npm - @authup/server-core - Versions diffs - 1.0.0-beta.53 → 1.0.0-beta.55 - Mend

@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.55

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1255) hide show

package/dist/app/modules/oauth2/repositories/consent/repository.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"repository.mjs","names":["IdentityType","buildRedisKeyPath","applyQuery","CachePrefix","ConsentEntity","isUniqueConstraintDatabaseError","CONSENT_FILTER_KEYS","applyRealmScopeSelect","ConsentRepositoryAdapter","repository","dataSource","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","defaultAlias","fields","default","filters","allowed","relations","sort","maxLimit","leftJoin","addSelect","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","realmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findAllBySubjectClient","clientId","where","cache","prefix","CONSENT_COVERING","key","getMany","insertMissing","input","existing","existingTokens","Set","map","row","scope","missing","scopes","filter","token","has","userId","USER","entity","create","client_id","realm_id","user_id","sub_kind","expires_at","save","e","remove"],"sources":["../../../../../../src/app/modules/oauth2/repositories/consent/repository.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { applyQuery } from 'typeorm-extension';\nimport { CachePrefix, ConsentEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isUniqueConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport type {\n ConsentFindManyOptions,\n ConsentOwner,\n IConsentRepository,\n} from '../../../../../core/index.ts';\nimport { CONSENT_FILTER_KEYS } from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../../database/repositories/helpers.ts';\n\nexport class ConsentRepositoryAdapter implements IConsentRepository {\n protected repository: Repository<ConsentEntity>;\n\n constructor(dataSource: DataSource) {\n this.repository = dataSource.getRepository(ConsentEntity);\n }\n\n async findMany(\n query: Record<string, any>,\n options: ConsentFindManyOptions = {},\n ): Promise<EntityRepositoryFindManyResult<Consent>> {\n const qb = this.repository.createQueryBuilder('consent');\n\n const { pagination } = applyQuery(qb, query, {\n defaultAlias: 'consent',\n fields: {\n // `default` (not just `allowed`) so applyQuery adds an explicit\n // per-column SELECT: it populates expressionMap.selects, which\n // applyRealmScopeSelect dedupes against. Without it the default\n // \"select all\" is implicit (empty selects) and the force-select\n // re-adds consent.sub — a duplicate `consent_sub` alias that\n // mysql rejects under the client join (see helpers.ts).\n default: [\n 'id',\n 'client_id',\n 'realm_id',\n 'user_id',\n 'sub',\n 'sub_kind',\n 'scope',\n 'expires_at',\n 'created_at',\n 'updated_at',\n ],\n },\n filters: { allowed: [...CONSENT_FILTER_KEYS] },\n relations: { allowed: ['realm'] },\n sort: { allowed: ['created_at', 'updated_at', 'scope'] },\n pagination: { maxLimit: 50 },\n });\n\n applyRealmScopeSelect(qb, 'consent', ['sub', 'sub_kind']);\n\n // Always expose only a client SUMMARY (id / name / display_name /\n // built_in) — NEVER the full ClientEntity (redirect_uri + post-logout\n // patterns = the trusted-origin set, grant_types, base_url/root_url,\n // secret-storage flags, access_policy_id). `client` is deliberately\n // absent from relations.allowed so a raw ?include=client cannot force\n // the full-column join; the self-service Applications tab still gets\n // the display name from this fixed projection.\n qb.leftJoin('consent.client', 'client')\n .addSelect([\n 'client.id',\n 'client.name',\n 'client.display_name',\n 'client.built_in',\n ]);\n\n if (options.owner) {\n // mandatory constraint — not overridable by a rapiq filter\n qb.andWhere('consent.sub = :ownerSub AND consent.sub_kind = :ownerSubKind', {\n ownerSub: options.owner.sub,\n ownerSubKind: options.owner.subKind,\n });\n }\n\n if (options.realmId) {\n // nested `/realms/:realmId/consents` mount — mandatory constraint,\n // not overridable by a rapiq filter\n qb.andWhere('consent.realm_id = :realmId', { realmId: options.realmId });\n }\n\n const [entities, total] = await qb.getManyAndCount();\n\n return {\n data: entities,\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n async findOneById(id: string): Promise<Consent \| null> {\n return this.repository.findOneBy({ id });\n }\n\n async findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]> {\n const qb = this.repository.createQueryBuilder('consent');\n qb.where('consent.client_id = :clientId AND consent.sub = :sub AND consent.sub_kind = :subKind', {\n clientId,\n sub: owner.sub,\n subKind: owner.subKind,\n });\n qb.cache(\n buildRedisKeyPath({\n prefix: CachePrefix.CONSENT_COVERING,\n key: `${clientId}:${owner.subKind}:${owner.sub}`,\n }),\n 60_000,\n );\n\n return qb.getMany();\n }\n\n async insertMissing(input: {\n clientId: string,\n realmId: string,\n owner: ConsentOwner,\n scopes: string[]\n }): Promise<void> {\n // uncached read — the diff must see the latest rows, and the covering\n // cache entry must not be refreshed on the write path.\n const existing = await this.repository.createQueryBuilder('consent')\n .where('consent.client_id = :clientId AND consent.sub = :sub AND consent.sub_kind = :subKind', {\n clientId: input.clientId,\n sub: input.owner.sub,\n subKind: input.owner.subKind,\n })\n .getMany();\n\n const existingTokens = new Set(existing.map((row) => row.scope));\n const missing = input.scopes.filter((token) => !existingTokens.has(token));\n\n // save-per-row (never a raw qb insert): entity-manager saves fire the\n // ConsentEntitySubscriber — covering-cache invalidation, realtime\n // destinations and audit mirroring depend on it. A duplicate-key\n // violation is the benign race outcome under the unique index.\n // Set the user_id FK only when the subject is a user, so a user\n // deletion cascade-drops its consent rows; non-user subjects leave it\n // null (the row is still cleaned up when its client/realm is deleted).\n const userId = input.owner.subKind === IdentityType.USER ?\n input.owner.sub :\n null;\n\n for (const scope of missing) {\n const entity = this.repository.create({\n client_id: input.clientId,\n realm_id: input.realmId,\n user_id: userId,\n sub: input.owner.sub,\n sub_kind: input.owner.subKind,\n scope,\n expires_at: null,\n });\n\n try {\n await this.repository.save(entity);\n } catch (e) {\n if (!isUniqueConstraintDatabaseError(e)) {\n throw e;\n }\n }\n }\n }\n\n async remove(entity: Consent): Promise<void> {\n await this.repository.remove(entity as ConsentEntity);\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuBA,IAAaQ,2BAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcP,aAAAA;CAC/C;CAEA,MAAMQ,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAef,WAAWa,IAAIF,OAAO;GACzCK,cAAc;GACdC,QAAQ,EAOJC,SAAS;IACL;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;KAER;GACAC,SAAS,EAAEC,SAAS,CAAA,GAAIhB,mBAAAA,EAAqB;GAC7CiB,WAAW,EAAED,SAAS,CAAC,OAAA,EAAS;GAChCE,MAAM,EAAEF,SAAS;IAAC;IAAc;IAAc;KAAS;GACvDL,YAAY,EAAEQ,UAAU,GAAG;EAC/B,CAAA;EAEAlB,sBAAsBQ,IAAI,WAAW,CAAC,OAAO,UAAA,CAAW;EASxDA,GAAGW,SAAS,kBAAkB,QAAA,CAAA,CACzBC,UAAU;GACP;GACA;GACA;GACA;GACH;EAEL,IAAIb,QAAQc,OAERb,GAAGc,SAAS,gEAAgE;GACxEC,UAAUhB,QAAQc,MAAMG;GACxBC,cAAclB,QAAQc,MAAMK;EAChC,CAAA;EAGJ,IAAInB,QAAQoB,SAGRnB,GAAGc,SAAS,+BAA+B,EAAEK,SAASpB,QAAQoB,QAAQ,CAAA;EAG1E,MAAM,CAACC,UAAUC,SAAS,MAAMrB,GAAGsB,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGnB;GACP;EACJ;CACJ;CAEA,MAAMuB,YAAYC,IAAqC;EACnD,OAAO,KAAKhC,WAAWiC,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,uBAAuBC,UAAkBhB,OAAyC;EACpF,MAAMb,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAC9CD,GAAG8B,MAAM,wFAAwF;GAC7FD;GACAb,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA;EACAlB,GAAG+B,MACC7C,kBAAkB;GACd8C,QAAQ5C,YAAY6C;GACpBC,KAAK,GAAGL,SAAS,GAAGhB,MAAMK,QAAQ,GAAGL,MAAMG;EAC/C,CAAA,GACA,GAAA;EAGJ,OAAOhB,GAAGmC,QAAO;CACrB;CAEA,MAAMC,cAAcC,OAKF;EAGd,MAAMC,WAAW,MAAM,KAAK5C,WAAWO,mBAAmB,SAAA,CAAA,CACrD6B,MAAM,wFAAwF;GAC3FD,UAAUQ,MAAMR;GAChBb,KAAKqB,MAAMxB,MAAMG;GACjBE,SAASmB,MAAMxB,MAAMK;EACzB,CAAA,CAAA,CACCiB,QAAO;EAEZ,MAAMI,iBAAiB,IAAIC,IAAIF,SAASG,KAAKC,QAAQA,IAAIC,KAAK,CAAA;EAC9D,MAAMC,UAAUP,MAAMQ,OAAOC,QAAQC,UAAU,CAACR,eAAeS,IAAID,KAAAA,CAAAA;EASnE,MAAME,SAASZ,MAAMxB,MAAMK,YAAYjC,aAAaiE,OAChDb,MAAMxB,MAAMG,MACZ;EAEJ,KAAK,MAAM2B,SAASC,SAAS;GACzB,MAAMO,SAAS,KAAKzD,WAAW0D,OAAO;IAClCC,WAAWhB,MAAMR;IACjByB,UAAUjB,MAAMlB;IAChBoC,SAASN;IACTjC,KAAKqB,MAAMxB,MAAMG;IACjBwC,UAAUnB,MAAMxB,MAAMK;IACtByB;IACAc,YAAY;GAChB,CAAA;GAEA,IAAI;IACA,MAAM,KAAK/D,WAAWgE,KAAKP,MAAAA;GAC/B,SAASQ,GAAG;IACR,IAAI,CAACrE,gCAAgCqE,CAAAA,GACjC,MAAMA;GAEd;EACJ;CACJ;CAEA,MAAMC,OAAOT,QAAgC;EACzC,MAAM,KAAKzD,WAAWkE,OAAOT,MAAAA;CACjC;AACJ"}
1	+ {"version":3,"file":"repository.mjs","names":["IdentityType","buildRedisKeyPath","applyQuery","CachePrefix","ConsentEntity","isUniqueConstraintDatabaseError","applyRealmScopeSelect","ConsentRepositoryAdapter","repository","dataSource","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","leftJoin","addSelect","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","realmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findAllBySubjectClient","clientId","where","cache","prefix","CONSENT_COVERING","key","getMany","insertMissing","input","existing","existingTokens","Set","map","row","scope","missing","scopes","filter","token","has","userId","USER","entity","create","expiresAt","save","e","remove"],"sources":["../../../../../../src/app/modules/oauth2/repositories/consent/repository.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { IdentityType } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { applyQuery } from '../../../database/repositories/query.ts';\nimport { CachePrefix, ConsentEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isUniqueConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport type {\n ConsentFindManyOptions,\n ConsentOwner,\n IConsentRepository,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../../database/repositories/helpers.ts';\n\nexport class ConsentRepositoryAdapter implements IConsentRepository {\n protected repository: Repository<ConsentEntity>;\n\n constructor(dataSource: DataSource) {\n this.repository = dataSource.getRepository(ConsentEntity);\n }\n\n async findMany(\n query: IQuery,\n options: ConsentFindManyOptions = {},\n ): Promise<EntityRepositoryFindManyResult<Consent>> {\n const qb = this.repository.createQueryBuilder('consent');\n\n const { pagination } = applyQuery(qb, query);\n\n applyRealmScopeSelect(qb, 'consent', ['sub', 'subKind']);\n\n // Always expose only a client SUMMARY (id / name / displayName /\n // builtIn) — NEVER the full ClientEntity (redirectUri + post-logout\n // patterns = the trusted-origin set, grantTypes, baseUrl/rootUrl,\n // secret-storage flags, accessPolicyId). `client` is deliberately\n // absent from relations.allowed so a raw ?include=client cannot force\n // the full-column join; the self-service Applications tab still gets\n // the display name from this fixed projection.\n qb.leftJoin('consent.client', 'client')\n .addSelect([\n 'client.id',\n 'client.name',\n 'client.displayName',\n 'client.builtIn',\n ]);\n\n if (options.owner) {\n // mandatory constraint — not overridable by a rapiq filter\n qb.andWhere('consent.sub = :ownerSub AND consent.subKind = :ownerSubKind', {\n ownerSub: options.owner.sub,\n ownerSubKind: options.owner.subKind,\n });\n }\n\n if (options.realmId) {\n // nested `/realms/:realmId/consents` mount — mandatory constraint,\n // not overridable by a rapiq filter\n qb.andWhere('consent.realmId = :realmId', { realmId: options.realmId });\n }\n\n const [entities, total] = await qb.getManyAndCount();\n\n return {\n data: entities,\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n async findOneById(id: string): Promise<Consent \| null> {\n return this.repository.findOneBy({ id });\n }\n\n async findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]> {\n const qb = this.repository.createQueryBuilder('consent');\n qb.where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n clientId,\n sub: owner.sub,\n subKind: owner.subKind,\n });\n qb.cache(\n buildRedisKeyPath({\n prefix: CachePrefix.CONSENT_COVERING,\n key: `${clientId}:${owner.subKind}:${owner.sub}`,\n }),\n 60_000,\n );\n\n return qb.getMany();\n }\n\n async insertMissing(input: {\n clientId: string,\n realmId: string,\n owner: ConsentOwner,\n scopes: string[]\n }): Promise<void> {\n // uncached read — the diff must see the latest rows, and the covering\n // cache entry must not be refreshed on the write path.\n const existing = await this.repository.createQueryBuilder('consent')\n .where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n clientId: input.clientId,\n sub: input.owner.sub,\n subKind: input.owner.subKind,\n })\n .getMany();\n\n const existingTokens = new Set(existing.map((row) => row.scope));\n const missing = input.scopes.filter((token) => !existingTokens.has(token));\n\n // save-per-row (never a raw qb insert): entity-manager saves fire the\n // ConsentEntitySubscriber — covering-cache invalidation, realtime\n // destinations and audit mirroring depend on it. A duplicate-key\n // violation is the benign race outcome under the unique index.\n // Set the userId FK only when the subject is a user, so a user\n // deletion cascade-drops its consent rows; non-user subjects leave it\n // null (the row is still cleaned up when its client/realm is deleted).\n const userId = input.owner.subKind === IdentityType.USER ?\n input.owner.sub :\n null;\n\n for (const scope of missing) {\n const entity = this.repository.create({\n clientId: input.clientId,\n realmId: input.realmId,\n userId,\n sub: input.owner.sub,\n subKind: input.owner.subKind,\n scope,\n expiresAt: null,\n });\n\n try {\n await this.repository.save(entity);\n } catch (e) {\n if (!isUniqueConstraintDatabaseError(e)) {\n throw e;\n }\n }\n }\n }\n\n async remove(entity: Consent): Promise<void> {\n await this.repository.remove(entity as ConsentEntity);\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,IAAaO,2BAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcN,aAAAA;CAC/C;CAEA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAed,WAAWY,IAAIF,KAAAA;EAEtCN,sBAAsBQ,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EASvDA,GAAGG,SAAS,kBAAkB,QAAA,CAAA,CACzBC,UAAU;GACP;GACA;GACA;GACA;EACH,CAAA;EAEL,IAAIL,QAAQM,OAERL,GAAGM,SAAS,+DAA+D;GACvEC,UAAUR,QAAQM,MAAMG;GACxBC,cAAcV,QAAQM,MAAMK;EAChC,CAAA;EAGJ,IAAIX,QAAQY,SAGRX,GAAGM,SAAS,8BAA8B,EAAEK,SAASZ,QAAQY,QAAQ,CAAA;EAGzE,MAAM,CAACC,UAAUC,SAAS,MAAMb,GAAGc,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGX;GACP;EACJ;CACJ;CAEA,MAAMe,YAAYC,IAAqC;EACnD,OAAO,KAAKxB,WAAWyB,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,uBAAuBC,UAAkBhB,OAAyC;EACpF,MAAML,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAC9CD,GAAGsB,MAAM,sFAAsF;GAC3FD;GACAb,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA;EACAV,GAAGuB,MACCpC,kBAAkB;GACdqC,QAAQnC,YAAYoC;GACpBC,KAAK,GAAGL,SAAS,GAAGhB,MAAMK,QAAQ,GAAGL,MAAMG;EAC/C,CAAA,GACA,GAAA;EAGJ,OAAOR,GAAG2B,QAAO;CACrB;CAEA,MAAMC,cAAcC,OAKF;EAGd,MAAMC,WAAW,MAAM,KAAKpC,WAAWO,mBAAmB,SAAA,CAAA,CACrDqB,MAAM,sFAAsF;GACzFD,UAAUQ,MAAMR;GAChBb,KAAKqB,MAAMxB,MAAMG;GACjBE,SAASmB,MAAMxB,MAAMK;EACzB,CAAA,CAAA,CACCiB,QAAO;EAEZ,MAAMI,iBAAiB,IAAIC,IAAIF,SAASG,KAAKC,QAAQA,IAAIC,KAAK,CAAA;EAC9D,MAAMC,UAAUP,MAAMQ,OAAOC,QAAQC,UAAU,CAACR,eAAeS,IAAID,KAAAA,CAAAA;EASnE,MAAME,SAASZ,MAAMxB,MAAMK,YAAYxB,aAAawD,OAChDb,MAAMxB,MAAMG,MACZ;EAEJ,KAAK,MAAM2B,SAASC,SAAS;GACzB,MAAMO,SAAS,KAAKjD,WAAWkD,OAAO;IAClCvB,UAAUQ,MAAMR;IAChBV,SAASkB,MAAMlB;IACf8B;IACAjC,KAAKqB,MAAMxB,MAAMG;IACjBE,SAASmB,MAAMxB,MAAMK;IACrByB;IACAU,WAAW;GACf,CAAA;GAEA,IAAI;IACA,MAAM,KAAKnD,WAAWoD,KAAKH,MAAAA;GAC/B,SAASI,GAAG;IACR,IAAI,CAACxD,gCAAgCwD,CAAAA,GACjC,MAAMA;GAEd;EACJ;CACJ;CAEA,MAAMC,OAAOL,QAAgC;EACzC,MAAM,KAAKjD,WAAWsD,OAAOL,MAAAA;CACjC;AACJ"}

package/dist/app/modules/oauth2/repositories/constants.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"constants.mjs","names":["CacheOAuth2Prefix"],"sources":["../../../../../src/app/modules/oauth2/repositories/constants.ts"],"sourcesContent":["/\n Copyright (c) 2024-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum CacheOAuth2Prefix {\n AUTHORIZATION_STATE = 'oauth2_authorization_state',\n AUTHORIZATION_CODE = 'oauth2_authorization_code',\n TOKEN = 'oauth2_token',\n TOKEN_CLAIMS = 'oauth2_token_claims',\n TOKEN_INACTIVE = 'oauth2_token_blocked',\n}\n"],"mappings":";;;;AAOA,IAAO,oBAAKA,uBAAAA,mBAAAA;;;;;;~~QAAAA~~"}
1	+ {"version":3,"file":"constants.mjs","names":["CacheOAuth2Prefix"],"sources":["../../../../../src/app/modules/oauth2/repositories/constants.ts"],"sourcesContent":["/\n Copyright (c) 2024-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum CacheOAuth2Prefix {\n AUTHORIZATION_STATE = 'oauth2_authorization_state',\n AUTHORIZATION_CODE = 'oauth2_authorization_code',\n TOKEN = 'oauth2_token',\n TOKEN_CLAIMS = 'oauth2_token_claims',\n TOKEN_INACTIVE = 'oauth2_token_blocked',\n}\n"],"mappings":";;;;AAOA,IAAO,oBAAKA,uBAAAA,mBAAAA;;;;;;CAAAA,OAAAA;AAMX,EAAA,CAAA,CAAA"}

package/dist/app/modules/oauth2/repositories/scope/repository.mjs CHANGED Viewed

@@ -9,7 +9,7 @@ var OAuth2ScopeRepository = class {
 	}
 	async findByClientId(clientId) {
 		return (await this.repository.find({
-			where: { client_id: clientId },
+			where: { clientId },
 			relations: { scope: true }
 		})).map((clientScope) => clientScope.scope);
 	}

package/dist/app/modules/oauth2/repositories/scope/repository.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"repository.mjs","names":["OAuth2ScopeRepository","repository","findByClientId","clientId","clientScopes","find","where","~~client_id","~~relations","scope","map","clientScope"],"sources":["../../../../../../src/app/modules/oauth2/repositories/scope/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ClientScope, Scope } from '@authup/core-kit';\nimport type { Repository } from 'typeorm';\nimport type { IOAuth2ScopeRepository } from '../../../../../core/index.ts';\n\nexport class OAuth2ScopeRepository implements IOAuth2ScopeRepository {\n private readonly repository: Repository<ClientScope>;\n\n constructor(\n repository: Repository<ClientScope>,\n ) {\n this.repository = repository;\n }\n\n async findByClientId(clientId: string): Promise<Scope[]> {\n const clientScopes = await this.repository.find({\n where: { ~~client_id:~~ clientId },\n relations: { scope: true },\n });\n\n return clientScopes.map((clientScope) => clientScope.scope);\n }\n}\n"],"mappings":";;;;AAWA,IAAaA,wBAAb,MAAaA;CACQC;CAEjB,YACIA,YACF;EACE,KAAKA,aAAaA;CACtB;CAEA,MAAMC,eAAeC,UAAoC;EAMrD,QAAOC,MALoB,KAAKH,WAAWI,KAAK;GAC5CC,OAAO,~~EAAEC~~,~~WAAWJ,~~SAAS;~~GAC7BK~~,WAAW,EAAEC,OAAO,KAAK;EAC7B,CAAA,EAAA,CAEoBC,KAAKC,gBAAgBA,YAAYF,KAAK;CAC9D;AACJ"}
1	+ {"version":3,"file":"repository.mjs","names":["OAuth2ScopeRepository","repository","findByClientId","clientId","clientScopes","find","where","relations","scope","map","clientScope"],"sources":["../../../../../../src/app/modules/oauth2/repositories/scope/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ClientScope, Scope } from '@authup/core-kit';\nimport type { Repository } from 'typeorm';\nimport type { IOAuth2ScopeRepository } from '../../../../../core/index.ts';\n\nexport class OAuth2ScopeRepository implements IOAuth2ScopeRepository {\n private readonly repository: Repository<ClientScope>;\n\n constructor(\n repository: Repository<ClientScope>,\n ) {\n this.repository = repository;\n }\n\n async findByClientId(clientId: string): Promise<Scope[]> {\n const clientScopes = await this.repository.find({\n where: { clientId },\n relations: { scope: true },\n });\n\n return clientScopes.map((clientScope) => clientScope.scope);\n }\n}\n"],"mappings":";;;;AAWA,IAAaA,wBAAb,MAAaA;CACQC;CAEjB,YACIA,YACF;EACE,KAAKA,aAAaA;CACtB;CAEA,MAAMC,eAAeC,UAAoC;EAMrD,QAAOC,MALoB,KAAKH,WAAWI,KAAK;GAC5CC,OAAO,EAAEH,SAAS;GAClBI,WAAW,EAAEC,OAAO,KAAK;EAC7B,CAAA,EAAA,CAEoBC,KAAKC,gBAAgBA,YAAYF,KAAK;CAC9D;AACJ"}

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs CHANGED Viewed

@@ -13,48 +13,51 @@ var SessionTokenRepositoryAdapter = class {
 	async create(input) {
 		const entity = this.repository.create({
 			id: input.id,
-			session_id: input.session_id,
+			sessionId: input.sessionId,
 			kind: input.kind,
-			parent_id: input.parent_id ?? null,
-			refresh_token_id: input.refresh_token_id ?? null,
-			ip_address: input.ip_address,
-			user_agent: input.user_agent,
-			consumed_at: null,
-			revoked_at: null,
-			expires_at: input.expires_at
+			parentId: input.parentId ?? null,
+			refreshTokenId: input.refreshTokenId ?? null,
+			ipAddress: input.ipAddress,
+			userAgent: input.userAgent,
+			consumedAt: null,
+			revokedAt: null,
+			expiresAt: input.expiresAt
 		});
 		await this.repository.insert(entity);
-		entity.created_at = entity.created_at ?? (/* @__PURE__ */ new Date()).toISOString();
+		entity.createdAt = entity.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
 		return entity;
 	}
 	async findOneById(id) {
 		return this.repository.findOne({ where: { id } });
 	}
 	async findBySessionId(sessionId) {
-		return this.repository.find({ where: { session_id: sessionId } });
+		return this.repository.find({ where: { sessionId } });
 	}
 	async markRefreshConsumed(id, at) {
-		return ((await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ consumed_at: at }).where("id = :id", { id }).andWhere("kind = :kind", { kind: "refresh" }).andWhere("consumed_at IS NULL").andWhere("revoked_at IS NULL").execute()).affected ?? 0) > 0;
+		return ((await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ consumedAt: at }).where("id = :id", { id }).andWhere("kind = :kind", { kind: "refresh" }).andWhere("consumedAt IS NULL").andWhere("revokedAt IS NULL").execute()).affected ?? 0) > 0;
 	}
 	async hasConsumedChild(parentId) {
-		return await this.repository.createQueryBuilder().where("parent_id = :parentId", { parentId }).andWhere("consumed_at IS NOT NULL").getCount() > 0;
+		return await this.repository.createQueryBuilder("sessionToken").where("sessionToken.parentId = :parentId", { parentId }).andWhere("sessionToken.consumedAt IS NOT NULL").getCount() > 0;
 	}
 	async revokeById(id, at) {
-		await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revoked_at: at }).where("id = :id", { id }).andWhere("revoked_at IS NULL").execute();
+		await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revokedAt: at }).where("id = :id", { id }).andWhere("revokedAt IS NULL").execute();
 	}
 	async revokeBySessionId(sessionId, at) {
 		const refs = (await this.repository.find({
-			where: { session_id: sessionId },
-			select: ["id", "expires_at"]
+			where: { sessionId },
+			select: {
+				id: true,
+				expiresAt: true
+			}
 		})).map((row) => ({
 			id: row.id,
-			expires_at: row.expires_at
+			expiresAt: row.expiresAt
 		}));
-		if (refs.length > 0) await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revoked_at: at }).where({ id: In(refs.map((ref) => ref.id)) }).andWhere("revoked_at IS NULL").execute();
+		if (refs.length > 0) await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revokedAt: at }).where({ id: In(refs.map((ref) => ref.id)) }).andWhere("revokedAt IS NULL").execute();
 		return refs;
 	}
 	async deleteExpired(before) {
-		return (await this.repository.delete({ expires_at: LessThan(before) })).affected ?? 0;
+		return (await this.repository.delete({ expiresAt: LessThan(before) })).affected ?? 0;
 	}
 };
 //#endregion

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"repository.mjs","names":["In","LessThan","SessionTokenEntity","SessionTokenRepositoryAdapter","repository","dataSource","getRepository","create","input","entity","id","~~session_id~~","kind","~~parent_id~~","~~refresh_token_id~~","~~ip_address~~","~~user_agent~~","~~consumed_at~~","~~revoked_at~~","~~expires_at~~","insert","~~created_at~~","Date","toISOString","findOneById","findOne","where","findBySessionId","~~sessionId","~~find","markRefreshConsumed","at","result","createQueryBuilder","update","set","andWhere","execute","affected","hasConsumedChild","~~parentId","~~count","getCount","revokeById","revokeBySessionId","rows","select","refs","map","row","length","ref","deleteExpired","before","delete"],"sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { SessionToken } from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { In, LessThan } from 'typeorm';\nimport { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';\nimport type {\n ISessionTokenRepository,\n SessionTokenCreateInput,\n SessionTokenRef,\n} from '../../../../../core/index.ts';\n\nexport class SessionTokenRepositoryAdapter implements ISessionTokenRepository {\n protected repository: Repository<SessionTokenEntity>;\n\n constructor(dataSource: DataSource) {\n this.repository = dataSource.getRepository(SessionTokenEntity);\n }\n\n async create(input: SessionTokenCreateInput): Promise<SessionToken> {\n const entity = this.repository.create({\n id: input.id,\n ~~session_id~~: input.~~session_id~~,\n kind: input.kind,\n ~~parent_id~~: input.~~parent_id~~ ?? null,\n ~~refresh_token_id~~: input.~~refresh_token_id~~ ?? null,\n ~~ip_address~~: input.~~ip_address~~,\n ~~user_agent~~: input.~~user_agent~~,\n ~~consumed_at~~: null,\n ~~revoked_at~~: null,\n ~~expires_at~~: input.~~expires_at~~,\n });\n\n await this.repository.insert(entity);\n\n // insert() does not hydrate @CreateDateColumn back onto the in-memory\n // entity (the DB fills created_at via its DEFAULT). Stamp it so the\n // returned object satisfies the SessionToken contract instead of\n // carrying an undefined ~~created_at~~.\n entity.~~created_at~~ = entity.~~created_at~~ ?? new Date().toISOString();\n\n return entity;\n }\n\n async findOneById(id: string): Promise<SessionToken \| null> {\n return this.repository.findOne({ where: { id } });\n }\n\n async findBySessionId(sessionId: string): Promise<SessionToken[]> {\n return this.repository.find({ where: { ~~session_id:~~ sessionId } });\n }\n\n async markRefreshConsumed(id: string, at: string): Promise<boolean> {\n const result = await this.repository.createQueryBuilder()\n .update(SessionTokenEntity)\n .set({ ~~consumed_at~~: at })\n .where('id = :id', { id })\n .andWhere('kind = :kind', { kind: 'refresh' })\n .andWhere('~~consumed_at~~ IS NULL')\n .andWhere('~~revoked_at~~ IS NULL')\n .execute();\n\n return (result.affected ?? 0) > 0;\n }\n\n async hasConsumedChild(parentId: string): Promise<boolean> {\n const count = await this.repository.createQueryBuilder()\n .where('~~parent_id~~ = :parentId', { parentId })\n .andWhere('~~consumed_at~~ IS NOT NULL')\n .getCount();\n\n return count > 0;\n }\n\n async revokeById(id: string, at: string): Promise<void> {\n await this.repository.createQueryBuilder()\n .update(SessionTokenEntity)\n .set({ ~~revoked_at~~: at })\n .where('id = :id', { id })\n .andWhere('~~revoked_at~~ IS NULL')\n .execute();\n }\n\n async revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]> {\n const rows = await this.repository.find({\n where: { ~~session_id:~~ sessionId },\n select: ['id', ~~'expires_at']~~,\n });\n\n const refs: SessionTokenRef[] = rows.map((row) => ({\n id: row.id,\n ~~expires_at~~: row.~~expires_at~~,\n }));\n if (refs.length > 0) {\n await this.repository.createQueryBuilder()\n .update(SessionTokenEntity)\n .set({ ~~revoked_at~~: at })\n .where({ id: In(refs.map((ref) => ref.id)) })\n .andWhere('~~revoked_at~~ IS NULL')\n .execute();\n }\n\n return refs;\n }\n\n async deleteExpired(before: string): Promise<number> {\n const result = await this.repository.delete({ ~~expires_at~~: LessThan(before) });\n\n return result.affected ?? 0;\n }\n}\n"],"mappings":";;;;;;;AAiBA,IAAaG,gCAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcJ,kBAAAA;CAC/C;CAEA,MAAMK,OAAOC,OAAuD;EAChE,MAAMC,SAAS,KAAKL,WAAWG,OAAO;GAClCG,IAAIF,MAAME;GACVC,~~YAAYH~~,MAAMG;~~GAClBC~~,MAAMJ,MAAMI;GACZC,~~WAAWL~~,MAAMK,~~aAAa~~;~~GAC9BC~~,~~kBAAkBN~~,MAAMM,~~oBAAoB~~;~~GAC5CC~~,~~YAAYP~~,MAAMO;~~GAClBC~~,~~YAAYR~~,MAAMQ;~~GAClBC~~,~~aAAa;GACbC,~~YAAY;GACZC,~~YAAYX~~,MAAMW;~~EACtB~~,CAAA;EAEA,MAAM,KAAKf,WAAWgB,OAAOX,MAAAA;EAM7BA,OAAOY,~~aAAaZ~~,OAAOY~~,+BAAc~~,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;~~EAE/D~~,OAAOd;CACX;CAEA,MAAMe,YAAYd,IAA0C;EACxD,OAAO,KAAKN,WAAWqB,QAAQ,EAAEC,OAAO,EAAEhB,GAAG,EAAE,CAAA;CACnD;CAEA,MAAMiB,~~gBAAgBC~~,WAA4C;EAC9D,OAAO,~~KAAKxB~~,~~WAAWyB~~,KAAK,~~EAAEH~~,OAAO,EAAEf,~~YAAYiB,~~UAAU,EAAE,CAAA;~~CACnE~~;CAEA,~~MAAME~~,~~oBAAoBpB~~,~~IAAYqB~~,IAA8B;EAUhE,SAAQC,MATa,~~KAAK5B~~,~~WAAW6B~~,mBAAkB,CAAA,CAClDC,~~OAAOhC~~,kBAAAA,CAAAA,~~CACPiC~~,IAAI,~~EAAElB~~,~~aAAac~~,GAAG,CAAA,CAAA,~~CACtBL~~,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,~~CACvB0B~~,SAAS,gBAAgB,~~EAAExB~~,MAAM,UAAU,CAAA,CAAA,~~CAC3CwB~~,SAAS,~~qBAAA~~,CAAA,CACTA,SAAS,~~oBAAA~~,CAAA,CACTC,QAAO,EAAA,CAEGC,YAAY,KAAK;CACpC;CAEA,MAAMC,~~iBAAiBC~~,UAAoC;EAMvD,~~OAAOC~~,MALa,~~KAAKrC~~,~~WAAW6B~~,~~mBAAkB~~,CAAA,~~CACjDP~~,MAAM,~~yBAAyB~~,~~EAAEc~~,SAAS,CAAA,CAAA,~~CAC1CJ~~,SAAS,~~yBAAA~~,CAAA,~~CACTM~~,SAAQ,IAEE;CACnB;CAEA,MAAMC,~~WAAWjC~~,~~IAAYqB~~,IAA2B;EACpD,MAAM,~~KAAK3B~~,~~WAAW6B~~,mBAAkB,CAAA,CACnCC,~~OAAOhC~~,kBAAAA,CAAAA,~~CACPiC~~,IAAI,~~EAAEjB~~,~~YAAYa~~,GAAG,CAAA,CAAA,~~CACrBL~~,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,~~CACvB0B~~,SAAS,~~oBAAA~~,CAAA,CACTC,QAAO;CAChB;CAEA,~~MAAMO~~,~~kBAAkBhB~~,~~WAAmBG~~,IAAwC;EAM/E,~~MAAMgB~~,QAA0BF,MALb,~~KAAKzC~~,~~WAAWyB~~,KAAK;~~GACpCH~~,OAAO,EAAEf,~~YAAYiB,~~UAAU;~~GAC/BkB~~,QAAQ,~~CAAC~~,~~MAAM,YAAA~~;~~EACnB~~,CAAA,EAAA,~~CAEqCE~~,KAAKC,SAAS;GAC/~~CvC~~,~~IAAIuC~~,~~IAAIvC~~;GACRS,~~YAAY8B~~,~~IAAI9B~~;~~EACpB~~,EAAA;EACA,~~IAAI4B~~,KAAKG,SAAS,GACd,MAAM,~~KAAK9C~~,~~WAAW6B~~,mBAAkB,CAAA,CACnCC,~~OAAOhC~~,kBAAAA,CAAAA,~~CACPiC~~,IAAI,~~EAAEjB~~,~~YAAYa~~,GAAG,CAAA,CAAA,~~CACrBL~~,MAAM,EAAEhB,IAAIV,~~GAAG+C~~,KAAKC,KAAKG,QAAQA,~~IAAIzC~~,EAAE,CAAA,EAAG,CAAA,CAAA,~~CAC1C0B~~,SAAS,~~oBAAA~~,CAAA,CACTC,QAAO;EAGhB,~~OAAOU~~;CACX;CAEA,MAAMK,cAAcC,QAAiC;EAGjD,~~QAAOrB~~,MAFc,~~KAAK5B~~,~~WAAWkD~~,OAAO,~~EAAEnC~~,~~YAAYlB~~,~~SAASoD~~,MAAAA,EAAQ,CAAA,EAAA,~~CAE7Df~~,YAAY;CAC9B;AACJ"}
1	+ {"version":3,"file":"repository.mjs","names":["In","LessThan","SessionTokenEntity","SessionTokenRepositoryAdapter","repository","dataSource","getRepository","create","input","entity","id","sessionId","kind","parentId","refreshTokenId","ipAddress","userAgent","consumedAt","revokedAt","expiresAt","insert","createdAt","Date","toISOString","findOneById","findOne","where","findBySessionId","find","markRefreshConsumed","at","result","createQueryBuilder","update","set","andWhere","execute","affected","hasConsumedChild","count","getCount","revokeById","revokeBySessionId","rows","select","refs","map","row","length","ref","deleteExpired","before","delete"],"sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { SessionToken } from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { In, LessThan } from 'typeorm';\nimport { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';\nimport type {\n ISessionTokenRepository,\n SessionTokenCreateInput,\n SessionTokenRef,\n} from '../../../../../core/index.ts';\n\nexport class SessionTokenRepositoryAdapter implements ISessionTokenRepository {\n protected repository: Repository<SessionTokenEntity>;\n\n constructor(dataSource: DataSource) {\n this.repository = dataSource.getRepository(SessionTokenEntity);\n }\n\n async create(input: SessionTokenCreateInput): Promise<SessionToken> {\n const entity = this.repository.create({\n id: input.id,\n sessionId: input.sessionId,\n kind: input.kind,\n parentId: input.parentId ?? null,\n refreshTokenId: input.refreshTokenId ?? null,\n ipAddress: input.ipAddress,\n userAgent: input.userAgent,\n consumedAt: null,\n revokedAt: null,\n expiresAt: input.expiresAt,\n });\n\n await this.repository.insert(entity);\n\n // insert() does not hydrate @CreateDateColumn back onto the in-memory\n // entity (the DB fills created_at via its DEFAULT). Stamp it so the\n // returned object satisfies the SessionToken contract instead of\n // carrying an undefined createdAt.\n entity.createdAt = entity.createdAt ?? new Date().toISOString();\n\n return entity;\n }\n\n async findOneById(id: string): Promise<SessionToken \| null> {\n return this.repository.findOne({ where: { id } });\n }\n\n async findBySessionId(sessionId: string): Promise<SessionToken[]> {\n return this.repository.find({ where: { sessionId } });\n }\n\n async markRefreshConsumed(id: string, at: string): Promise<boolean> {\n const result = await this.repository.createQueryBuilder()\n .update(SessionTokenEntity)\n .set({ consumedAt: at })\n .where('id = :id', { id })\n .andWhere('kind = :kind', { kind: 'refresh' })\n .andWhere('consumedAt IS NULL')\n .andWhere('revokedAt IS NULL')\n .execute();\n\n return (result.affected ?? 0) > 0;\n }\n\n async hasConsumedChild(parentId: string): Promise<boolean> {\n const count = await this.repository.createQueryBuilder('sessionToken')\n .where('sessionToken.parentId = :parentId', { parentId })\n .andWhere('sessionToken.consumedAt IS NOT NULL')\n .getCount();\n\n return count > 0;\n }\n\n async revokeById(id: string, at: string): Promise<void> {\n await this.repository.createQueryBuilder()\n .update(SessionTokenEntity)\n .set({ revokedAt: at })\n .where('id = :id', { id })\n .andWhere('revokedAt IS NULL')\n .execute();\n }\n\n async revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]> {\n const rows = await this.repository.find({\n where: { sessionId },\n select: { id: true, expiresAt: true },\n });\n\n const refs: SessionTokenRef[] = rows.map((row) => ({\n id: row.id,\n expiresAt: row.expiresAt,\n }));\n if (refs.length > 0) {\n await this.repository.createQueryBuilder()\n .update(SessionTokenEntity)\n .set({ revokedAt: at })\n .where({ id: In(refs.map((ref) => ref.id)) })\n .andWhere('revokedAt IS NULL')\n .execute();\n }\n\n return refs;\n }\n\n async deleteExpired(before: string): Promise<number> {\n const result = await this.repository.delete({ expiresAt: LessThan(before) });\n\n return result.affected ?? 0;\n }\n}\n"],"mappings":";;;;;;;AAiBA,IAAaG,gCAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcJ,kBAAAA;CAC/C;CAEA,MAAMK,OAAOC,OAAuD;EAChE,MAAMC,SAAS,KAAKL,WAAWG,OAAO;GAClCG,IAAIF,MAAME;GACVC,WAAWH,MAAMG;GACjBC,MAAMJ,MAAMI;GACZC,UAAUL,MAAMK,YAAY;GAC5BC,gBAAgBN,MAAMM,kBAAkB;GACxCC,WAAWP,MAAMO;GACjBC,WAAWR,MAAMQ;GACjBC,YAAY;GACZC,WAAW;GACXC,WAAWX,MAAMW;EACrB,CAAA;EAEA,MAAM,KAAKf,WAAWgB,OAAOX,MAAAA;EAM7BA,OAAOY,YAAYZ,OAAOY,8BAAa,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAE7D,OAAOd;CACX;CAEA,MAAMe,YAAYd,IAA0C;EACxD,OAAO,KAAKN,WAAWqB,QAAQ,EAAEC,OAAO,EAAEhB,GAAG,EAAE,CAAA;CACnD;CAEA,MAAMiB,gBAAgBhB,WAA4C;EAC9D,OAAO,KAAKP,WAAWwB,KAAK,EAAEF,OAAO,EAAEf,UAAU,EAAE,CAAA;CACvD;CAEA,MAAMkB,oBAAoBnB,IAAYoB,IAA8B;EAUhE,SAAQC,MATa,KAAK3B,WAAW4B,mBAAkB,CAAA,CAClDC,OAAO/B,kBAAAA,CAAAA,CACPgC,IAAI,EAAEjB,YAAYa,GAAG,CAAA,CAAA,CACrBJ,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvByB,SAAS,gBAAgB,EAAEvB,MAAM,UAAU,CAAA,CAAA,CAC3CuB,SAAS,oBAAA,CAAA,CACTA,SAAS,mBAAA,CAAA,CACTC,QAAO,EAAA,CAEGC,YAAY,KAAK;CACpC;CAEA,MAAMC,iBAAiBzB,UAAoC;EAMvD,OAAO0B,MALa,KAAKnC,WAAW4B,mBAAmB,cAAA,CAAA,CAClDN,MAAM,qCAAqC,EAAEb,SAAS,CAAA,CAAA,CACtDsB,SAAS,qCAAA,CAAA,CACTK,SAAQ,IAEE;CACnB;CAEA,MAAMC,WAAW/B,IAAYoB,IAA2B;EACpD,MAAM,KAAK1B,WAAW4B,mBAAkB,CAAA,CACnCC,OAAO/B,kBAAAA,CAAAA,CACPgC,IAAI,EAAEhB,WAAWY,GAAG,CAAA,CAAA,CACpBJ,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvByB,SAAS,mBAAA,CAAA,CACTC,QAAO;CAChB;CAEA,MAAMM,kBAAkB/B,WAAmBmB,IAAwC;EAM/E,MAAMe,QAA0BF,MALb,KAAKvC,WAAWwB,KAAK;GACpCF,OAAO,EAAEf,UAAU;GACnBiC,QAAQ;IAAElC,IAAI;IAAMS,WAAW;GAAK;EACxC,CAAA,EAAA,CAEqC2B,KAAKC,SAAS;GAC/CrC,IAAIqC,IAAIrC;GACRS,WAAW4B,IAAI5B;EACnB,EAAA;EACA,IAAI0B,KAAKG,SAAS,GACd,MAAM,KAAK5C,WAAW4B,mBAAkB,CAAA,CACnCC,OAAO/B,kBAAAA,CAAAA,CACPgC,IAAI,EAAEhB,WAAWY,GAAG,CAAA,CAAA,CACpBJ,MAAM,EAAEhB,IAAIV,GAAG6C,KAAKC,KAAKG,QAAQA,IAAIvC,EAAE,CAAA,EAAG,CAAA,CAAA,CAC1CyB,SAAS,mBAAA,CAAA,CACTC,QAAO;EAGhB,OAAOS;CACX;CAEA,MAAMK,cAAcC,QAAiC;EAGjD,QAAOpB,MAFc,KAAK3B,WAAWgD,OAAO,EAAEjC,WAAWlB,SAASkD,MAAAA,EAAQ,CAAA,EAAA,CAE5Dd,YAAY;CAC9B;AACJ"}

package/dist/app/modules/provisioning/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"~~AAqBA~~,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;~~AAsBtD~~,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;~~AAYxC~~,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAOH,uBAAuB,~~EAW1B~~,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAWrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;~~cA+KjC~~,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAmBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAWxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAOH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAWrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAiKjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}

package/dist/app/modules/provisioning/module.mjs CHANGED Viewed

@@ -10,10 +10,7 @@ import { PermissionEntity } from "../../../adapters/database/domains/permission/
 import { ClientPermissionEntity } from "../../../adapters/database/domains/client-permission/entity.mjs";
 import { ScopeEntity } from "../../../adapters/database/domains/scope/entity.mjs";
 import { UserRepository } from "../../../adapters/database/domains/user/repository.mjs";
-import { RobotEntity } from "../../../adapters/database/domains/robot/entity.mjs";
 import { PermissionPolicyEntity } from "../../../adapters/database/domains/permission-policy/entity.mjs";
-import { RobotPermissionEntity } from "../../../adapters/database/domains/robot-permission/entity.mjs";
-import { RobotRoleEntity } from "../../../adapters/database/domains/robot-role/entity.mjs";
 import { RolePermissionEntity } from "../../../adapters/database/domains/role-permission/entity.mjs";
 import { UserPermissionEntity } from "../../../adapters/database/domains/user-permission/entity.mjs";
 import { UserRoleEntity } from "../../../adapters/database/domains/user-role/entity.mjs";
@@ -28,7 +25,6 @@ import { PolicyProvisioningSynchronizer } from "../../../core/provisioning/synch
 import { RealmProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/realm/module.mjs";
 import { RoleProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/role/module.mjs";
 import { GraphProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/root/module.mjs";
-import { RobotProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/robot/module.mjs";
 import { ScopeProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/scope/module.mjs";
 import { UserProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/user/module.mjs";
 import "../../../core/provisioning/synchronizer/index.mjs";
@@ -45,9 +41,6 @@ import { KeyRepositoryAdapter } from "../database/repositories/key/repository.mj
 import { PermissionRepositoryAdapter } from "../database/repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "../database/repositories/permission-policy/repository.mjs";
 import { PolicyRepositoryAdapter } from "../database/repositories/policy/repository.mjs";
-import { RobotRepositoryAdapter } from "../database/repositories/robot/repository.mjs";
-import { RobotPermissionRepositoryAdapter } from "../database/repositories/robot-permission/repository.mjs";
-import { RobotRoleRepositoryAdapter } from "../database/repositories/robot-role/repository.mjs";
 import { RoleRepositoryAdapter } from "../database/repositories/role/repository.mjs";
 import { RolePermissionRepositoryAdapter } from "../database/repositories/role-permission/repository.mjs";
 import { ScopeRepositoryAdapter } from "../database/repositories/scope/repository.mjs";
@@ -80,7 +73,10 @@ var ProvisionerModule = class {
 		const sources = [...this.sources];
 		const config = container.resolve(ConfigInjectionKey);
 		const provisioningDir = path.join(config.writableDirectoryPath, "provisioning");
-		if (fs.existsSync(provisioningDir)) sources.push(new FileProvisioningSource({ cwd: provisioningDir }));
+		if (fs.existsSync(provisioningDir)) sources.push(new FileProvisioningSource({
+			cwd: provisioningDir,
+			logger: container.resolve(LoggerInjectionKey)
+		}));
 		const data = await new CompositeProvisioningSource(sources).load(container);
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
 		const realmRepository = container.resolve(RealmEntity);
@@ -135,16 +131,6 @@ var ProvisionerModule = class {
 			roleRepository,
 			permissionRepository
 		});
-		const robotSynchronizer = new RobotProvisioningSynchronizer({
-			robotRepository: new RobotRepositoryAdapter({
-				repository: container.resolve(RobotEntity),
-				realmRepository
-			}),
-			robotRoleRepository: new RobotRoleRepositoryAdapter(container.resolve(RobotRoleEntity)),
-			robotPermissionRepository: new RobotPermissionRepositoryAdapter(container.resolve(RobotPermissionEntity)),
-			roleRepository,
-			permissionRepository
-		});
 		const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: new ScopeRepositoryAdapter({
 			repository: container.resolve(ScopeEntity),
 			realmRepository
@@ -159,7 +145,6 @@ var ProvisionerModule = class {
 				roleSynchronizer,
 				permissionSynchronizer,
 				userSynchronizer,
-				robotSynchronizer,
 				scopeSynchronizer
 			}),
 			scopeSynchronizer
@@ -186,11 +171,11 @@ var ProvisionerModule = class {
 		const permissionRepo = dataSource.getRepository(PermissionEntity);
 		const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);
 		const permissions = await permissionRepo.find();
-		for (const permission of permissions) if (!await junctionRepo.findOneBy({ permission_id: permission.id })) await junctionRepo.save(junctionRepo.create({
-			permission_id: permission.id,
-			permission_realm_id: permission.realm_id,
-			policy_id: defaultPolicy.id,
-			policy_realm_id: defaultPolicy.realm_id
+		for (const permission of permissions) if (!await junctionRepo.findOneBy({ permissionId: permission.id })) await junctionRepo.save(junctionRepo.create({
+			permissionId: permission.id,
+			permissionRealmId: permission.realmId,
+			policyId: defaultPolicy.id,
+			policyRealmId: defaultPolicy.realmId
 		}));
 	}
 };

package/dist/app/modules/provisioning/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RobotEntity","RobotPermissionEntity","RobotRoleEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RobotProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RobotPermissionRepositoryAdapter","RobotRepositoryAdapter","RobotRoleRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","WebClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","robotSynchronizer","robotRepository","robotRoleRepository","robotPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","logger","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permission_id","id","save","create","permission_realm_id","realm_id","policy_id","policy_realm_id"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n Client,\n ClientPermission,\n ClientRole,\n PermissionPolicy,\n Realm,\n Robot,\n RobotPermission,\n RobotRole,\n Role,\n RolePermission,\n Scope,\n UserPermission,\n UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n ClientEntity,\n ClientPermissionEntity,\n ClientRoleEntity,\n PermissionEntity,\n RealmEntity,\n RobotEntity,\n RobotPermissionEntity,\n RobotRoleEntity,\n RoleEntity,\n RolePermissionEntity,\n ScopeEntity,\n UserPermissionEntity,\n UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n PermissionPolicyEntity,\n PolicyRepository,\n UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n ClientProvisioningSynchronizer,\n GraphProvisioningSynchronizer,\n PermissionProvisioningSynchronizer,\n PolicyProvisioningSynchronizer,\n RealmProvisioningSynchronizer,\n RobotProvisioningSynchronizer,\n RoleProvisioningSynchronizer,\n ScopeProvisioningSynchronizer,\n UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n ClientPermissionRepositoryAdapter,\n ClientRepositoryAdapter,\n ClientRoleRepositoryAdapter,\n KeyRepositoryAdapter,\n PermissionPolicyRepositoryAdapter,\n PermissionRepositoryAdapter,\n PolicyRepositoryAdapter,\n RealmRepositoryAdapter,\n RobotPermissionRepositoryAdapter,\n RobotRepositoryAdapter,\n RobotRoleRepositoryAdapter,\n RolePermissionRepositoryAdapter,\n RoleRepositoryAdapter,\n ScopeRepositoryAdapter,\n UserPermissionRepositoryAdapter,\n UserRepositoryAdapter, \n UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n protected sources: IProvisioningSource[];\n\n constructor(sources: IProvisioningSource[] = []) {\n this.name = ModuleName.PROVISIONING;\n this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n this.sources = sources;\n }\n\n async setup(container: IContainer): Promise<void> {\n const sources = [...this.sources];\n\n const config = container.resolve(ConfigInjectionKey);\n const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n if (fs.existsSync(provisioningDir)) {\n sources.push(new FileProvisioningSource({ cwd: provisioningDir }));\n }\n\n const composite = new CompositeProvisioningSource(sources);\n const data = await composite.load(container);\n\n const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n const permissionRepository = new PermissionRepositoryAdapter({\n repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n realmRepository,\n });\n\n const policyRepository = new PolicyRepositoryAdapter({\n repository: new PolicyRepository(dataSource),\n realmRepository,\n });\n\n // ---------------------------------------------------------------\n // Synchronize all entities (policies → permissions → roles → ...)\n // ---------------------------------------------------------------\n\n const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n );\n\n const policySynchronizer = new PolicyProvisioningSynchronizer({\n repository: policyRepository,\n permissionPolicyRepository,\n });\n\n const roleRepository = new RoleRepositoryAdapter({\n repository: container.resolve<Repository<Role>>(RoleEntity),\n realmRepository,\n });\n const clientRepository = new ClientRepositoryAdapter({\n repository: container.resolve<Repository<Client>>(ClientEntity),\n realmRepository,\n });\n\n const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n repository: permissionRepository,\n policyRepository,\n permissionPolicyRepository,\n });\n\n const roleSynchronizer = new RoleProvisioningSynchronizer({\n repository: roleRepository,\n permissionRepository,\n rolePermissionRepository: new RolePermissionRepositoryAdapter(\n container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n ),\n });\n\n const clientSynchronizer = new ClientProvisioningSynchronizer({\n clientRepository,\n clientRoleRepository: new ClientRoleRepositoryAdapter(\n container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n ),\n clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n ),\n\n roleRepository,\n permissionRepository,\n\n roleSynchronizer,\n permissionSynchronizer,\n });\n\n const userSynchronizer = new UserProvisioningSynchronizer({\n userRepository: new UserRepositoryAdapter({\n repository: new UserRepository(dataSource),\n realmRepository,\n }),\n userRoleRepository: new UserRoleRepositoryAdapter(\n container.resolve<Repository<UserRole>>(UserRoleEntity),\n ),\n userPermissionRepository: new UserPermissionRepositoryAdapter(\n container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n ),\n\n clientRepository,\n roleRepository,\n permissionRepository,\n });\n\n const robotSynchronizer = new RobotProvisioningSynchronizer({\n robotRepository: new RobotRepositoryAdapter({\n repository: container.resolve<Repository<Robot>>(RobotEntity),\n realmRepository,\n }),\n robotRoleRepository: new RobotRoleRepositoryAdapter(\n container.resolve<Repository<RobotRole>>(RobotRoleEntity),\n ),\n robotPermissionRepository: new RobotPermissionRepositoryAdapter(\n container.resolve<Repository<RobotPermission>>(RobotPermissionEntity),\n ),\n\n roleRepository,\n permissionRepository,\n });\n\n const scopeRepository = new ScopeRepositoryAdapter({\n repository: container.resolve<Repository<Scope>>(ScopeEntity),\n realmRepository,\n });\n\n const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n const realmSynchronizer = new RealmProvisioningSynchronizer({\n repository: new RealmRepositoryAdapter(realmRepository),\n\n clientSynchronizer,\n roleSynchronizer,\n permissionSynchronizer,\n userSynchronizer,\n robotSynchronizer,\n scopeSynchronizer,\n });\n\n const rootSynchronizer = new GraphProvisioningSynchronizer({\n policySynchronizer,\n permissionSynchronizer,\n roleSynchronizer,\n realmSynchronizer,\n scopeSynchronizer,\n });\n\n await rootSynchronizer.synchronize(data);\n\n // ---------------------------------------------------------------\n // Per-realm public `web` client. Single provisioning mechanism:\n // list every realm (incl. pre-existing) and upsert its web client.\n // Idempotent; guarded on built_in inside the provisioner.\n // ---------------------------------------------------------------\n const webClientProvisioner = new WebClientProvisioner({\n clientRepository,\n appOrigins: getAppOrigins(config),\n logger: container.resolve(LoggerInjectionKey),\n });\n\n // Eager key minting (plan 071 hybrid model): every realm — incl.\n // pre-existing ones — holds sig + enc keys after startup, so the\n // management API shows them without waiting for first use. The\n // adapter is constructed locally (NOT resolved from the oauth2\n // module's registration) so provisioning stays runnable in minimal\n // module graphs (test setup, CLI); the KEK handling is identical.\n const keyProvisioner = new KeyProvisioner({\n keyStore: new KeyRepositoryAdapter(dataSource, {\n secretsCipher: config.secretsEncryptionKey ?\n new SymmetricCipher(config.secretsEncryptionKey) :\n null,\n }),\n logger: container.resolve(LoggerInjectionKey),\n });\n\n const realms = await realmRepository.find();\n for (const realm of realms) {\n await webClientProvisioner.ensureForRealm(realm);\n await keyProvisioner.ensureForRealm(realm);\n }\n\n if (config.permissionsDefaultPolicyAssignment) {\n await this.assignDefaultPolicy(dataSource, policyRepository);\n }\n }\n\n protected async assignDefaultPolicy(\n dataSource: DataSource,\n policyRepository: PolicyRepositoryAdapter,\n ): Promise<void> {\n const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n if (!defaultPolicy) {\n return;\n }\n\n const permissionRepo = dataSource.getRepository(PermissionEntity);\n const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n const permissions = await permissionRepo.find();\n for (const permission of permissions) {\n const hasAnyPolicy = await junctionRepo.findOneBy({ permission_id: permission.id });\n\n if (!hasAnyPolicy) {\n await junctionRepo.save(junctionRepo.create({\n permission_id: permission.id,\n permission_realm_id: permission.realm_id,\n policy_id: defaultPolicy.id,\n policy_realm_id: defaultPolicy.realm_id,\n }));\n }\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuFA,IAAauD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAAA;EACnD,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAA,GAAI,KAAKA,OAAAA;EAEzB,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB,EAAEiB,KAAKL,gBAAgB,CAAA,CAAA;EAInE,MAAMO,OAAO,MAAMD,IADGnB,4BAA4BK,OAC/Bc,CAAAA,CAAUE,KAAKX,SAAAA;EAElC,MAAMY,aAAaZ,UAAUE,QAAQtB,qBAAqBiC,UAAU;EACpE,MAAMC,kBAAkBd,UAAUE,QAA2B7D,WAAAA;EAE7D,MAAM0E,uBAAuB,IAAI/C,4BAA4B;GACzDgD,YAAYhB,UAAUE,QAAsC9D,gBAAAA;GAC5D0E;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAIhD,wBAAwB;GACjD+C,YAAY,IAAIhE,iBAAiB4D,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAInD,kCACnCiC,UAAUE,QAAsCnD,sBAAAA,CAAAA;EAGpD,MAAMoE,qBAAqB,IAAI9D,+BAA+B;GAC1D2D,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI7C,sBAAsB;GAC7CyC,YAAYhB,UAAUE,QAA0BzD,UAAAA;GAChDqE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAIzD,wBAAwB;GACjDoD,YAAYhB,UAAUE,QAA4BjE,YAAAA;GAClD6E;EACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAIlE,mCAAmC;GAClE4D,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAI/D,6BAA6B;GACtDwD,YAAYI;GACZL;GACAS,0BAA0B,IAAIlD,gCAC1B0B,UAAUE,QAAoCxD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM+E,qBAAqB,IAAIvE,+BAA+B;GAC1DmE;GACAK,sBAAsB,IAAI7D,4BACtBmC,UAAUE,QAAgC/D,gBAAAA,CAAAA;GAE9CwF,4BAA4B,IAAIhE,kCAC5BqC,UAAUE,QAAsChE,sBAAAA,CAAAA;GAGpDkF;GACAL;GAEAQ;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAIlE,6BAA6B;GACtDmE,gBAAgB,IAAInD,sBAAsB;IACtCsC,YAAY,IAAI/D,eAAe2D,UAAAA;IAC/BE;GACJ,CAAA;GACAgB,oBAAoB,IAAInD,0BACpBqB,UAAUE,QAA8BrD,cAAAA,CAAAA;GAE5CkF,0BAA0B,IAAItD,gCAC1BuB,UAAUE,QAAoCtD,oBAAAA,CAAAA;GAGlDyE;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMiB,oBAAoB,IAAIzE,8BAA8B;GACxD0E,iBAAiB,IAAI7D,uBAAuB;IACxC4C,YAAYhB,UAAUE,QAA2B5D,WAAAA;IACjDwE;GACJ,CAAA;GACAoB,qBAAqB,IAAI7D,2BACrB2B,UAAUE,QAA+B1D,eAAAA,CAAAA;GAE7C2F,2BAA2B,IAAIhE,iCAC3B6B,UAAUE,QAAqC3D,qBAAAA,CAAAA;GAGnD6E;GACAL;EACJ,CAAA;EAOA,MAAMsB,oBAAoB,IAAI5E,8BAA8B,EAAEuD,YAAYoB,IAL9C5D,uBAAuB;GAC/CwC,YAAYhB,UAAUE,QAA2BvD,WAAAA;GACjDmE;EACJ,CAE0EsB,EAAgB,CAAA;EAqB1F,MAAMG,IARuBpF,8BAA8B;GACvDgE;GACAG;GACAC;GACAe,mBAAAA,IAf0BhF,8BAA8B;IACxD0D,YAAY,IAAI9C,uBAAuB4C,eAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAI;IACAK;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY9B,IAAAA;EAOnC,MAAM+B,uBAAuB,IAAIrD,qBAAqB;GAClDiC;GACAqB,YAAYzD,cAAcgB,MAAAA;GAC1B0C,QAAQ3C,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMyD,iBAAiB,IAAIvD,eAAe;GACtCwD,UAAU,IAAI/E,qBAAqB8C,YAAY,EAC3CkC,eAAe7C,OAAO8C,uBAClB,IAAI7D,gBAAgBe,OAAO8C,oBAAoB,IAC/C,KACR,CAAA;GACAJ,QAAQ3C,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAEA,MAAM6D,SAAS,MAAMlC,gBAAgBmC,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMP,qBAAqBU,eAAeD,KAAAA;GAC1C,MAAMN,eAAeO,eAAeD,KAAAA;EACxC;EAEA,IAAIjD,OAAOmD,oCACP,MAAM,KAAKC,oBAAoBzC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgBoC,oBACZzC,YACAK,kBACa;EACb,MAAMqC,gBAAgB,MAAMrC,iBAAiBsC,cAAczG,iBAAiB0G,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiB7C,WAAW8C,cAActH,gBAAAA;EAChD,MAAMuH,eAAe/C,WAAW8C,cAAc3G,sBAAAA;EAE9C,MAAM6G,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,eAAeH,WAAWI,GAAG,CAAA,GAG7E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,eAAeH,WAAWI;GAC1BG,qBAAqBP,WAAWQ;GAChCC,WAAWhB,cAAcW;GACzBM,iBAAiBjB,cAAce;EACnC,CAAA,CAAA;CAGZ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","WebClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n Client,\n ClientPermission,\n ClientRole,\n PermissionPolicy,\n Realm,\n Role,\n RolePermission,\n Scope,\n UserPermission,\n UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n ClientEntity,\n ClientPermissionEntity,\n ClientRoleEntity,\n PermissionEntity,\n RealmEntity,\n RoleEntity,\n RolePermissionEntity,\n ScopeEntity,\n UserPermissionEntity,\n UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n PermissionPolicyEntity,\n PolicyRepository,\n UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n ClientProvisioningSynchronizer,\n GraphProvisioningSynchronizer,\n PermissionProvisioningSynchronizer,\n PolicyProvisioningSynchronizer,\n RealmProvisioningSynchronizer,\n RoleProvisioningSynchronizer,\n ScopeProvisioningSynchronizer,\n UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n ClientPermissionRepositoryAdapter,\n ClientRepositoryAdapter,\n ClientRoleRepositoryAdapter,\n KeyRepositoryAdapter,\n PermissionPolicyRepositoryAdapter,\n PermissionRepositoryAdapter,\n PolicyRepositoryAdapter,\n RealmRepositoryAdapter,\n RolePermissionRepositoryAdapter,\n RoleRepositoryAdapter,\n ScopeRepositoryAdapter,\n UserPermissionRepositoryAdapter,\n UserRepositoryAdapter, \n UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n protected sources: IProvisioningSource[];\n\n constructor(sources: IProvisioningSource[] = []) {\n this.name = ModuleName.PROVISIONING;\n this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n this.sources = sources;\n }\n\n async setup(container: IContainer): Promise<void> {\n const sources = [...this.sources];\n\n const config = container.resolve(ConfigInjectionKey);\n const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n if (fs.existsSync(provisioningDir)) {\n sources.push(new FileProvisioningSource({\n cwd: provisioningDir,\n logger: container.resolve(LoggerInjectionKey),\n }));\n }\n\n const composite = new CompositeProvisioningSource(sources);\n const data = await composite.load(container);\n\n const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n const permissionRepository = new PermissionRepositoryAdapter({\n repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n realmRepository,\n });\n\n const policyRepository = new PolicyRepositoryAdapter({\n repository: new PolicyRepository(dataSource),\n realmRepository,\n });\n\n // ---------------------------------------------------------------\n // Synchronize all entities (policies → permissions → roles → ...)\n // ---------------------------------------------------------------\n\n const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n );\n\n const policySynchronizer = new PolicyProvisioningSynchronizer({\n repository: policyRepository,\n permissionPolicyRepository,\n });\n\n const roleRepository = new RoleRepositoryAdapter({\n repository: container.resolve<Repository<Role>>(RoleEntity),\n realmRepository,\n });\n const clientRepository = new ClientRepositoryAdapter({\n repository: container.resolve<Repository<Client>>(ClientEntity),\n realmRepository,\n });\n\n const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n repository: permissionRepository,\n policyRepository,\n permissionPolicyRepository,\n });\n\n const roleSynchronizer = new RoleProvisioningSynchronizer({\n repository: roleRepository,\n permissionRepository,\n rolePermissionRepository: new RolePermissionRepositoryAdapter(\n container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n ),\n });\n\n const clientSynchronizer = new ClientProvisioningSynchronizer({\n clientRepository,\n clientRoleRepository: new ClientRoleRepositoryAdapter(\n container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n ),\n clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n ),\n\n roleRepository,\n permissionRepository,\n\n roleSynchronizer,\n permissionSynchronizer,\n });\n\n const userSynchronizer = new UserProvisioningSynchronizer({\n userRepository: new UserRepositoryAdapter({\n repository: new UserRepository(dataSource),\n realmRepository,\n }),\n userRoleRepository: new UserRoleRepositoryAdapter(\n container.resolve<Repository<UserRole>>(UserRoleEntity),\n ),\n userPermissionRepository: new UserPermissionRepositoryAdapter(\n container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n ),\n\n clientRepository,\n roleRepository,\n permissionRepository,\n });\n\n const scopeRepository = new ScopeRepositoryAdapter({\n repository: container.resolve<Repository<Scope>>(ScopeEntity),\n realmRepository,\n });\n\n const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n const realmSynchronizer = new RealmProvisioningSynchronizer({\n repository: new RealmRepositoryAdapter(realmRepository),\n\n clientSynchronizer,\n roleSynchronizer,\n permissionSynchronizer,\n userSynchronizer,\n scopeSynchronizer,\n });\n\n const rootSynchronizer = new GraphProvisioningSynchronizer({\n policySynchronizer,\n permissionSynchronizer,\n roleSynchronizer,\n realmSynchronizer,\n scopeSynchronizer,\n });\n\n await rootSynchronizer.synchronize(data);\n\n // ---------------------------------------------------------------\n // Per-realm public `web` client. Single provisioning mechanism:\n // list every realm (incl. pre-existing) and upsert its web client.\n // Idempotent; guarded on builtIn inside the provisioner.\n // ---------------------------------------------------------------\n const webClientProvisioner = new WebClientProvisioner({\n clientRepository,\n appOrigins: getAppOrigins(config),\n logger: container.resolve(LoggerInjectionKey),\n });\n\n // Eager key minting (plan 071 hybrid model): every realm — incl.\n // pre-existing ones — holds sig + enc keys after startup, so the\n // management API shows them without waiting for first use. The\n // adapter is constructed locally (NOT resolved from the oauth2\n // module's registration) so provisioning stays runnable in minimal\n // module graphs (test setup, CLI); the KEK handling is identical.\n const keyProvisioner = new KeyProvisioner({\n keyStore: new KeyRepositoryAdapter(dataSource, {\n secretsCipher: config.secretsEncryptionKey ?\n new SymmetricCipher(config.secretsEncryptionKey) :\n null,\n }),\n logger: container.resolve(LoggerInjectionKey),\n });\n\n const realms = await realmRepository.find();\n for (const realm of realms) {\n await webClientProvisioner.ensureForRealm(realm);\n await keyProvisioner.ensureForRealm(realm);\n }\n\n if (config.permissionsDefaultPolicyAssignment) {\n await this.assignDefaultPolicy(dataSource, policyRepository);\n }\n }\n\n protected async assignDefaultPolicy(\n dataSource: DataSource,\n policyRepository: PolicyRepositoryAdapter,\n ): Promise<void> {\n const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n if (!defaultPolicy) {\n return;\n }\n\n const permissionRepo = dataSource.getRepository(PermissionEntity);\n const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n const permissions = await permissionRepo.find();\n for (const permission of permissions) {\n const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n if (!hasAnyPolicy) {\n await junctionRepo.save(junctionRepo.create({\n permissionId: permission.id,\n permissionRealmId: permission.realmId,\n policyId: defaultPolicy.id,\n policyRealmId: defaultPolicy.realmId,\n }));\n }\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6EA,IAAagD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMwB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAElC,MAAMa,aAAab,UAAUE,QAAQtB,qBAAqBkC,UAAU;EACpE,MAAMC,kBAAkBf,UAAUE,QAA2BtD,WAAAA;EAE7D,MAAMoE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYjB,UAAUE,QAAsCvD,gBAAAA;GAC5DoE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI7D,iBAAiByD,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC8B,UAAUE,QAAsC/C,sBAAAA,CAAAA;EAGpD,MAAMiE,qBAAqB,IAAI3D,+BAA+B;GAC1DwD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI9C,sBAAsB;GAC7C0C,YAAYjB,UAAUE,QAA0BrD,UAAAA;GAChDkE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAIvD,wBAAwB;GACjDkD,YAAYjB,UAAUE,QAA4B1D,YAAAA;GAClDuE;EACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI/D,mCAAmC;GAClEyD,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAI7D,6BAA6B;GACtDsD,YAAYI;GACZL;GACAS,0BAA0B,IAAInD,gCAC1B0B,UAAUE,QAAoCpD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM4E,qBAAqB,IAAIpE,+BAA+B;GAC1DgE;GACAK,sBAAsB,IAAI3D,4BACtBgC,UAAUE,QAAgCxD,gBAAAA,CAAAA;GAE9CkF,4BAA4B,IAAI9D,kCAC5BkC,UAAUE,QAAsCzD,sBAAAA,CAAAA;GAGpD4E;GACAL;GAEAQ;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAIhE,6BAA6B;GACtDiE,gBAAgB,IAAIpD,sBAAsB;IACtCuC,YAAY,IAAI5D,eAAewD,UAAAA;IAC/BE;GACJ,CAAA;GACAgB,oBAAoB,IAAIpD,0BACpBqB,UAAUE,QAA8BjD,cAAAA,CAAAA;GAE5C+E,0BAA0B,IAAIvD,gCAC1BuB,UAAUE,QAAoClD,oBAAAA,CAAAA;GAGlDsE;GACAD;GACAL;EACJ,CAAA;EAOA,MAAMkB,oBAAoB,IAAItE,8BAA8B,EAAEqD,YAAYgB,IAL9CzD,uBAAuB;GAC/CyC,YAAYjB,UAAUE,QAA2BnD,WAAAA;GACjDgE;EACJ,CAE0EkB,EAAgB,CAAA;EAoB1F,MAAMG,IARuB7E,8BAA8B;GACvD6D;GACAG;GACAC;GACAW,mBAAAA,IAd0BzE,8BAA8B;IACxDuD,YAAY,IAAI5C,uBAAuB0C,eAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAK;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY1B,IAAAA;EAOnC,MAAM2B,uBAAuB,IAAIlD,qBAAqB;GAClDkC;GACAiB,YAAYtD,cAAcgB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMqD,iBAAiB,IAAInD,eAAe;GACtCoD,UAAU,IAAIxE,qBAAqB4C,YAAY,EAC3C6B,eAAezC,OAAO0C,uBAClB,IAAIzD,gBAAgBe,OAAO0C,oBAAoB,IAC/C,KACR,CAAA;GACAlC,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAEA,MAAMyD,SAAS,MAAM7B,gBAAgB8B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMN,qBAAqBS,eAAeD,KAAAA;GAC1C,MAAMN,eAAeO,eAAeD,KAAAA;EACxC;EAEA,IAAI7C,OAAO+C,oCACP,MAAM,KAAKC,oBAAoBpC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgB+B,oBACZpC,YACAK,kBACa;EACb,MAAMgC,gBAAgB,MAAMhC,iBAAiBiC,cAAcjG,iBAAiBkG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBxC,WAAWyC,cAAc3G,gBAAAA;EAChD,MAAM4G,eAAe1C,WAAWyC,cAAcnG,sBAAAA;EAE9C,MAAMqG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}

package/dist/app/modules/provisioning/sources/composite/module.d.ts CHANGED Viewed

@@ -8,5 +8,22 @@ export declare class CompositeProvisioningSource implements IProvisioningSource
     merge(target: RootProvisioningEntity, source: RootProvisioningEntity): void;
     private buildEntityKey;
     private mergeEntities;
+    /**
+     * Deep-merge two entries sharing a composite key. The later source wins
+     * per attribute, but relations are UNIONED — a later source (e.g. a
+     * mounted provisioning file) extending a built-in entry (the default
+     * source's master realm) must not silently drop the built-in relations
+     * (admin user, system client).
+     *
+     * Policy extraAttributes merge per key with the later source winning —
+     * like attributes, NOT like relations: an EA value (a names denylist,
+     * an ATTRIBUTES query tree) is policy configuration, and unioning would
+     * make shrinking a list impossible and fabricate predicates neither
+     * source authored.
+     */
+    private mergeEntity;
+    private mergeRecord;
+    private mergeValue;
+    private isEntityArray;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/app/modules/provisioning/sources/composite/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"names":[],"mappings":"~~AAOA~~,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;~~AAExC~~,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,SAAS,CAAC,OAAO,EAAG,mBAAmB,EAAE,CAAC;gBAE9B,OAAO,EAAG,mBAAmB,EAAE;IAIrC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAYlE,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB;IAQpE,OAAO,CAAC,cAAc;~~IAWtB~~,OAAO,CAAC,aAAa;~~CAgCxB~~"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAmBxC,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,SAAS,CAAC,OAAO,EAAG,mBAAmB,EAAE,CAAC;gBAE9B,OAAO,EAAG,mBAAmB,EAAE;IAIrC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAYlE,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB;IAQpE,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,aAAa;IAyBrB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,WAAW;IAiCnB,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,UAAU;IAqBlB,OAAO,CAAC,aAAa;CAKxB"}

package/dist/app/modules/provisioning/sources/composite/module.mjs CHANGED Viewed

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { isObject } from "@authup/kit";
 //#region src/app/modules/provisioning/sources/composite/module.ts
 var CompositeProvisioningSource = class {
 	sources;
@@ -21,7 +22,7 @@ var CompositeProvisioningSource = class {
 	}
 	buildEntityKey(attributes) {
 		if (!attributes.name) return void 0;
-		return `${attributes.name}:${attributes.realm_id || ""}:${attributes.client_id || ""}`;
+		return `${attributes.name}:${attributes.realmId || ""}:${attributes.clientId || ""}`;
 	}
 	mergeEntities(target, source) {
 		if (!source) return target;
@@ -34,11 +35,62 @@ var CompositeProvisioningSource = class {
 				return;
 			}
 			const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);
-			if (idx !== -1) result[idx] = item;
+			if (idx !== -1) result[idx] = this.mergeEntity(result[idx], item);
 			else result.push(item);
 		});
 		return result;
 	}
+	/**
+	* Deep-merge two entries sharing a composite key. The later source wins
+	* per attribute, but relations are UNIONED — a later source (e.g. a
+	* mounted provisioning file) extending a built-in entry (the default
+	* source's master realm) must not silently drop the built-in relations
+	* (admin user, system client).
+	*
+	* Policy extraAttributes merge per key with the later source winning —
+	* like attributes, NOT like relations: an EA value (a names denylist,
+	* an ATTRIBUTES query tree) is policy configuration, and unioning would
+	* make shrinking a list impossible and fabricate predicates neither
+	* source authored.
+	*/ mergeEntity(target, source) {
+		const output = {
+			...target,
+			...source
+		};
+		output.attributes = {
+			...target.attributes,
+			...source.attributes
+		};
+		if (target.strategy && !source.strategy) output.strategy = target.strategy;
+		if (target.relations && source.relations) output.relations = this.mergeRecord(target.relations, source.relations);
+		else if (target.relations && !source.relations) output.relations = target.relations;
+		if (target.extraAttributes && source.extraAttributes) output.extraAttributes = {
+			...target.extraAttributes,
+			...source.extraAttributes
+		};
+		else if (target.extraAttributes && !source.extraAttributes) output.extraAttributes = target.extraAttributes;
+		if (target.children && source.children) output.children = this.mergeEntities(target.children, source.children);
+		else if (target.children && !source.children) output.children = target.children;
+		return output;
+	}
+	mergeRecord(target, source) {
+		const output = { ...target };
+		for (const key of Object.keys(source)) output[key] = key in target ? this.mergeValue(target[key], source[key]) : source[key];
+		return output;
+	}
+	mergeValue(target, source) {
+		if (typeof target === "undefined") return source;
+		if (typeof source === "undefined") return target;
+		if (Array.isArray(target) && Array.isArray(source)) {
+			if (this.isEntityArray(target) || this.isEntityArray(source)) return this.mergeEntities(target, source);
+			return [.../* @__PURE__ */ new Set([...target, ...source])];
+		}
+		if (isObject(target) && isObject(source)) return this.mergeRecord(target, source);
+		return source;
+	}
+	isEntityArray(value) {
+		return value.some((item) => isObject(item) && "attributes" in item);
+	}
 };
 //#endregion
 export { CompositeProvisioningSource };

package/dist/app/modules/provisioning/sources/composite/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["CompositeProvisioningSource","sources","load","container","output","sourcesData","Promise","all","map","source","sourceData","merge","target","policies","mergeEntities","permissions","roles","scopes","realms","buildEntityKey","attributes","name","undefined","~~realm_id~~","~~client_id~~","result","forEach","item","key","push","idx","findIndex","r"],"sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport type { IContainer } from 'eldin';\n\nexport class CompositeProvisioningSource implements IProvisioningSource {\n protected sources : IProvisioningSource[];\n\n constructor(sources : IProvisioningSource[]) {\n this.sources = sources;\n }\n\n async load(container: IContainer): Promise<RootProvisioningEntity> {\n const output : RootProvisioningEntity = {};\n\n const sourcesData = await Promise.all(\n (this.sources).map((source) => source.load(container)),\n );\n\n sourcesData.map((sourceData) => this.merge(output, sourceData));\n\n return output;\n }\n\n merge(target: RootProvisioningEntity, source: RootProvisioningEntity) {\n target.policies = this.mergeEntities(target.policies, source.policies);\n target.permissions = this.mergeEntities(target.permissions, source.permissions);\n target.roles = this.mergeEntities(target.roles, source.roles);\n target.scopes = this.mergeEntities(target.scopes, source.scopes);\n target.realms = this.mergeEntities(target.realms, source.realms);\n }\n\n private buildEntityKey(\n attributes: ~~{\n name?: string~~,\n ~~realm_id?: string \| null,\n client_id?: string \| null\n },\n~~ ): string \| undefined {\n if (!attributes.name) return undefined;\n return `${attributes.name}:${attributes.~~realm_id~~ \|\| ''}:${attributes.~~client_id~~ \|\| ''}`;\n }\n\n private mergeEntities~~<\n~~ T extends ~~{\n attributes: {\n name?: string,\n realm_id?: string \| null,\n client_id?: string \| null\n }\n },\n~~ >(\n target: T[] \| undefined,\n source: T[] \| undefined,\n ): T[] \| undefined {\n if (!source) return target;\n if (!target) return [...source];\n\n const result = [...target];\n source.forEach((item) => {\n const key = this.buildEntityKey(item.attributes);\n if (!key) {\n result.push(item);\n return;\n }\n\n const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);\n if (idx !== -1) {\n result[idx] = item;\n } else {\n result.push(item);\n }\n });\n return result;\n }\n}\n"],"mappings":"~~;;;;AAWA~~,~~IAAaA~~,8BAAb,MAAaA;CACCC;CAEV,YAAYA,SAAiC;EACzC,KAAKA,UAAUA;CACnB;CAEA,MAAMC,KAAKC,WAAwD;EAC/D,MAAMC,SAAkC,CAAC;EAMzCC,CAAAA,MAJ0BC,QAAQC,IAC9B,KAAMN,QAASO,KAAKC,WAAWA,OAAOP,KAAKC,SAAAA,CAAAA,CAAAA,EAAAA,CAGnCK,KAAKE,eAAe,KAAKC,MAAMP,QAAQM,UAAAA,CAAAA;EAEnD,OAAON;CACX;CAEAO,MAAMC,QAAgCH,QAAgC;EAClEG,OAAOC,WAAW,KAAKC,cAAcF,OAAOC,UAAUJ,OAAOI,QAAQ;EACrED,OAAOG,cAAc,KAAKD,cAAcF,OAAOG,aAAaN,OAAOM,WAAW;EAC9EH,OAAOI,QAAQ,KAAKF,cAAcF,OAAOI,OAAOP,OAAOO,KAAK;EAC5DJ,OAAOK,SAAS,KAAKH,cAAcF,OAAOK,QAAQR,OAAOQ,MAAM;EAC/DL,OAAOM,SAAS,KAAKJ,cAAcF,OAAOM,QAAQT,OAAOS,MAAM;CACnE;CAEQC,eACJC,~~YAKkB~~;EAClB,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;EAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,~~YAAY~~,GAAG,GAAGH,WAAWI,~~aAAa~~;~~CACtF~~;CAEQV,~~cASJF~~,QACAH,QACe;EACf,IAAI,CAACA,QAAQ,OAAOG;EACpB,IAAI,CAACA,QAAQ,OAAO,~~CAAA~~,~~GAAIH~~,~~MAAAA~~;~~EAExB~~,MAAMgB,SAAS,~~CAAA~~,~~GAAIb~~,~~MAAAA~~;~~EACnBH~~,OAAOiB,SAASC,SAAAA;GACZ,MAAMC,MAAM,KAAKT,eAAeQ,KAAKP,UAAU;GAC/C,IAAI,CAACQ,KAAK;IACNH,OAAOI,KAAKF,IAAAA;IACZ;GACJ;GAEA,MAAMG,MAAML,OAAOM,WAAWC,MAAM,KAAKb,eAAea,EAAEZ,UAAU,MAAMQ,GAAAA;GAC1E,IAAIE,QAAQ,IACRL,OAAOK,~~OAAOH~~;~~QAEdF~~,OAAOI,KAAKF,IAAAA;EAEpB,CAAA;EACA,OAAOF;CACX;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["isObject","CompositeProvisioningSource","sources","load","container","output","sourcesData","Promise","all","map","source","sourceData","merge","target","policies","mergeEntities","permissions","roles","scopes","realms","buildEntityKey","attributes","name","undefined","realmId","clientId","result","forEach","item","key","push","idx","findIndex","r","mergeEntity","strategy","relations","mergeRecord","extraAttributes","children","Object","keys","mergeValue","Array","isArray","isEntityArray","Set","value","some"],"sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { isObject } from '@authup/kit';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport type { IContainer } from 'eldin';\n\n/\n Structural view of a provisioning entity used by the composite merge.\n * Covers every entity shape (realm, client, user, role, permission, scope,\n * policy): the composite-key attribute bag plus the deep-mergeable groups.\n /\ntype MergeableProvisioningEntity = {\n attributes: {\n name?: string,\n realmId?: string \| null,\n clientId?: string \| null,\n },\n strategy?: unknown,\n relations?: Record<string, unknown>,\n children?: MergeableProvisioningEntity[],\n extraAttributes?: Record<string, unknown>,\n};\n\nexport class CompositeProvisioningSource implements IProvisioningSource {\n protected sources : IProvisioningSource[];\n\n constructor(sources : IProvisioningSource[]) {\n this.sources = sources;\n }\n\n async load(container: IContainer): Promise<RootProvisioningEntity> {\n const output : RootProvisioningEntity = {};\n\n const sourcesData = await Promise.all(\n (this.sources).map((source) => source.load(container)),\n );\n\n sourcesData.map((sourceData) => this.merge(output, sourceData));\n\n return output;\n }\n\n merge(target: RootProvisioningEntity, source: RootProvisioningEntity) {\n target.policies = this.mergeEntities(target.policies, source.policies);\n target.permissions = this.mergeEntities(target.permissions, source.permissions);\n target.roles = this.mergeEntities(target.roles, source.roles);\n target.scopes = this.mergeEntities(target.scopes, source.scopes);\n target.realms = this.mergeEntities(target.realms, source.realms);\n }\n\n private buildEntityKey(\n attributes: MergeableProvisioningEntity['attributes'],\n ): string \| undefined {\n if (!attributes.name) return undefined;\n return `${attributes.name}:${attributes.realmId \|\| ''}:${attributes.clientId \|\| ''}`;\n }\n\n private mergeEntities<T extends MergeableProvisioningEntity>(\n target: T[] \| undefined,\n source: T[] \| undefined,\n ): T[] \| undefined {\n if (!source) return target;\n if (!target) return [...source];\n\n const result = [...target];\n source.forEach((item) => {\n const key = this.buildEntityKey(item.attributes);\n if (!key) {\n result.push(item);\n return;\n }\n\n const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);\n if (idx !== -1) {\n result[idx] = this.mergeEntity(result[idx], item) as T;\n } else {\n result.push(item);\n }\n });\n return result;\n }\n\n /\n Deep-merge two entries sharing a composite key. The later source wins\n * per attribute, but relations are UNIONED — a later source (e.g. a\n * mounted provisioning file) extending a built-in entry (the default\n * source's master realm) must not silently drop the built-in relations\n * (admin user, system client).\n \n Policy extraAttributes merge per key with the later source winning —\n * like attributes, NOT like relations: an EA value (a names denylist,\n * an ATTRIBUTES query tree) is policy configuration, and unioning would\n * make shrinking a list impossible and fabricate predicates neither\n * source authored.\n */\n private mergeEntity(\n target: MergeableProvisioningEntity,\n source: MergeableProvisioningEntity,\n ): MergeableProvisioningEntity {\n const output = { ...target, ...source };\n\n output.attributes = { ...target.attributes, ...source.attributes };\n\n if (target.strategy && !source.strategy) {\n output.strategy = target.strategy;\n }\n\n if (target.relations && source.relations) {\n output.relations = this.mergeRecord(target.relations, source.relations);\n } else if (target.relations && !source.relations) {\n output.relations = target.relations;\n }\n\n if (target.extraAttributes && source.extraAttributes) {\n output.extraAttributes = { ...target.extraAttributes, ...source.extraAttributes };\n } else if (target.extraAttributes && !source.extraAttributes) {\n output.extraAttributes = target.extraAttributes;\n }\n\n if (target.children && source.children) {\n output.children = this.mergeEntities(target.children, source.children);\n } else if (target.children && !source.children) {\n output.children = target.children;\n }\n\n return output;\n }\n\n private mergeRecord(\n target: Record<string, unknown>,\n source: Record<string, unknown>,\n ): Record<string, unknown> {\n const output : Record<string, unknown> = { ...target };\n for (const key of Object.keys(source)) {\n output[key] = key in target ?\n this.mergeValue(target[key], source[key]) :\n source[key];\n }\n return output;\n }\n\n private mergeValue(target: unknown, source: unknown): unknown {\n if (typeof target === 'undefined') return source;\n if (typeof source === 'undefined') return target;\n\n if (Array.isArray(target) && Array.isArray(source)) {\n if (this.isEntityArray(target) \|\| this.isEntityArray(source)) {\n return this.mergeEntities(\n target as MergeableProvisioningEntity[],\n source as MergeableProvisioningEntity[],\n );\n }\n return [...new Set([...target, ...source])];\n }\n\n if (isObject(target) && isObject(source)) {\n return this.mergeRecord(target, source);\n }\n\n return source;\n }\n\n private isEntityArray(value: unknown[]): value is MergeableProvisioningEntity[] {\n return value.some(\n (item) => isObject(item) && 'attributes' in item,\n );\n }\n}\n"],"mappings":";;;;;AA6BA,IAAaC,8BAAb,MAAaA;CACCC;CAEV,YAAYA,SAAiC;EACzC,KAAKA,UAAUA;CACnB;CAEA,MAAMC,KAAKC,WAAwD;EAC/D,MAAMC,SAAkC,CAAC;EAMzCC,CAAAA,MAJ0BC,QAAQC,IAC9B,KAAMN,QAASO,KAAKC,WAAWA,OAAOP,KAAKC,SAAAA,CAAAA,CAAAA,EAAAA,CAGnCK,KAAKE,eAAe,KAAKC,MAAMP,QAAQM,UAAAA,CAAAA;EAEnD,OAAON;CACX;CAEAO,MAAMC,QAAgCH,QAAgC;EAClEG,OAAOC,WAAW,KAAKC,cAAcF,OAAOC,UAAUJ,OAAOI,QAAQ;EACrED,OAAOG,cAAc,KAAKD,cAAcF,OAAOG,aAAaN,OAAOM,WAAW;EAC9EH,OAAOI,QAAQ,KAAKF,cAAcF,OAAOI,OAAOP,OAAOO,KAAK;EAC5DJ,OAAOK,SAAS,KAAKH,cAAcF,OAAOK,QAAQR,OAAOQ,MAAM;EAC/DL,OAAOM,SAAS,KAAKJ,cAAcF,OAAOM,QAAQT,OAAOS,MAAM;CACnE;CAEQC,eACJC,YACkB;EAClB,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;EAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,WAAW,GAAG,GAAGH,WAAWI,YAAY;CACpF;CAEQV,cACJF,QACAH,QACe;EACf,IAAI,CAACA,QAAQ,OAAOG;EACpB,IAAI,CAACA,QAAQ,OAAO,CAAIH,GAAAA,MAAO;EAE/B,MAAMgB,SAAS,CAAIb,GAAAA,MAAO;EAC1BH,OAAOiB,SAASC,SAAAA;GACZ,MAAMC,MAAM,KAAKT,eAAeQ,KAAKP,UAAU;GAC/C,IAAI,CAACQ,KAAK;IACNH,OAAOI,KAAKF,IAAAA;IACZ;GACJ;GAEA,MAAMG,MAAML,OAAOM,WAAWC,MAAM,KAAKb,eAAea,EAAEZ,UAAU,MAAMQ,GAAAA;GAC1E,IAAIE,QAAQ,IACRL,OAAOK,OAAO,KAAKG,YAAYR,OAAOK,MAAMH,IAAAA;QAE5CF,OAAOI,KAAKF,IAAAA;EAEpB,CAAA;EACA,OAAOF;CACX;;;;;;;;;;;;;IAeA,YACIb,QACAH,QAC2B;EAC3B,MAAML,SAAS;GAAE,GAAGQ;GAAQ,GAAGH;EAAO;EAEtCL,OAAOgB,aAAa;GAAE,GAAGR,OAAOQ;GAAY,GAAGX,OAAOW;EAAW;EAEjE,IAAIR,OAAOsB,YAAY,CAACzB,OAAOyB,UAC3B9B,OAAO8B,WAAWtB,OAAOsB;EAG7B,IAAItB,OAAOuB,aAAa1B,OAAO0B,WAC3B/B,OAAO+B,YAAY,KAAKC,YAAYxB,OAAOuB,WAAW1B,OAAO0B,SAAS;OACnE,IAAIvB,OAAOuB,aAAa,CAAC1B,OAAO0B,WACnC/B,OAAO+B,YAAYvB,OAAOuB;EAG9B,IAAIvB,OAAOyB,mBAAmB5B,OAAO4B,iBACjCjC,OAAOiC,kBAAkB;GAAE,GAAGzB,OAAOyB;GAAiB,GAAG5B,OAAO4B;EAAgB;OAC7E,IAAIzB,OAAOyB,mBAAmB,CAAC5B,OAAO4B,iBACzCjC,OAAOiC,kBAAkBzB,OAAOyB;EAGpC,IAAIzB,OAAO0B,YAAY7B,OAAO6B,UAC1BlC,OAAOkC,WAAW,KAAKxB,cAAcF,OAAO0B,UAAU7B,OAAO6B,QAAQ;OAClE,IAAI1B,OAAO0B,YAAY,CAAC7B,OAAO6B,UAClClC,OAAOkC,WAAW1B,OAAO0B;EAG7B,OAAOlC;CACX;CAEQgC,YACJxB,QACAH,QACuB;EACvB,MAAML,SAAmC,EAAE,GAAGQ,OAAO;EACrD,KAAK,MAAMgB,OAAOW,OAAOC,KAAK/B,MAAAA,GAC1BL,OAAOwB,OAAOA,OAAOhB,SACjB,KAAK6B,WAAW7B,OAAOgB,MAAMnB,OAAOmB,IAAI,IACxCnB,OAAOmB;EAEf,OAAOxB;CACX;CAEQqC,WAAW7B,QAAiBH,QAA0B;EAC1D,IAAI,OAAOG,WAAW,aAAa,OAAOH;EAC1C,IAAI,OAAOA,WAAW,aAAa,OAAOG;EAE1C,IAAI8B,MAAMC,QAAQ/B,MAAAA,KAAW8B,MAAMC,QAAQlC,MAAAA,GAAS;GAChD,IAAI,KAAKmC,cAAchC,MAAAA,KAAW,KAAKgC,cAAcnC,MAAAA,GACjD,OAAO,KAAKK,cACRF,QACAH,MAAAA;GAGR,OAAO,CAAI,mBAAA,IAAIoC,IAAI,CAAIjC,GAAAA,QAAWH,GAAAA,MAAO,CAAA,CAAE;EAC/C;EAEA,IAAIV,SAASa,MAAAA,KAAWb,SAASU,MAAAA,GAC7B,OAAO,KAAK2B,YAAYxB,QAAQH,MAAAA;EAGpC,OAAOA;CACX;CAEQmC,cAAcE,OAA0D;EAC5E,OAAOA,MAAMC,MACRpB,SAAS5B,SAAS4B,IAAAA,KAAS,gBAAgBA,IAAAA;CAEpD;AACJ"}

package/dist/app/modules/provisioning/sources/default/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"~~AA2BA~~,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;~~AAMxC~~,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;~~IAgG3C~~,gBAAgB,IAAI,4BAA4B,EAAE;~~IA6BlD~~,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;~~IA2EhC~~,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;~~IA+F~~/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAKxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IAgF3C,gBAAgB,IAAI,4BAA4B,EAAE;IA4BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IAwEhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAwE/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}