npm - @authup/server-core - Versions diffs - 1.0.0-beta.53 → 1.0.0-beta.55 - Mend

@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.55

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1255) hide show

package/dist/core/entities/trust-anchor/service.mjs CHANGED Viewed

@@ -1,6 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { trustAnchorSchema } from "./schema.mjs";
+import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { buildEntityDiff } from "../event/diff.mjs";
 import "../event/index.mjs";
 import { parseCertificateChain } from "../../key/certificate.mjs";
@@ -10,6 +13,7 @@ import { EntityType, EventName, EventScope, PermissionName, TrustAnchorValidator
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { EntityNotFoundError, ValidationError } from "@authup/errors";
+import { eq, inArray } from "@rapiq/core";
 //#region src/core/entities/trust-anchor/service.ts
 const PERMISSION_NAMES = [
 	PermissionName.KEY_READ,
@@ -28,9 +32,21 @@ var TrustAnchorService = class extends AbstractEntityService {
 		this.eventService = ctx.eventService;
 		this.requestContext = ctx.requestContext;
 	}
-	async getMany(query, actor) {
+	async getMany(query, actor, options = {}) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });
-		const { data: entities, meta } = await this.repository.findMany(query);
+		let parsed = await decodeQuery(query, {
+			schema: trustAnchorSchema,
+			actor
+		});
+		if (options.realmId) parsed = appendQueryConditions(parsed, eq("realmId", options.realmId));
+		const compiled = await actor.permissionEvaluator.compile({ name: PERMISSION_NAMES });
+		if (compiled.verdict === "deny") parsed = appendQueryConditions(parsed, inArray("id", []));
+		else if (compiled.verdict === "conditional") parsed = appendQueryConditions(parsed, compiled.condition);
+		const { data: entities, meta } = await this.repository.findMany(parsed);
+		if (compiled.verdict !== "post") return {
+			data: entities,
+			meta
+		};
 		const data = [];
 		let { total } = meta;
 		for (const entity of entities) try {
@@ -69,11 +85,11 @@ var TrustAnchorService = class extends AbstractEntityService {
 	async create(data, actor) {
 		await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });
 		const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });
-		if (!validated.realm_id && actor.identity) {
+		if (!validated.realmId && actor.identity) {
 			const actorRealmId = this.getActorRealmId(actor);
-			if (actorRealmId) validated.realm_id = actorRealmId;
+			if (actorRealmId) validated.realmId = actorRealmId;
 		}
-		if (!validated.realm_id) throw new ValidationError("A realm must be specified.");
+		if (!validated.realmId) throw new ValidationError("A realm must be specified.");
 		await this.repository.validateJoinColumns(validated);
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.KEY_CREATE,
@@ -108,7 +124,7 @@ var TrustAnchorService = class extends AbstractEntityService {
 		});
 		if (validated.name && validated.name !== entity.name) await this.repository.checkUniqueness({
 			name: validated.name,
-			realm_id: entity.realm_id
+			realmId: entity.realmId
 		}, entity);
 		const previous = this.pickAuditFields(entity);
 		entity = this.repository.merge(entity, validated);
@@ -147,7 +163,7 @@ var TrustAnchorService = class extends AbstractEntityService {
 			name,
 			refType: EntityType.TRUST_ANCHOR,
 			refId: entity.id,
-			realmId: entity.realm_id ?? null,
+			realmId: entity.realmId ?? null,
 			actorType: actor.identity?.type ?? null,
 			actorId: actor.identity?.data.id ?? null,
 			actorName: actor.identity?.data.name ?? null,

package/dist/core/entities/trust-anchor/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityType","EventName","EventScope","PermissionName","TrustAnchorValidator","EntityNotFoundError","ValidationError","ValidatorGroup","AbstractEntityService","buildEntityDiff","parseCertificateChain","PERMISSION_NAMES","KEY_READ","KEY_UPDATE","KEY_DELETE","TrustAnchorService","repository","validator","eventService","requestContext","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","data","entities","meta","findMany","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","realmId","findOneByIdOrName","create","preEvaluate","KEY_CREATE","validated","run","group","CREATE","realm_id","identity","actorRealmId","getActorRealmId","validateJoinColumns","evaluate","checkUniqueness","chain","certificate","ca","enabled","save","recordEvent","CREATED","update","UPDATE","previous","pickAuditFields","merge","diff","UPDATED","Object","keys","length","delete","id","findOneBy","entityId","remove","DELETED","undefined","record","scope","ENTITY","refType","TRUST_ANCHOR","refId","actorType","type","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent"],"sources":["../../../../src/core/entities/trust-anchor/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport {\n EntityType,\n EventName,\n EventScope,\n PermissionName,\n TrustAnchorValidator,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { buildEntityDiff } from '../event/index.ts';\nimport type { EventRequestContext, IEventService } from '../event/index.ts';\nimport { parseCertificateChain } from '../../key/index.ts';\nimport type { ITrustAnchorRepository, ITrustAnchorService } from './types.ts';\n\nexport type TrustAnchorServiceContext = {\n repository: ITrustAnchorRepository,\n eventService?: IEventService,\n requestContext?: () => EventRequestContext \| undefined,\n};\n\nconst PERMISSION_NAMES = [\n PermissionName.KEY_READ,\n PermissionName.KEY_UPDATE,\n PermissionName.KEY_DELETE,\n];\n\nexport class TrustAnchorService extends AbstractEntityService implements ITrustAnchorService {\n protected repository: ITrustAnchorRepository;\n\n protected validator: TrustAnchorValidator;\n\n protected eventService?: IEventService;\n\n protected requestContext?: () => EventRequestContext \| undefined;\n\n constructor(ctx: TrustAnchorServiceContext) {\n super();\n this.repository = ctx.repository;\n this.validator = new TrustAnchorValidator();\n this.eventService = ctx.eventService;\n this.requestContext = ctx.requestContext;\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<TrustAnchor>> {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n const { data: entities, meta } = await this.repository.findMany(query);\n\n const data: TrustAnchor[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: PERMISSION_NAMES,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total,\n },\n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n realmId?: string,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n const entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluateOneOf({\n name: PERMISSION_NAMES,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n if (!validated.realm_id && actor.identity) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n if (!validated.realm_id) {\n throw new ValidationError('A realm must be specified.');\n }\n\n await this.repository.validateJoinColumns(validated);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.KEY_CREATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: validated,\n ...this.resourceRealmMatch(validated),\n }),\n });\n\n await this.repository.checkUniqueness(validated);\n\n const chain = parseCertificateChain(validated.certificate as string);\n if (!chain[0] \|\| !chain[0].ca) {\n throw new ValidationError('A trust anchor must contain a CA certificate.');\n }\n\n if (typeof validated.enabled !== 'boolean') {\n validated.enabled = true;\n }\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n await this.recordEvent(EventName.CREATED, entity, actor);\n\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realmId?: string,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });\n\n let entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.KEY_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n if (validated.name && validated.name !== entity.name) {\n await this.repository.checkUniqueness({\n name: validated.name,\n realm_id: entity.realm_id,\n }, entity);\n }\n\n const previous = this.pickAuditFields(entity);\n\n entity = this.repository.merge(entity, validated);\n entity = await this.repository.save(entity);\n\n const diff = buildEntityDiff(this.pickAuditFields(entity), previous);\n await this.recordEvent(EventName.UPDATED, entity, actor, { ...(Object.keys(diff).length > 0 ? { diff } : {}) });\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.KEY_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n await this.recordEvent(EventName.DELETED, entity, actor);\n\n return entity;\n }\n\n // ------------------------------------------------------------------\n\n /\n Metadata-only audit trail for trust-anchor lifecycle operations\n * (issue #3269) — trust anchors have no entity subscriber, so the\n * security-relevant mutations (an enabled CA anchor turns on mTLS client\n * auth for a realm) are recorded explicitly. The payload never carries\n * certificate bytes.\n */\n protected async recordEvent(\n name: `${EventName}`,\n entity: TrustAnchor,\n actor: ActorContext,\n data: Record<string, any> = {},\n ): Promise<void> {\n const requestContext = this.requestContext ?\n this.requestContext() :\n undefined;\n\n await this.eventService?.record({\n scope: EventScope.ENTITY,\n name,\n refType: EntityType.TRUST_ANCHOR,\n refId: entity.id,\n realmId: entity.realm_id ?? null,\n actorType: actor.identity?.type ?? null,\n actorId: actor.identity?.data.id ?? null,\n actorName: actor.identity?.data.name ?? null,\n requestPath: requestContext?.requestPath ?? null,\n requestMethod: requestContext?.requestMethod ?? null,\n requestIpAddress: requestContext?.requestIpAddress ?? null,\n requestUserAgent: requestContext?.requestUserAgent ?? null,\n data: {\n name: entity.name,\n enabled: entity.enabled,\n ...data,\n },\n });\n }\n\n protected pickAuditFields(entity: TrustAnchor): Record<string, any> {\n return {\n name: entity.name,\n enabled: entity.enabled,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;AA+BA,MAAMa,mBAAmB;CACrBR,eAAeS;CACfT,eAAeU;CACfV,eAAeW;;AAGnB,IAAaC,qBAAb,cAAwCP,sBAAAA;CAC1BQ;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,YAAY,IAAIb,qBAAAA;EACrB,KAAKc,eAAeE,IAAIF;EACxB,KAAKC,iBAAiBC,IAAID;CAC9B;CAEA,MAAME,QACFC,OACAC,OACoD;EACpD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMf,iBAAiB,CAAA;EAE1E,MAAM,EAAEgB,MAAMC,UAAUC,SAAS,MAAM,KAAKb,WAAWc,SAASR,KAAAA;EAEhE,MAAMK,OAAsB,CAAA;EAC5B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UACjB,IAAI;GACA,MAAML,MAAMC,oBAAoBS,cAAc;IAC1CP,MAAMf;IACNgB,MAAM5B,iBAAiB;MAClBD,kBAAkBoC,aAAaF;KAChC,GAAG,KAAKG,mBAAmBH,MAAAA;IAC/B,CAAA;GACJ,CAAA;GACAL,KAAKS,KAAKJ,MAAAA;EACd,QAAQ;GACJD,SAAS;EACb;EAGJ,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,UACAf,OACAgB,SACoB;EACpB,MAAMhB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMf,iBAAiB,CAAA;EAE1E,MAAMqB,SAAS,MAAM,KAAKhB,WAAWwB,kBAAkBF,UAAUC,OAAAA;EACjE,IAAI,CAACP,QACD,MAAM,IAAI3B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBS,cAAc;GAC1CP,MAAMf;GACNgB,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMS,OACFd,MACAJ,OACoB;EACpB,MAAMA,MAAMC,oBAAoBkB,YAAY,EAAEhB,MAAMvB,eAAewC,WAAW,CAAA;EAE9E,MAAMC,YAAY,MAAM,KAAK3B,UAAU4B,IAAIlB,MAAM,EAAEmB,OAAOvC,eAAewC,OAAO,CAAA;EAEhF,IAAI,CAACH,UAAUI,YAAYzB,MAAM0B,UAAU;GACvC,MAAMC,eAAe,KAAKC,gBAAgB5B,KAAAA;GAC1C,IAAI2B,cACAN,UAAUI,WAAWE;EAE7B;EAEA,IAAI,CAACN,UAAUI,UACX,MAAM,IAAI1C,gBAAgB,4BAAA;EAG9B,MAAM,KAAKU,WAAWoC,oBAAoBR,SAAAA;EAE1C,MAAMrB,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMvB,eAAewC;GACrBhB,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAaU;IAChC,GAAG,KAAKT,mBAAmBS,SAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAK5B,WAAWsC,gBAAgBV,SAAAA;EAEtC,MAAMW,QAAQ7C,sBAAsBkC,UAAUY,WAAW;EACzD,IAAI,CAACD,MAAM,MAAM,CAACA,MAAM,EAAE,CAACE,IACvB,MAAM,IAAInD,gBAAgB,+CAAA;EAG9B,IAAI,OAAOsC,UAAUc,YAAY,WAC7Bd,UAAUc,UAAU;EAGxB,IAAI1B,SAAS,KAAKhB,WAAWyB,OAAOG,SAAAA;EACpCZ,SAAS,MAAM,KAAKhB,WAAW2C,KAAK3B,MAAAA;EAEpC,MAAM,KAAK4B,YAAY3D,UAAU4D,SAAS7B,QAAQT,KAAAA;EAElD,OAAOS;CACX;CAEA,MAAM8B,OACFxB,UACAX,MACAJ,OACAgB,SACoB;EACpB,MAAMhB,MAAMC,oBAAoBkB,YAAY,EAAEhB,MAAMvB,eAAeU,WAAW,CAAA;EAE9E,IAAImB,SAAS,MAAM,KAAKhB,WAAWwB,kBAAkBF,UAAUC,OAAAA;EAC/D,IAAI,CAACP,QACD,MAAM,IAAI3B,oBAAAA;EAGd,MAAMuC,YAAY,MAAM,KAAK3B,UAAU4B,IAAIlB,MAAM,EAAEmB,OAAOvC,eAAewD,OAAO,CAAA;EAEhF,MAAMxC,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMvB,eAAeU;GACrBc,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAa;KAC5B,GAAGF;KACH,GAAGY;IACP;IACA,GAAG,KAAKT,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIY,UAAUlB,QAAQkB,UAAUlB,SAASM,OAAON,MAC5C,MAAM,KAAKV,WAAWsC,gBAAgB;GAClC5B,MAAMkB,UAAUlB;GAChBsB,UAAUhB,OAAOgB;EACrB,GAAGhB,MAAAA;EAGP,MAAMgC,WAAW,KAAKC,gBAAgBjC,MAAAA;EAEtCA,SAAS,KAAKhB,WAAWkD,MAAMlC,QAAQY,SAAAA;EACvCZ,SAAS,MAAM,KAAKhB,WAAW2C,KAAK3B,MAAAA;EAEpC,MAAMmC,OAAO1D,gBAAgB,KAAKwD,gBAAgBjC,MAAAA,GAASgC,QAAAA;EAC3D,MAAM,KAAKJ,YAAY3D,UAAUmE,SAASpC,QAAQT,OAAO,EAAE,GAAI8C,OAAOC,KAAKH,IAAAA,CAAAA,CAAMI,SAAS,IAAI,EAAEJ,KAAK,IAAI,CAAC,EAAG,CAAA;EAE7G,OAAOnC;CACX;CAEA,MAAMwC,OACFC,IACAlD,OACoB;EACpB,MAAMA,MAAMC,oBAAoBkB,YAAY,EAAEhB,MAAMvB,eAAeW,WAAW,CAAA;EAE9E,MAAMkB,SAAS,MAAM,KAAKhB,WAAW0D,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACzC,QACD,MAAM,IAAI3B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoB6B,SAAS;GACrC3B,MAAMvB,eAAeW;GACrBa,MAAM5B,iBAAiB;KAClBD,kBAAkBoC,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,EAAEyC,IAAIE,aAAa3C;EACzB,MAAM,KAAKhB,WAAW4D,OAAO5C,MAAAA;EAC7BA,OAAOyC,KAAKE;EAEZ,MAAM,KAAKf,YAAY3D,UAAU4E,SAAS7C,QAAQT,KAAAA;EAElD,OAAOS;CACX;;;;;;;IAWA,MAAgB4B,YACZlC,MACAM,QACAT,OACAI,OAA4B,CAAC,GAChB;EACb,MAAMR,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnB2D,KAAAA;EAEJ,MAAM,KAAK5D,cAAc6D,OAAO;GAC5BC,OAAO9E,WAAW+E;GAClBvD;GACAwD,SAASlF,WAAWmF;GACpBC,OAAOpD,OAAOyC;GACdlC,SAASP,OAAOgB,YAAY;GAC5BqC,WAAW9D,MAAM0B,UAAUqC,QAAQ;GACnCC,SAAShE,MAAM0B,UAAUtB,KAAK8C,MAAM;GACpCe,WAAWjE,MAAM0B,UAAUtB,KAAKD,QAAQ;GACxC+D,aAAatE,gBAAgBsE,eAAe;GAC5CC,eAAevE,gBAAgBuE,iBAAiB;GAChDC,kBAAkBxE,gBAAgBwE,oBAAoB;GACtDC,kBAAkBzE,gBAAgByE,oBAAoB;GACtDjE,MAAM;IACFD,MAAMM,OAAON;IACbgC,SAAS1B,OAAO0B;IAChB,GAAG/B;GACP;EACJ,CAAA;CACJ;CAEUsC,gBAAgBjC,QAA0C;EAChE,OAAO;GACHN,MAAMM,OAAON;GACbgC,SAAS1B,OAAO0B;EACpB;CACJ;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","eq","inArray","EntityType","EventName","EventScope","PermissionName","TrustAnchorValidator","EntityNotFoundError","ValidationError","ValidatorGroup","AbstractEntityService","buildEntityDiff","parseCertificateChain","appendQueryConditions","decodeQuery","trustAnchorSchema","PERMISSION_NAMES","KEY_READ","KEY_UPDATE","KEY_DELETE","TrustAnchorService","repository","validator","eventService","requestContext","ctx","getMany","query","actor","options","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","realmId","compiled","compile","verdict","condition","data","entities","meta","findMany","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","findOneByIdOrName","create","preEvaluate","KEY_CREATE","validated","run","group","CREATE","identity","actorRealmId","getActorRealmId","validateJoinColumns","evaluate","checkUniqueness","chain","certificate","ca","enabled","save","recordEvent","CREATED","update","UPDATE","previous","pickAuditFields","merge","diff","UPDATED","Object","keys","length","delete","id","findOneBy","entityId","remove","DELETED","undefined","record","scope","ENTITY","refType","TRUST_ANCHOR","refId","actorType","type","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent"],"sources":["../../../../src/core/entities/trust-anchor/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { eq, inArray } from '@rapiq/core';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport {\n EntityType,\n EventName,\n EventScope,\n PermissionName,\n TrustAnchorValidator,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { buildEntityDiff } from '../event/index.ts';\nimport type { EventRequestContext, IEventService } from '../event/index.ts';\nimport { parseCertificateChain } from '../../key/index.ts';\nimport type {\n ITrustAnchorRepository, \n ITrustAnchorService, \n TrustAnchorServiceReadOptions,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { trustAnchorSchema } from './schema.ts';\n\nexport type TrustAnchorServiceContext = {\n repository: ITrustAnchorRepository,\n eventService?: IEventService,\n requestContext?: () => EventRequestContext \| undefined,\n};\n\nconst PERMISSION_NAMES = [\n PermissionName.KEY_READ,\n PermissionName.KEY_UPDATE,\n PermissionName.KEY_DELETE,\n];\n\nexport class TrustAnchorService extends AbstractEntityService implements ITrustAnchorService {\n protected repository: ITrustAnchorRepository;\n\n protected validator: TrustAnchorValidator;\n\n protected eventService?: IEventService;\n\n protected requestContext?: () => EventRequestContext \| undefined;\n\n constructor(ctx: TrustAnchorServiceContext) {\n super();\n this.repository = ctx.repository;\n this.validator = new TrustAnchorValidator();\n this.eventService = ctx.eventService;\n this.requestContext = ctx.requestContext;\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n options: TrustAnchorServiceReadOptions = {},\n ): Promise<EntityRepositoryFindManyResult<TrustAnchor>> {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n let parsed = await decodeQuery(query, { schema: trustAnchorSchema, actor });\n if (options.realmId) {\n parsed = appendQueryConditions(parsed, eq('realmId', options.realmId));\n }\n\n // Compile the read permissions against the knowns (actor identity) into a\n // row condition (issue #3286 phase 3): the authorization runs as WHERE, so\n // pagination and totals stay exact. Non-expressible policies fall back to\n // the per-row post-evaluation below.\n const compiled = await actor.permissionEvaluator.compile({ name: PERMISSION_NAMES });\n if (compiled.verdict === 'deny') {\n // no row can pass — a constant-false condition keeps the meta shape\n parsed = appendQueryConditions(parsed, inArray('id', []));\n } else if (compiled.verdict === 'conditional') {\n parsed = appendQueryConditions(parsed, compiled.condition);\n }\n\n const { data: entities, meta } = await this.repository.findMany(parsed);\n\n if (compiled.verdict !== 'post') {\n return { data: entities, meta };\n }\n\n const data: TrustAnchor[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: PERMISSION_NAMES,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total,\n },\n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n realmId?: string,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n const entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluateOneOf({\n name: PERMISSION_NAMES,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n if (!validated.realmId && actor.identity) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realmId = actorRealmId;\n }\n }\n\n if (!validated.realmId) {\n throw new ValidationError('A realm must be specified.');\n }\n\n await this.repository.validateJoinColumns(validated);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.KEY_CREATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: validated,\n ...this.resourceRealmMatch(validated),\n }),\n });\n\n await this.repository.checkUniqueness(validated);\n\n const chain = parseCertificateChain(validated.certificate as string);\n if (!chain[0] \|\| !chain[0].ca) {\n throw new ValidationError('A trust anchor must contain a CA certificate.');\n }\n\n if (typeof validated.enabled !== 'boolean') {\n validated.enabled = true;\n }\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n await this.recordEvent(EventName.CREATED, entity, actor);\n\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n realmId?: string,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });\n\n let entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.KEY_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n if (validated.name && validated.name !== entity.name) {\n await this.repository.checkUniqueness({\n name: validated.name,\n realmId: entity.realmId,\n }, entity);\n }\n\n const previous = this.pickAuditFields(entity);\n\n entity = this.repository.merge(entity, validated);\n entity = await this.repository.save(entity);\n\n const diff = buildEntityDiff(this.pickAuditFields(entity), previous);\n await this.recordEvent(EventName.UPDATED, entity, actor, { ...(Object.keys(diff).length > 0 ? { diff } : {}) });\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<TrustAnchor> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.KEY_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n await this.recordEvent(EventName.DELETED, entity, actor);\n\n return entity;\n }\n\n // ------------------------------------------------------------------\n\n /\n Metadata-only audit trail for trust-anchor lifecycle operations\n * (issue #3269) — trust anchors have no entity subscriber, so the\n * security-relevant mutations (an enabled CA anchor turns on mTLS client\n * auth for a realm) are recorded explicitly. The payload never carries\n * certificate bytes.\n */\n protected async recordEvent(\n name: `${EventName}`,\n entity: TrustAnchor,\n actor: ActorContext,\n data: Record<string, any> = {},\n ): Promise<void> {\n const requestContext = this.requestContext ?\n this.requestContext() :\n undefined;\n\n await this.eventService?.record({\n scope: EventScope.ENTITY,\n name,\n refType: EntityType.TRUST_ANCHOR,\n refId: entity.id,\n realmId: entity.realmId ?? null,\n actorType: actor.identity?.type ?? null,\n actorId: actor.identity?.data.id ?? null,\n actorName: actor.identity?.data.name ?? null,\n requestPath: requestContext?.requestPath ?? null,\n requestMethod: requestContext?.requestMethod ?? null,\n requestIpAddress: requestContext?.requestIpAddress ?? null,\n requestUserAgent: requestContext?.requestUserAgent ?? null,\n data: {\n name: entity.name,\n enabled: entity.enabled,\n ...data,\n },\n });\n }\n\n protected pickAuditFields(entity: TrustAnchor): Record<string, any> {\n return {\n name: entity.name,\n enabled: entity.enabled,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,MAAMkB,mBAAmB;CACrBX,eAAeY;CACfZ,eAAea;CACfb,eAAec;AAClB;AAED,IAAaC,qBAAb,cAAwCV,sBAAAA;CAC1BW;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,YAAY,IAAIhB,qBAAAA;EACrB,KAAKiB,eAAeE,IAAIF;EACxB,KAAKC,iBAAiBC,IAAID;CAC9B;CAEA,MAAME,QACFC,OACAC,OACAC,UAAyC,CAAC,GACU;EACpD,MAAMD,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,IAAIiB,SAAS,MAAMnB,YAAYa,OAAO;GAAEO,QAAQnB;GAAmBa;EAAM,CAAA;EACzE,IAAIC,QAAQM,SACRF,SAASpB,sBAAsBoB,QAAQjC,GAAG,WAAW6B,QAAQM,OAAO,CAAA;EAOxE,MAAMC,WAAW,MAAMR,MAAME,oBAAoBO,QAAQ,EAAEL,MAAMhB,iBAAiB,CAAA;EAClF,IAAIoB,SAASE,YAAY,QAErBL,SAASpB,sBAAsBoB,QAAQhC,QAAQ,MAAM,CAAA,CAAE,CAAA;OACpD,IAAImC,SAASE,YAAY,eAC5BL,SAASpB,sBAAsBoB,QAAQG,SAASG,SAAS;EAG7D,MAAM,EAAEC,MAAMC,UAAUC,SAAS,MAAM,KAAKrB,WAAWsB,SAASV,MAAAA;EAEhE,IAAIG,SAASE,YAAY,QACrB,OAAO;GAAEE,MAAMC;GAAUC;EAAK;EAGlC,MAAMF,OAAsB,CAAA;EAC5B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UACjB,IAAI;GACA,MAAMb,MAAME,oBAAoBgB,cAAc;IAC1Cd,MAAMhB;IACNwB,MAAMzC,iBAAiB;MAClBD,kBAAkBiD,aAAaF;KAChC,GAAG,KAAKG,mBAAmBH,MAAAA;IAC/B,CAAA;GACJ,CAAA;GACAL,KAAKS,KAAKJ,MAAAA;EACd,QAAQ;GACJD,SAAS;EACb;EAGJ,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,UACAvB,OACAO,SACoB;EACpB,MAAMP,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,MAAM6B,SAAS,MAAM,KAAKxB,WAAW+B,kBAAkBD,UAAUhB,OAAAA;EACjE,IAAI,CAACU,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMqB,MAAME,oBAAoBgB,cAAc;GAC1Cd,MAAMhB;GACNwB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMQ,OACFb,MACAZ,OACoB;EACpB,MAAMA,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAekD,WAAW,CAAA;EAE9E,MAAMC,YAAY,MAAM,KAAKlC,UAAUmC,IAAIjB,MAAM,EAAEkB,OAAOjD,eAAekD,OAAO,CAAA;EAEhF,IAAI,CAACH,UAAUrB,WAAWP,MAAMgC,UAAU;GACtC,MAAMC,eAAe,KAAKC,gBAAgBlC,KAAAA;GAC1C,IAAIiC,cACAL,UAAUrB,UAAU0B;EAE5B;EAEA,IAAI,CAACL,UAAUrB,SACX,MAAM,IAAI3B,gBAAgB,4BAAA;EAG9B,MAAM,KAAKa,WAAW0C,oBAAoBP,SAAAA;EAE1C,MAAM5B,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAekD;GACrBf,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaS;IAChC,GAAG,KAAKR,mBAAmBQ,SAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKnC,WAAW4C,gBAAgBT,SAAAA;EAEtC,MAAMU,QAAQtD,sBAAsB4C,UAAUW,WAAW;EACzD,IAAI,CAACD,MAAM,MAAM,CAACA,MAAM,EAAE,CAACE,IACvB,MAAM,IAAI5D,gBAAgB,+CAAA;EAG9B,IAAI,OAAOgD,UAAUa,YAAY,WAC7Bb,UAAUa,UAAU;EAGxB,IAAIxB,SAAS,KAAKxB,WAAWgC,OAAOG,SAAAA;EACpCX,SAAS,MAAM,KAAKxB,WAAWiD,KAAKzB,MAAAA;EAEpC,MAAM,KAAK0B,YAAYpE,UAAUqE,SAAS3B,QAAQjB,KAAAA;EAElD,OAAOiB;CACX;CAEA,MAAM4B,OACFtB,UACAX,MACAZ,OACAO,SACoB;EACpB,MAAMP,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAea,WAAW,CAAA;EAE9E,IAAI2B,SAAS,MAAM,KAAKxB,WAAW+B,kBAAkBD,UAAUhB,OAAAA;EAC/D,IAAI,CAACU,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMiD,YAAY,MAAM,KAAKlC,UAAUmC,IAAIjB,MAAM,EAAEkB,OAAOjD,eAAeiE,OAAO,CAAA;EAEhF,MAAM9C,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAea;GACrBsB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAa;KAC5B,GAAGF;KACH,GAAGW;IACP;IACA,GAAG,KAAKR,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIW,UAAUxB,QAAQwB,UAAUxB,SAASa,OAAOb,MAC5C,MAAM,KAAKX,WAAW4C,gBAAgB;GAClCjC,MAAMwB,UAAUxB;GAChBG,SAASU,OAAOV;EACpB,GAAGU,MAAAA;EAGP,MAAM8B,WAAW,KAAKC,gBAAgB/B,MAAAA;EAEtCA,SAAS,KAAKxB,WAAWwD,MAAMhC,QAAQW,SAAAA;EACvCX,SAAS,MAAM,KAAKxB,WAAWiD,KAAKzB,MAAAA;EAEpC,MAAMiC,OAAOnE,gBAAgB,KAAKiE,gBAAgB/B,MAAAA,GAAS8B,QAAAA;EAC3D,MAAM,KAAKJ,YAAYpE,UAAU4E,SAASlC,QAAQjB,OAAO,EAAE,GAAIoD,OAAOC,KAAKH,IAAAA,CAAAA,CAAMI,SAAS,IAAI,EAAEJ,KAAK,IAAI,CAAC,EAAG,CAAA;EAE7G,OAAOjC;CACX;CAEA,MAAMsC,OACFC,IACAxD,OACoB;EACpB,MAAMA,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAec,WAAW,CAAA;EAE9E,MAAM0B,SAAS,MAAM,KAAKxB,WAAWgE,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACvC,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMqB,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAec;GACrBqB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,EAAEuC,IAAIE,aAAazC;EACzB,MAAM,KAAKxB,WAAWkE,OAAO1C,MAAAA;EAC7BA,OAAOuC,KAAKE;EAEZ,MAAM,KAAKf,YAAYpE,UAAUqF,SAAS3C,QAAQjB,KAAAA;EAElD,OAAOiB;CACX;;;;;;;IAWA,MAAgB0B,YACZvC,MACAa,QACAjB,OACAY,OAA4B,CAAC,GAChB;EACb,MAAMhB,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBiE,KAAAA;EAEJ,MAAM,KAAKlE,cAAcmE,OAAO;GAC5BC,OAAOvF,WAAWwF;GAClB5D;GACA6D,SAAS3F,WAAW4F;GACpBC,OAAOlD,OAAOuC;GACdjD,SAASU,OAAOV,WAAW;GAC3B6D,WAAWpE,MAAMgC,UAAUqC,QAAQ;GACnCC,SAAStE,MAAMgC,UAAUpB,KAAK4C,MAAM;GACpCe,WAAWvE,MAAMgC,UAAUpB,KAAKR,QAAQ;GACxCoE,aAAa5E,gBAAgB4E,eAAe;GAC5CC,eAAe7E,gBAAgB6E,iBAAiB;GAChDC,kBAAkB9E,gBAAgB8E,oBAAoB;GACtDC,kBAAkB/E,gBAAgB+E,oBAAoB;GACtD/D,MAAM;IACFR,MAAMa,OAAOb;IACbqC,SAASxB,OAAOwB;IAChB,GAAG7B;GACP;EACJ,CAAA;CACJ;CAEUoC,gBAAgB/B,QAA0C;EAChE,OAAO;GACHb,MAAMa,OAAOb;GACbqC,SAASxB,OAAOwB;EACpB;CACJ;AACJ"}

package/dist/core/entities/trust-anchor/types.d.ts CHANGED Viewed

@@ -4,8 +4,16 @@ export interface ITrustAnchorRepository extends IEntityRepository<TrustAnchor> {
     checkUniqueness(data: Partial<TrustAnchor>, existing?: TrustAnchor): Promise<void>;
     findOneByIdOrName(idOrName: string, realm?: string): Promise<TrustAnchor | null>;
 }
+export type TrustAnchorServiceReadOptions = {
+    /**
+     * Route-scoped realm (nested `/realms/:realmId/trust-anchors`
+     * mount) — appended onto the decoded query IR as a
+     * non-displaceable `realmId` condition.
+     */
+    realmId?: string;
+};
 export interface ITrustAnchorService {
-    getMany(query: Record<string, any>, actor: ActorContext): Promise<EntityRepositoryFindManyResult<TrustAnchor>>;
+    getMany(query: Record<string, any>, actor: ActorContext, options?: TrustAnchorServiceReadOptions): Promise<EntityRepositoryFindManyResult<TrustAnchor>>;
     getOne(idOrName: string, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;
     create(data: Record<string, any>, actor: ActorContext): Promise<TrustAnchor>;
     update(idOrName: string, data: Record<string, any>, actor: ActorContext, realmId?: string): Promise<TrustAnchor>;

package/dist/core/entities/trust-anchor/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE1G,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB,CAAC,WAAW,CAAC;IAC1E,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnF,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,mBAAmB;IAChC,OAAO,~~CAAC~~,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,~~EAAE~~,KAAK,EAAE,YAAY,~~GAAG~~,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC,CAAC;~~IAC/G~~,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjE"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/trust-anchor/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE1G,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB,CAAC,WAAW,CAAC;IAC1E,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnF,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACpF;AAED,MAAM,MAAM,6BAA6B,GAAG;IACxC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAChC,OAAO,CACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,6BAA6B,GACxC,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC,CAAC;IACxD,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjE"}

package/dist/core/entities/user/index.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/user/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/user/index.mjs CHANGED Viewed

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { userSchema } from "./schema.mjs";
 import { UserService } from "./service.mjs";
-export { UserService };
+export { UserService, userSchema };

package/dist/core/entities/user/schema.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+import type { User } from '@authup/core-kit';
+export declare const userSchema: import("@rapiq/core").Schema<User, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/user/schema.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAM7C,eAAO,MAAM,UAAU,yCAwBrB,CAAC"}

package/dist/core/entities/user/schema.mjs ADDED Viewed

@@ -0,0 +1,50 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/user/schema.ts
+const schemaMapping = { realm: EntityType.REALM };
+const userSchema = defineSchema({
+	name: EntityType.USER,
+	fields: {
+		default: [
+			"id",
+			"name",
+			"nameLocked",
+			"firstName",
+			"lastName",
+			"displayName",
+			"avatar",
+			"cover",
+			"active",
+			"createdAt",
+			"updatedAt",
+			"realmId"
+		],
+		allowed: ["email"]
+	},
+	filters: { allowed: [
+		"id",
+		"name",
+		"realmId"
+	] },
+	relations: {
+		allowed: ["realm"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"id",
+		"name",
+		"displayName",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { userSchema };
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/user/schema.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","userSchema","name","USER","fields","default","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { User } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const userSchema = defineSchema<User>({\n name: EntityType.USER,\n fields: {\n default: [\n 'id',\n 'name',\n 'nameLocked',\n 'firstName',\n 'lastName',\n 'displayName',\n 'avatar',\n 'cover',\n 'active',\n 'createdAt',\n 'updatedAt',\n 'realmId',\n ],\n allowed: ['email'],\n },\n filters: { allowed: ['id', 'name', 'realmId'] },\n relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'name', 'displayName', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,aAAaN,aAAmB;CACzCO,MAAMN,WAAWO;CACjBC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,OAAQ;CACtB;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;CAAU,EAAC;CAC9CE,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAe;EAAa;CAAY,EAAC;CACzEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}

package/dist/core/entities/user/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/service.ts"],"names":[],"mappings":"~~AAUA~~,OAAO,EAEH,aAAa,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;~~AAEhE~~,MAAM,MAAM,kBAAkB,GAAG;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,qBAAa,WAAY,SAAQ,qBAAsB,YAAW,YAAY;IAC1E,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;gBAEvB,GAAG,EAAE,kBAAkB;IAO7B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;~~IAoD1C~~,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;~~IAsCV~~,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAsII,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;CA2BnB"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/service.ts"],"names":[],"mappings":"AAWA,OAAO,EAEH,aAAa,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAIhE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,qBAAa,WAAY,SAAQ,qBAAsB,YAAW,YAAY;IAC1E,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;gBAEvB,GAAG,EAAE,kBAAkB;IAO7B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;IA8E1C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IA8CV,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAsII,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;CA2BnB"}

package/dist/core/entities/user/service.mjs CHANGED Viewed

@@ -2,11 +2,15 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { UserCredentialsService } from "../../authentication/credential/entities/user/module.mjs";
+import { userSchema } from "./schema.mjs";
+import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { ValidatorGroup, isUUID } from "@authup/kit";
 import { PermissionName, UserValidator } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { EntityNotFoundError, ValidationError } from "@authup/errors";
+import { eq, inArray, or } from "@rapiq/core";
 //#region src/core/entities/user/service.ts
 var UserService = class extends AbstractEntityService {
 	repository;
@@ -19,12 +23,25 @@ var UserService = class extends AbstractEntityService {
 		this.validator = new UserValidator({ passwordMinLength: ctx.passwordMinLength });
 	}
 	async getMany(query, actor) {
-		await actor.permissionEvaluator.preEvaluateOneOf({ name: [
+		const permissionNames = [
 			PermissionName.USER_READ,
 			PermissionName.USER_UPDATE,
 			PermissionName.USER_DELETE
-		] });
-		const { data: entities, meta } = await this.repository.findMany(query);
+		];
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });
+		const parsed = await decodeQuery(query, {
+			schema: userSchema,
+			actor
+		});
+		const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });
+		if (compiled.verdict !== "post") {
+			const self = actor.identity && actor.identity.type === "user" ? eq("id", actor.identity.data.id) : null;
+			let scoped = parsed;
+			if (compiled.verdict === "deny") scoped = appendQueryConditions(parsed, self ?? inArray("id", []));
+			else if (compiled.verdict === "conditional") scoped = appendQueryConditions(parsed, self ? or(self, compiled.condition) : compiled.condition);
+			return this.repository.findMany(scoped);
+		}
+		const { data: entities, meta } = await this.repository.findMany(parsed);
 		const data = [];
 		let { total } = meta;
 		for (const entity of entities) {
@@ -65,7 +82,11 @@ var UserService = class extends AbstractEntityService {
 		];
 		let isMe = !!actor.identity && actor.identity.type === "user" && (actor.identity.data.id === idOrName || actor.identity.data.name === idOrName);
 		if (!isMe) await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });
-		const entity = await this.repository.findOne(idOrName, query, realmId);
+		const entity = await this.repository.findOne(idOrName, await decodeQuery(query, {
+			schema: userSchema,
+			parameters: ["fields", "relations"],
+			actor
+		}), realmId);
 		if (!entity) throw new EntityNotFoundError();
 		if (isMe && actor.identity.data.id !== entity.id) {
 			isMe = false;
@@ -90,13 +111,13 @@ var UserService = class extends AbstractEntityService {
 	}
 	async save(idOrName, data, actor, options = {}) {
 		let group;
-		const realm = typeof data.realm_id === "string" ? await this.realmRepository.resolve(data.realm_id) : void 0;
+		const realm = typeof data.realmId === "string" ? await this.realmRepository.resolve(data.realmId) : void 0;
 		let entity;
 		if (idOrName) {
 			const where = {};
 			if (isUUID(idOrName)) where.id = idOrName;
 			else where.name = idOrName;
-			if (realm) where.realm_id = realm.id;
+			if (realm) where.realmId = realm.id;
 			entity = await this.repository.findOneBy(where);
 			if (!entity && options.updateOnly) throw new EntityNotFoundError();
 		} else if (options.updateOnly) throw new EntityNotFoundError();
@@ -119,7 +140,7 @@ var UserService = class extends AbstractEntityService {
 		const credentialsService = new UserCredentialsService();
 		if (entity) {
 			const originalName = entity.name;
-			const originalNameLocked = entity.name_locked;
+			const originalNameLocked = entity.nameLocked;
 			if (isSelfEdit) await actor.permissionEvaluator.evaluate({
 				name: PermissionName.USER_SELF_MANAGE,
 				data: definePolicyData({
@@ -129,8 +150,8 @@ var UserService = class extends AbstractEntityService {
 			});
 			entity = this.repository.merge(entity, validated);
 			if (validated.name && validated.name !== originalName) {
-				if (validated.name_locked) entity.name_locked = validated.name_locked;
-				if (originalNameLocked && validated.name_locked !== false) entity.name = originalName;
+				if (validated.nameLocked) entity.nameLocked = validated.nameLocked;
+				if (originalNameLocked && validated.nameLocked !== false) entity.name = originalName;
 			}
 			if (!isSelfEdit) await actor.permissionEvaluator.evaluate({
 				name: PermissionName.USER_UPDATE,
@@ -139,7 +160,7 @@ var UserService = class extends AbstractEntityService {
 						...entity,
 						...validated
 					},
-					[BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null
+					[BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null
 				})
 			});
 			if (validated.password) entity.password = await credentialsService.protect(validated.password);
@@ -149,9 +170,9 @@ var UserService = class extends AbstractEntityService {
 				created: false
 			};
 		}
-		if (!validated.realm_id) {
+		if (!validated.realmId) {
 			const actorRealmId = this.getActorRealmId(actor);
-			if (actorRealmId) validated.realm_id = actorRealmId;
+			if (actorRealmId) validated.realmId = actorRealmId;
 		}
 		entity = this.repository.create(validated);
 		await actor.permissionEvaluator.evaluate({

package/dist/core/entities/user/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","PermissionName","UserValidator","AbstractEntityService","UserCredentialsService","UserService","repository","realmRepository","validator","ctx","passwordMinLength","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_READ","USER_UPDATE","USER_DELETE","data","entities","meta","findMany","total","entity","identity","type","id","push","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","getOne","idOrName","realmId","permissionNames","isMe","findOne","create","save","undefined","update","updateOnly","options","group","realm","realm_id","resolve","where","findOneBy","isSelfEdit","preEvaluate","e","USER_SELF_MANAGE","UPDATE","USER_CREATE","CREATE","validated","run","validateJoinColumns","credentialsService","originalName","originalNameLocked","name_locked","evaluate","merge","REALM_MATCH","password","protect","created","actorRealmId","getActorRealmId","delete","entityId","remove"],"sources":["../../../../src/core/entities/user/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n PermissionName,\n UserValidator,\n} from '@authup/core-kit';\nimport type { User } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type { IUserRepository, IUserService } from './types.ts';\n\nexport type UserServiceContext = {\n repository: IUserRepository;\n realmRepository: IRealmRepository;\n passwordMinLength?: number;\n};\n\nexport class UserService extends AbstractEntityService implements IUserService {\n protected repository: IUserRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: UserValidator;\n\n constructor(ctx: UserServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new UserValidator({ passwordMinLength: ctx.passwordMinLength });\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<User>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.USER_READ,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ],\n });\n\n const {\n data: entities, \n meta, \n } = await this.repository.findMany(query);\n\n const data: User[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n if (\n actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === entity.id\n ) {\n data.push(entity);\n continue;\n }\n\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.USER_READ,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ],\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n data.push(entity);\n } catch {\n total -= 1;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<User> {\n const permissionNames = [\n PermissionName.USER_READ,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ];\n\n let isMe = !!actor.identity &&\n actor.identity.type === 'user' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n const entity = await this.repository.findOne(idOrName, query, realmId);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n if (!isMe) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: permissionNames,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<User> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<User> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: User,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realm_id === 'string' ?\n await this.realmRepository.resolve(data.realm_id) :\n undefined;\n\n let entity: User \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realm_id = realm.id;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'user' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n }\n\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_CREATE });\n\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n await this.repository.validateJoinColumns(validated);\n\n const credentialsService = new UserCredentialsService();\n\n if (entity) {\n const originalName = entity.name;\n const originalNameLocked = entity.name_locked;\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (\n validated.name &&\n validated.name !== originalName\n ) {\n if (validated.name_locked) {\n entity.name_locked = validated.name_locked;\n }\n\n if (originalNameLocked && validated.name_locked !== false) {\n entity.name = originalName;\n }\n }\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n [BuiltInPolicyType.REALM_MATCH]: validated.realm_id ?? entity.realm_id ?? null,\n }),\n });\n }\n\n if (validated.password) {\n entity.password = await credentialsService.protect(validated.password);\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realm_id) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realm_id = actorRealmId;\n }\n }\n\n entity = this.repository.create(validated);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n if (validated.password) {\n entity.password = await credentialsService.protect(validated.password);\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<User> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });\n\n if (\n actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === id\n ) {\n throw new ValidationError('The own user can not be deleted.');\n }\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;AA2BA,IAAaU,cAAb,cAAiCF,sBAAAA;CACnBG;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIN,cAAc,EAAEQ,mBAAmBD,IAAIC,kBAAkB,CAAA;CAClF;CAEA,MAAMC,QACFC,OACAC,OAC6C;EAC7C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKhB,WAAWiB,SAASX,KAAAA;EAEnC,MAAMQ,OAAe,CAAA;EACrB,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UAAU;GAC3B,IACIR,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,IACpC;IACER,KAAKS,KAAKJ,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMZ,MAAMC,oBAAoBgB,cAAc;KAC1Cd,MAAM;MACFf,eAAegB;MACfhB,eAAeiB;MACfjB,eAAekB;;KAEnBC,MAAMxB,iBAAiB;OAAGD,kBAAkBoC,aAAaN;MAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;KAAQ,CAAA;IACxG,CAAA;IAEAL,KAAKS,KAAKJ,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACArB,OACAD,OACAuB,SACa;EACb,MAAMC,kBAAkB;GACpBnC,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;;EAGnB,IAAIkB,OAAO,CAAC,CAACxB,MAAMa,YACfb,MAAMa,SAASC,SAAS,WAEpBd,MAAMa,SAASN,KAAKQ,OAAOM,YAC3BrB,MAAMa,SAASN,KAAKJ,SAASkB;EAGrC,IAAI,CAACG,MACD,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAG7E,MAAMX,SAAS,MAAM,KAAKnB,WAAWgC,QAAQJ,UAAUtB,OAAOuB,OAAAA;EAC9D,IAAI,CAACV,QACD,MAAM,IAAI1B,oBAAAA;EAGd,IAAIsC,QAAQxB,MAAMa,SAAUN,KAAKQ,OAAOH,OAAOG,IAAI;GAC/CS,OAAO;GACP,MAAMxB,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMoB,gBAAgB,CAAA;EAC7E;EAEA,IAAI,CAACC,MACD,MAAMxB,MAAMC,oBAAoBgB,cAAc;GAC1Cd,MAAMoB;GACNhB,MAAMxB,iBAAiB;KAAGD,kBAAkBoC,aAAaN;IAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMc,OACFnB,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKC,KAAAA,GAAWrB,MAAMP,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMiB,OACFR,UACAd,MACAP,OACa;EACb,MAAM,EAAEY,WAAW,MAAM,KAAKe,KAAKN,UAAUd,MAAMP,OAAO,EAAE8B,YAAY,KAAK,CAAA;EAC7E,OAAOlB;CACX;CAEA,MAAMe,KACFN,UACAd,MACAP,OACA+B,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO1B,KAAK2B,aAAa,WACnC,MAAM,KAAKxC,gBAAgByC,QAAQ5B,KAAK2B,QAAQ,IAChDN,KAAAA;EAEJ,IAAIhB;EACJ,IAAIS,UAAU;GACV,MAAMe,QAA6B,CAAC;GACpC,IAAInD,OAAOoC,QAAAA,GACPe,MAAMrB,KAAKM;QAEXe,MAAMjC,OAAOkB;GAGjB,IAAIY,OACAG,MAAMF,WAAWD,MAAMlB;GAG3BH,SAAS,MAAM,KAAKnB,WAAW4C,UAAUD,KAAAA;GACzC,IAAI,CAACxB,UAAUmB,QAAQD,YACnB,MAAM,IAAI5C,oBAAAA;EAElB,OAAO,IAAI6C,QAAQD,YACf,MAAM,IAAI5C,oBAAAA;EAGd,IAAIoD,aAAa;EACjB,IAAI1B,QAAQ;GACR,IAAI;IACA,MAAMZ,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeiB,YAAY,CAAA;GACnF,SAASmC,GAAG;IACR,IACI,CAACxC,MAAMa,YACPb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOH,OAAOG,IAElC,MAAMyB;IAEVF,aAAa;IACb,MAAMtC,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeqD,iBAAiB,CAAA;GACxF;GAEAT,QAAQhD,eAAe0D;EAC3B,OAAO;GACH,MAAM1C,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAeuD,YAAY,CAAA;GAE/EX,QAAQhD,eAAe4D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKlD,UAAUmD,IAAIvC,MAAM,EAAEyB,MAAM,CAAA;EAEzD,MAAM,KAAKvC,WAAWsD,oBAAoBF,SAAAA;EAE1C,MAAMG,qBAAqB,IAAIzD,uBAAAA;EAE/B,IAAIqB,QAAQ;GACR,MAAMqC,eAAerC,OAAOT;GAC5B,MAAM+C,qBAAqBtC,OAAOuC;GAElC,IAAIb,YACA,MAAMtC,MAAMC,oBAAoBmD,SAAS;IACrCjD,MAAMf,eAAeqD;IACrBlC,MAAMxB,iBAAiB;MAAGD,kBAAkBoC,aAAa2B;KAAW,GAAG,KAAK1B,mBAAmB0B,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJjC,SAAS,KAAKnB,WAAW4D,MAAMzC,QAAQiC,SAAAA;GAEvC,IACIA,UAAU1C,QACV0C,UAAU1C,SAAS8C,cACrB;IACE,IAAIJ,UAAUM,aACVvC,OAAOuC,cAAcN,UAAUM;IAGnC,IAAID,sBAAsBL,UAAUM,gBAAgB,OAChDvC,OAAOT,OAAO8C;GAEtB;GAEA,IAAI,CAACX,YACD,MAAMtC,MAAMC,oBAAoBmD,SAAS;IACrCjD,MAAMf,eAAeiB;IACrBE,MAAMxB,iBAAiB;MAClBD,kBAAkBoC,aAAa;MAC5B,GAAGN;MACH,GAAGiC;KACP;MACC/D,kBAAkBwE,cAAcT,UAAUX,YAAYtB,OAAOsB,YAAY;IAC9E,CAAA;GACJ,CAAA;GAGJ,IAAIW,UAAUU,UACV3C,OAAO2C,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;GAGzE,MAAM,KAAK9D,WAAWkC,KAAKf,MAAAA;GAE3B,OAAO;IACHA;IACA6C,SAAS;GACb;EACJ;EAEA,IAAI,CAACZ,UAAUX,UAAU;GACrB,MAAMwB,eAAe,KAAKC,gBAAgB3D,KAAAA;GAC1C,IAAI0D,cACAb,UAAUX,WAAWwB;EAE7B;EAEA9C,SAAS,KAAKnB,WAAWiC,OAAOmB,SAAAA;EAEhC,MAAM7C,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMf,eAAeuD;GACrBpC,MAAMxB,iBAAiB;KAAGD,kBAAkBoC,aAAaN;IAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,IAAIiC,UAAUU,UACV3C,OAAO2C,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;EAGzE,MAAM,KAAK9D,WAAWkC,KAAKf,MAAAA;EAE3B,OAAO;GACHA;GACA6C,SAAS;EACb;CACJ;CAEA,MAAMG,OACF7C,IACAf,OACa;EACb,MAAMA,MAAMC,oBAAoBsC,YAAY,EAAEpC,MAAMf,eAAekB,YAAY,CAAA;EAE/E,IACIN,MAAMa,YACNb,MAAMa,SAASC,SAAS,UACxBd,MAAMa,SAASN,KAAKQ,OAAOA,IAE3B,MAAM,IAAI5B,gBAAgB,kCAAA;EAG9B,MAAMyB,SAAS,MAAM,KAAKnB,WAAW4C,UAAU,EAAEtB,GAAG,CAAA;EACpD,IAAI,CAACH,QACD,MAAM,IAAI1B,oBAAAA;EAGd,MAAMc,MAAMC,oBAAoBmD,SAAS;GACrCjD,MAAMf,eAAekB;GACrBC,MAAMxB,iBAAiB;KAAGD,kBAAkBoC,aAAaN;IAAQ,GAAG,KAAKO,mBAAmBP,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEG,IAAI8C,aAAajD;EACzB,MAAM,KAAKnB,WAAWqE,OAAOlD,MAAAA;EAC7BA,OAAOG,KAAK8C;EAEZ,OAAOjD;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","eq","inArray","or","PermissionName","UserValidator","AbstractEntityService","UserCredentialsService","appendQueryConditions","decodeQuery","userSchema","UserService","repository","realmRepository","validator","ctx","passwordMinLength","getMany","query","actor","permissionNames","USER_READ","USER_UPDATE","USER_DELETE","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","compiled","compile","verdict","self","identity","type","data","id","scoped","condition","findMany","entities","meta","total","entity","push","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","getOne","idOrName","realmId","isMe","findOne","parameters","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneBy","isSelfEdit","preEvaluate","e","USER_SELF_MANAGE","UPDATE","USER_CREATE","CREATE","validated","run","validateJoinColumns","credentialsService","originalName","originalNameLocked","nameLocked","evaluate","merge","REALM_MATCH","password","protect","created","actorRealmId","getActorRealmId","delete","entityId","remove"],"sources":["../../../../src/core/entities/user/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { eq, inArray, or } from '@rapiq/core';\nimport {\n PermissionName,\n UserValidator,\n} from '@authup/core-kit';\nimport type { User } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type { IUserRepository, IUserService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { userSchema } from './schema.ts';\n\nexport type UserServiceContext = {\n repository: IUserRepository;\n realmRepository: IRealmRepository;\n passwordMinLength?: number;\n};\n\nexport class UserService extends AbstractEntityService implements IUserService {\n protected repository: IUserRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: UserValidator;\n\n constructor(ctx: UserServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new UserValidator({ passwordMinLength: ctx.passwordMinLength });\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<User>> {\n const permissionNames = [\n PermissionName.USER_READ,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ];\n\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n\n const parsed = await decodeQuery(query, { schema: userSchema, actor });\n\n // Compile the read permissions into a row condition (#3286 phase 3). The\n // own row is always readable, so the self short-circuit composes as an\n // OR-alternative — the whole gate runs as WHERE and pagination/totals\n // stay exact. A non-expressible policy falls back to the per-row loop\n // below.\n const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });\n if (compiled.verdict !== 'post') {\n const self = actor.identity && actor.identity.type === 'user' ?\n eq('id', actor.identity.data.id) :\n null;\n\n let scoped = parsed;\n if (compiled.verdict === 'deny') {\n scoped = appendQueryConditions(parsed, self ?? inArray('id', []));\n } else if (compiled.verdict === 'conditional') {\n scoped = appendQueryConditions(\n parsed,\n self ? or(self, compiled.condition) : compiled.condition,\n );\n }\n\n return this.repository.findMany(scoped);\n }\n\n const {\n data: entities,\n meta,\n } = await this.repository.findMany(parsed);\n\n const data: User[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n if (\n actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === entity.id\n ) {\n data.push(entity);\n continue;\n }\n\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.USER_READ,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ],\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n data.push(entity);\n } catch {\n total -= 1;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<User> {\n const permissionNames = [\n PermissionName.USER_READ,\n PermissionName.USER_UPDATE,\n PermissionName.USER_DELETE,\n ];\n\n let isMe = !!actor.identity &&\n actor.identity.type === 'user' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n const entity = await this.repository.findOne(\n idOrName,\n await decodeQuery(query, {\n schema: userSchema, \n parameters: ['fields', 'relations'], \n actor, \n }),\n realmId,\n );\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n if (!isMe) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: permissionNames,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<User> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<User> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: User,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realmId === 'string' ?\n await this.realmRepository.resolve(data.realmId) :\n undefined;\n\n let entity: User \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realmId = realm.id;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'user' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n }\n\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_CREATE });\n\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n await this.repository.validateJoinColumns(validated);\n\n const credentialsService = new UserCredentialsService();\n\n if (entity) {\n const originalName = entity.name;\n const originalNameLocked = entity.nameLocked;\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (\n validated.name &&\n validated.name !== originalName\n ) {\n if (validated.nameLocked) {\n entity.nameLocked = validated.nameLocked;\n }\n\n if (originalNameLocked && validated.nameLocked !== false) {\n entity.name = originalName;\n }\n }\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n }),\n });\n }\n\n if (validated.password) {\n entity.password = await credentialsService.protect(validated.password);\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realmId) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realmId = actorRealmId;\n }\n }\n\n entity = this.repository.create(validated);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n if (validated.password) {\n entity.password = await credentialsService.protect(validated.password);\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<User> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });\n\n if (\n actor.identity &&\n actor.identity.type === 'user' &&\n actor.identity.data.id === id\n ) {\n throw new ValidationError('The own user can not be deleted.');\n }\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.USER_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;AA8BA,IAAagB,cAAb,cAAiCL,sBAAAA;CACnBM;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIT,cAAc,EAAEW,mBAAmBD,IAAIC,kBAAkB,CAAA;CAClF;CAEA,MAAMC,QACFC,OACAC,OAC6C;EAC7C,MAAMC,kBAAkB;GACpBhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;EAClB;EAED,MAAMJ,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAEzE,MAAMO,SAAS,MAAMlB,YAAYS,OAAO;GAAEU,QAAQlB;GAAYS;EAAM,CAAA;EAOpE,MAAMU,WAAW,MAAMV,MAAMK,oBAAoBM,QAAQ,EAAEJ,MAAMN,gBAAgB,CAAA;EACjF,IAAIS,SAASE,YAAY,QAAQ;GAC7B,MAAMC,OAAOb,MAAMc,YAAYd,MAAMc,SAASC,SAAS,SACnDjC,GAAG,MAAMkB,MAAMc,SAASE,KAAKC,EAAE,IAC/B;GAEJ,IAAIC,SAASV;GACb,IAAIE,SAASE,YAAY,QACrBM,SAAS7B,sBAAsBmB,QAAQK,QAAQ9B,QAAQ,MAAM,CAAA,CAAE,CAAA;QAC5D,IAAI2B,SAASE,YAAY,eAC5BM,SAAS7B,sBACLmB,QACAK,OAAO7B,GAAG6B,MAAMH,SAASS,SAAS,IAAIT,SAASS,SAAS;GAIhE,OAAO,KAAK1B,WAAW2B,SAASF,MAAAA;EACpC;EAEA,MAAM,EACFF,MAAMK,UACNC,SACA,MAAM,KAAK7B,WAAW2B,SAASZ,MAAAA;EAEnC,MAAMQ,OAAe,CAAA;EACrB,IAAI,EAAEO,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IACIrB,MAAMc,YACNd,MAAMc,SAASC,SAAS,UACxBf,MAAMc,SAASE,KAAKC,OAAOO,OAAOP,IACpC;IACED,KAAKS,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMxB,MAAMK,oBAAoBqB,cAAc;KAC1CnB,MAAM;MACFtB,eAAeiB;MACfjB,eAAekB;MACflB,eAAemB;KAClB;KACDY,MAAMvC,iBAAiB;OAAGD,kBAAkBmD,aAAaH;MAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;KAAQ,CAAA;IACxG,CAAA;IAEAR,KAAKS,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHP;GACAM,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,UACA9B,OACAD,OACAgC,SACa;EACb,MAAM9B,kBAAkB;GACpBhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;EAClB;EAED,IAAI4B,OAAO,CAAC,CAAChC,MAAMc,YACfd,MAAMc,SAASC,SAAS,WAEpBf,MAAMc,SAASE,KAAKC,OAAOa,YAC3B9B,MAAMc,SAASE,KAAKT,SAASuB;EAGrC,IAAI,CAACE,MACD,MAAMhC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAG7E,MAAMuB,SAAS,MAAM,KAAK/B,WAAWwC,QACjCH,UACA,MAAMxC,YAAYS,OAAO;GACrBU,QAAQlB;GACR2C,YAAY,CAAC,UAAU,WAAY;GACnClC;EACJ,CAAA,GACA+B,OAAAA;EAEJ,IAAI,CAACP,QACD,MAAM,IAAI5C,oBAAAA;EAGd,IAAIoD,QAAQhC,MAAMc,SAAUE,KAAKC,OAAOO,OAAOP,IAAI;GAC/Ce,OAAO;GACP,MAAMhC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAC7E;EAEA,IAAI,CAAC+B,MACD,MAAMhC,MAAMK,oBAAoBqB,cAAc;GAC1CnB,MAAMN;GACNe,MAAMvC,iBAAiB;KAAGD,kBAAkBmD,aAAaH;IAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMW,OACFnB,MACAhB,OACa;EACb,MAAM,EAAEwB,WAAW,MAAM,KAAKY,KAAKC,KAAAA,GAAWrB,MAAMhB,KAAAA;EACpD,OAAOwB;CACX;CAEA,MAAMc,OACFR,UACAd,MACAhB,OACa;EACb,MAAM,EAAEwB,WAAW,MAAM,KAAKY,KAAKN,UAAUd,MAAMhB,OAAO,EAAEuC,YAAY,KAAK,CAAA;EAC7E,OAAOf;CACX;CAEA,MAAMY,KACFN,UACAd,MACAhB,OACAwC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO1B,KAAKe,YAAY,WAClC,MAAM,KAAKrC,gBAAgBiD,QAAQ3B,KAAKe,OAAO,IAC/CM,KAAAA;EAEJ,IAAIb;EACJ,IAAIM,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAIjE,OAAOmD,QAAAA,GACPc,MAAM3B,KAAKa;QAEXc,MAAMrC,OAAOuB;GAGjB,IAAIY,OACAE,MAAMb,UAAUW,MAAMzB;GAG1BO,SAAS,MAAM,KAAK/B,WAAWoD,UAAUD,KAAAA;GACzC,IAAI,CAACpB,UAAUgB,QAAQD,YACnB,MAAM,IAAI3D,oBAAAA;EAElB,OAAO,IAAI4D,QAAQD,YACf,MAAM,IAAI3D,oBAAAA;EAGd,IAAIkE,aAAa;EACjB,IAAItB,QAAQ;GACR,IAAI;IACA,MAAMxB,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAekB,YAAY,CAAA;GACnF,SAAS6C,GAAG;IACR,IACI,CAAChD,MAAMc,YACPd,MAAMc,SAASC,SAAS,UACxBf,MAAMc,SAASE,KAAKC,OAAOO,OAAOP,IAElC,MAAM+B;IAEVF,aAAa;IACb,MAAM9C,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAegE,iBAAiB,CAAA;GACxF;GAEAR,QAAQ/D,eAAewE;EAC3B,OAAO;GACH,MAAMlD,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAekE,YAAY,CAAA;GAE/EV,QAAQ/D,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK1D,UAAU2D,IAAItC,MAAM,EAAEyB,MAAM,CAAA;EAEzD,MAAM,KAAKhD,WAAW8D,oBAAoBF,SAAAA;EAE1C,MAAMG,qBAAqB,IAAIpE,uBAAAA;EAE/B,IAAIoC,QAAQ;GACR,MAAMiC,eAAejC,OAAOjB;GAC5B,MAAMmD,qBAAqBlC,OAAOmC;GAElC,IAAIb,YACA,MAAM9C,MAAMK,oBAAoBuD,SAAS;IACrCrD,MAAMtB,eAAegE;IACrBjC,MAAMvC,iBAAiB;MAAGD,kBAAkBmD,aAAa0B;KAAW,GAAG,KAAKzB,mBAAmByB,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJ7B,SAAS,KAAK/B,WAAWoE,MAAMrC,QAAQ6B,SAAAA;GAEvC,IACIA,UAAU9C,QACV8C,UAAU9C,SAASkD,cACrB;IACE,IAAIJ,UAAUM,YACVnC,OAAOmC,aAAaN,UAAUM;IAGlC,IAAID,sBAAsBL,UAAUM,eAAe,OAC/CnC,OAAOjB,OAAOkD;GAEtB;GAEA,IAAI,CAACX,YACD,MAAM9C,MAAMK,oBAAoBuD,SAAS;IACrCrD,MAAMtB,eAAekB;IACrBa,MAAMvC,iBAAiB;MAClBD,kBAAkBmD,aAAa;MAC5B,GAAGH;MACH,GAAG6B;KACP;MACC7E,kBAAkBsF,cAAcT,UAAUtB,WAAWP,OAAOO,WAAW;IAC5E,CAAA;GACJ,CAAA;GAGJ,IAAIsB,UAAUU,UACVvC,OAAOuC,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;GAGzE,MAAM,KAAKtE,WAAW2C,KAAKZ,MAAAA;GAE3B,OAAO;IACHA;IACAyC,SAAS;GACb;EACJ;EAEA,IAAI,CAACZ,UAAUtB,SAAS;GACpB,MAAMmC,eAAe,KAAKC,gBAAgBnE,KAAAA;GAC1C,IAAIkE,cACAb,UAAUtB,UAAUmC;EAE5B;EAEA1C,SAAS,KAAK/B,WAAW0C,OAAOkB,SAAAA;EAEhC,MAAMrD,MAAMK,oBAAoBuD,SAAS;GACrCrD,MAAMtB,eAAekE;GACrBnC,MAAMvC,iBAAiB;KAAGD,kBAAkBmD,aAAaH;IAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,IAAI6B,UAAUU,UACVvC,OAAOuC,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;EAGzE,MAAM,KAAKtE,WAAW2C,KAAKZ,MAAAA;EAE3B,OAAO;GACHA;GACAyC,SAAS;EACb;CACJ;CAEA,MAAMG,OACFnD,IACAjB,OACa;EACb,MAAMA,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAemB,YAAY,CAAA;EAE/E,IACIJ,MAAMc,YACNd,MAAMc,SAASC,SAAS,UACxBf,MAAMc,SAASE,KAAKC,OAAOA,IAE3B,MAAM,IAAIpC,gBAAgB,kCAAA;EAG9B,MAAM2C,SAAS,MAAM,KAAK/B,WAAWoD,UAAU,EAAE5B,GAAG,CAAA;EACpD,IAAI,CAACO,QACD,MAAM,IAAI5C,oBAAAA;EAGd,MAAMoB,MAAMK,oBAAoBuD,SAAS;GACrCrD,MAAMtB,eAAemB;GACrBY,MAAMvC,iBAAiB;KAAGD,kBAAkBmD,aAAaH;IAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEP,IAAIoD,aAAa7C;EACzB,MAAM,KAAK/B,WAAW6E,OAAO9C,MAAAA;EAC7BA,OAAOP,KAAKoD;EAEZ,OAAO7C;CACX;AACJ"}

package/dist/core/entities/user/types.d.ts CHANGED Viewed

@@ -1,9 +1,10 @@
 import type { Role, User } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
 import type { PermissionPolicyBinding } from '@authup/access';
 import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
 export interface IUserRepository extends IEntityRepository<User> {
     checkUniqueness(data: Partial<User>, existing?: User): Promise<void>;
-    findOne(id: string, query?: Record<string, any>, realm?: string): Promise<User | null>;
+    findOne(id: string, query?: IQuery, realm?: string): Promise<User | null>;
     findOneByWithEmail(where: Record<string, any>): Promise<User | null>;
     getBoundRoles(entity: string | User): Promise<Role[]>;
     getBoundPermissions(entity: string | User): Promise<PermissionPolicyBinding[]>;

package/dist/core/entities/user/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G,MAAM,WAAW,eAAgB,SAAQ,iBAAiB,CAAC,IAAI,CAAC;IAC5D,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,~~CAAC,MAAM,~~EAAE,~~GAAG,CAAC,EAAE,~~KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;~~IAEvF~~,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAErE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAEtD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,YAAY;IACzB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC;IACxG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5G,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G,MAAM,WAAW,eAAgB,SAAQ,iBAAiB,CAAC,IAAI,CAAC;IAC5D,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAE1E,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAErE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAEtD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,YAAY;IACzB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC;IACxG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5G,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D"}

package/dist/core/entities/user-attribute/index.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/user-attribute/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-attribute/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-attribute/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/user-attribute/index.mjs CHANGED Viewed

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { userAttributeSchema } from "./schema.mjs";
 import { UserAttributeService } from "./service.mjs";
-export { UserAttributeService };
+export { UserAttributeService, userAttributeSchema };

package/dist/core/entities/user-attribute/schema.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+import type { UserAttribute } from '@authup/core-kit';
+export declare const userAttributeSchema: import("@rapiq/core").Schema<UserAttribute, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/user-attribute/schema.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-attribute/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMtD,eAAO,MAAM,mBAAmB,kDA4B9B,CAAC"}

package/dist/core/entities/user-attribute/schema.mjs ADDED Viewed

@@ -0,0 +1,47 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/user-attribute/schema.ts
+const schemaMapping = {
+	user: EntityType.USER,
+	realm: EntityType.REALM
+};
+const userAttributeSchema = defineSchema({
+	name: EntityType.USER_ATTRIBUTE,
+	fields: { default: [
+		"id",
+		"name",
+		"value",
+		"userId",
+		"realmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: [
+		"id",
+		"name",
+		"userId",
+		"realmId"
+	] },
+	relations: {
+		allowed: ["user", "realm"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"id",
+		"name",
+		"userId",
+		"realmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { userAttributeSchema };
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/user-attribute/schema.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","user","USER","realm","REALM","userAttributeSchema","name","USER_ATTRIBUTE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user-attribute/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { user: EntityType.USER, realm: EntityType.REALM };\n\nexport const userAttributeSchema = defineSchema<UserAttribute>({\n name: EntityType.USER_ATTRIBUTE,\n // see user-role schema — explicit root projection for include= decodes\n fields: {\n default: [\n 'id',\n 'name',\n 'value',\n 'userId',\n 'realmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['id', 'name', 'userId', 'realmId'] },\n relations: { allowed: ['user', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: {\n allowed: [\n 'id',\n 'name',\n 'userId',\n 'realmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,sBAAsBR,aAA4B;CAC3DS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAM;EAAQ;EAAU;CAAU,EAAC;CACxDC,WAAW;EAAED,SAAS,CAAC,QAAQ,OAAQ;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC1Fc,MAAM,EACFH,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/user-attribute/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-attribute/service.ts"],"names":[],"mappings":"~~AAUA~~,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;~~AAElF~~,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE,wBAAwB,CAAC;IACrC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,qBAAsB,YAAW,qBAAqB;IAC5F,SAAS,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAE/C,SAAS,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAEjC,GAAG,EAAE,2BAA2B;IAMtC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,aAAa,CAAC,CAAC;~~IAkCnD~~,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAqBnB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAwDnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAuDnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;YAyBX,oBAAoB;CAuBrC"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-attribute/service.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAIlF,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE,wBAAwB,CAAC;IACrC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,qBAAsB,YAAW,qBAAqB;IAC5F,SAAS,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAE/C,SAAS,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAEjC,GAAG,EAAE,2BAA2B;IAMtC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,aAAa,CAAC,CAAC;IA6DnD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAqBnB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAwDnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAuDnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;YAyBX,oBAAoB;CAuBrC"}