttributes(entity, identity, 10);
 		if (!attributesSelf) throw new Error("Identity provider attributes could not be validated.");

package/dist/core/identity/provider/account/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["UserValidator","buildUserFakeEmail","isUserFakeEmail","ValidatorGroup","createNanoID","extendObject","isValidupError","stringifyPath","IdentityProviderIdentityOperation","IdentityProviderMapperOperation","IdentityProviderAccountManager","attributesMapper","permissionMapper","roleMapper","repository","userRepository","userValidator","ctx","attributeMapper","save","identity","account","findOneByProviderIdentity","operation","UPDATE","user","saveUser","saveRoles","savePermissions","CREATE","provider_id","provider","id","provider_user_id","provider_user_name","name","provider_realm_id","realm_id","user_id","user_realm_id","attributes","execute","entity","attribute","key","value","active","name_locked","client_id","clientId","attributesSelf","validateAttributes","Error","attributesSelfKeys","Object","keys","attributesExtra","entityKeys","entityKey","index","indexOf","output","trim","toLowerCase","attempts","Math","max","attributeCandidates","length","saveOneWithEA","names","shift","run","group","email","e","retry","i","issues","child","pathNormalized","path","Array","isArray","first","rest","push","entities"],"sources":["../../../../../src/core/identity/provider/account/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderAccount, User } from '@authup/core-kit';\nimport {\n    UserValidator,\n    buildUserFakeEmail,\n    isUserFakeEmail,\n} from '@authup/core-kit';\nimport { ValidatorGroup, createNanoID, extendObject } from '@authup/kit';\nimport { isValidupError, stringifyPath } from 'validup';\nimport type { IUserIdentityRepository } from '../../entities/index.ts';\nimport { IdentityProviderIdentityOperation } from '../constants.ts';\nimport type { IIdentityProviderMapper } from '../mapper/index.ts';\nimport { IdentityProviderMapperOperation } from '../mapper/index.ts';\nimport type { IdentityProviderIdentity } from '../types.ts';\nimport type { IIdentityProviderAccountManager, IIdentityProviderAccountRepository, IdentityProviderAccountManagerContext } from './types.ts';\n\nexport class IdentityProviderAccountManager implements IIdentityProviderAccountManager {\n    protected attributesMapper : IIdentityProviderMapper;\n\n    protected permissionMapper : IIdentityProviderMapper;\n\n    protected roleMapper : IIdentityProviderMapper;\n\n    protected repository : IIdentityProviderAccountRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected userValidator : UserValidator;\n\n    constructor(ctx: IdentityProviderAccountManagerContext) {\n        this.attributesMapper = ctx.attributeMapper;\n        this.permissionMapper = ctx.permissionMapper;\n        this.roleMapper = ctx.roleMapper;\n        this.repository = ctx.repository;\n        this.userRepository = ctx.userRepository;\n\n        this.userValidator = new UserValidator();\n    }\n\n    async save(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount> {\n        let account = await this.repository.findOneByProviderIdentity(identity);\n        if (account) {\n            identity.operation = IdentityProviderIdentityOperation.UPDATE;\n\n            account.user = await this.saveUser(identity, account.user);\n\n            await this.repository.save(account);\n\n            await this.saveRoles(identity, account.user);\n            await this.savePermissions(identity, account.user);\n\n            return account;\n        }\n\n        identity.operation = IdentityProviderIdentityOperation.CREATE;\n\n        const user = await this.saveUser(identity);\n\n        account = await this.repository.save({\n            provider_id: identity.provider.id,\n            provider_user_id: identity.id,\n            provider_user_name: user.name, // todo: parse identity.name\n            provider_realm_id: identity.provider.realm_id,\n            user,\n            user_id: user.id,\n            user_realm_id: user.realm_id,\n        });\n\n        await this.saveRoles(identity, account.user);\n        await this.savePermissions(identity, account.user);\n\n        return account;\n    }\n\n    async saveUser(\n        identity: IdentityProviderIdentity,\n        user?: User,\n    ): Promise<User> {\n        const attributes = await this.attributesMapper.execute(\n            identity,\n        );\n\n        const entity : Record<string, any> = {};\n        for (const attribute of attributes) {\n            if (\n                attribute.key &&\n                attribute.operation === IdentityProviderMapperOperation.CREATE\n            ) {\n                // attribute value might be object, array, ...\n                entity[attribute.key] = attribute.value;\n            }\n        }\n\n        if (!user) {\n            entity.realm_id = identity.provider.realm_id;\n            entity.active = true;\n            entity.name_locked = true;\n            entity.client_id = identity.clientId || null;\n        }\n\n        const attributesSelf = await this.validateAttributes(entity, identity, 10);\n        if (!attributesSelf) {\n            // todo: better error name\n            throw new Error('Identity provider attributes could not be validated.');\n        }\n        const attributesSelfKeys = Object.keys(attributesSelf);\n\n        const attributesExtra : Record<string, any> = {};\n\n        const entityKeys = Object.keys(entity);\n        for (const entityKey of entityKeys) {\n            const index = attributesSelfKeys.indexOf(entityKey);\n            if (index !== -1) {\n                continue;\n            }\n\n            attributesExtra[entityKey] = entity[entityKey];\n        }\n\n        let output : User;\n        if (user) {\n            output = extendObject(user, attributesSelf);\n        } else {\n            output = attributesSelf;\n        }\n\n        if (typeof output.name === 'string') {\n            output.name = output.name.trim().toLowerCase();\n        }\n\n        let attempts = Math.max((identity.attributeCandidates?.name?.length || 0) + 1, 10);\n        while (attempts > 0) {\n            try {\n                // todo: we also need to remove existing ones via idp login flow ( but not other attributes!)\n                return await this.userRepository.saveOneWithEA(output, attributesExtra);\n            } catch {\n                const names = identity.attributeCandidates?.name || [];\n                if (names.length > 0) {\n                    while (names.length > 0) {\n                        output.name = `${names.shift()}`.trim().toLowerCase();\n\n                        try {\n                            await this.userValidator.run(output, {\n                                group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n                                    ValidatorGroup.CREATE :\n                                    ValidatorGroup.UPDATE,\n                            });\n                            break;\n                        } catch {\n                            // todo: do nothing.\n                        }\n                    }\n                } else {\n                    output.name = createNanoID('0123456789abcdefghijklmnopqrstuvwxyz-_', 10);\n                }\n\n                if (isUserFakeEmail(output.email)) {\n                    output.email = buildUserFakeEmail(output.name);\n                }\n\n                attempts -= 1;\n            }\n        }\n\n        throw new Error('The user account could not be created due a conflict error.');\n    }\n\n    async validateAttributes(\n        entity: Record<string, any>,\n        identity: IdentityProviderIdentity,\n        attempts: number,\n    ) : Promise<User | null> {\n        attempts--;\n        if (attempts <= 0) {\n            return null;\n        }\n\n        try {\n            return await this.userValidator.run(entity, {\n                group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n                    ValidatorGroup.CREATE :\n                    ValidatorGroup.UPDATE,\n            });\n        } catch (e: any) {\n            if (!isValidupError(e)) {\n                return null;\n            }\n\n            let retry = false;\n            for (let i = 0; i < e.issues.length; i++) {\n                const child = e.issues[i];\n\n                const pathNormalized = stringifyPath(child.path);\n\n                if (\n                    Array.isArray(entity[pathNormalized]) &&\n                    entity[pathNormalized].length > 0\n                ) {\n                    const [first, ...rest] = entity[pathNormalized];\n                    entity[pathNormalized] = first;\n\n                    if (rest.length > 0) {\n                        if (!identity.attributeCandidates) {\n                            identity.attributeCandidates = {};\n                        }\n\n                        if (!identity.attributeCandidates[pathNormalized]) {\n                            identity.attributeCandidates[pathNormalized] = [];\n                        }\n\n                        identity.attributeCandidates[pathNormalized]!.push(...rest);\n                    }\n\n                    retry = true;\n                    break;\n                }\n\n                if (\n                    identity.attributeCandidates &&\n                    identity.attributeCandidates[pathNormalized] &&\n                    identity.attributeCandidates[pathNormalized]!.length > 0\n                ) {\n                    entity[pathNormalized] = identity.attributeCandidates[pathNormalized]!.shift();\n                    retry = true;\n                    break;\n                }\n\n                if (\n                    entity.name &&\n                    pathNormalized === 'email'\n                ) {\n                    entity[pathNormalized] = buildUserFakeEmail(entity.name);\n                    retry = true;\n                    break;\n                }\n\n                if (entity[pathNormalized]) {\n                    entity[pathNormalized] = null;\n                    break;\n                }\n            }\n\n            if (retry) {\n                return this.validateAttributes(entity, identity, attempts);\n            }\n\n            return null;\n        }\n    }\n\n    async savePermissions(\n        identity: IdentityProviderIdentity,\n        user: User,\n    ) {\n        const entities = await this.permissionMapper.execute(identity);\n\n        await this.userRepository.savePermissions(user, entities);\n    }\n\n    async saveRoles(\n        identity: IdentityProviderIdentity,\n        user: User,\n    ) {\n        const entities = await this.roleMapper.execute(identity);\n\n        await this.userRepository.saveRoles(user, entities);\n    }\n}\n"],"mappings":";;;;;;;;;;AAsBA,IAAaU,iCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,KAAKN,mBAAmBM,IAAIC;EAC5B,KAAKN,mBAAmBK,IAAIL;EAC5B,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,iBAAiBE,IAAIF;EAE1B,KAAKC,gBAAgB,IAAIhB,cAAAA;CAC7B;CAEA,MAAMmB,KAAKC,UAAsE;EAC7E,IAAIC,UAAU,MAAM,KAAKP,WAAWQ,0BAA0BF,QAAAA;EAC9D,IAAIC,SAAS;GACTD,SAASG,YAAYf,kCAAkCgB;GAEvDH,QAAQI,OAAO,MAAM,KAAKC,SAASN,UAAUC,QAAQI,IAAI;GAEzD,MAAM,KAAKX,WAAWK,KAAKE,OAAAA;GAE3B,MAAM,KAAKM,UAAUP,UAAUC,QAAQI,IAAI;GAC3C,MAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,IAAI;GAEjD,OAAOJ;EACX;EAEAD,SAASG,YAAYf,kCAAkCqB;EAEvD,MAAMJ,OAAO,MAAM,KAAKC,SAASN,QAAAA;EAEjCC,UAAU,MAAM,KAAKP,WAAWK,KAAK;GACjCW,aAAaV,SAASW,SAASC;GAC/BC,kBAAkBb,SAASY;GAC3BE,oBAAoBT,KAAKU;GACzBC,mBAAmBhB,SAASW,SAASM;GACrCZ;GACAa,SAASb,KAAKO;GACdO,eAAed,KAAKY;EACxB,CAAA;EAEA,MAAM,KAAKV,UAAUP,UAAUC,QAAQI,IAAI;EAC3C,MAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,IAAI;EAEjD,OAAOJ;CACX;CAEA,MAAMK,SACFN,UACAK,MACa;EACb,MAAMe,aAAa,MAAM,KAAK7B,iBAAiB8B,QAC3CrB,QAAAA;EAGJ,MAAMsB,SAA+B,CAAC;EACtC,KAAK,MAAMC,aAAaH,YACpB,IACIG,UAAUC,OACVD,UAAUpB,cAAcd,gCAAgCoB,QAGxDa,OAAOC,UAAUC,OAAOD,UAAUE;EAI1C,IAAI,CAACpB,MAAM;GACPiB,OAAOL,WAAWjB,SAASW,SAASM;GACpCK,OAAOI,SAAS;GAChBJ,OAAOK,cAAc;GACrBL,OAAOM,YAAY5B,SAAS6B,YAAY;EAC5C;EAEA,MAAMC,iBAAiB,MAAM,KAAKC,mBAAmBT,QAAQtB,UAAU,EAAA;EACvE,IAAI,CAAC8B,gBAED,MAAM,IAAIE,MAAM,sDAAA;EAEpB,MAAMC,qBAAqBC,OAAOC,KAAKL,cAAAA;EAEvC,MAAMM,kBAAwC,CAAC;EAE/C,MAAMC,aAAaH,OAAOC,KAAKb,MAAAA;EAC/B,KAAK,MAAMgB,aAAaD,YAAY;GAEhC,IADcJ,mBAAmBO,QAAQF,SACrCC,MAAU,IACV;GAGJH,gBAAgBE,aAAahB,OAAOgB;EACxC;EAEA,IAAIG;EACJ,IAAIpC,MACAoC,SAASxD,aAAaoB,MAAMyB,cAAAA;OAE5BW,SAASX;EAGb,IAAI,OAAOW,OAAO1B,SAAS,UACvB0B,OAAO1B,OAAO0B,OAAO1B,KAAK2B,KAAI,CAAA,CAAGC,YAAW;EAGhD,IAAIC,WAAWC,KAAKC,KAAK9C,SAAS+C,qBAAqBhC,MAAMiC,UAAU,KAAK,GAAG,EAAA;EAC/E,OAAOJ,WAAW,GACd,IAAI;GAEA,OAAO,MAAM,KAAKjD,eAAesD,cAAcR,QAAQL,eAAAA;EAC3D,QAAQ;GACJ,MAAMc,QAAQlD,SAAS+C,qBAAqBhC,QAAQ,CAAA;GACpD,IAAImC,MAAMF,SAAS,GACf,OAAOE,MAAMF,SAAS,GAAG;IACrBP,OAAO1B,OAAO,GAAGmC,MAAMC,MAAK,IAAKT,KAAI,CAAA,CAAGC,YAAW;IAEnD,IAAI;KACA,MAAM,KAAK/C,cAAcwD,IAAIX,QAAQ,EACjCY,OAAOrD,SAASG,cAAcf,kCAAkCqB,SAC5D1B,eAAe0B,SACf1B,eAAeqB,OACvB,CAAA;KACA;IACJ,QAAQ,CAER;GACJ;QAEAqC,OAAO1B,OAAO/B,aAAa,0CAA0C,EAAA;GAGzE,IAAIF,gBAAgB2D,OAAOa,KAAK,GAC5Bb,OAAOa,QAAQzE,mBAAmB4D,OAAO1B,IAAI;GAGjD6B,YAAY;EAChB;EAGJ,MAAM,IAAIZ,MAAM,6DAAA;CACpB;CAEA,MAAMD,mBACFT,QACAtB,UACA4C,UACqB;EACrBA;EACA,IAAIA,YAAY,GACZ,OAAO;EAGX,IAAI;GACA,OAAO,MAAM,KAAKhD,cAAcwD,IAAI9B,QAAQ,EACxC+B,OAAOrD,SAASG,cAAcf,kCAAkCqB,SAC5D1B,eAAe0B,SACf1B,eAAeqB,OACvB,CAAA;EACJ,SAASmD,GAAQ;GACb,IAAI,CAACrE,eAAeqE,CAAAA,GAChB,OAAO;GAGX,IAAIC,QAAQ;GACZ,KAAK,IAAIC,IAAI,GAAGA,IAAIF,EAAEG,OAAOV,QAAQS,KAAK;IACtC,MAAME,QAAQJ,EAAEG,OAAOD;IAEvB,MAAMG,iBAAiBzE,cAAcwE,MAAME,IAAI;IAE/C,IACIC,MAAMC,QAAQzC,OAAOsC,eAAe,KACpCtC,OAAOsC,eAAe,CAACZ,SAAS,GAClC;KACE,MAAM,CAACgB,OAAO,GAAGC,QAAQ3C,OAAOsC;KAChCtC,OAAOsC,kBAAkBI;KAEzB,IAAIC,KAAKjB,SAAS,GAAG;MACjB,IAAI,CAAChD,SAAS+C,qBACV/C,SAAS+C,sBAAsB,CAAC;MAGpC,IAAI,CAAC/C,SAAS+C,oBAAoBa,iBAC9B5D,SAAS+C,oBAAoBa,kBAAkB,CAAA;MAGnD5D,SAAS+C,oBAAoBa,eAAe,CAAEM,KAAI,GAAID,IAAAA;KAC1D;KAEAT,QAAQ;KACR;IACJ;IAEA,IACIxD,SAAS+C,uBACT/C,SAAS+C,oBAAoBa,mBAC7B5D,SAAS+C,oBAAoBa,eAAe,CAAEZ,SAAS,GACzD;KACE1B,OAAOsC,kBAAkB5D,SAAS+C,oBAAoBa,eAAe,CAAET,MAAK;KAC5EK,QAAQ;KACR;IACJ;IAEA,IACIlC,OAAOP,QACP6C,mBAAmB,SACrB;KACEtC,OAAOsC,kBAAkB/E,mBAAmByC,OAAOP,IAAI;KACvDyC,QAAQ;KACR;IACJ;IAEA,IAAIlC,OAAOsC,iBAAiB;KACxBtC,OAAOsC,kBAAkB;KACzB;IACJ;GACJ;GAEA,IAAIJ,OACA,OAAO,KAAKzB,mBAAmBT,QAAQtB,UAAU4C,QAAAA;GAGrD,OAAO;EACX;CACJ;CAEA,MAAMpC,gBACFR,UACAK,MACF;EACE,MAAM8D,WAAW,MAAM,KAAK3E,iBAAiB6B,QAAQrB,QAAAA;EAErD,MAAM,KAAKL,eAAea,gBAAgBH,MAAM8D,QAAAA;CACpD;CAEA,MAAM5D,UACFP,UACAK,MACF;EACE,MAAM8D,WAAW,MAAM,KAAK1E,WAAW4B,QAAQrB,QAAAA;EAE/C,MAAM,KAAKL,eAAeY,UAAUF,MAAM8D,QAAAA;CAC9C;AACJ"}
+{"version":3,"file":"module.mjs","names":["UserValidator","buildUserFakeEmail","isUserFakeEmail","ValidatorGroup","createNanoID","extendObject","isValidupError","stringifyPath","IdentityProviderIdentityOperation","IdentityProviderMapperOperation","IdentityProviderAccountManager","attributesMapper","permissionMapper","roleMapper","repository","userRepository","userValidator","ctx","attributeMapper","save","identity","account","findOneByProviderIdentity","operation","UPDATE","user","saveUser","saveRoles","savePermissions","CREATE","providerId","provider","id","providerUserId","providerUserName","name","providerRealmId","realmId","userId","userRealmId","attributes","execute","entity","attribute","key","value","active","nameLocked","clientId","attributesSelf","validateAttributes","Error","attributesSelfKeys","Object","keys","attributesExtra","entityKeys","entityKey","index","indexOf","output","trim","toLowerCase","attempts","Math","max","attributeCandidates","length","saveOneWithEA","names","shift","run","group","email","e","retry","i","issues","child","pathNormalized","path","Array","isArray","first","rest","push","entities"],"sources":["../../../../../src/core/identity/provider/account/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderAccount, User } from '@authup/core-kit';\nimport {\n    UserValidator,\n    buildUserFakeEmail,\n    isUserFakeEmail,\n} from '@authup/core-kit';\nimport { ValidatorGroup, createNanoID, extendObject } from '@authup/kit';\nimport { isValidupError, stringifyPath } from 'validup';\nimport type { IUserIdentityRepository } from '../../entities/index.ts';\nimport { IdentityProviderIdentityOperation } from '../constants.ts';\nimport type { IIdentityProviderMapper } from '../mapper/index.ts';\nimport { IdentityProviderMapperOperation } from '../mapper/index.ts';\nimport type { IdentityProviderIdentity } from '../types.ts';\nimport type { IIdentityProviderAccountManager, IIdentityProviderAccountRepository, IdentityProviderAccountManagerContext } from './types.ts';\n\nexport class IdentityProviderAccountManager implements IIdentityProviderAccountManager {\n    protected attributesMapper : IIdentityProviderMapper;\n\n    protected permissionMapper : IIdentityProviderMapper;\n\n    protected roleMapper : IIdentityProviderMapper;\n\n    protected repository : IIdentityProviderAccountRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected userValidator : UserValidator;\n\n    constructor(ctx: IdentityProviderAccountManagerContext) {\n        this.attributesMapper = ctx.attributeMapper;\n        this.permissionMapper = ctx.permissionMapper;\n        this.roleMapper = ctx.roleMapper;\n        this.repository = ctx.repository;\n        this.userRepository = ctx.userRepository;\n\n        this.userValidator = new UserValidator();\n    }\n\n    async save(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount> {\n        let account = await this.repository.findOneByProviderIdentity(identity);\n        if (account) {\n            identity.operation = IdentityProviderIdentityOperation.UPDATE;\n\n            account.user = await this.saveUser(identity, account.user);\n\n            await this.repository.save(account);\n\n            await this.saveRoles(identity, account.user);\n            await this.savePermissions(identity, account.user);\n\n            return account;\n        }\n\n        identity.operation = IdentityProviderIdentityOperation.CREATE;\n\n        const user = await this.saveUser(identity);\n\n        account = await this.repository.save({\n            providerId: identity.provider.id,\n            providerUserId: identity.id,\n            providerUserName: user.name, // todo: parse identity.name\n            providerRealmId: identity.provider.realmId,\n            user,\n            userId: user.id,\n            userRealmId: user.realmId,\n        });\n\n        await this.saveRoles(identity, account.user);\n        await this.savePermissions(identity, account.user);\n\n        return account;\n    }\n\n    async saveUser(\n        identity: IdentityProviderIdentity,\n        user?: User,\n    ): Promise<User> {\n        const attributes = await this.attributesMapper.execute(\n            identity,\n        );\n\n        const entity : Record<string, any> = {};\n        for (const attribute of attributes) {\n            if (\n                attribute.key &&\n                attribute.operation === IdentityProviderMapperOperation.CREATE\n            ) {\n                // attribute value might be object, array, ...\n                entity[attribute.key] = attribute.value;\n            }\n        }\n\n        if (!user) {\n            entity.realmId = identity.provider.realmId;\n            entity.active = true;\n            entity.nameLocked = true;\n            entity.clientId = identity.clientId || null;\n        }\n\n        const attributesSelf = await this.validateAttributes(entity, identity, 10);\n        if (!attributesSelf) {\n            // todo: better error name\n            throw new Error('Identity provider attributes could not be validated.');\n        }\n        const attributesSelfKeys = Object.keys(attributesSelf);\n\n        const attributesExtra : Record<string, any> = {};\n\n        const entityKeys = Object.keys(entity);\n        for (const entityKey of entityKeys) {\n            const index = attributesSelfKeys.indexOf(entityKey);\n            if (index !== -1) {\n                continue;\n            }\n\n            attributesExtra[entityKey] = entity[entityKey];\n        }\n\n        let output : User;\n        if (user) {\n            output = extendObject(user, attributesSelf);\n        } else {\n            output = attributesSelf;\n        }\n\n        if (typeof output.name === 'string') {\n            output.name = output.name.trim().toLowerCase();\n        }\n\n        let attempts = Math.max((identity.attributeCandidates?.name?.length || 0) + 1, 10);\n        while (attempts > 0) {\n            try {\n                // todo: we also need to remove existing ones via idp login flow ( but not other attributes!)\n                return await this.userRepository.saveOneWithEA(output, attributesExtra);\n            } catch {\n                const names = identity.attributeCandidates?.name || [];\n                if (names.length > 0) {\n                    while (names.length > 0) {\n                        output.name = `${names.shift()}`.trim().toLowerCase();\n\n                        try {\n                            await this.userValidator.run(output, {\n                                group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n                                    ValidatorGroup.CREATE :\n                                    ValidatorGroup.UPDATE,\n                            });\n                            break;\n                        } catch {\n                            // todo: do nothing.\n                        }\n                    }\n                } else {\n                    output.name = createNanoID('0123456789abcdefghijklmnopqrstuvwxyz-_', 10);\n                }\n\n                if (isUserFakeEmail(output.email)) {\n                    output.email = buildUserFakeEmail(output.name);\n                }\n\n                attempts -= 1;\n            }\n        }\n\n        throw new Error('The user account could not be created due a conflict error.');\n    }\n\n    async validateAttributes(\n        entity: Record<string, any>,\n        identity: IdentityProviderIdentity,\n        attempts: number,\n    ) : Promise<User | null> {\n        attempts--;\n        if (attempts <= 0) {\n            return null;\n        }\n\n        try {\n            return await this.userValidator.run(entity, {\n                group: identity.operation === IdentityProviderIdentityOperation.CREATE ?\n                    ValidatorGroup.CREATE :\n                    ValidatorGroup.UPDATE,\n            });\n        } catch (e: any) {\n            if (!isValidupError(e)) {\n                return null;\n            }\n\n            let retry = false;\n            for (let i = 0; i < e.issues.length; i++) {\n                const child = e.issues[i];\n\n                const pathNormalized = stringifyPath(child.path);\n\n                if (\n                    Array.isArray(entity[pathNormalized]) &&\n                    entity[pathNormalized].length > 0\n                ) {\n                    const [first, ...rest] = entity[pathNormalized];\n                    entity[pathNormalized] = first;\n\n                    if (rest.length > 0) {\n                        if (!identity.attributeCandidates) {\n                            identity.attributeCandidates = {};\n                        }\n\n                        if (!identity.attributeCandidates[pathNormalized]) {\n                            identity.attributeCandidates[pathNormalized] = [];\n                        }\n\n                        identity.attributeCandidates[pathNormalized]!.push(...rest);\n                    }\n\n                    retry = true;\n                    break;\n                }\n\n                if (\n                    identity.attributeCandidates &&\n                    identity.attributeCandidates[pathNormalized] &&\n                    identity.attributeCandidates[pathNormalized]!.length > 0\n                ) {\n                    entity[pathNormalized] = identity.attributeCandidates[pathNormalized]!.shift();\n                    retry = true;\n                    break;\n                }\n\n                if (\n                    entity.name &&\n                    pathNormalized === 'email'\n                ) {\n                    entity[pathNormalized] = buildUserFakeEmail(entity.name);\n                    retry = true;\n                    break;\n                }\n\n                if (entity[pathNormalized]) {\n                    entity[pathNormalized] = null;\n                    break;\n                }\n            }\n\n            if (retry) {\n                return this.validateAttributes(entity, identity, attempts);\n            }\n\n            return null;\n        }\n    }\n\n    async savePermissions(\n        identity: IdentityProviderIdentity,\n        user: User,\n    ) {\n        const entities = await this.permissionMapper.execute(identity);\n\n        await this.userRepository.savePermissions(user, entities);\n    }\n\n    async saveRoles(\n        identity: IdentityProviderIdentity,\n        user: User,\n    ) {\n        const entities = await this.roleMapper.execute(identity);\n\n        await this.userRepository.saveRoles(user, entities);\n    }\n}\n"],"mappings":";;;;;;;;;;AAsBA,IAAaU,iCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,KAAKN,mBAAmBM,IAAIC;EAC5B,KAAKN,mBAAmBK,IAAIL;EAC5B,KAAKC,aAAaI,IAAIJ;EACtB,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,iBAAiBE,IAAIF;EAE1B,KAAKC,gBAAgB,IAAIhB,cAAAA;CAC7B;CAEA,MAAMmB,KAAKC,UAAsE;EAC7E,IAAIC,UAAU,MAAM,KAAKP,WAAWQ,0BAA0BF,QAAAA;EAC9D,IAAIC,SAAS;GACTD,SAASG,YAAYf,kCAAkCgB;GAEvDH,QAAQI,OAAO,MAAM,KAAKC,SAASN,UAAUC,QAAQI,IAAI;GAEzD,MAAM,KAAKX,WAAWK,KAAKE,OAAAA;GAE3B,MAAM,KAAKM,UAAUP,UAAUC,QAAQI,IAAI;GAC3C,MAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,IAAI;GAEjD,OAAOJ;EACX;EAEAD,SAASG,YAAYf,kCAAkCqB;EAEvD,MAAMJ,OAAO,MAAM,KAAKC,SAASN,QAAAA;EAEjCC,UAAU,MAAM,KAAKP,WAAWK,KAAK;GACjCW,YAAYV,SAASW,SAASC;GAC9BC,gBAAgBb,SAASY;GACzBE,kBAAkBT,KAAKU;GACvBC,iBAAiBhB,SAASW,SAASM;GACnCZ;GACAa,QAAQb,KAAKO;GACbO,aAAad,KAAKY;EACtB,CAAA;EAEA,MAAM,KAAKV,UAAUP,UAAUC,QAAQI,IAAI;EAC3C,MAAM,KAAKG,gBAAgBR,UAAUC,QAAQI,IAAI;EAEjD,OAAOJ;CACX;CAEA,MAAMK,SACFN,UACAK,MACa;EACb,MAAMe,aAAa,MAAM,KAAK7B,iBAAiB8B,QAC3CrB,QAAAA;EAGJ,MAAMsB,SAA+B,CAAC;EACtC,KAAK,MAAMC,aAAaH,YACpB,IACIG,UAAUC,OACVD,UAAUpB,cAAcd,gCAAgCoB,QAGxDa,OAAOC,UAAUC,OAAOD,UAAUE;EAI1C,IAAI,CAACpB,MAAM;GACPiB,OAAOL,UAAUjB,SAASW,SAASM;GACnCK,OAAOI,SAAS;GAChBJ,OAAOK,aAAa;GACpBL,OAAOM,WAAW5B,SAAS4B,YAAY;EAC3C;EAEA,MAAMC,iBAAiB,MAAM,KAAKC,mBAAmBR,QAAQtB,UAAU,EAAA;EACvE,IAAI,CAAC6B,gBAED,MAAM,IAAIE,MAAM,sDAAA;EAEpB,MAAMC,qBAAqBC,OAAOC,KAAKL,cAAAA;EAEvC,MAAMM,kBAAwC,CAAC;EAE/C,MAAMC,aAAaH,OAAOC,KAAKZ,MAAAA;EAC/B,KAAK,MAAMe,aAAaD,YAAY;GAEhC,IADcJ,mBAAmBO,QAAQF,SACrCC,MAAU,IACV;GAGJH,gBAAgBE,aAAaf,OAAOe;EACxC;EAEA,IAAIG;EACJ,IAAInC,MACAmC,SAASvD,aAAaoB,MAAMwB,cAAAA;OAE5BW,SAASX;EAGb,IAAI,OAAOW,OAAOzB,SAAS,UACvByB,OAAOzB,OAAOyB,OAAOzB,KAAK0B,KAAI,CAAA,CAAGC,YAAW;EAGhD,IAAIC,WAAWC,KAAKC,KAAK7C,SAAS8C,qBAAqB/B,MAAMgC,UAAU,KAAK,GAAG,EAAA;EAC/E,OAAOJ,WAAW,GACd,IAAI;GAEA,OAAO,MAAM,KAAKhD,eAAeqD,cAAcR,QAAQL,eAAAA;EAC3D,QAAQ;GACJ,MAAMc,QAAQjD,SAAS8C,qBAAqB/B,QAAQ,CAAA;GACpD,IAAIkC,MAAMF,SAAS,GACf,OAAOE,MAAMF,SAAS,GAAG;IACrBP,OAAOzB,OAAO,GAAGkC,MAAMC,MAAK,IAAKT,KAAI,CAAA,CAAGC,YAAW;IAEnD,IAAI;KACA,MAAM,KAAK9C,cAAcuD,IAAIX,QAAQ,EACjCY,OAAOpD,SAASG,cAAcf,kCAAkCqB,SAC5D1B,eAAe0B,SACf1B,eAAeqB,OACvB,CAAA;KACA;IACJ,QAAQ,CAER;GACJ;QAEAoC,OAAOzB,OAAO/B,aAAa,0CAA0C,EAAA;GAGzE,IAAIF,gBAAgB0D,OAAOa,KAAK,GAC5Bb,OAAOa,QAAQxE,mBAAmB2D,OAAOzB,IAAI;GAGjD4B,YAAY;EAChB;EAGJ,MAAM,IAAIZ,MAAM,6DAAA;CACpB;CAEA,MAAMD,mBACFR,QACAtB,UACA2C,UACqB;EACrBA;EACA,IAAIA,YAAY,GACZ,OAAO;EAGX,IAAI;GACA,OAAO,MAAM,KAAK/C,cAAcuD,IAAI7B,QAAQ,EACxC8B,OAAOpD,SAASG,cAAcf,kCAAkCqB,SAC5D1B,eAAe0B,SACf1B,eAAeqB,OACvB,CAAA;EACJ,SAASkD,GAAQ;GACb,IAAI,CAACpE,eAAeoE,CAAAA,GAChB,OAAO;GAGX,IAAIC,QAAQ;GACZ,KAAK,IAAIC,IAAI,GAAGA,IAAIF,EAAEG,OAAOV,QAAQS,KAAK;IACtC,MAAME,QAAQJ,EAAEG,OAAOD;IAEvB,MAAMG,iBAAiBxE,cAAcuE,MAAME,IAAI;IAE/C,IACIC,MAAMC,QAAQxC,OAAOqC,eAAe,KACpCrC,OAAOqC,eAAe,CAACZ,SAAS,GAClC;KACE,MAAM,CAACgB,OAAO,GAAGC,QAAQ1C,OAAOqC;KAChCrC,OAAOqC,kBAAkBI;KAEzB,IAAIC,KAAKjB,SAAS,GAAG;MACjB,IAAI,CAAC/C,SAAS8C,qBACV9C,SAAS8C,sBAAsB,CAAC;MAGpC,IAAI,CAAC9C,SAAS8C,oBAAoBa,iBAC9B3D,SAAS8C,oBAAoBa,kBAAkB,CAAA;MAGnD3D,SAAS8C,oBAAoBa,eAAe,CAAEM,KAAI,GAAID,IAAAA;KAC1D;KAEAT,QAAQ;KACR;IACJ;IAEA,IACIvD,SAAS8C,uBACT9C,SAAS8C,oBAAoBa,mBAC7B3D,SAAS8C,oBAAoBa,eAAe,CAAEZ,SAAS,GACzD;KACEzB,OAAOqC,kBAAkB3D,SAAS8C,oBAAoBa,eAAe,CAAET,MAAK;KAC5EK,QAAQ;KACR;IACJ;IAEA,IACIjC,OAAOP,QACP4C,mBAAmB,SACrB;KACErC,OAAOqC,kBAAkB9E,mBAAmByC,OAAOP,IAAI;KACvDwC,QAAQ;KACR;IACJ;IAEA,IAAIjC,OAAOqC,iBAAiB;KACxBrC,OAAOqC,kBAAkB;KACzB;IACJ;GACJ;GAEA,IAAIJ,OACA,OAAO,KAAKzB,mBAAmBR,QAAQtB,UAAU2C,QAAAA;GAGrD,OAAO;EACX;CACJ;CAEA,MAAMnC,gBACFR,UACAK,MACF;EACE,MAAM6D,WAAW,MAAM,KAAK1E,iBAAiB6B,QAAQrB,QAAAA;EAErD,MAAM,KAAKL,eAAea,gBAAgBH,MAAM6D,QAAAA;CACpD;CAEA,MAAM3D,UACFP,UACAK,MACF;EACE,MAAM6D,WAAW,MAAM,KAAKzE,WAAW4B,QAAQrB,QAAAA;EAE/C,MAAM,KAAKL,eAAeY,UAAUF,MAAM6D,QAAAA;CAC9C;AACJ"}