@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.54

package/dist/core/query/relations.mjs

@@ -0,0 +1,103 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EntityType, PermissionName } from "@authup/core-kit";
+//#region src/core/query/relations.ts
+/**
+* Read gate per include target: the permission disjunction an actor
+* must hold (data-availability-derived pre-gate, issue #3290) for the
+* target entity type to be joinable via `include=` OR reachable via a
+* dotted `filter`/`sort`/`field` key. Mirrors each target service's own
+* `getMany` read pre-gate, so "may list the entity type" and "may join
+* it onto another list" stay one predicate.
+* Policies are deliberately gated under the PERMISSION family — they
+* are managed under the permission domain.
+*
+* Absent entries are ungated: `realm` (the realm list is public — the
+* login realm chooser reads it anonymously) and `identityProvider`
+* (the anonymous login page lists providers; its schema field
+* allow-list is the safe-DTO layer).
+*/ const RELATION_TARGET_READ_GATES = {
+	[EntityType.CLIENT]: [
+		PermissionName.CLIENT_READ,
+		PermissionName.CLIENT_UPDATE,
+		PermissionName.CLIENT_DELETE
+	],
+	[EntityType.USER]: [
+		PermissionName.USER_READ,
+		PermissionName.USER_UPDATE,
+		PermissionName.USER_DELETE
+	],
+	[EntityType.ROLE]: [
+		PermissionName.ROLE_READ,
+		PermissionName.ROLE_UPDATE,
+		PermissionName.ROLE_DELETE
+	],
+	[EntityType.SCOPE]: [
+		PermissionName.SCOPE_READ,
+		PermissionName.SCOPE_UPDATE,
+		PermissionName.SCOPE_DELETE
+	],
+	[EntityType.PERMISSION]: [
+		PermissionName.PERMISSION_READ,
+		PermissionName.PERMISSION_UPDATE,
+		PermissionName.PERMISSION_DELETE
+	],
+	[EntityType.POLICY]: [
+		PermissionName.PERMISSION_READ,
+		PermissionName.PERMISSION_UPDATE,
+		PermissionName.PERMISSION_DELETE
+	]
+};
+/**
+* Build a rapiq `relations.validate` hook gating each include on the
+* TARGET entity type's read permission (issue #3295): the actor must
+* pass the derived pre-gate (`preEvaluateOneOf`, #3290) for the
+* relation's mapped entity type — row data is unknown at decode time,
+* so only a settled-false (the actor can never read that entity type)
+* denies. A denial STRIPS the relation silently — the explicit
+* `include=`, and (since rapiq beta.7, tada5hi/rapiq#815) every dotted
+* `filter`/`sort`/`field` key that traverses the denied relation,
+* whether or not it was explicitly included. rapiq records one
+* authorization obligation per distinct relation reached by any
+* parameter, evaluates this hook once for it, and prunes the dependent
+* keys — the same fail-soft flavor as the allow-lists, so a scoped
+* reader degrades to the un-joined / un-filtered row shape instead of
+* a 403.
+*
+* `mapping` is the schema's own relation → entity-type `schemaMapping`;
+* rapiq invokes the hook per include segment against the schema
+* governing it, so nested paths (`include=user.realm`) are gated hop
+* by hop by each governing schema's own hook. Unmapped relations and
+* ungated targets neutral-pass.
+*
+* Caller classes: a SYSTEM call (no actor in the decode context) is
+* unrestricted — the gate neutral-passes. A REQUEST call always
+* carries an actor (`buildActorContext` supplies one even for an
+* anonymous request), so restriction attaches at the request
+* boundary: an authenticated actor is gated by its grants, an
+* anonymous actor holds none and every gated include strips. A gate
+* evaluation failure fails closed (strip).
+*
+* NOTE: schemas import this file DIRECTLY (never the `core/query`
+* barrel) — the barrel reaches `module.ts`, which imports every
+* schema; importing it from a schema would create a TDZ cycle.
+*/ function createRelationsReadGate(mapping) {
+	return async (name, context) => {
+		const target = mapping[name];
+		if (!target) return true;
+		const permissions = RELATION_TARGET_READ_GATES[target];
+		if (!permissions) return true;
+		if (!context || !context.actor) return true;
+		try {
+			await context.actor.permissionEvaluator.preEvaluateOneOf({ name: permissions });
+			return true;
+		} catch {
+			return false;
+		}
+	};
+}
+//#endregion
+export { createRelationsReadGate };
+
+//# sourceMappingURL=relations.mjs.map

package/dist/core/query/relations.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations.mjs","names":["EntityType","PermissionName","RELATION_TARGET_READ_GATES","CLIENT","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","USER","USER_READ","USER_UPDATE","USER_DELETE","ROLE","ROLE_READ","ROLE_UPDATE","ROLE_DELETE","SCOPE","SCOPE_READ","SCOPE_UPDATE","SCOPE_DELETE","PERMISSION","PERMISSION_READ","PERMISSION_UPDATE","PERMISSION_DELETE","POLICY","createRelationsReadGate","mapping","name","context","target","permissions","actor","permissionEvaluator","preEvaluateOneOf"],"sources":["../../../src/core/query/relations.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { KeyValidator } from '@rapiq/core';\nimport { EntityType, PermissionName } from '@authup/core-kit';\nimport type { QueryDecodeContext } from './types.ts';\n\n/**\n * Read gate per include target: the permission disjunction an actor\n * must hold (data-availability-derived pre-gate, issue #3290) for the\n * target entity type to be joinable via `include=` OR reachable via a\n * dotted `filter`/`sort`/`field` key. Mirrors each target service's own\n * `getMany` read pre-gate, so \"may list the entity type\" and \"may join\n * it onto another list\" stay one predicate.\n * Policies are deliberately gated under the PERMISSION family — they\n * are managed under the permission domain.\n *\n * Absent entries are ungated: `realm` (the realm list is public — the\n * login realm chooser reads it anonymously) and `identityProvider`\n * (the anonymous login page lists providers; its schema field\n * allow-list is the safe-DTO layer).\n */\nconst RELATION_TARGET_READ_GATES : Partial<Record<`${EntityType}`, PermissionName[]>> = {\n    [EntityType.CLIENT]: [\n        PermissionName.CLIENT_READ,\n        PermissionName.CLIENT_UPDATE,\n        PermissionName.CLIENT_DELETE,\n    ],\n    [EntityType.USER]: [\n        PermissionName.USER_READ,\n        PermissionName.USER_UPDATE,\n        PermissionName.USER_DELETE,\n    ],\n    [EntityType.ROLE]: [\n        PermissionName.ROLE_READ,\n        PermissionName.ROLE_UPDATE,\n        PermissionName.ROLE_DELETE,\n    ],\n    [EntityType.SCOPE]: [\n        PermissionName.SCOPE_READ,\n        PermissionName.SCOPE_UPDATE,\n        PermissionName.SCOPE_DELETE,\n    ],\n    [EntityType.PERMISSION]: [\n        PermissionName.PERMISSION_READ,\n        PermissionName.PERMISSION_UPDATE,\n        PermissionName.PERMISSION_DELETE,\n    ],\n    [EntityType.POLICY]: [\n        PermissionName.PERMISSION_READ,\n        PermissionName.PERMISSION_UPDATE,\n        PermissionName.PERMISSION_DELETE,\n    ],\n};\n\n/**\n * Build a rapiq `relations.validate` hook gating each include on the\n * TARGET entity type's read permission (issue #3295): the actor must\n * pass the derived pre-gate (`preEvaluateOneOf`, #3290) for the\n * relation's mapped entity type — row data is unknown at decode time,\n * so only a settled-false (the actor can never read that entity type)\n * denies. A denial STRIPS the relation silently — the explicit\n * `include=`, and (since rapiq beta.7, tada5hi/rapiq#815) every dotted\n * `filter`/`sort`/`field` key that traverses the denied relation,\n * whether or not it was explicitly included. rapiq records one\n * authorization obligation per distinct relation reached by any\n * parameter, evaluates this hook once for it, and prunes the dependent\n * keys — the same fail-soft flavor as the allow-lists, so a scoped\n * reader degrades to the un-joined / un-filtered row shape instead of\n * a 403.\n *\n * `mapping` is the schema's own relation → entity-type `schemaMapping`;\n * rapiq invokes the hook per include segment against the schema\n * governing it, so nested paths (`include=user.realm`) are gated hop\n * by hop by each governing schema's own hook. Unmapped relations and\n * ungated targets neutral-pass.\n *\n * Caller classes: a SYSTEM call (no actor in the decode context) is\n * unrestricted — the gate neutral-passes. A REQUEST call always\n * carries an actor (`buildActorContext` supplies one even for an\n * anonymous request), so restriction attaches at the request\n * boundary: an authenticated actor is gated by its grants, an\n * anonymous actor holds none and every gated include strips. A gate\n * evaluation failure fails closed (strip).\n *\n * NOTE: schemas import this file DIRECTLY (never the `core/query`\n * barrel) — the barrel reaches `module.ts`, which imports every\n * schema; importing it from a schema would create a TDZ cycle.\n */\nexport function createRelationsReadGate(\n    mapping: Record<string, `${EntityType}`>,\n) : KeyValidator<QueryDecodeContext | undefined> {\n    return async (name, context) => {\n        const target = mapping[name];\n        if (!target) {\n            return true;\n        }\n\n        const permissions = RELATION_TARGET_READ_GATES[target];\n        if (!permissions) {\n            return true;\n        }\n\n        if (!context || !context.actor) {\n            return true;\n        }\n\n        try {\n            await context.actor.permissionEvaluator.preEvaluateOneOf({ name: permissions });\n            return true;\n        } catch {\n            return false;\n        }\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;GA0BA,MAAME,6BAAkF;EACnFF,WAAWG,SAAS;EACjBF,eAAeG;EACfH,eAAeI;EACfJ,eAAeK;;EAElBN,WAAWO,OAAO;EACfN,eAAeO;EACfP,eAAeQ;EACfR,eAAeS;;EAElBV,WAAWW,OAAO;EACfV,eAAeW;EACfX,eAAeY;EACfZ,eAAea;;EAElBd,WAAWe,QAAQ;EAChBd,eAAee;EACff,eAAegB;EACfhB,eAAeiB;;EAElBlB,WAAWmB,aAAa;EACrBlB,eAAemB;EACfnB,eAAeoB;EACfpB,eAAeqB;;EAElBtB,WAAWuB,SAAS;EACjBtB,eAAemB;EACfnB,eAAeoB;EACfpB,eAAeqB;;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCA,SAAgBE,wBACZC,SAAwC;CAExC,OAAO,OAAOC,MAAMC,YAAAA;EAChB,MAAMC,SAASH,QAAQC;EACvB,IAAI,CAACE,QACD,OAAO;EAGX,MAAMC,cAAc3B,2BAA2B0B;EAC/C,IAAI,CAACC,aACD,OAAO;EAGX,IAAI,CAACF,WAAW,CAACA,QAAQG,OACrB,OAAO;EAGX,IAAI;GACA,MAAMH,QAAQG,MAAMC,oBAAoBC,iBAAiB,EAAEN,MAAMG,YAAY,CAAA;GAC7E,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ"}

package/dist/core/query/types.d.ts

@@ -0,0 +1,39 @@
+import type { ObjectLiteral, Parameter, Schema } from '@rapiq/core';
+import type { ActorContext } from '@authup/server-kit';
+export type QueryParameter = `${Parameter}`;
+/**
+ * Caller context threaded through the decode into every schema
+ * validate hook (rapiq `ParseQueryOptions['context']`). Carries the
+ * acting identity so per-key gates — the relations read gate — can
+ * consult its permissions. An actor-less context is a SYSTEM call
+ * and passes ungated; request surfaces always supply an actor (an
+ * anonymous one holds no grants, so gated includes strip).
+ */
+export type QueryDecodeContext = {
+    actor?: ActorContext;
+};
+export type DecodeQueryOptions<RECORD extends ObjectLiteral = ObjectLiteral> = {
+    /**
+     * The schema (or name of the registered schema) to validate
+     * against.
+     */
+    schema: Schema<RECORD> | string;
+    /**
+     * Restrict which parameters are processed (default: all). A
+     * parameter that is not listed is neither parsed nor defaulted.
+     * E.g. a bulk-delete selection processes `['filters']` only, so a
+     * schema `pagination.maxLimit` can never silently truncate the
+     * affected row set.
+     */
+    parameters?: QueryParameter[];
+    /**
+     * The acting identity, forwarded to the schema validate hooks as
+     * the decode context. Every REQUEST decode must pass it — the
+     * HTTP adapter builds an actor for authenticated and anonymous
+     * requests alike, so restriction attaches at the request
+     * boundary. Omitting it marks a SYSTEM decode, which runs
+     * unrestricted.
+     */
+    actor?: ActorContext;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/query/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/query/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,MAAM,cAAc,GAAG,GAAG,SAAS,EAAE,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC7B,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,kBAAkB,CAAC,MAAM,SAAS,aAAa,GAAG,aAAa,IAAI;IAC3E;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB,CAAC"}

package/dist/core/security/policy/evaluator.d.ts

@@ -7,6 +7,7 @@ export declare class PermissionBindingPolicyEvaluator implements IPolicyEvaluato
     protected realmMatchEvaluator: RealmMatchPolicyEvaluator;
     protected identityPermissionProvider: IIdentityPermissionProvider;
     constructor(identityPermissionProvider: IIdentityPermissionProvider);
+    requires(): string[];
     accessData(ctx: PolicyEvaluationContext): Promise<PermissionPolicyBindingAggregated | null>;
     evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }

package/dist/core/security/policy/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/core/security/policy/evaluator.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,gBAAgB,EAChB,iCAAiC,EACjC,uBAAuB,EACvB,sBAAsB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEH,uBAAuB,EACvB,gCAAgC,EAGhC,yBAAyB,EAI5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,qBAAa,gCAAiC,YAAW,gBAAgB;IACrE,SAAS,CAAC,SAAS,EAAG,gCAAgC,CAAC;IAEvD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,0BAA0B,EAAE,2BAA2B;IAO7D,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAiB5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA2G5G"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/core/security/policy/evaluator.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACR,gBAAgB,EAChB,iCAAiC,EACjC,uBAAuB,EACvB,sBAAsB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEH,uBAAuB,EACvB,gCAAgC,EAGhC,yBAAyB,EAM5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,qBAAa,gCAAiC,YAAW,gBAAgB;IACrE,SAAS,CAAC,SAAS,EAAG,gCAAgC,CAAC;IAEvD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,0BAA0B,EAAE,2BAA2B;IAOnE,QAAQ,IAAK,MAAM,EAAE;IAQf,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAiB5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA+L5G"}

package/dist/core/security/policy/evaluator.mjs

@@ -1,7 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { BuiltInPolicyType, IdentityPolicyEvaluator, PermissionBindingPolicyValidator, PolicyEngine, PolicyIssueCode, RealmMatchPolicyEvaluator, aggregatePermissionPolicyBindings, definePolicyIssueItem, maybeInvertPolicyOutcome } from "@authup/access";
+import { BuiltInPolicyType, IdentityPolicyEvaluator, PermissionBindingPolicyValidator, PolicyEngine, PolicyIssueCode, RealmMatchPolicyEvaluator, RealmScope, aggregatePermissionPolicyBindings, definePolicyIssueItem, maybeInvertPolicyOutcome, normalizeRealmScope } from "@authup/access";
+import { and, or } from "@rapiq/core";
 //#region src/core/security/policy/evaluator.ts
 var PermissionBindingPolicyEvaluator = class {
 	validator;
@@ -14,6 +15,9 @@ var PermissionBindingPolicyEvaluator = class {
 		this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();
 		this.identityPermissionProvider = identityPermissionProvider;
 	}
+	requires() {
+		return [BuiltInPolicyType.PERMISSION_BINDING];
+	}
 	async accessData(ctx) {
 		if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) return null;
 		if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);
@@ -44,22 +48,65 @@ var PermissionBindingPolicyEvaluator = class {
 		};
 		const identityBindings = await this.identityPermissionProvider.getFor(identity).then((bindings) => bindings.filter((item) => {
 			if (item.permission.name !== binding.permission.name) return false;
-			return (binding.permission.realm_id ?? null) === (item.permission.realm_id ?? null) && (binding.permission.client_id ?? null) === (item.permission.client_id ?? null);
+			return (binding.permission.realmId ?? null) === (item.permission.realmId ?? null) && (binding.permission.clientId ?? null) === (item.permission.clientId ?? null);
 		}));
 		if (identityBindings.length === 0) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
 		const [aggr] = aggregatePermissionPolicyBindings(identityBindings);
 		if (!aggr) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
 		const issues = [];
+		const pendingIssues = [];
+		const conditions = [];
+		let pending = false;
+		let lowerable = true;
 		for (const grant of aggr.grants) {
-			if (!(await this.realmMatchEvaluator.evaluate({ scope: grant.realm_scope }, ctx)).success) continue;
-			if (!grant.policy) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+			let reachCondition = null;
+			const realmOutcome = await this.realmMatchEvaluator.evaluate({ scope: grant.realmScope }, ctx);
+			if (realmOutcome.pending) {
+				const scope = normalizeRealmScope(grant.realmScope);
+				if (scope === RealmScope.NONE) continue;
+				if (scope !== RealmScope.ANY) {
+					if (!realmOutcome.condition) {
+						pending = true;
+						lowerable = false;
+						continue;
+					}
+					reachCondition = realmOutcome.condition;
+				}
+			} else if (!realmOutcome.success) continue;
+			if (!grant.policy) {
+				if (!reachCondition) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+				conditions.push(reachCondition);
+				pending = true;
+				continue;
+			}
 			const outcome = await new PolicyEngine(ctx.evaluators).evaluate(grant.policy, {
 				...ctx,
 				path: [...ctx.path || []]
 			});
-			if (outcome.success) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+			if (outcome.success) {
+				if (!reachCondition) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+				conditions.push(reachCondition);
+				pending = true;
+				continue;
+			}
+			if (outcome.pending) {
+				pending = true;
+				if (ctx.withConditions && outcome.condition) conditions.push(reachCondition ? and(reachCondition, outcome.condition) : outcome.condition);
+				else lowerable = false;
+				if (outcome.issues) pendingIssues.push(...outcome.issues);
+				continue;
+			}
 			if (outcome.issues) issues.push(...outcome.issues);
 		}
+		if (pending) {
+			const result = {
+				success: false,
+				pending: true,
+				issues: pendingIssues
+			};
+			if (ctx.withConditions && lowerable && conditions.length > 0) result.condition = conditions.length === 1 ? conditions[0] : or(...conditions);
+			return result;
+		}
 		const success = maybeInvertPolicyOutcome(false, policy.invert);
 		return {
 			success,

package/dist/core/security/policy/evaluator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.mjs","names":["BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","RealmMatchPolicyEvaluator","aggregatePermissionPolicyBindings","definePolicyIssueItem","maybeInvertPolicyOutcome","PermissionBindingPolicyEvaluator","validator","identityEvaluator","realmMatchEvaluator","identityPermissionProvider","accessData","ctx","data","has","PERMISSION_BINDING","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realm_id","client_id","length","invert","aggr","grant","grants","realmOutcome","scope","realm_scope","engine","evaluators","outcome","push"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Issue } from 'validup';\nimport type {\n    IPolicyEvaluator,\n    PermissionPolicyBindingAggregated,\n    PolicyEvaluationContext,\n    PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n    BuiltInPolicyType,\n    IdentityPolicyEvaluator,\n    PermissionBindingPolicyValidator,\n    PolicyEngine,\n    PolicyIssueCode,\n    RealmMatchPolicyEvaluator,\n    aggregatePermissionPolicyBindings,\n    definePolicyIssueItem,\n    maybeInvertPolicyOutcome,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n    protected validator : PermissionBindingPolicyValidator;\n\n    protected identityEvaluator: IdentityPolicyEvaluator;\n\n    protected realmMatchEvaluator : RealmMatchPolicyEvaluator;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        this.validator = new PermissionBindingPolicyValidator();\n        this.identityEvaluator = new IdentityPolicyEvaluator();\n        this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();\n        this.identityPermissionProvider = identityPermissionProvider;\n    }\n\n    async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBindingAggregated | null> {\n        if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return null;\n        }\n\n        if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n        }\n\n        const data = ctx.data.get<PermissionPolicyBindingAggregated>(BuiltInPolicyType.PERMISSION_BINDING);\n\n        ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n        ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n        return data;\n    }\n\n    async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n        const policy = await this.validator.run(value);\n\n        const identity = await this.identityEvaluator.accessData(ctx);\n        if (!identity) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property identity is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n        const binding = await this.accessData(ctx);\n        if (!binding) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property permission is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n\n        const identityBindings = await this.identityPermissionProvider.getFor(identity)\n            .then((bindings) => bindings.filter((item) => {\n                if (item.permission.name !== binding.permission.name) {\n                    return false;\n                }\n\n                return (binding.permission.realm_id ?? null) === (item.permission.realm_id ?? null) &&\n                    (binding.permission.client_id ?? null) === (item.permission.client_id ?? null);\n            }));\n\n        if (identityBindings.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const [aggr] = aggregatePermissionPolicyBindings(identityBindings);\n        if (!aggr) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        // identityBindings is filtered to a single (name, realm_id, client_id) key, so the\n        // aggregate yields exactly one entry whose `grants` are the actor's per-grant\n        // (realm_scope, policy) disjunction terms; access is the DISJUNCTION over them:\n        //   ∃ grant . realmScopeMatches(grant.realm_scope, resource) ∧ (grant.policy passes)\n        // Pairing each grant's realm reach with its OWN policy is what fixes both the mixed\n        // policy-free + policy-bound UNDER-grant (a policy-free `own` grant must not mask a\n        // policy-bound `any` grant's wider reach) and the symmetric OVER-grant (an `own`\n        // grant's passing policy must not ride an `any` grant's wider reach).\n        const issues : Issue[] = [];\n        for (const grant of aggr.grants) {\n            // Realm reach (coarse, actor-relative) — a SEPARATE factor from the grant's\n            // policy, ANDed with it. The realm-match evaluator runs in SCOPE MODE: it reads the\n            // resource realm from ctx.data[REALM_MATCH] (fallback ATTRIBUTES.realm_id) and\n            // neutral-passes when absent (preEvaluate / gate checks / realm-less resources) —\n            // key-PRESENCE is the discriminator. Invoked DIRECTLY (not via PolicyEngine —\n            // REALM_MATCH is in policiesExcluded, so the engine would skip it).\n            const realmOutcome = await this.realmMatchEvaluator.evaluate(\n                { scope: grant.realm_scope },\n                ctx,\n            );\n            if (!realmOutcome.success) {\n                continue;\n            }\n\n            if (!grant.policy) {\n                // Reach matches and this grant carries no further restriction.\n                return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n            }\n\n            // Missing evaluators is a misconfiguration: let the engine fail CLOSED with a\n            // surfaced POLICY_EVALUATOR_NOT_FOUND issue (new PolicyEngine(undefined) defaults\n            // to an empty registry, so grant.policy resolves to no evaluator) rather than\n            // swallowing the grant with a silent issue-less deny.\n            const engine = new PolicyEngine(ctx.evaluators);\n            const outcome = await engine.evaluate(grant.policy, {\n                ...ctx,\n                path: [\n                    ...(ctx.path || []),\n                ],\n            });\n\n            if (outcome.success) {\n                return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n            }\n\n            if (outcome.issues) {\n                issues.push(...outcome.issues);\n            }\n        }\n\n        // No grant term satisfied (reach ∧ policies). Apply `invert` ONCE to the aggregated\n        // disjunction outcome — never per term, which would corrupt the quantifier.\n        const success = maybeInvertPolicyOutcome(false, policy.invert);\n        return {\n            success,\n            issues: success ? [] : issues,\n        };\n    }\n}\n"],"mappings":";;;;;AA2BA,IAAaS,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;EACjE,KAAKH,YAAY,IAAIR,iCAAAA;EACrB,KAAKS,oBAAoB,IAAIV,wBAAAA;EAC7B,KAAKW,sBAAsB,IAAIP,0BAAAA;EAC/B,KAAKQ,6BAA6BA;CACtC;CAEA,MAAMC,WAAWC,KAAkF;EAC/F,IAAI,CAACA,IAAIC,KAAKC,IAAIjB,kBAAkBkB,kBAAkB,GAClD,OAAO;EAGX,IAAIH,IAAIC,KAAKG,YAAYnB,kBAAkBkB,kBAAkB,GACzD,OAAOH,IAAIC,KAAKI,IAAIpB,kBAAkBkB,kBAAkB;EAG5D,MAAMF,OAAOD,IAAIC,KAAKI,IAAuCpB,kBAAkBkB,kBAAkB;EAEjGH,IAAIC,KAAKK,IAAIrB,kBAAkBkB,oBAAoBF,IAAAA;EACnDD,IAAIC,KAAKM,aAAatB,kBAAkBkB,kBAAkB;EAE1D,OAAOF;CACX;CAEA,MAAMO,SAASC,OAA4BT,KAA+D;EACtG,MAAMU,SAAS,MAAM,KAAKf,UAAUgB,IAAIF,KAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKhB,kBAAkBG,WAAWC,GAAAA;EACzD,IAAI,CAACY,UACD,OAAO;GACHC,SAAS;GACTC,QAAQ,CACJtB,sBAAsB;IAClBuB,MAAM1B,gBAAgB2B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;GACd,CAAA,CAAA;EAER;EAEJ,MAAMC,UAAU,MAAM,KAAKpB,WAAWC,GAAAA;EACtC,IAAI,CAACmB,SACD,OAAO;GACHN,SAAS;GACTC,QAAQ,CACJtB,sBAAsB;IAClBuB,MAAM1B,gBAAgB2B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;GACd,CAAA,CAAA;EAER;EAGJ,MAAME,mBAAmB,MAAM,KAAKtB,2BAA2BuB,OAAOT,QAAAA,CAAAA,CACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;GACjC,IAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,MAC5C,OAAO;GAGX,QAAQR,QAAQO,WAAWE,YAAY,WAAWH,KAAKC,WAAWE,YAAY,UACzET,QAAQO,WAAWG,aAAa,WAAWJ,KAAKC,WAAWG,aAAa;EACjF,CAAA,CAAA;EAEJ,IAAIT,iBAAiBU,WAAW,GAC5B,OAAO,EAAEjB,SAASpB,yBAAyB,OAAOiB,OAAOqB,MAAM,EAAE;EAGrE,MAAM,CAACC,QAAQzC,kCAAkC6B,gBAAAA;EACjD,IAAI,CAACY,MACD,OAAO,EAAEnB,SAASpB,yBAAyB,OAAOiB,OAAOqB,MAAM,EAAE;EAWrE,MAAMjB,SAAmB,CAAA;EACzB,KAAK,MAAMmB,SAASD,KAAKE,QAAQ;GAW7B,IAAI,EAACC,MAJsB,KAAKtC,oBAAoBW,SAChD,EAAE4B,OAAOH,MAAMI,YAAY,GAC3BrC,GAAAA,EAAAA,CAEca,SACd;GAGJ,IAAI,CAACoB,MAAMvB,QAEP,OAAO,EAAEG,SAASpB,yBAAyB,MAAMiB,OAAOqB,MAAM,EAAE;GAQpE,MAAMS,UAAU,MAAMF,IADHlD,aAAaY,IAAIuC,UACdD,CAAAA,CAAO9B,SAASyB,MAAMvB,QAAQ;IAChD,GAAGV;IACHkB,MAAM,CAAA,GACElB,IAAIkB,QAAQ,CAAA,CAAA;GAExB,CAAA;GAEA,IAAIsB,QAAQ3B,SACR,OAAO,EAAEA,SAASpB,yBAAyB,MAAMiB,OAAOqB,MAAM,EAAE;GAGpE,IAAIS,QAAQ1B,QACRA,OAAO2B,KAAI,GAAID,QAAQ1B,MAAM;EAErC;EAIA,MAAMD,UAAUpB,yBAAyB,OAAOiB,OAAOqB,MAAM;EAC7D,OAAO;GACHlB;GACAC,QAAQD,UAAU,CAAA,IAAKC;EAC3B;CACJ;AACJ"}
+{"version":3,"file":"evaluator.mjs","names":["and","or","BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","RealmMatchPolicyEvaluator","RealmScope","aggregatePermissionPolicyBindings","definePolicyIssueItem","maybeInvertPolicyOutcome","normalizeRealmScope","PermissionBindingPolicyEvaluator","validator","identityEvaluator","realmMatchEvaluator","identityPermissionProvider","requires","PERMISSION_BINDING","accessData","ctx","data","has","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realmId","clientId","length","invert","aggr","pendingIssues","conditions","pending","lowerable","grant","grants","reachCondition","realmOutcome","scope","realmScope","NONE","ANY","condition","push","engine","evaluators","outcome","withConditions","result"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICondition } from '@rapiq/core';\nimport { and, or } from '@rapiq/core';\nimport type { Issue } from 'validup';\nimport type {\n    IPolicyEvaluator,\n    PermissionPolicyBindingAggregated,\n    PolicyEvaluationContext,\n    PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n    BuiltInPolicyType,\n    IdentityPolicyEvaluator,\n    PermissionBindingPolicyValidator,\n    PolicyEngine,\n    PolicyIssueCode,\n    RealmMatchPolicyEvaluator,\n    RealmScope,\n    aggregatePermissionPolicyBindings,\n    definePolicyIssueItem,\n    maybeInvertPolicyOutcome,\n    normalizeRealmScope,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n    protected validator : PermissionBindingPolicyValidator;\n\n    protected identityEvaluator: IdentityPolicyEvaluator;\n\n    protected realmMatchEvaluator : RealmMatchPolicyEvaluator;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        this.validator = new PermissionBindingPolicyValidator();\n        this.identityEvaluator = new IdentityPolicyEvaluator();\n        this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();\n        this.identityPermissionProvider = identityPermissionProvider;\n    }\n\n    requires() : string[] {\n        // IDENTITY is deliberately NOT declared: a missing identity must stay a\n        // settled DATA_MISSING deny (fail-closed) so a scope-restricted or anonymous\n        // bearer still fails the pre-gate through system.default — pending would be\n        // permitted there.\n        return [BuiltInPolicyType.PERMISSION_BINDING];\n    }\n\n    async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBindingAggregated | null> {\n        if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return null;\n        }\n\n        if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n        }\n\n        const data = ctx.data.get<PermissionPolicyBindingAggregated>(BuiltInPolicyType.PERMISSION_BINDING);\n\n        ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n        ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n        return data;\n    }\n\n    async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n        const policy = await this.validator.run(value);\n\n        const identity = await this.identityEvaluator.accessData(ctx);\n        if (!identity) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property identity is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n        const binding = await this.accessData(ctx);\n        if (!binding) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property permission is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n\n        const identityBindings = await this.identityPermissionProvider.getFor(identity)\n            .then((bindings) => bindings.filter((item) => {\n                if (item.permission.name !== binding.permission.name) {\n                    return false;\n                }\n\n                return (binding.permission.realmId ?? null) === (item.permission.realmId ?? null) &&\n                    (binding.permission.clientId ?? null) === (item.permission.clientId ?? null);\n            }));\n\n        if (identityBindings.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const [aggr] = aggregatePermissionPolicyBindings(identityBindings);\n        if (!aggr) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        // identityBindings is filtered to a single (name, realm_id, client_id) key, so the\n        // aggregate yields exactly one entry whose `grants` are the actor's per-grant\n        // (realm_scope, policy) disjunction terms; access is the DISJUNCTION over them:\n        //   ∃ grant . realmScopeMatches(grant.realmScope, resource) ∧ (grant.policy passes)\n        // Pairing each grant's realm reach with its OWN policy is what fixes both the mixed\n        // policy-free + policy-bound UNDER-grant (a policy-free `own` grant must not mask a\n        // policy-bound `any` grant's wider reach) and the symmetric OVER-grant (an `own`\n        // grant's passing policy must not ride an `any` grant's wider reach).\n        const issues : Issue[] = [];\n        const pendingIssues : Issue[] = [];\n        const conditions : ICondition[] = [];\n        let pending = false;\n        let lowerable = true;\n        for (const grant of aggr.grants) {\n            // Realm reach (coarse, actor-relative) — a SEPARATE factor from the grant's\n            // policy, ANDed with it. The realm-match evaluator runs in SCOPE MODE: it reads the\n            // resource realm from ctx.data[REALM_MATCH] (fallback ATTRIBUTES.realmId) and\n            // neutral-passes when absent (preEvaluate / gate checks / realm-less resources) —\n            // key-PRESENCE is the discriminator. Invoked DIRECTLY (not via PolicyEngine) so\n            // the reach factor can never be skipped by a caller's include/exclude filters or\n            // deferred by the engine's data-availability gate.\n            //\n            // Under `withConditions` (query-build) with no resource realm present, the\n            // reach PENDS with its condition form over the row's realm column instead of\n            // neutral-passing — `any` stays unrestricted and `none` reaches nothing, so\n            // neither pollutes the composed WHERE with constant terms.\n            let reachCondition : ICondition | null = null;\n            const realmOutcome = await this.realmMatchEvaluator.evaluate(\n                { scope: grant.realmScope },\n                ctx,\n            );\n            if (realmOutcome.pending) {\n                const scope = normalizeRealmScope(grant.realmScope);\n                if (scope === RealmScope.NONE) {\n                    continue;\n                }\n\n                if (scope !== RealmScope.ANY) {\n                    if (!realmOutcome.condition) {\n                        pending = true;\n                        lowerable = false;\n                        continue;\n                    }\n\n                    reachCondition = realmOutcome.condition;\n                }\n            } else if (!realmOutcome.success) {\n                continue;\n            }\n\n            if (!grant.policy) {\n                if (!reachCondition) {\n                    // Reach matches and this grant carries no further restriction.\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                // Reach is the grant's only restriction — a pure condition term.\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // Missing evaluators is a misconfiguration: let the engine fail CLOSED with a\n            // surfaced POLICY_EVALUATOR_NOT_FOUND issue (new PolicyEngine(undefined) defaults\n            // to an empty registry, so grant.policy resolves to no evaluator) rather than\n            // swallowing the grant with a silent issue-less deny.\n            const engine = new PolicyEngine(ctx.evaluators);\n            const outcome = await engine.evaluate(grant.policy, {\n                ...ctx,\n                path: [\n                    ...(ctx.path || []),\n                ],\n            });\n\n            if (outcome.success) {\n                if (!reachCondition) {\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // A PENDING junction policy (required data key absent — e.g. an ATTRIBUTES\n            // policy at the pre-gate) leaves this grant term UNKNOWN, not failed: the\n            // grant could still pass once the data arrives, so it must not settle the\n            // disjunction to false.\n            if (outcome.pending) {\n                pending = true;\n\n                if (ctx.withConditions && outcome.condition) {\n                    conditions.push(\n                        reachCondition ?\n                            and(reachCondition, outcome.condition) :\n                            outcome.condition,\n                    );\n                } else {\n                    lowerable = false;\n                }\n\n                if (outcome.issues) {\n                    pendingIssues.push(...outcome.issues);\n                }\n\n                continue;\n            }\n\n            if (outcome.issues) {\n                issues.push(...outcome.issues);\n            }\n        }\n\n        // No grant term settled true. If some term is still pending, the disjunction is\n        // pending — deliberately uninverted (unknown stays unknown under negation). The\n        // condition form composes the grant terms as a disjunction, all-or-nothing: a\n        // single non-expressible grant term makes the whole binding non-expressible\n        // (pushing a partial OR would wrongly exclude rows).\n        if (pending) {\n            const result : PolicyEvaluationResult = {\n                success: false,\n                pending: true,\n                issues: pendingIssues,\n            };\n\n            if (ctx.withConditions && lowerable && conditions.length > 0) {\n                result.condition = conditions.length === 1 ?\n                    conditions[0]! :\n                    or(...conditions);\n            }\n\n            return result;\n        }\n\n        // No grant term satisfied (reach ∧ policies). Apply `invert` ONCE to the aggregated\n        // disjunction outcome — never per term, which would corrupt the quantifier.\n        const success = maybeInvertPolicyOutcome(false, policy.invert);\n        return {\n            success,\n            issues: success ? [] : issues,\n        };\n    }\n}\n"],"mappings":";;;;;;AA+BA,IAAaa,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;EACjE,KAAKH,YAAY,IAAIV,iCAAAA;EACrB,KAAKW,oBAAoB,IAAIZ,wBAAAA;EAC7B,KAAKa,sBAAsB,IAAIT,0BAAAA;EAC/B,KAAKU,6BAA6BA;CACtC;CAEAC,WAAsB;EAKlB,OAAO,CAAChB,kBAAkBiB,kBAAAA;CAC9B;CAEA,MAAMC,WAAWC,KAAkF;EAC/F,IAAI,CAACA,IAAIC,KAAKC,IAAIrB,kBAAkBiB,kBAAkB,GAClD,OAAO;EAGX,IAAIE,IAAIC,KAAKE,YAAYtB,kBAAkBiB,kBAAkB,GACzD,OAAOE,IAAIC,KAAKG,IAAIvB,kBAAkBiB,kBAAkB;EAG5D,MAAMG,OAAOD,IAAIC,KAAKG,IAAuCvB,kBAAkBiB,kBAAkB;EAEjGE,IAAIC,KAAKI,IAAIxB,kBAAkBiB,oBAAoBG,IAAAA;EACnDD,IAAIC,KAAKK,aAAazB,kBAAkBiB,kBAAkB;EAE1D,OAAOG;CACX;CAEA,MAAMM,SAASC,OAA4BR,KAA+D;EACtG,MAAMS,SAAS,MAAM,KAAKhB,UAAUiB,IAAIF,KAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKjB,kBAAkBK,WAAWC,GAAAA;EACzD,IAAI,CAACW,UACD,OAAO;GACHC,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CAAA;EAER;EAEJ,MAAMC,UAAU,MAAM,KAAKnB,WAAWC,GAAAA;EACtC,IAAI,CAACkB,SACD,OAAO;GACHN,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CAAA;EAER;EAGJ,MAAME,mBAAmB,MAAM,KAAKvB,2BAA2BwB,OAAOT,QAAAA,CAAAA,CACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;GACjC,IAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,MAC5C,OAAO;GAGX,QAAQR,QAAQO,WAAWE,WAAW,WAAWH,KAAKC,WAAWE,WAAW,UACvET,QAAQO,WAAWG,YAAY,WAAWJ,KAAKC,WAAWG,YAAY;EAC/E,CAAA,CAAA;EAEJ,IAAIT,iBAAiBU,WAAW,GAC5B,OAAO,EAAEjB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAGrE,MAAM,CAACC,QAAQ3C,kCAAkC+B,gBAAAA;EACjD,IAAI,CAACY,MACD,OAAO,EAAEnB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAWrE,MAAMjB,SAAmB,CAAA;EACzB,MAAMmB,gBAA0B,CAAA;EAChC,MAAMC,aAA4B,CAAA;EAClC,IAAIC,UAAU;EACd,IAAIC,YAAY;EAChB,KAAK,MAAMC,SAASL,KAAKM,QAAQ;GAa7B,IAAIC,iBAAqC;GACzC,MAAMC,eAAe,MAAM,KAAK5C,oBAAoBY,SAChD,EAAEiC,OAAOJ,MAAMK,WAAW,GAC1BzC,GAAAA;GAEJ,IAAIuC,aAAaL,SAAS;IACtB,MAAMM,QAAQjD,oBAAoB6C,MAAMK,UAAU;IAClD,IAAID,UAAUrD,WAAWuD,MACrB;IAGJ,IAAIF,UAAUrD,WAAWwD,KAAK;KAC1B,IAAI,CAACJ,aAAaK,WAAW;MACzBV,UAAU;MACVC,YAAY;MACZ;KACJ;KAEAG,iBAAiBC,aAAaK;IAClC;GACJ,OAAO,IAAI,CAACL,aAAa3B,SACrB;GAGJ,IAAI,CAACwB,MAAM3B,QAAQ;IACf,IAAI,CAAC6B,gBAED,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAIpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAOA,MAAMc,UAAU,MAAMF,IADH9D,aAAagB,IAAI+C,UACdD,CAAAA,CAAOvC,SAAS6B,MAAM3B,QAAQ;IAChD,GAAGT;IACHiB,MAAM,CAAA,GACEjB,IAAIiB,QAAQ,CAAA,CAAA;GAExB,CAAA;GAEA,IAAI+B,QAAQpC,SAAS;IACjB,IAAI,CAAC0B,gBACD,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAGpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAMA,IAAIc,QAAQd,SAAS;IACjBA,UAAU;IAEV,IAAIlC,IAAIiD,kBAAkBD,QAAQJ,WAC9BX,WAAWY,KACPP,iBACI3D,IAAI2D,gBAAgBU,QAAQJ,SAAS,IACrCI,QAAQJ,SAAS;SAGzBT,YAAY;IAGhB,IAAIa,QAAQnC,QACRmB,cAAca,KAAI,GAAIG,QAAQnC,MAAM;IAGxC;GACJ;GAEA,IAAImC,QAAQnC,QACRA,OAAOgC,KAAI,GAAIG,QAAQnC,MAAM;EAErC;EAOA,IAAIqB,SAAS;GACT,MAAMgB,SAAkC;IACpCtC,SAAS;IACTsB,SAAS;IACTrB,QAAQmB;GACZ;GAEA,IAAIhC,IAAIiD,kBAAkBd,aAAaF,WAAWJ,SAAS,GACvDqB,OAAON,YAAYX,WAAWJ,WAAW,IACrCI,WAAW,KACXrD,GAAAA,GAAMqD,UAAAA;GAGd,OAAOiB;EACX;EAIA,MAAMtC,UAAUtB,yBAAyB,OAAOmB,OAAOqB,MAAM;EAC7D,OAAO;GACHlB;GACAC,QAAQD,UAAU,CAAA,IAAKC;EAC3B;CACJ;AACJ"}

package/dist/index.mjs

@@ -50,16 +50,10 @@ import { IdentityProviderAttributeMappingEntity } from "./adapters/database/doma
 import { IdentityProviderPermissionMappingEntity } from "./adapters/database/domains/identity-provider-permission-mapping/entity.mjs";
 import { IdentityProviderRoleMappingEntity } from "./adapters/database/domains/identity-provider-role-mapping/entity.mjs";
 import { IdentityProviderRoleSubscriber } from "./adapters/database/domains/identity-provider-role-mapping/subscriber.mjs";
-import { RobotEntity } from "./adapters/database/domains/robot/entity.mjs";
-import { RobotSubscriber } from "./adapters/database/domains/robot/subscriber.mjs";
 import { SessionEntity } from "./adapters/database/domains/session/entity.mjs";
 import { SessionTokenEntity } from "./adapters/database/domains/session-token/entity.mjs";
 import { TrustAnchorEntity } from "./adapters/database/domains/trust-anchor/entity.mjs";
 import { PermissionPolicyEntity } from "./adapters/database/domains/permission-policy/entity.mjs";
-import { RobotPermissionEntity } from "./adapters/database/domains/robot-permission/entity.mjs";
-import { RobotPermissionSubscriber } from "./adapters/database/domains/robot-permission/subscriber.mjs";
-import { RobotRoleEntity } from "./adapters/database/domains/robot-role/entity.mjs";
-import { RobotRoleSubscriber } from "./adapters/database/domains/robot-role/subscriber.mjs";
 import { RoleAttributeSubscriber } from "./adapters/database/domains/role-attribute/subscriber.mjs";
 import { RolePermissionEntity } from "./adapters/database/domains/role-permission/entity.mjs";
 import { RolePermissionSubscriber } from "./adapters/database/domains/role-permission/subscriber.mjs";
@@ -110,9 +104,6 @@ import { PermissionRepositoryAdapter } from "./app/modules/database/repositories
 import { PermissionPolicyRepositoryAdapter } from "./app/modules/database/repositories/permission-policy/repository.mjs";
 import { PermissionDatabaseProvider } from "./app/modules/database/repositories/permission-provider/module.mjs";
 import { PolicyRepositoryAdapter } from "./app/modules/database/repositories/policy/repository.mjs";
-import { RobotRepositoryAdapter } from "./app/modules/database/repositories/robot/repository.mjs";
-import { RobotPermissionRepositoryAdapter } from "./app/modules/database/repositories/robot-permission/repository.mjs";
-import { RobotRoleRepositoryAdapter } from "./app/modules/database/repositories/robot-role/repository.mjs";
 import { RoleRepositoryAdapter } from "./app/modules/database/repositories/role/repository.mjs";
 import { RoleAttributeRepositoryAdapter } from "./app/modules/database/repositories/role-attribute/repository.mjs";
 import { RolePermissionRepositoryAdapter } from "./app/modules/database/repositories/role-permission/repository.mjs";
@@ -157,7 +148,6 @@ import { HTTPClientCredentialsGrant } from "./adapters/http/adapters/oauth2/gran
 import { HTTPOAuth2IdentityGrantType } from "./adapters/http/adapters/oauth2/grant-types/identity.mjs";
 import { HTTPPasswordGrant } from "./adapters/http/adapters/oauth2/grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./adapters/http/adapters/oauth2/grant-types/refresh_token.mjs";
-import { HTTPRobotCredentialsGrant } from "./adapters/http/adapters/oauth2/grant-types/robot-credentials.mjs";
 import { ClientController } from "./adapters/http/controllers/entities/client/module.mjs";
 import { ClientPermissionController } from "./adapters/http/controllers/entities/client-permission/module.mjs";
 import { ClientPermissionRequestValidator } from "./adapters/http/controllers/entities/client-permission/utils/validation.mjs";
@@ -185,11 +175,6 @@ import { RegisterController } from "./adapters/http/controllers/workflows/regist
 import { StatusController } from "./adapters/http/controllers/workflows/status/module.mjs";
 import { TokenController } from "./adapters/http/controllers/workflows/token/module.mjs";
 import { RealmController } from "./adapters/http/controllers/entities/realm/module.mjs";
-import { RobotController } from "./adapters/http/controllers/entities/robot/module.mjs";
-import { RobotPermissionController } from "./adapters/http/controllers/entities/robot-permission/module.mjs";
-import { RobotPermissionRequestValidator } from "./adapters/http/controllers/entities/robot-permission/utils/validation.mjs";
-import { RobotRoleController } from "./adapters/http/controllers/entities/robot-role/module.mjs";
-import { RobotRoleRequestValidator } from "./adapters/http/controllers/entities/robot-role/utils/validation.mjs";
 import { RoleController } from "./adapters/http/controllers/entities/role/module.mjs";
 import { RoleAttributeController } from "./adapters/http/controllers/entities/role-attribute/module.mjs";
 import { RoleAttributeRequestValidator } from "./adapters/http/controllers/entities/role-attribute/utils/validation.mjs";
@@ -217,7 +202,6 @@ import { IdentityProviderAttributeMappingRepository } from "./app/modules/identi
 import { IdentityProviderPermissionMappingRepository } from "./app/modules/identity/repositories/provider/mapper/permission.mjs";
 import { IdentityProviderRoleMappingRepository } from "./app/modules/identity/repositories/provider/mapper/role.mjs";
 import { ClientIdentityRepository } from "./app/modules/identity/repositories/client.mjs";
-import { RobotIdentityRepository } from "./app/modules/identity/repositories/robot.mjs";
 import { UserIdentityRepository } from "./app/modules/identity/repositories/user.mjs";
 import { LDAPInjectionKey } from "./app/modules/ldap/constants.mjs";
 import { LdapModule } from "./app/modules/ldap/module.mjs";
@@ -240,4 +224,4 @@ import { defineCLIResetCommand } from "./cli/commands/reset.mjs";
 import { defineCLIStartCommand } from "./cli/commands/start.mjs";
 import "./cli/commands/index.mjs";
 import "reflect-metadata";
-export { ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, ConsentController, ConsentEntity, ConsentEntitySubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, EventController, EventEntity, EventRepositoryAdapter, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountEntity, IdentityProviderAccountRepository, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyController, KeyEntity, KeyRepositoryAdapter, LDAPInjectionKey, LOCALE_COOKIE, LdapModule, LoggerInjectionKey, LoggerModule, LogoutController, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, PromAuthFlowMetrics, ProvisionerModule, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotEntity, RobotIdentityRepository, RobotPermissionController, RobotPermissionEntity, RobotPermissionRepositoryAdapter, RobotPermissionRequestValidator, RobotPermissionSubscriber, RobotRepositoryAdapter, RobotRoleController, RobotRoleEntity, RobotRoleRepositoryAdapter, RobotRoleRequestValidator, RobotRoleSubscriber, RobotSubscriber, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionController, SessionEntity, SessionRepository, SessionTokenEntity, StatusController, TokenController, TrustAnchorController, TrustAnchorEntity, TrustAnchorRepositoryAdapter, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserAuthenticatorController, UserAuthenticatorEntity, UserAuthenticatorRepositoryAdapter, UserController, UserEntity, UserIdentityRepository, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIResetCommand, defineCLIStartCommand, expandToOrigins, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getAppOrigins, getBodyRealmID, getDatabaseDriverErrorCode, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isUniqueConstraintDatabaseError, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };
+export { ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, ConsentController, ConsentEntity, ConsentEntitySubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, EventController, EventEntity, EventRepositoryAdapter, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountEntity, IdentityProviderAccountRepository, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyController, KeyEntity, KeyRepositoryAdapter, LDAPInjectionKey, LOCALE_COOKIE, LdapModule, LoggerInjectionKey, LoggerModule, LogoutController, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, PromAuthFlowMetrics, ProvisionerModule, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionController, SessionEntity, SessionRepository, SessionTokenEntity, StatusController, TokenController, TrustAnchorController, TrustAnchorEntity, TrustAnchorRepositoryAdapter, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserAuthenticatorController, UserAuthenticatorEntity, UserAuthenticatorRepositoryAdapter, UserController, UserEntity, UserIdentityRepository, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIResetCommand, defineCLIStartCommand, expandToOrigins, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getAppOrigins, getBodyRealmID, getDatabaseDriverErrorCode, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isUniqueConstraintDatabaseError, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };