npm - @authup/server-core - Versions diffs - 1.0.0-beta.53 → 1.0.0-beta.54 - Mend

@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.54

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1152) hide show

package/dist/core/provisioning/synchronizer/realm/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","RealmProvisioningSynchronizer","repository","clientSynchronizer","permissionSynchronizer","roleSynchronizer","userSynchronizer","~~robotSynchronizer","~~scopeSynchronizer","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","clients","map","child","~~realm_id~~","realm","synchronizeMany","permissions","roles","users","~~robots","~~scopes"],"sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IRealmRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity, ScopeProvisioningEntity } from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { RealmProvisioningEntity } from '../../entities/realm/index.ts';\nimport type { ~~RobotProvisioningEntity } from '../../entities/robot/index.ts';\nimport type {~~ RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RealmProvisioningSynchronizerContext } from './types.ts';\n\nexport class RealmProvisioningSynchronizer extends BaseProvisioningSynchronizer<RealmProvisioningEntity> {\n protected repository : IRealmRepository;\n\n protected clientSynchronizer: IProvisioningSynchronizer<ClientProvisioningEntity>;\n\n protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n protected userSynchronizer: IProvisioningSynchronizer<UserProvisioningEntity>;\n\n protected ~~robotSynchronizer: IProvisioningSynchronizer<RobotProvisioningEntity>;\n\n protected~~ scopeSynchronizer : IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n constructor(ctx: RealmProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n this.clientSynchronizer = ctx.clientSynchronizer;\n this.permissionSynchronizer = ctx.permissionSynchronizer;\n this.roleSynchronizer = ctx.roleSynchronizer;\n this.userSynchronizer = ctx.userSynchronizer;\n this.~~robotSynchronizer = ctx.robotSynchronizer;\n this.~~scopeSynchronizer = ctx.scopeSynchronizer;\n }\n\n async synchronize(input: RealmProvisioningEntity): Promise<RealmProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n let attributes = await this.repository.findOneBy({ name: input.attributes.name });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n if (input.relations && input.relations.clients) {\n const clients = input.relations.clients.map(\n (child) => {\n child.attributes.~~realm_id~~ = attributes.id;\n child.attributes.realm = attributes;\n return child;\n },\n );\n\n await this.clientSynchronizer.synchronizeMany(clients);\n }\n\n if (input.relations && input.relations.permissions) {\n const permissions = input.relations.permissions.map((child) => {\n child.attributes.~~realm_id~~ = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.permissionSynchronizer.synchronizeMany(permissions);\n }\n\n if (input.relations && input.relations.roles) {\n const roles = input.relations.roles.map((child) => {\n child.attributes.~~realm_id~~ = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.roleSynchronizer.synchronizeMany(roles);\n }\n\n if (input.relations && input.relations.users) {\n const users = input.relations.users.map((child) => {\n child.attributes.~~realm_id~~ = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.userSynchronizer.synchronizeMany(users);\n }\n\n if (input.relations && input.relations.robots) {\n const robots = input.relations.robots.map((child) => {\n child.attributes.realm_id = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.robotSynchronizer.synchronizeMany(robots);\n }\n\n if (input.relations && input.relations.scopes) {\n const scopes = input.relations.scopes.map((child) => {\n child.attributes.~~realm_id~~ = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.scopeSynchronizer.synchronizeMany(scopes);\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;~~AAoBA~~,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;~~CAEAC;~~CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,~~KAAKP~~,~~aAAaO~~,~~IAAIP~~;EACtB,KAAKC,~~qBAAqBM~~,~~IAAIN~~;EAC9B,KAAKC,~~yBAAyBK~~,~~IAAIL~~;EAClC,KAAKC,~~mBAAmBI,IAAIJ;EAC5B,KAAKC,~~mBAAmBG,IAAIH;EAC5B,KAAKC,~~oBAAoBE~~,IAAIF;~~EAC7B~~,KAAKC,oBAAoBC,IAAID;CACjC;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,~~WAAWf~~,~~oCAAoCY~~,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,~~KAAKX~~,~~WAAWa~~,UAAU,EAAEC,MAAML,MAAME,WAAWG,KAAK,CAAA;EAE/E,IAAIF,SAASG,~~SAASnB~~,+BAA+~~BoB~~,QAAQ;GACzD,IAAIL,YACA,MAAM,~~KAAKX~~,~~WAAWiB~~,OAAON,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASG,MAAjB;GACI,~~KAAKnB~~,+BAA+~~BsB~~;IAChCP,aAAa,~~KAAKX~~,~~WAAWmB~~,MACzBR,YACAC,SAASD,~~aACLhB~~,~~WAAWc~~,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,~~KAAKX~~,~~WAAWoB~~,KAAKT,UAAAA;IACxC;GACJ,~~KAAKf~~,+BAA+~~ByB~~;IAChCZ,MAAME,WAAWW,KAAKX,WAAWW;IACjCX,aAAa,MAAM,~~KAAKX~~,~~WAAWoB~~,KAAK,~~KAAKpB~~,~~WAAWuB~~,OAAOd,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,~~KAAKX~~,~~WAAWoB~~,KAAK,~~KAAKpB~~,~~WAAWuB~~,OAAOd,MAAME,UAAU,CAAA;EAGnF,IAAIF,MAAMe,aAAaf,MAAMe,UAAUC,SAAS;GAC5C,MAAMA,UAAUhB,MAAMe,UAAUC,QAAQC,KACnCC,UAAAA;IACGA,MAAMhB,WAAWiB,~~WAAWjB~~,WAAWW;~~IACvCK~~,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAGJ,MAAM,~~KAAK1B~~,~~mBAAmB6B~~,gBAAgBL,OAAAA;EAClD;EAEA,IAAIhB,MAAMe,aAAaf,MAAMe,UAAUO,aAAa;GAChD,MAAMA,cAActB,MAAMe,UAAUO,YAAYL,KAAKC,UAAAA;IACjDA,MAAMhB,WAAWiB,~~WAAWjB~~,WAAWW;~~IACvCK~~,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,~~KAAKzB~~,~~uBAAuB4B~~,gBAAgBC,WAAAA;EACtD;EAEA,IAAItB,MAAMe,aAAaf,MAAMe,UAAUQ,OAAO;GAC1C,MAAMA,QAAQvB,MAAMe,UAAUQ,MAAMN,KAAKC,UAAAA;IACrCA,MAAMhB,WAAWiB,~~WAAWjB~~,WAAWW;~~IACvCK~~,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,~~KAAKxB~~,~~iBAAiB2B~~,gBAAgBE,KAAAA;EAChD;EAEA,IAAIvB,MAAMe,aAAaf,MAAMe,UAAUS,OAAO;GAC1C,MAAMA,QAAQxB,MAAMe,UAAUS,MAAMP,KAAKC,UAAAA;IACrCA,MAAMhB,WAAWiB,~~WAAWjB~~,WAAWW;~~IACvCK~~,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,~~KAAKvB~~,~~iBAAiB0B~~,gBAAgBG,KAAAA;EAChD;EAEA,IAAIxB,MAAMe,aAAaf,MAAMe,UAAUU,QAAQ;GAC3C,MAAMA,SAASzB,MAAMe,UAAUU,OAAOR,KAAKC,UAAAA;IACvCA,MAAMhB,WAAWiB,~~WAAWjB~~,WAAWW;~~IACvCK~~,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKtB,kBAAkByB,gBAAgBI,MAAAA;EACjD;EAEA,IAAIzB,MAAMe,aAAaf,MAAMe,UAAUW,QAAQ;GAC3C,MAAMA,SAAS1B,MAAMe,UAAUW,OAAOT,KAAKC,UAAAA;IACvCA,MAAMhB,WAAWiB,WAAWjB,WAAWW;IACvCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKrB,kBAAkBwB,~~gBAAgBK~~,MAAAA;EACjD;EAEA,OAAO;GACH,~~GAAG1B~~;GACHE;EACJ;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","RealmProvisioningSynchronizer","repository","clientSynchronizer","permissionSynchronizer","roleSynchronizer","userSynchronizer","scopeSynchronizer","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","clients","map","child","realmId","realm","synchronizeMany","permissions","roles","users","scopes"],"sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IRealmRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity, ScopeProvisioningEntity } from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { RealmProvisioningEntity } from '../../entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RealmProvisioningSynchronizerContext } from './types.ts';\n\nexport class RealmProvisioningSynchronizer extends BaseProvisioningSynchronizer<RealmProvisioningEntity> {\n protected repository : IRealmRepository;\n\n protected clientSynchronizer: IProvisioningSynchronizer<ClientProvisioningEntity>;\n\n protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n protected userSynchronizer: IProvisioningSynchronizer<UserProvisioningEntity>;\n\n protected scopeSynchronizer : IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n constructor(ctx: RealmProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n this.clientSynchronizer = ctx.clientSynchronizer;\n this.permissionSynchronizer = ctx.permissionSynchronizer;\n this.roleSynchronizer = ctx.roleSynchronizer;\n this.userSynchronizer = ctx.userSynchronizer;\n this.scopeSynchronizer = ctx.scopeSynchronizer;\n }\n\n async synchronize(input: RealmProvisioningEntity): Promise<RealmProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n let attributes = await this.repository.findOneBy({ name: input.attributes.name });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n if (input.relations && input.relations.clients) {\n const clients = input.relations.clients.map(\n (child) => {\n child.attributes.realmId = attributes.id;\n child.attributes.realm = attributes;\n return child;\n },\n );\n\n await this.clientSynchronizer.synchronizeMany(clients);\n }\n\n if (input.relations && input.relations.permissions) {\n const permissions = input.relations.permissions.map((child) => {\n child.attributes.realmId = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.permissionSynchronizer.synchronizeMany(permissions);\n }\n\n if (input.relations && input.relations.roles) {\n const roles = input.relations.roles.map((child) => {\n child.attributes.realmId = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.roleSynchronizer.synchronizeMany(roles);\n }\n\n if (input.relations && input.relations.users) {\n const users = input.relations.users.map((child) => {\n child.attributes.realmId = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.userSynchronizer.synchronizeMany(users);\n }\n\n if (input.relations && input.relations.scopes) {\n const scopes = input.relations.scopes.map((child) => {\n child.attributes.realmId = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.scopeSynchronizer.synchronizeMany(scopes);\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKN,aAAaM,IAAIN;EACtB,KAAKC,qBAAqBK,IAAIL;EAC9B,KAAKC,yBAAyBI,IAAIJ;EAClC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,oBAAoBC,IAAID;CACjC;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWd,oCAAoCW,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,KAAKV,WAAWY,UAAU,EAAEC,MAAML,MAAME,WAAWG,KAAK,CAAA;EAE/E,IAAIF,SAASG,SAASlB,+BAA+BmB,QAAQ;GACzD,IAAIL,YACA,MAAM,KAAKV,WAAWgB,OAAON,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASG,MAAjB;GACI,KAAKlB,+BAA+BqB;IAChCP,aAAa,KAAKV,WAAWkB,MACzBR,YACAC,SAASD,aACLf,WAAWa,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKV,WAAWmB,KAAKT,UAAAA;IACxC;GACJ,KAAKd,+BAA+BwB;IAChCZ,MAAME,WAAWW,KAAKX,WAAWW;IACjCX,aAAa,MAAM,KAAKV,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOd,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKV,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOd,MAAME,UAAU,CAAA;EAGnF,IAAIF,MAAMe,aAAaf,MAAMe,UAAUC,SAAS;GAC5C,MAAMA,UAAUhB,MAAMe,UAAUC,QAAQC,KACnCC,UAAAA;IACGA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAGJ,MAAM,KAAKzB,mBAAmB4B,gBAAgBL,OAAAA;EAClD;EAEA,IAAIhB,MAAMe,aAAaf,MAAMe,UAAUO,aAAa;GAChD,MAAMA,cAActB,MAAMe,UAAUO,YAAYL,KAAKC,UAAAA;IACjDA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKxB,uBAAuB2B,gBAAgBC,WAAAA;EACtD;EAEA,IAAItB,MAAMe,aAAaf,MAAMe,UAAUQ,OAAO;GAC1C,MAAMA,QAAQvB,MAAMe,UAAUQ,MAAMN,KAAKC,UAAAA;IACrCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKvB,iBAAiB0B,gBAAgBE,KAAAA;EAChD;EAEA,IAAIvB,MAAMe,aAAaf,MAAMe,UAAUS,OAAO;GAC1C,MAAMA,QAAQxB,MAAMe,UAAUS,MAAMP,KAAKC,UAAAA;IACrCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKtB,iBAAiByB,gBAAgBG,KAAAA;EAChD;EAEA,IAAIxB,MAAMe,aAAaf,MAAMe,UAAUU,QAAQ;GAC3C,MAAMA,SAASzB,MAAMe,UAAUU,OAAOR,KAAKC,UAAAA;IACvCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKrB,kBAAkBwB,gBAAgBI,MAAAA;EACjD;EAEA,OAAO;GACH,GAAGzB;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/realm/types.d.ts CHANGED Viewed

@@ -2,7 +2,6 @@ import type { IRealmRepository } from '../../../entities/index.ts';
 import type { ScopeProvisioningEntity } from '../../entities/index.ts';
 import type { ClientProvisioningEntity } from '../../entities/client/index.ts';
 import type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';
-import type { RobotProvisioningEntity } from '../../entities/robot/index.ts';
 import type { RoleProvisioningEntity } from '../../entities/role/index.ts';
 import type { UserProvisioningEntity } from '../../entities/user/index.ts';
 import type { IProvisioningSynchronizer } from '../../types.ts';
@@ -12,7 +11,6 @@ export type RealmProvisioningSynchronizerContext = {
     roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;
     permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;
     userSynchronizer: IProvisioningSynchronizer<UserProvisioningEntity>;
-    robotSynchronizer: IProvisioningSynchronizer<RobotProvisioningEntity>;
     scopeSynchronizer: IProvisioningSynchronizer<ScopeProvisioningEntity>;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/realm/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/realm/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,~~uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,~~sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,MAAM,oCAAoC,GAAG;IAC/C,UAAU,EAAE,gBAAgB,CAAC;IAE7B,kBAAkB,EAAE,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;IACxE,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IAChF,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,iBAAiB,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;~~IACtE,iBAAiB,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;~~CACzE,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/realm/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,MAAM,oCAAoC,GAAG;IAC/C,UAAU,EAAE,gBAAgB,CAAC;IAE7B,kBAAkB,EAAE,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;IACxE,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IAChF,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,iBAAiB,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;CACzE,CAAC"}

package/dist/core/provisioning/synchronizer/role/module.mjs CHANGED Viewed

@@ -19,8 +19,8 @@ var RoleProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 		this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);
 		this.permissionJunction = new ProvisioningJunctionSynchronizer({
 			repository: ctx.rolePermissionRepository,
-			ownerKey: "role_id",
-			ownerRealmKey: "role_realm_id"
+			ownerKey: "roleId",
+			ownerRealmKey: "roleRealmId"
 		});
 	}
 	async synchronize(input) {
@@ -28,8 +28,8 @@ var RoleProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
 		let attributes = await this.repository.findOneBy({
 			name: input.attributes.name,
-			realm_id: input.attributes.realm_id || null,
-			client_id: input.attributes.client_id || null
+			realmId: input.attributes.realmId || null,
+			clientId: input.attributes.clientId || null
 		});
 		if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {
 			if (attributes) await this.repository.remove(attributes);
@@ -58,7 +58,7 @@ var RoleProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 			const excludeSet = new Set(input.relations.globalPermissionsExclude);
 			globalPermissions = globalPermissions.filter((p) => !excludeSet.has(p.name));
 		}
-		const realmPermissions = attributes.realm_id ? await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realm_id) : [];
+		const realmPermissions = attributes.realmId ? await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realmId) : [];
 		const permissions = [...globalPermissions, ...realmPermissions];
 		if (permissions.length > 0) {
 			const defaultScope = input.relations.globalPermissionsRealmScope;
@@ -66,9 +66,9 @@ var RoleProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 				const overrides = this.buildRealmScopeOverrides(input);
 				for (const permission of permissions) {
 					const realmScope = overrides.get(permission.name) ?? defaultScope;
-					await this.permissionJunction.synchronize(attributes, [permission], "permission_id", "permission_realm_id", { realm_scope: realmScope });
+					await this.permissionJunction.synchronize(attributes, [permission], "permissionId", "permissionRealmId", { realmScope });
 				}
-			} else await this.permissionJunction.synchronize(attributes, permissions, "permission_id", "permission_realm_id");
+			} else await this.permissionJunction.synchronize(attributes, permissions, "permissionId", "permissionRealmId");
 		}
 		return {
 			...input,

package/dist/core/provisioning/synchronizer/role/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RoleProvisioningSynchronizer","repository","permissionResolver","permissionJunction","ctx","permissionRepository","rolePermissionRepository","ownerKey","ownerRealmKey","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","~~realm_id~~","~~client_id~~","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","globalPermissions","resolveGlobal","globalPermissionsExclude","length","excludeSet","Set","filter","p","has","realmPermissions","resolveRealm","permissions","defaultScope","globalPermissionsRealmScope","overrides","buildRealmScopeOverrides","permission","realmScope","get","~~realm_scope","~~Map","globalPermissionsRealmScopeOverrides","permissionNames","Object","entries","permName","set"],"sources":["../../../../../src/core/provisioning/synchronizer/role/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IRoleRepository } from '../../../entities/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RoleProvisioningSynchronizerContext } from './types.ts';\n\nexport class RoleProvisioningSynchronizer extends BaseProvisioningSynchronizer<RoleProvisioningEntity> {\n protected repository : IRoleRepository;\n\n protected permissionResolver : ProvisioningEntityResolver<Permission>;\n\n protected permissionJunction: ProvisioningJunctionSynchronizer<RolePermission>;\n\n constructor(ctx: RoleProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n this.permissionJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.rolePermissionRepository,\n ownerKey: '~~role_id~~',\n ownerRealmKey: '~~role_realm_id~~',\n });\n }\n\n async synchronize(input: RoleProvisioningEntity): Promise<RoleProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n let attributes = await this.repository.findOneBy({\n name: input.attributes.name,\n ~~realm_id~~: input.attributes.~~realm_id~~ \|\| null,\n ~~client_id~~: input.attributes.~~client_id~~ \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes,\n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n if (!input.relations) {\n return {\n ...input,\n attributes,\n };\n }\n\n let globalPermissions = await this.permissionResolver.resolveGlobal(input.relations.globalPermissions);\n\n if (input.relations.globalPermissionsExclude && input.relations.globalPermissionsExclude.length > 0) {\n const excludeSet = new Set(input.relations.globalPermissionsExclude);\n globalPermissions = globalPermissions.filter((p) => !excludeSet.has(p.name));\n }\n\n const realmPermissions = attributes.~~realm_id~~ ?\n await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.~~realm_id~~) :\n [];\n\n const permissions = [\n ...globalPermissions,\n ...realmPermissions,\n ];\n\n if (permissions.length > 0) {\n const defaultScope = input.relations.globalPermissionsRealmScope;\n\n if (defaultScope) {\n const overrides = this.buildRealmScopeOverrides(input);\n for (const permission of permissions) {\n const realmScope = overrides.get(permission.name) ?? defaultScope;\n await this.permissionJunction.synchronize(\n attributes,\n [permission],\n '~~permission_id~~',\n '~~permission_realm_id~~',\n { ~~realm_scope:~~ realmScope },\n );\n }\n } else {\n await this.permissionJunction.synchronize(\n attributes,\n permissions,\n '~~permission_id~~',\n '~~permission_realm_id~~',\n );\n }\n }\n\n return {\n ...input,\n attributes,\n };\n }\n\n private buildRealmScopeOverrides(input: RoleProvisioningEntity): Map<string, string> {\n const overrides = new Map<string, string>();\n if (input.relations?.globalPermissionsRealmScopeOverrides) {\n for (const [realmScope, permissionNames] of Object.entries(input.relations.globalPermissionsRealmScopeOverrides)) {\n if (!permissionNames) {\n continue;\n }\n for (const permName of permissionNames) {\n overrides.set(permName, realmScope);\n }\n }\n }\n return overrides;\n }\n}\n"],"mappings":";;;;;;;;;;;AAiBA,IAAaM,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,qBAAqB,IAAIJ,2BAA2BM,IAAIC,oBAAoB;EACjF,KAAKF,qBAAqB,IAAIJ,iCAAiC;GAC3DE,YAAYG,IAAIE;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAMC,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWjB,oCAAoCc,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,KAAKX,WAAWa,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,~~UAAUN~~,MAAME,WAAWI,~~YAAY~~;~~GACvCC~~,~~WAAWP~~,MAAME,WAAWK,~~aAAa~~;~~EAC7C~~,CAAA;EAEA,IAAIJ,SAASK,SAASvB,+BAA+BwB,QAAQ;GACzD,IAAIP,YACA,MAAM,KAAKX,WAAWmB,OAAOR,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASK,MAAjB;GACI,KAAKvB,+BAA+B0B;IAChCT,aAAa,KAAKX,WAAWqB,MACzBV,YACAC,SAASD,aACLlB,WAAWgB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKX,WAAWsB,KAAKX,UAAAA;IACxC;GACJ,KAAKjB,+BAA+B6B;IAChCd,MAAME,WAAWa,KAAKb,WAAWa;IACjCb,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;EAGnF,IAAI,CAACF,MAAMiB,WACP,OAAO;GACH,GAAGjB;GACHE;EACJ;EAGJ,IAAIgB,oBAAoB,MAAM,KAAK1B,mBAAmB2B,cAAcnB,MAAMiB,UAAUC,iBAAiB;EAErG,IAAIlB,MAAMiB,UAAUG,4BAA4BpB,MAAMiB,UAAUG,yBAAyBC,SAAS,GAAG;GACjG,MAAMC,aAAa,IAAIC,IAAIvB,MAAMiB,UAAUG,wBAAwB;GACnEF,oBAAoBA,kBAAkBM,QAAQC,MAAM,CAACH,WAAWI,IAAID,EAAEpB,IAAI,CAAA;EAC9E;EAEA,MAAMsB,mBAAmBzB,WAAWI,~~WAChC~~,MAAM,KAAKd,mBAAmBoC,aAAa5B,MAAMiB,UAAUU,kBAAkBzB,WAAWI,~~QAAQ~~,~~IAChG~~,CAAA;EAEJ,MAAMuB,cAAc,CAAA,GACbX,mBAAAA,GACAS,gBAAAA;EAGP,IAAIE,YAAYR,SAAS,GAAG;GACxB,MAAMS,eAAe9B,MAAMiB,UAAUc;GAErC,IAAID,cAAc;IACd,MAAME,YAAY,KAAKC,yBAAyBjC,KAAAA;IAChD,KAAK,MAAMkC,cAAcL,aAAa;KAClC,MAAMM,aAAaH,UAAUI,IAAIF,WAAW7B,IAAI,KAAKyB;KACrD,MAAM,KAAKrC,mBAAmBM,YAC1BG,YACA,CAACgC,UAAAA,GACD,~~iBACA~~,~~uBACA~~,~~EAAEG~~,~~aAAaF,~~WAAW,CAAA;~~IAElC~~;GACJ,OACI,MAAM,KAAK1C,mBAAmBM,YAC1BG,YACA2B,aACA,~~iBACA~~,~~qBAAA~~;EAGZ;EAEA,OAAO;GACH,GAAG7B;GACHE;EACJ;CACJ;CAEQ+B,yBAAyBjC,OAAoD;EACjF,MAAMgC,4BAAY,~~IAAIM~~,IAAAA;EACtB,~~IAAItC~~,MAAMiB,~~WAAWsB~~,sCACjB,KAAK,MAAM,~~CAACJ~~,~~YAAYK~~,oBAAoBC,OAAOC,~~QAAQ1C~~,MAAMiB,~~UAAUsB~~,oCAAoC,GAAG;GAC9G,IAAI,CAACC,iBACD;GAEJ,KAAK,MAAMG,YAAYH,~~iBACnBR~~,~~UAAUY~~,IAAID,~~UAAUR~~,UAAAA;EAEhC;EAEJ,OAAOH;CACX;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RoleProvisioningSynchronizer","repository","permissionResolver","permissionJunction","ctx","permissionRepository","rolePermissionRepository","ownerKey","ownerRealmKey","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","clientId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","globalPermissions","resolveGlobal","globalPermissionsExclude","length","excludeSet","Set","filter","p","has","realmPermissions","resolveRealm","permissions","defaultScope","globalPermissionsRealmScope","overrides","buildRealmScopeOverrides","permission","realmScope","get","Map","globalPermissionsRealmScopeOverrides","permissionNames","Object","entries","permName","set"],"sources":["../../../../../src/core/provisioning/synchronizer/role/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IRoleRepository } from '../../../entities/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RoleProvisioningSynchronizerContext } from './types.ts';\n\nexport class RoleProvisioningSynchronizer extends BaseProvisioningSynchronizer<RoleProvisioningEntity> {\n protected repository : IRoleRepository;\n\n protected permissionResolver : ProvisioningEntityResolver<Permission>;\n\n protected permissionJunction: ProvisioningJunctionSynchronizer<RolePermission>;\n\n constructor(ctx: RoleProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n this.permissionJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.rolePermissionRepository,\n ownerKey: 'roleId',\n ownerRealmKey: 'roleRealmId',\n });\n }\n\n async synchronize(input: RoleProvisioningEntity): Promise<RoleProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n let attributes = await this.repository.findOneBy({\n name: input.attributes.name,\n realmId: input.attributes.realmId \|\| null,\n clientId: input.attributes.clientId \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes,\n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n if (!input.relations) {\n return {\n ...input,\n attributes,\n };\n }\n\n let globalPermissions = await this.permissionResolver.resolveGlobal(input.relations.globalPermissions);\n\n if (input.relations.globalPermissionsExclude && input.relations.globalPermissionsExclude.length > 0) {\n const excludeSet = new Set(input.relations.globalPermissionsExclude);\n globalPermissions = globalPermissions.filter((p) => !excludeSet.has(p.name));\n }\n\n const realmPermissions = attributes.realmId ?\n await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realmId) :\n [];\n\n const permissions = [\n ...globalPermissions,\n ...realmPermissions,\n ];\n\n if (permissions.length > 0) {\n const defaultScope = input.relations.globalPermissionsRealmScope;\n\n if (defaultScope) {\n const overrides = this.buildRealmScopeOverrides(input);\n for (const permission of permissions) {\n const realmScope = overrides.get(permission.name) ?? defaultScope;\n await this.permissionJunction.synchronize(\n attributes,\n [permission],\n 'permissionId',\n 'permissionRealmId',\n { realmScope },\n );\n }\n } else {\n await this.permissionJunction.synchronize(\n attributes,\n permissions,\n 'permissionId',\n 'permissionRealmId',\n );\n }\n }\n\n return {\n ...input,\n attributes,\n };\n }\n\n private buildRealmScopeOverrides(input: RoleProvisioningEntity): Map<string, string> {\n const overrides = new Map<string, string>();\n if (input.relations?.globalPermissionsRealmScopeOverrides) {\n for (const [realmScope, permissionNames] of Object.entries(input.relations.globalPermissionsRealmScopeOverrides)) {\n if (!permissionNames) {\n continue;\n }\n for (const permName of permissionNames) {\n overrides.set(permName, realmScope);\n }\n }\n }\n return overrides;\n }\n}\n"],"mappings":";;;;;;;;;;;AAiBA,IAAaM,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,qBAAqB,IAAIJ,2BAA2BM,IAAIC,oBAAoB;EACjF,KAAKF,qBAAqB,IAAIJ,iCAAiC;GAC3DE,YAAYG,IAAIE;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAMC,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWjB,oCAAoCc,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,KAAKX,WAAWa,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;GACrCC,UAAUP,MAAME,WAAWK,YAAY;EAC3C,CAAA;EAEA,IAAIJ,SAASK,SAASvB,+BAA+BwB,QAAQ;GACzD,IAAIP,YACA,MAAM,KAAKX,WAAWmB,OAAOR,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASK,MAAjB;GACI,KAAKvB,+BAA+B0B;IAChCT,aAAa,KAAKX,WAAWqB,MACzBV,YACAC,SAASD,aACLlB,WAAWgB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKX,WAAWsB,KAAKX,UAAAA;IACxC;GACJ,KAAKjB,+BAA+B6B;IAChCd,MAAME,WAAWa,KAAKb,WAAWa;IACjCb,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;EAGnF,IAAI,CAACF,MAAMiB,WACP,OAAO;GACH,GAAGjB;GACHE;EACJ;EAGJ,IAAIgB,oBAAoB,MAAM,KAAK1B,mBAAmB2B,cAAcnB,MAAMiB,UAAUC,iBAAiB;EAErG,IAAIlB,MAAMiB,UAAUG,4BAA4BpB,MAAMiB,UAAUG,yBAAyBC,SAAS,GAAG;GACjG,MAAMC,aAAa,IAAIC,IAAIvB,MAAMiB,UAAUG,wBAAwB;GACnEF,oBAAoBA,kBAAkBM,QAAQC,MAAM,CAACH,WAAWI,IAAID,EAAEpB,IAAI,CAAA;EAC9E;EAEA,MAAMsB,mBAAmBzB,WAAWI,UAChC,MAAM,KAAKd,mBAAmBoC,aAAa5B,MAAMiB,UAAUU,kBAAkBzB,WAAWI,OAAO,IAC/F,CAAA;EAEJ,MAAMuB,cAAc,CAAA,GACbX,mBAAAA,GACAS,gBAAAA;EAGP,IAAIE,YAAYR,SAAS,GAAG;GACxB,MAAMS,eAAe9B,MAAMiB,UAAUc;GAErC,IAAID,cAAc;IACd,MAAME,YAAY,KAAKC,yBAAyBjC,KAAAA;IAChD,KAAK,MAAMkC,cAAcL,aAAa;KAClC,MAAMM,aAAaH,UAAUI,IAAIF,WAAW7B,IAAI,KAAKyB;KACrD,MAAM,KAAKrC,mBAAmBM,YAC1BG,YACA,CAACgC,UAAAA,GACD,gBACA,qBACA,EAAEC,WAAW,CAAA;IAErB;GACJ,OACI,MAAM,KAAK1C,mBAAmBM,YAC1BG,YACA2B,aACA,gBACA,mBAAA;EAGZ;EAEA,OAAO;GACH,GAAG7B;GACHE;EACJ;CACJ;CAEQ+B,yBAAyBjC,OAAoD;EACjF,MAAMgC,4BAAY,IAAIK,IAAAA;EACtB,IAAIrC,MAAMiB,WAAWqB,sCACjB,KAAK,MAAM,CAACH,YAAYI,oBAAoBC,OAAOC,QAAQzC,MAAMiB,UAAUqB,oCAAoC,GAAG;GAC9G,IAAI,CAACC,iBACD;GAEJ,KAAK,MAAMG,YAAYH,iBACnBP,UAAUW,IAAID,UAAUP,UAAAA;EAEhC;EAEJ,OAAOH;CACX;AACJ"}

package/dist/core/provisioning/synchronizer/scope/module.mjs CHANGED Viewed

@@ -18,7 +18,7 @@ var ScopeProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
 		let attributes = await this.repository.findOneBy({
 			name: input.attributes.name,
-			realm_id: input.attributes.realm_id || null
+			realmId: input.attributes.realmId || null
 		});
 		if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {
 			if (attributes) await this.repository.remove(attributes);

package/dist/core/provisioning/synchronizer/scope/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ScopeProvisioningSynchronizer","repository","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","~~realm_id~~","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create"],"sources":["../../../../../src/core/provisioning/synchronizer/scope/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IScopeRepository } from '../../../entities/index.ts';\nimport type { ScopeProvisioningEntity } from '../../entities/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { ScopeProvisioningSynchronizerContext } from './types.ts';\n\nexport class ScopeProvisioningSynchronizer extends BaseProvisioningSynchronizer<ScopeProvisioningEntity> {\n protected repository : IScopeRepository;\n\n constructor(ctx: ScopeProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n }\n\n async synchronize(input: ScopeProvisioningEntity): Promise<ScopeProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n let attributes = await this.repository.findOneBy({\n name: input.attributes.name,\n ~~realm_id~~: input.attributes.~~realm_id~~ \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWT,oCAAoCM,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKL,WAAWO,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,~~UAAUN~~,MAAME,WAAWI,~~YAAY~~;~~EAC3C~~,CAAA;EAEA,IAAIH,SAASI,SAASd,+BAA+Be,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKL,WAAWY,OAAOP,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAKd,+BAA+BiB;IAChCR,aAAa,KAAKL,WAAWc,MACzBT,YACAC,SAASD,aACLV,WAAWQ,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKL,WAAWe,KAAKV,UAAAA;IACxC;GACJ,KAAKT,+BAA+BoB;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;EAGnF,OAAO;GACH,GAAGF;GACHE;EACJ;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ScopeProvisioningSynchronizer","repository","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create"],"sources":["../../../../../src/core/provisioning/synchronizer/scope/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IScopeRepository } from '../../../entities/index.ts';\nimport type { ScopeProvisioningEntity } from '../../entities/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { ScopeProvisioningSynchronizerContext } from './types.ts';\n\nexport class ScopeProvisioningSynchronizer extends BaseProvisioningSynchronizer<ScopeProvisioningEntity> {\n protected repository : IScopeRepository;\n\n constructor(ctx: ScopeProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n }\n\n async synchronize(input: ScopeProvisioningEntity): Promise<ScopeProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n let attributes = await this.repository.findOneBy({\n name: input.attributes.name,\n realmId: input.attributes.realmId \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWT,oCAAoCM,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKL,WAAWO,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAASd,+BAA+Be,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKL,WAAWY,OAAOP,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAKd,+BAA+BiB;IAChCR,aAAa,KAAKL,WAAWc,MACzBT,YACAC,SAASD,aACLV,WAAWQ,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKL,WAAWe,KAAKV,UAAAA;IACxC;GACJ,KAAKT,+BAA+BoB;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;EAGnF,OAAO;GACH,GAAGF;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/user/module.mjs CHANGED Viewed

@@ -25,13 +25,13 @@ var UserProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 		this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);
 		this.permissionJunction = new ProvisioningJunctionSynchronizer({
 			repository: ctx.userPermissionRepository,
-			ownerKey: "user_id",
-			ownerRealmKey: "user_realm_id"
+			ownerKey: "userId",
+			ownerRealmKey: "userRealmId"
 		});
 		this.roleJunction = new ProvisioningJunctionSynchronizer({
 			repository: ctx.userRoleRepository,
-			ownerKey: "user_id",
-			ownerRealmKey: "user_realm_id"
+			ownerKey: "userId",
+			ownerRealmKey: "userRealmId"
 		});
 	}
 	async synchronize(input) {
@@ -39,7 +39,7 @@ var UserProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
 		let attributes = await this.userRepository.findOneBy({
 			name: input.attributes.name,
-			realm_id: input.attributes.realm_id || null
+			realmId: input.attributes.realmId || null
 		});
 		if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {
 			if (attributes) await this.userRepository.remove(attributes);
@@ -64,36 +64,36 @@ var UserProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 			if (!input.attributes.email && input.attributes.name) input.attributes.email = buildUserFakeEmail(input.attributes.name);
 			attributes = await this.userRepository.save(this.userRepository.create(input.attributes));
 		}
-		const permissions = [...await this.permissionResolver.resolveGlobal(input.relations && input.relations.globalPermissions), ...attributes.realm_id ? await this.permissionResolver.resolveRealm(input.relations && input.relations.realmPermissions, attributes.realm_id) : []];
+		const permissions = [...await this.permissionResolver.resolveGlobal(input.relations && input.relations.globalPermissions), ...attributes.realmId ? await this.permissionResolver.resolveRealm(input.relations && input.relations.realmPermissions, attributes.realmId) : []];
 		if (input.relations && input.relations.clientPermissions) {
 			const clientKeys = Object.keys(input.relations.clientPermissions);
 			for (const clientKey of clientKeys) {
 				const client = await this.clientRepository.findOneBy({
 					name: clientKey,
-					realm_id: attributes.realm_id
+					realmId: attributes.realmId
 				});
 				if (client) {
-					const entities = await this.permissionResolver.resolveClient(input.relations.clientPermissions[clientKey], attributes.realm_id, client.id);
+					const entities = await this.permissionResolver.resolveClient(input.relations.clientPermissions[clientKey], attributes.realmId, client.id);
 					permissions.push(...entities);
 				}
 			}
 		}
-		if (permissions.length > 0) await this.permissionJunction.synchronize(attributes, permissions, "permission_id", "permission_realm_id");
-		const roles = [...await this.roleResolver.resolveGlobal(input.relations && input.relations.globalRoles), ...attributes.realm_id ? await this.roleResolver.resolveRealm(input.relations && input.relations.realmRoles, attributes.realm_id) : []];
+		if (permissions.length > 0) await this.permissionJunction.synchronize(attributes, permissions, "permissionId", "permissionRealmId");
+		const roles = [...await this.roleResolver.resolveGlobal(input.relations && input.relations.globalRoles), ...attributes.realmId ? await this.roleResolver.resolveRealm(input.relations && input.relations.realmRoles, attributes.realmId) : []];
 		if (input.relations && input.relations.clientRoles) {
 			const clientKeys = Object.keys(input.relations.clientRoles);
 			for (const clientKey of clientKeys) {
 				const client = await this.clientRepository.findOneBy({
 					name: clientKey,
-					realm_id: attributes.realm_id
+					realmId: attributes.realmId
 				});
 				if (client) {
-					const entities = await this.roleResolver.resolveClient(input.relations.clientRoles[clientKey], attributes.realm_id, client.id);
+					const entities = await this.roleResolver.resolveClient(input.relations.clientRoles[clientKey], attributes.realmId, client.id);
 					roles.push(...entities);
 				}
 			}
 		}
-		if (roles.length > 0) await this.roleJunction.synchronize(attributes, roles, "role_id", "role_realm_id");
+		if (roles.length > 0) await this.roleJunction.synchronize(attributes, roles, "roleId", "roleRealmId");
 		return {
 			...input,
 			attributes

package/dist/core/provisioning/synchronizer/user/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["buildUserFakeEmail","pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","UserProvisioningSynchronizer","userRepository","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","userPermissionRepository","ownerKey","ownerRealmKey","userRoleRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","includes","email","merge","save","REPLACE","undefined","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","clientPermissions","clientKeys","Object","keys","clientKey","client","entities","resolveClient","push","length","roles","globalRoles","realmRoles","clientRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n Permission, \n Role, \n UserPermission, \n UserRole,\n} from '@authup/core-kit';\nimport { buildUserFakeEmail } from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type {\n IClientRepository,\n IUserRepository,\n} from '../../../entities/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { UserProvisioningSynchronizerContext } from './types.ts';\n\nexport class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {\n protected userRepository: IUserRepository;\n\n protected clientRepository: IClientRepository;\n\n protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n protected roleResolver: ProvisioningEntityResolver<Role>;\n\n protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;\n\n protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;\n\n constructor(ctx: UserProvisioningSynchronizerContext) {\n super();\n\n this.userRepository = ctx.userRepository;\n this.clientRepository = ctx.clientRepository;\n\n this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n this.permissionJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.userPermissionRepository,\n ownerKey: 'user_id',\n ownerRealmKey: 'user_realm_id',\n });\n this.roleJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.userRoleRepository,\n ownerKey: 'user_id',\n ownerRealmKey: 'user_realm_id',\n });\n }\n\n async synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n let attributes = await this.userRepository.findOneBy({\n name: input.attributes.name,\n realm_id: input.attributes.realm_id \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.userRepository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n if (\n strategy.attributes &&\n strategy.attributes.includes('email')\n ) {\n input.attributes.email = input.attributes.email \|\|\n attributes.email \|\|\n buildUserFakeEmail(input.attributes.name \|\| attributes.name);\n }\n\n attributes = this.userRepository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.userRepository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.email = input.attributes.email \|\|\n attributes.email \|\|\n (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);\n\n input.attributes.id = attributes.id;\n attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n break;\n }\n } else {\n if (!input.attributes.email && input.attributes.name) {\n input.attributes.email = buildUserFakeEmail(input.attributes.name);\n }\n\n attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n }\n\n // Permissions (Global, Realm & Client)\n const permissions : Permission[] = [\n ...await this.permissionResolver.resolveGlobal(\n input.relations && input.relations.globalPermissions,\n ),\n ...(attributes.realm_id ?\n await this.permissionResolver.resolveRealm(\n input.relations && input.relations.realmPermissions,\n attributes.realm_id,\n ) :\n []),\n ];\n\n if (input.relations && input.relations.clientPermissions) {\n const clientKeys = Object.keys(input.relations.clientPermissions);\n for (const clientKey of clientKeys) {\n const client = await this.clientRepository.findOneBy({\n name: clientKey,\n realm_id: attributes.realm_id,\n });\n\n if (client) {\n const entities = await this.permissionResolver.resolveClient(\n input.relations.clientPermissions[clientKey],\n attributes.realm_id,\n client.id,\n );\n permissions.push(...entities);\n }\n }\n }\n\n if (permissions.length > 0) {\n await this.permissionJunction.synchronize(\n attributes,\n permissions,\n 'permission_id',\n 'permission_realm_id',\n );\n }\n\n // Roles (Global, Realm & Client)\n const roles : Role[] = [\n ...await this.roleResolver.resolveGlobal(\n input.relations && input.relations.globalRoles,\n ),\n ...(attributes.realm_id ?\n await this.roleResolver.resolveRealm(\n input.relations && input.relations.realmRoles,\n attributes.realm_id,\n ) :\n []),\n ];\n\n if (input.relations && input.relations.clientRoles) {\n const clientKeys = Object.keys(input.relations.clientRoles);\n for (const clientKey of clientKeys) {\n const client = await this.clientRepository.findOneBy({\n name: clientKey,\n realm_id: attributes.realm_id,\n });\n\n if (client) {\n const entities = await this.roleResolver.resolveClient(\n input.relations.clientRoles[clientKey],\n attributes.realm_id,\n client.id,\n );\n roles.push(...entities);\n }\n }\n }\n\n if (roles.length > 0) {\n await this.roleJunction.synchronize(\n attributes,\n roles,\n 'role_id',\n 'role_realm_id',\n );\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAaO,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKN,iBAAiBM,IAAIN;EAC1B,KAAKC,mBAAmBK,IAAIL;EAE5B,KAAKC,qBAAqB,IAAIL,2BAA2BS,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIN,2BAA2BS,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIN,iCAAiC;GAC3DW,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIP,iCAAiC;GACrDW,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWvB,oCAAoCoB,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKjB,eAAemB,UAAU;GACjDC,MAAML,MAAME,WAAWG;GACvBC,UAAUN,MAAME,WAAWI,YAAY;EAC3C,CAAA;EAEA,IAAIH,SAASI,SAAS5B,+BAA+B6B,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKjB,eAAewB,OAAOP,UAAAA;GAErC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAK5B,+BAA+B+B;IAChC,IACIP,SAASD,cACTC,SAASD,WAAWS,SAAS,OAAA,GAE7BX,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,SACXnC,mBAAmBuB,MAAME,WAAWG,QAAQH,WAAWG,IAAI;IAGnEH,aAAa,KAAKjB,eAAe4B,MAC7BX,YACAC,SAASD,aACLxB,WAAWsB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKjB,eAAe6B,KAAKZ,UAAAA;IAC5C;GACJ,KAAKvB,+BAA+BoC;IAChCf,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,UACVZ,MAAME,WAAWG,OAAO5B,mBAAmBuB,MAAME,WAAWG,IAAI,IAAIW,KAAAA;IAEzEhB,MAAME,WAAWe,KAAKf,WAAWe;IACjCf,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;IACvF;EACR;OACG;GACH,IAAI,CAACF,MAAME,WAAWU,SAASZ,MAAME,WAAWG,MAC5CL,MAAME,WAAWU,QAAQnC,mBAAmBuB,MAAME,WAAWG,IAAI;GAGrEH,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;EAC3F;EAGA,MAAMiB,cAA6B,CAAA,GAC5B,MAAM,KAAKhC,mBAAmBiC,cAC7BpB,MAAMqB,aAAarB,MAAMqB,UAAUC,iBAAiB,GAAA,GAEpDpB,WAAWI,WACX,MAAM,KAAKnB,mBAAmBoC,aAC1BvB,MAAMqB,aAAarB,MAAMqB,UAAUG,kBACnCtB,WAAWI,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUI,mBAAmB;GACtD,MAAMC,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUI,iBAAiB;GAChE,KAAK,MAAMI,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,UAAUJ,WAAWI;IACzB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK5C,mBAAmB6C,cAC3ChC,MAAMqB,UAAUI,kBAAkBI,YAClC3B,WAAWI,UACXwB,OAAOb,EAAE;KAEbE,YAAYc,KAAI,GAAIF,QAAAA;IACxB;GACJ;EACJ;EAEA,IAAIZ,YAAYe,SAAS,GACrB,MAAM,KAAK7C,mBAAmBU,YAC1BG,YACAiB,aACA,iBACA,qBAAA;EAKR,MAAMgB,QAAiB,CAAA,GAChB,MAAM,KAAK/C,aAAagC,cACvBpB,MAAMqB,aAAarB,MAAMqB,UAAUe,WAAW,GAAA,GAE9ClC,WAAWI,WACX,MAAM,KAAKlB,aAAamC,aACpBvB,MAAMqB,aAAarB,MAAMqB,UAAUgB,YACnCnC,WAAWI,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUiB,aAAa;GAChD,MAAMZ,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUiB,WAAW;GAC1D,KAAK,MAAMT,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,UAAUJ,WAAWI;IACzB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK3C,aAAa4C,cACrChC,MAAMqB,UAAUiB,YAAYT,YAC5B3B,WAAWI,UACXwB,OAAOb,EAAE;KAEbkB,MAAMF,KAAI,GAAIF,QAAAA;IAClB;GACJ;EACJ;EAEA,IAAII,MAAMD,SAAS,GACf,MAAM,KAAK5C,aAAaS,YACpBG,YACAiC,OACA,WACA,eAAA;EAIR,OAAO;GACH,GAAGnC;GACHE;EACJ;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["buildUserFakeEmail","pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","UserProvisioningSynchronizer","userRepository","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","userPermissionRepository","ownerKey","ownerRealmKey","userRoleRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","includes","email","merge","save","REPLACE","undefined","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","clientPermissions","clientKeys","Object","keys","clientKey","client","entities","resolveClient","push","length","roles","globalRoles","realmRoles","clientRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n Permission, \n Role, \n UserPermission, \n UserRole,\n} from '@authup/core-kit';\nimport { buildUserFakeEmail } from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type {\n IClientRepository,\n IUserRepository,\n} from '../../../entities/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { UserProvisioningSynchronizerContext } from './types.ts';\n\nexport class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {\n protected userRepository: IUserRepository;\n\n protected clientRepository: IClientRepository;\n\n protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n protected roleResolver: ProvisioningEntityResolver<Role>;\n\n protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;\n\n protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;\n\n constructor(ctx: UserProvisioningSynchronizerContext) {\n super();\n\n this.userRepository = ctx.userRepository;\n this.clientRepository = ctx.clientRepository;\n\n this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n this.permissionJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.userPermissionRepository,\n ownerKey: 'userId',\n ownerRealmKey: 'userRealmId',\n });\n this.roleJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.userRoleRepository,\n ownerKey: 'userId',\n ownerRealmKey: 'userRealmId',\n });\n }\n\n async synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n let attributes = await this.userRepository.findOneBy({\n name: input.attributes.name,\n realmId: input.attributes.realmId \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.userRepository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n if (\n strategy.attributes &&\n strategy.attributes.includes('email')\n ) {\n input.attributes.email = input.attributes.email \|\|\n attributes.email \|\|\n buildUserFakeEmail(input.attributes.name \|\| attributes.name);\n }\n\n attributes = this.userRepository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.userRepository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.email = input.attributes.email \|\|\n attributes.email \|\|\n (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);\n\n input.attributes.id = attributes.id;\n attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n break;\n }\n } else {\n if (!input.attributes.email && input.attributes.name) {\n input.attributes.email = buildUserFakeEmail(input.attributes.name);\n }\n\n attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n }\n\n // Permissions (Global, Realm & Client)\n const permissions : Permission[] = [\n ...await this.permissionResolver.resolveGlobal(\n input.relations && input.relations.globalPermissions,\n ),\n ...(attributes.realmId ?\n await this.permissionResolver.resolveRealm(\n input.relations && input.relations.realmPermissions,\n attributes.realmId,\n ) :\n []),\n ];\n\n if (input.relations && input.relations.clientPermissions) {\n const clientKeys = Object.keys(input.relations.clientPermissions);\n for (const clientKey of clientKeys) {\n const client = await this.clientRepository.findOneBy({\n name: clientKey,\n realmId: attributes.realmId,\n });\n\n if (client) {\n const entities = await this.permissionResolver.resolveClient(\n input.relations.clientPermissions[clientKey],\n attributes.realmId,\n client.id,\n );\n permissions.push(...entities);\n }\n }\n }\n\n if (permissions.length > 0) {\n await this.permissionJunction.synchronize(\n attributes,\n permissions,\n 'permissionId',\n 'permissionRealmId',\n );\n }\n\n // Roles (Global, Realm & Client)\n const roles : Role[] = [\n ...await this.roleResolver.resolveGlobal(\n input.relations && input.relations.globalRoles,\n ),\n ...(attributes.realmId ?\n await this.roleResolver.resolveRealm(\n input.relations && input.relations.realmRoles,\n attributes.realmId,\n ) :\n []),\n ];\n\n if (input.relations && input.relations.clientRoles) {\n const clientKeys = Object.keys(input.relations.clientRoles);\n for (const clientKey of clientKeys) {\n const client = await this.clientRepository.findOneBy({\n name: clientKey,\n realmId: attributes.realmId,\n });\n\n if (client) {\n const entities = await this.roleResolver.resolveClient(\n input.relations.clientRoles[clientKey],\n attributes.realmId,\n client.id,\n );\n roles.push(...entities);\n }\n }\n }\n\n if (roles.length > 0) {\n await this.roleJunction.synchronize(\n attributes,\n roles,\n 'roleId',\n 'roleRealmId',\n );\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAaO,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKN,iBAAiBM,IAAIN;EAC1B,KAAKC,mBAAmBK,IAAIL;EAE5B,KAAKC,qBAAqB,IAAIL,2BAA2BS,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIN,2BAA2BS,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIN,iCAAiC;GAC3DW,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIP,iCAAiC;GACrDW,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWvB,oCAAoCoB,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKjB,eAAemB,UAAU;GACjDC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAAS5B,+BAA+B6B,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKjB,eAAewB,OAAOP,UAAAA;GAErC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAK5B,+BAA+B+B;IAChC,IACIP,SAASD,cACTC,SAASD,WAAWS,SAAS,OAAA,GAE7BX,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,SACXnC,mBAAmBuB,MAAME,WAAWG,QAAQH,WAAWG,IAAI;IAGnEH,aAAa,KAAKjB,eAAe4B,MAC7BX,YACAC,SAASD,aACLxB,WAAWsB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKjB,eAAe6B,KAAKZ,UAAAA;IAC5C;GACJ,KAAKvB,+BAA+BoC;IAChCf,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,UACVZ,MAAME,WAAWG,OAAO5B,mBAAmBuB,MAAME,WAAWG,IAAI,IAAIW,KAAAA;IAEzEhB,MAAME,WAAWe,KAAKf,WAAWe;IACjCf,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;IACvF;EACR;OACG;GACH,IAAI,CAACF,MAAME,WAAWU,SAASZ,MAAME,WAAWG,MAC5CL,MAAME,WAAWU,QAAQnC,mBAAmBuB,MAAME,WAAWG,IAAI;GAGrEH,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;EAC3F;EAGA,MAAMiB,cAA6B,CAAA,GAC5B,MAAM,KAAKhC,mBAAmBiC,cAC7BpB,MAAMqB,aAAarB,MAAMqB,UAAUC,iBAAiB,GAAA,GAEpDpB,WAAWI,UACX,MAAM,KAAKnB,mBAAmBoC,aAC1BvB,MAAMqB,aAAarB,MAAMqB,UAAUG,kBACnCtB,WAAWI,OAAO,IAEtB,CAAA,CAAA;EAGR,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUI,mBAAmB;GACtD,MAAMC,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUI,iBAAiB;GAChE,KAAK,MAAMI,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,SAASJ,WAAWI;IACxB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK5C,mBAAmB6C,cAC3ChC,MAAMqB,UAAUI,kBAAkBI,YAClC3B,WAAWI,SACXwB,OAAOb,EAAE;KAEbE,YAAYc,KAAI,GAAIF,QAAAA;IACxB;GACJ;EACJ;EAEA,IAAIZ,YAAYe,SAAS,GACrB,MAAM,KAAK7C,mBAAmBU,YAC1BG,YACAiB,aACA,gBACA,mBAAA;EAKR,MAAMgB,QAAiB,CAAA,GAChB,MAAM,KAAK/C,aAAagC,cACvBpB,MAAMqB,aAAarB,MAAMqB,UAAUe,WAAW,GAAA,GAE9ClC,WAAWI,UACX,MAAM,KAAKlB,aAAamC,aACpBvB,MAAMqB,aAAarB,MAAMqB,UAAUgB,YACnCnC,WAAWI,OAAO,IAEtB,CAAA,CAAA;EAGR,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUiB,aAAa;GAChD,MAAMZ,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUiB,WAAW;GAC1D,KAAK,MAAMT,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,SAASJ,WAAWI;IACxB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK3C,aAAa4C,cACrChC,MAAMqB,UAAUiB,YAAYT,YAC5B3B,WAAWI,SACXwB,OAAOb,EAAE;KAEbkB,MAAMF,KAAI,GAAIF,QAAAA;IAClB;GACJ;EACJ;EAEA,IAAII,MAAMD,SAAS,GACf,MAAM,KAAK5C,aAAaS,YACpBG,YACAiC,OACA,UACA,aAAA;EAIR,OAAO;GACH,GAAGnC;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/query/index.d.ts ADDED Viewed

@@ -0,0 +1,4 @@
+export * from './module.ts';
+export * from './relations.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/query/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/query/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}

package/dist/core/query/index.mjs ADDED Viewed

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "./relations.mjs";
+import { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry } from "./module.mjs";
+export { appendQueryConditions, createRelationsReadGate, decodeQuery, queryCodec, schemaRegistry };

package/dist/core/query/module.d.ts ADDED Viewed

@@ -0,0 +1,60 @@
+import type { ICondition, IQuery, ObjectLiteral } from '@rapiq/core';
+import { Query, SchemaRegistry } from '@rapiq/core';
+import type { DecodeQueryOptions } from './types.ts';
+/**
+ * Registry of every entity schema — the server-side allow-list layer.
+ * Relation traversal (e.g. a `realm.name` filter) resolves through the
+ * `schemaMapping` of the owning schema into the related schema's own
+ * allow-lists.
+ *
+ * The registry deliberately lives in core (persistence-agnostic): the
+ * schemas are security policy over the domain types, and services
+ * consume them to decode wire queries into the rapiq IR. A repository
+ * layer MAY extend the registry with additional, storage-derived
+ * schemas (e.g. `@rapiq/typeorm`'s `defineSchemaRegistryWithDataSource`
+ * with the `registry` option — already-registered schemas take
+ * precedence), but the allow-lists themselves stay explicit and are
+ * never auto-derived from entity metadata.
+ */
+export declare const schemaRegistry: SchemaRegistry<any>;
+/**
+ * URL transport codec bound to the schema registry: decodes both the
+ * v2 expression dialect (stamped or detected) and legacy v1 bracket
+ * payloads, so pre-v2 clients keep working.
+ */
+export declare const queryCodec: import("@rapiq/codec-url").URLCodec;
+/**
+ * Decode a raw wire query (routup `useRequestQuery` output or a raw
+ * query string) against a registered schema into the rapiq IR. The
+ * schema's allow-lists, defaults and pagination bounds are applied
+ * here — downstream consumers (repository adapters) only execute the
+ * returned query.
+ *
+ * Async because the schema validate hooks are: the relations read
+ * gate (`createRelationsReadGate`) awaits the actor's permission
+ * pre-gate per include, and rapiq refuses async validators on the
+ * synchronous decode path. Pass the acting identity via
+ * `options.actor` on every request-driven decode (authenticated or
+ * anonymous — the HTTP adapter always builds one); a decode without
+ * an actor is a system call and runs unrestricted.
+ */
+export declare function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(input: unknown, options: DecodeQueryOptions<RECORD>): Promise<Query>;
+/**
+ * Append server-derived conditions (a route realm, an owner scope, ...)
+ * onto a decoded query by AND-wrapping its filter tree. The wrap makes
+ * the appended scope non-displaceable: unlike a filters merge (per-field
+ * replace, flat-root-AND restriction), a client-sent condition on the
+ * same field intersects with the scope instead of replacing it, and
+ * compound client trees (`or(...)`) are preserved as-is. Same guarantee
+ * class as a mandatory `andWhere` at the repository — expressed once in
+ * the IR. Appended conditions do not pass through `decodeQuery`, so the
+ * schema allow-lists do not constrain them (server-derived context).
+ *
+ * Immutable: returns a new `Query` whose filters node is the
+ * AND-wrapped successor (`IFilters.and`); every other parameter node is
+ * carried over **by reference**, so the input query stays untouched and
+ * nothing is copied. The node enumeration mirrors rapiq's
+ * `QueryContext` — keep it in sync when the IR gains a parameter.
+ */
+export declare function appendQueryConditions(query: IQuery, ...conditions: ICondition[]): Query;
+//# sourceMappingURL=module.d.ts.map

package/dist/core/query/module.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/core/query/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,UAAU,EACV,MAAM,EACN,aAAa,EAEhB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAY,MAAM,aAAa,CAAC;AAyB9D,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AAEzE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc,qBAAuB,CAAC;AAiCnD;;;;GAIG;AACH,eAAO,MAAM,UAAU,qCAAiC,CAAC;AAEzD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,MAAM,SAAS,aAAa,GAAG,aAAa,EAC1E,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,GACnC,OAAO,CAAC,KAAK,CAAC,CAYjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,GAAI,KAAK,CAQxF"}

package/dist/core/query/module.mjs ADDED Viewed

@@ -0,0 +1,128 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { clientSchema } from "../entities/client/schema.mjs";
+import { clientPermissionSchema } from "../entities/client-permission/schema.mjs";
+import { clientRoleSchema } from "../entities/client-role/schema.mjs";
+import { clientScopeSchema } from "../entities/client-scope/schema.mjs";
+import { consentSchema } from "../entities/consent/schema.mjs";
+import { eventSchema } from "../entities/event/schema.mjs";
+import { identityProviderSchema } from "../entities/identity-provider/schema.mjs";
+import { identityProviderRoleMappingSchema } from "../entities/identity-provider-role-mapping/schema.mjs";
+import { keySchema } from "../entities/key/schema.mjs";
+import { permissionSchema } from "../entities/permission/schema.mjs";
+import { permissionPolicySchema } from "../entities/permission-policy/schema.mjs";
+import { policySchema } from "../entities/policy/schema.mjs";
+import { realmSchema } from "../entities/realm/schema.mjs";
+import { roleSchema } from "../entities/role/schema.mjs";
+import { roleAttributeSchema } from "../entities/role-attribute/schema.mjs";
+import { rolePermissionSchema } from "../entities/role-permission/schema.mjs";
+import { scopeSchema } from "../entities/scope/schema.mjs";
+import { sessionSchema } from "../entities/session/schema.mjs";
+import { trustAnchorSchema } from "../entities/trust-anchor/schema.mjs";
+import { userSchema } from "../entities/user/schema.mjs";
+import { userAttributeSchema } from "../entities/user-attribute/schema.mjs";
+import { userAuthenticatorSchema } from "../entities/user-authenticator/schema.mjs";
+import { userPermissionSchema } from "../entities/user-permission/schema.mjs";
+import { userRoleSchema } from "../entities/user-role/schema.mjs";
+import { Query, SchemaRegistry, isObject } from "@rapiq/core";
+import { createURLCodec } from "@rapiq/codec-url";
+//#region src/core/query/module.ts
+/**
+* Registry of every entity schema — the server-side allow-list layer.
+* Relation traversal (e.g. a `realm.name` filter) resolves through the
+* `schemaMapping` of the owning schema into the related schema's own
+* allow-lists.
+*
+* The registry deliberately lives in core (persistence-agnostic): the
+* schemas are security policy over the domain types, and services
+* consume them to decode wire queries into the rapiq IR. A repository
+* layer MAY extend the registry with additional, storage-derived
+* schemas (e.g. `@rapiq/typeorm`'s `defineSchemaRegistryWithDataSource`
+* with the `registry` option — already-registered schemas take
+* precedence), but the allow-lists themselves stay explicit and are
+* never auto-derived from entity metadata.
+*/ const schemaRegistry = new SchemaRegistry();
+const schemas = [
+	clientSchema,
+	clientPermissionSchema,
+	clientRoleSchema,
+	clientScopeSchema,
+	consentSchema,
+	eventSchema,
+	identityProviderSchema,
+	identityProviderRoleMappingSchema,
+	keySchema,
+	permissionSchema,
+	permissionPolicySchema,
+	policySchema,
+	realmSchema,
+	roleSchema,
+	roleAttributeSchema,
+	rolePermissionSchema,
+	scopeSchema,
+	sessionSchema,
+	trustAnchorSchema,
+	userSchema,
+	userAttributeSchema,
+	userAuthenticatorSchema,
+	userPermissionSchema,
+	userRoleSchema
+];
+for (const schema of schemas) schemaRegistry.add(schema);
+/**
+* URL transport codec bound to the schema registry: decodes both the
+* v2 expression dialect (stamped or detected) and legacy v1 bracket
+* payloads, so pre-v2 clients keep working.
+*/ const queryCodec = createURLCodec(schemaRegistry);
+/**
+* Decode a raw wire query (routup `useRequestQuery` output or a raw
+* query string) against a registered schema into the rapiq IR. The
+* schema's allow-lists, defaults and pagination bounds are applied
+* here — downstream consumers (repository adapters) only execute the
+* returned query.
+*
+* Async because the schema validate hooks are: the relations read
+* gate (`createRelationsReadGate`) awaits the actor's permission
+* pre-gate per include, and rapiq refuses async validators on the
+* synchronous decode path. Pass the acting identity via
+* `options.actor` on every request-driven decode (authenticated or
+* anonymous — the HTTP adapter always builds one); a decode without
+* an actor is a system call and runs unrestricted.
+*/ async function decodeQuery(input, options) {
+	const normalized = isObject(input) || typeof input === "string" ? input : {};
+	return await queryCodec.decodeAsync(normalized, {
+		schema: options.schema,
+		parameters: options.parameters,
+		context: { actor: options.actor }
+	}) ?? new Query({});
+}
+/**
+* Append server-derived conditions (a route realm, an owner scope, ...)
+* onto a decoded query by AND-wrapping its filter tree. The wrap makes
+* the appended scope non-displaceable: unlike a filters merge (per-field
+* replace, flat-root-AND restriction), a client-sent condition on the
+* same field intersects with the scope instead of replacing it, and
+* compound client trees (`or(...)`) are preserved as-is. Same guarantee
+* class as a mandatory `andWhere` at the repository — expressed once in
+* the IR. Appended conditions do not pass through `decodeQuery`, so the
+* schema allow-lists do not constrain them (server-derived context).
+*
+* Immutable: returns a new `Query` whose filters node is the
+* AND-wrapped successor (`IFilters.and`); every other parameter node is
+* carried over **by reference**, so the input query stays untouched and
+* nothing is copied. The node enumeration mirrors rapiq's
+* `QueryContext` — keep it in sync when the IR gains a parameter.
+*/ function appendQueryConditions(query, ...conditions) {
+	return new Query({
+		fields: query.fields,
+		filters: query.filters.and(...conditions),
+		relations: query.relations,
+		pagination: query.pagination,
+		sorts: query.sorts
+	});
+}
+//#endregion
+export { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry };
+//# sourceMappingURL=module.mjs.map

package/dist/core/query/module.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"module.mjs","names":["createURLCodec","Query","SchemaRegistry","isObject","clientSchema","clientPermissionSchema","clientRoleSchema","clientScopeSchema","consentSchema","eventSchema","identityProviderSchema","identityProviderRoleMappingSchema","keySchema","permissionSchema","permissionPolicySchema","policySchema","realmSchema","roleSchema","roleAttributeSchema","rolePermissionSchema","scopeSchema","sessionSchema","trustAnchorSchema","userSchema","userAttributeSchema","userAuthenticatorSchema","userPermissionSchema","userRoleSchema","schemaRegistry","schemas","schema","add","queryCodec","decodeQuery","input","options","normalized","parsed","decodeAsync","parameters","context","actor","appendQueryConditions","query","conditions","fields","filters","and","relations","pagination","sorts"],"sources":["../../../src/core/query/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type {\n ICondition, \n IQuery, \n ObjectLiteral, \n Schema,\n} from '@rapiq/core';\nimport { Query, SchemaRegistry, isObject } from '@rapiq/core';\nimport { clientSchema } from '../entities/client/schema.ts';\nimport { clientPermissionSchema } from '../entities/client-permission/schema.ts';\nimport { clientRoleSchema } from '../entities/client-role/schema.ts';\nimport { clientScopeSchema } from '../entities/client-scope/schema.ts';\nimport { consentSchema } from '../entities/consent/schema.ts';\nimport { eventSchema } from '../entities/event/schema.ts';\nimport { identityProviderSchema } from '../entities/identity-provider/schema.ts';\nimport { identityProviderRoleMappingSchema } from '../entities/identity-provider-role-mapping/schema.ts';\nimport { keySchema } from '../entities/key/schema.ts';\nimport { permissionSchema } from '../entities/permission/schema.ts';\nimport { permissionPolicySchema } from '../entities/permission-policy/schema.ts';\nimport { policySchema } from '../entities/policy/schema.ts';\nimport { realmSchema } from '../entities/realm/schema.ts';\nimport { roleSchema } from '../entities/role/schema.ts';\nimport { roleAttributeSchema } from '../entities/role-attribute/schema.ts';\nimport { rolePermissionSchema } from '../entities/role-permission/schema.ts';\nimport { scopeSchema } from '../entities/scope/schema.ts';\nimport { sessionSchema } from '../entities/session/schema.ts';\nimport { trustAnchorSchema } from '../entities/trust-anchor/schema.ts';\nimport { userSchema } from '../entities/user/schema.ts';\nimport { userAttributeSchema } from '../entities/user-attribute/schema.ts';\nimport { userAuthenticatorSchema } from '../entities/user-authenticator/schema.ts';\nimport { userPermissionSchema } from '../entities/user-permission/schema.ts';\nimport { userRoleSchema } from '../entities/user-role/schema.ts';\nimport type { DecodeQueryOptions, QueryDecodeContext } from './types.ts';\n\n/**\n * Registry of every entity schema — the server-side allow-list layer.\n * Relation traversal (e.g. a `realm.name` filter) resolves through the\n * `schemaMapping` of the owning schema into the related schema's own\n * allow-lists.\n *\n * The registry deliberately lives in core (persistence-agnostic): the\n * schemas are security policy over the domain types, and services\n * consume them to decode wire queries into the rapiq IR. A repository\n * layer MAY extend the registry with additional, storage-derived\n * schemas (e.g. `@rapiq/typeorm`'s `defineSchemaRegistryWithDataSource`\n * with the `registry` option — already-registered schemas take\n * precedence), but the allow-lists themselves stay explicit and are\n * never auto-derived from entity metadata.\n */\nexport const schemaRegistry = new SchemaRegistry();\n\nconst schemas : Schema<any>[] = [\n clientSchema,\n clientPermissionSchema,\n clientRoleSchema,\n clientScopeSchema,\n consentSchema,\n eventSchema,\n identityProviderSchema,\n identityProviderRoleMappingSchema,\n keySchema,\n permissionSchema,\n permissionPolicySchema,\n policySchema,\n realmSchema,\n roleSchema,\n roleAttributeSchema,\n rolePermissionSchema,\n scopeSchema,\n sessionSchema,\n trustAnchorSchema,\n userSchema,\n userAttributeSchema,\n userAuthenticatorSchema,\n userPermissionSchema,\n userRoleSchema,\n];\n\nfor (const schema of schemas) {\n schemaRegistry.add(schema);\n}\n\n/**\n * URL transport codec bound to the schema registry: decodes both the\n * v2 expression dialect (stamped or detected) and legacy v1 bracket\n * payloads, so pre-v2 clients keep working.\n */\nexport const queryCodec = createURLCodec(schemaRegistry);\n\n/**\n * Decode a raw wire query (routup `useRequestQuery` output or a raw\n * query string) against a registered schema into the rapiq IR. The\n * schema's allow-lists, defaults and pagination bounds are applied\n * here — downstream consumers (repository adapters) only execute the\n * returned query.\n *\n * Async because the schema validate hooks are: the relations read\n * gate (`createRelationsReadGate`) awaits the actor's permission\n * pre-gate per include, and rapiq refuses async validators on the\n * synchronous decode path. Pass the acting identity via\n * `options.actor` on every request-driven decode (authenticated or\n * anonymous — the HTTP adapter always builds one); a decode without\n * an actor is a system call and runs unrestricted.\n */\nexport async function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(\n input: unknown,\n options: DecodeQueryOptions<RECORD>,\n) : Promise<Query> {\n const normalized = isObject(input) || typeof input === 'string' ? input : {};\n\n const parsed = await queryCodec.decodeAsync(normalized, {\n // Schema<RECORD> is invariant; the codec's non-generic options\n // accept Schema<ObjectLiteral>, so collapse the variance here.\n schema: options.schema as Schema<any> | string,\n parameters: options.parameters,\n context: { actor: options.actor } satisfies QueryDecodeContext,\n });\n\n return parsed ?? new Query({});\n}\n\n/**\n * Append server-derived conditions (a route realm, an owner scope, ...)\n * onto a decoded query by AND-wrapping its filter tree. The wrap makes\n * the appended scope non-displaceable: unlike a filters merge (per-field\n * replace, flat-root-AND restriction), a client-sent condition on the\n * same field intersects with the scope instead of replacing it, and\n * compound client trees (`or(...)`) are preserved as-is. Same guarantee\n * class as a mandatory `andWhere` at the repository — expressed once in\n * the IR. Appended conditions do not pass through `decodeQuery`, so the\n * schema allow-lists do not constrain them (server-derived context).\n *\n * Immutable: returns a new `Query` whose filters node is the\n * AND-wrapped successor (`IFilters.and`); every other parameter node is\n * carried over **by reference**, so the input query stays untouched and\n * nothing is copied. The node enumeration mirrors rapiq's\n * `QueryContext` — keep it in sync when the IR gains a parameter.\n */\nexport function appendQueryConditions(query: IQuery, ...conditions: ICondition[]) : Query {\n return new Query({\n fields: query.fields,\n filters: query.filters.and(...conditions),\n relations: query.relations,\n pagination: query.pagination,\n sorts: query.sorts,\n });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDA,MAAa4B,iBAAiB,IAAI1B,eAAAA;AAElC,MAAM2B,UAA0B;CAC5BzB;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;;AAGJ,KAAK,MAAMG,UAAUD,SACjBD,eAAeG,IAAID,MAAAA;;;;;GAQvB,MAAaE,aAAahC,eAAe4B,cAAAA;;;;;;;;;;;;;;;GAiBzC,eAAsBK,YAClBC,OACAC,SAAmC;CAEnC,MAAMC,aAAajC,SAAS+B,KAAAA,KAAU,OAAOA,UAAU,WAAWA,QAAQ,CAAC;CAU3E,OAAOG,MARcL,WAAWM,YAAYF,YAAY;EAGpDN,QAAQK,QAAQL;EAChBS,YAAYJ,QAAQI;EACpBC,SAAS,EAAEC,OAAON,QAAQM,MAAM;CACpC,CAAA,KAEiB,IAAIxC,MAAM,CAAC,CAAA;AAChC;;;;;;;;;;;;;;;;;GAmBA,SAAgByC,sBAAsBC,OAAe,GAAGC,YAAwB;CAC5E,OAAO,IAAI3C,MAAM;EACb4C,QAAQF,MAAME;EACdC,SAASH,MAAMG,QAAQC,IAAG,GAAIH,UAAAA;EAC9BI,WAAWL,MAAMK;EACjBC,YAAYN,MAAMM;EAClBC,OAAOP,MAAMO;CACjB,CAAA;AACJ"}

package/dist/core/query/relations.d.ts ADDED Viewed

@@ -0,0 +1,39 @@
+import type { KeyValidator } from '@rapiq/core';
+import { EntityType } from '@authup/core-kit';
+import type { QueryDecodeContext } from './types.ts';
+/**
+ * Build a rapiq `relations.validate` hook gating each include on the
+ * TARGET entity type's read permission (issue #3295): the actor must
+ * pass the derived pre-gate (`preEvaluateOneOf`, #3290) for the
+ * relation's mapped entity type — row data is unknown at decode time,
+ * so only a settled-false (the actor can never read that entity type)
+ * denies. A denial STRIPS the relation silently — the explicit
+ * `include=`, and (since rapiq beta.7, tada5hi/rapiq#815) every dotted
+ * `filter`/`sort`/`field` key that traverses the denied relation,
+ * whether or not it was explicitly included. rapiq records one
+ * authorization obligation per distinct relation reached by any
+ * parameter, evaluates this hook once for it, and prunes the dependent
+ * keys — the same fail-soft flavor as the allow-lists, so a scoped
+ * reader degrades to the un-joined / un-filtered row shape instead of
+ * a 403.
+ *
+ * `mapping` is the schema's own relation → entity-type `schemaMapping`;
+ * rapiq invokes the hook per include segment against the schema
+ * governing it, so nested paths (`include=user.realm`) are gated hop
+ * by hop by each governing schema's own hook. Unmapped relations and
+ * ungated targets neutral-pass.
+ *
+ * Caller classes: a SYSTEM call (no actor in the decode context) is
+ * unrestricted — the gate neutral-passes. A REQUEST call always
+ * carries an actor (`buildActorContext` supplies one even for an
+ * anonymous request), so restriction attaches at the request
+ * boundary: an authenticated actor is gated by its grants, an
+ * anonymous actor holds none and every gated include strips. A gate
+ * evaluation failure fails closed (strip).
+ *
+ * NOTE: schemas import this file DIRECTLY (never the `core/query`
+ * barrel) — the barrel reaches `module.ts`, which imports every
+ * schema; importing it from a schema would create a TDZ cycle.
+ */
+export declare function createRelationsReadGate(mapping: Record<string, `${EntityType}`>): KeyValidator<QueryDecodeContext | undefined>;
+//# sourceMappingURL=relations.d.ts.map

package/dist/core/query/relations.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"relations.d.ts","sourceRoot":"","sources":["../../../src/core/query/relations.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,UAAU,EAAkB,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAkDrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,uBAAuB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC,GACxC,YAAY,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAuB/C"}