@authup/server-core 1.0.0-beta.54 → 1.0.0-beta.55

package/dist/app/modules/metrics/prom.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"prom.mjs","names":["Counter","register","getOrCreateCounter","name","help","labelNames","existing","getSingleMetric","PromAuthFlowMetrics","loginCounter","tokenGrantCounter","authorizeCounter","refreshReplayCounter","recordLogin","result","inc","recordTokenGrant","grantType","grant_type","recordAuthorize","outcome","recordRefreshReplay"],"sources":["../../../../src/app/modules/metrics/prom.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Counter, register } from 'prom-client';\nimport type { OAuth2TokenGrant } from '@authup/specs';\nimport type {\n    AuthFlowAuthorizeOutcome,\n    AuthFlowLoginResult,\n    IAuthFlowMetrics,\n} from '../../../core/index.ts';\n\n// Counters are created against prom-client's default registry — the\n// @routup/prometheus handler serves that registry, so no extra wiring is\n// needed. getSingleMetric keeps construction idempotent across app instances\n// in one process (prom-client throws on duplicate metric names).\nfunction getOrCreateCounter<T extends string>(\n    name: string,\n    help: string,\n    labelNames: T[] = [],\n): Counter<T> {\n    const existing = register.getSingleMetric(name);\n    if (existing) {\n        return existing as Counter<T>;\n    }\n\n    return new Counter<T>({\n        name, \n        help, \n        labelNames, \n    });\n}\n\nexport class PromAuthFlowMetrics implements IAuthFlowMetrics {\n    protected loginCounter: Counter<'result'>;\n\n    protected tokenGrantCounter: Counter<'grant_type'>;\n\n    protected authorizeCounter: Counter<'outcome'>;\n\n    protected refreshReplayCounter: Counter;\n\n    constructor() {\n        this.loginCounter = getOrCreateCounter(\n            'authup_login_total',\n            'Password-grant login attempts by result.',\n            ['result'],\n        );\n        this.tokenGrantCounter = getOrCreateCounter(\n            'authup_token_grant_total',\n            'Successful token grants by grant_type; failures appear in the http_request_duration status codes.',\n            ['grant_type'],\n        );\n        this.authorizeCounter = getOrCreateCounter(\n            'authup_authorize_total',\n            'Authorization decisions by outcome.',\n            ['outcome'],\n        );\n        this.refreshReplayCounter = getOrCreateCounter(\n            'authup_refresh_replay_total',\n            'Detected refresh-token replays (family revocations).',\n        );\n    }\n\n    recordLogin(result: AuthFlowLoginResult): void {\n        this.loginCounter.inc({ result });\n    }\n\n    recordTokenGrant(grantType: `${OAuth2TokenGrant}`): void {\n        this.tokenGrantCounter.inc({ grant_type: grantType });\n    }\n\n    recordAuthorize(outcome: AuthFlowAuthorizeOutcome): void {\n        this.authorizeCounter.inc({ outcome });\n    }\n\n    recordRefreshReplay(): void {\n        this.refreshReplayCounter.inc();\n    }\n}\n"],"mappings":";;;;;AAmBA,SAASE,mBACLC,MACAC,MACAC,aAAkB,CAAA,GAAE;CAEpB,MAAMC,WAAWL,SAASM,gBAAgBJ,IAAAA;CAC1C,IAAIG,UACA,OAAOA;CAGX,OAAO,IAAIN,QAAW;EAClBG;EACAC;EACAC;CACJ,CAAA;AACJ;AAEA,IAAaG,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,cAAc;EACV,KAAKH,eAAeP,mBAChB,sBACA,4CACA,CAAC,QAAA,CAAS;EAEd,KAAKQ,oBAAoBR,mBACrB,4BACA,qGACA,CAAC,YAAA,CAAa;EAElB,KAAKS,mBAAmBT,mBACpB,0BACA,uCACA,CAAC,SAAA,CAAU;EAEf,KAAKU,uBAAuBV,mBACxB,+BACA,sDAAA;CAER;CAEAW,YAAYC,QAAmC;EAC3C,KAAKL,aAAaM,IAAI,EAAED,OAAO,CAAA;CACnC;CAEAE,iBAAiBC,WAAwC;EACrD,KAAKP,kBAAkBK,IAAI,EAAEG,YAAYD,UAAU,CAAA;CACvD;CAEAE,gBAAgBC,SAAyC;EACrD,KAAKT,iBAAiBI,IAAI,EAAEK,QAAQ,CAAA;CACxC;CAEAC,sBAA4B;EACxB,KAAKT,qBAAqBG,IAAG;CACjC;AACJ"}
+{"version":3,"file":"prom.mjs","names":["Counter","register","getOrCreateCounter","name","help","labelNames","existing","getSingleMetric","PromAuthFlowMetrics","loginCounter","tokenGrantCounter","authorizeCounter","refreshReplayCounter","recordLogin","result","inc","recordTokenGrant","grantType","grant_type","recordAuthorize","outcome","recordRefreshReplay"],"sources":["../../../../src/app/modules/metrics/prom.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Counter, register } from 'prom-client';\nimport type { OAuth2TokenGrant } from '@authup/specs';\nimport type {\n    AuthFlowAuthorizeOutcome,\n    AuthFlowLoginResult,\n    IAuthFlowMetrics,\n} from '../../../core/index.ts';\n\n// Counters are created against prom-client's default registry — the\n// @routup/prometheus handler serves that registry, so no extra wiring is\n// needed. getSingleMetric keeps construction idempotent across app instances\n// in one process (prom-client throws on duplicate metric names).\nfunction getOrCreateCounter<T extends string>(\n    name: string,\n    help: string,\n    labelNames: T[] = [],\n): Counter<T> {\n    const existing = register.getSingleMetric(name);\n    if (existing) {\n        return existing as Counter<T>;\n    }\n\n    return new Counter<T>({\n        name, \n        help, \n        labelNames, \n    });\n}\n\nexport class PromAuthFlowMetrics implements IAuthFlowMetrics {\n    protected loginCounter: Counter<'result'>;\n\n    protected tokenGrantCounter: Counter<'grant_type'>;\n\n    protected authorizeCounter: Counter<'outcome'>;\n\n    protected refreshReplayCounter: Counter;\n\n    constructor() {\n        this.loginCounter = getOrCreateCounter(\n            'authup_login_total',\n            'Password-grant login attempts by result.',\n            ['result'],\n        );\n        this.tokenGrantCounter = getOrCreateCounter(\n            'authup_token_grant_total',\n            'Successful token grants by grant_type; failures appear in the http_request_duration status codes.',\n            ['grant_type'],\n        );\n        this.authorizeCounter = getOrCreateCounter(\n            'authup_authorize_total',\n            'Authorization decisions by outcome.',\n            ['outcome'],\n        );\n        this.refreshReplayCounter = getOrCreateCounter(\n            'authup_refresh_replay_total',\n            'Detected refresh-token replays (family revocations).',\n        );\n    }\n\n    recordLogin(result: AuthFlowLoginResult): void {\n        this.loginCounter.inc({ result });\n    }\n\n    recordTokenGrant(grantType: `${OAuth2TokenGrant}`): void {\n        this.tokenGrantCounter.inc({ grant_type: grantType });\n    }\n\n    recordAuthorize(outcome: AuthFlowAuthorizeOutcome): void {\n        this.authorizeCounter.inc({ outcome });\n    }\n\n    recordRefreshReplay(): void {\n        this.refreshReplayCounter.inc();\n    }\n}\n"],"mappings":";;;;;AAmBA,SAASE,mBACLC,MACAC,MACAC,aAAkB,CAAA,GAAE;CAEpB,MAAMC,WAAWL,SAASM,gBAAgBJ,IAAAA;CAC1C,IAAIG,UACA,OAAOA;CAGX,OAAO,IAAIN,QAAW;EAClBG;EACAC;EACAC;CACJ,CAAA;AACJ;AAEA,IAAaG,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,cAAc;EACV,KAAKH,eAAeP,mBAChB,sBACA,4CACA,CAAC,QAAS,CAAA;EAEd,KAAKQ,oBAAoBR,mBACrB,4BACA,qGACA,CAAC,YAAa,CAAA;EAElB,KAAKS,mBAAmBT,mBACpB,0BACA,uCACA,CAAC,SAAU,CAAA;EAEf,KAAKU,uBAAuBV,mBACxB,+BACA,sDAAA;CAER;CAEAW,YAAYC,QAAmC;EAC3C,KAAKL,aAAaM,IAAI,EAAED,OAAO,CAAA;CACnC;CAEAE,iBAAiBC,WAAwC;EACrD,KAAKP,kBAAkBK,IAAI,EAAEG,YAAYD,UAAU,CAAA;CACvD;CAEAE,gBAAgBC,SAAyC;EACrD,KAAKT,iBAAiBI,IAAI,EAAEK,QAAQ,CAAA;CACxC;CAEAC,sBAA4B;EACxB,KAAKT,qBAAqBG,IAAG;CACjC;AACJ"}

package/dist/app/modules/oauth2/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["SymmetricCipher","CacheInjectionKey","ModuleName","LoggerInjectionKey","ConsentRepositoryAdapter","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2ScopeRepository","OAuth2TokenRepository","SessionTokenRepositoryAdapter","KeyRepositoryAdapter","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2MfaTokenIssuer","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","SessionTokenRepository","DataSource","ConsentRepository","KeyStore","secretsCipher","secretsEncryptionKey","env","logger","warn","TokenSigner","keyStore","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","sessionTokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","MfaTokenIssuer","mfaTicketMaxAge","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { SymmetricCipher } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nimport {\n    ConsentRepositoryAdapter,\n    OAuth2AuthorizationCodeRepository,\n    OAuth2AuthorizationStateRepository,\n    OAuth2ClientRepository,\n    OAuth2ScopeRepository,\n    OAuth2TokenRepository,\n    SessionTokenRepositoryAdapter,\n} from './repositories/index.ts';\nimport { KeyRepositoryAdapter } from '../database/repositories/index.ts';\nimport {\n    OAuth2AccessTokenIssuer,\n    OAuth2AuthorizationCodeIssuer,\n    OAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeVerifier,\n    OAuth2AuthorizationStateManager,\n    OAuth2MfaTokenIssuer,\n    OAuth2OpenIDTokenIssuer,\n    OAuth2RefreshTokenIssuer,\n    OAuth2TokenRevoker,\n    OAuth2TokenSigner,\n    OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.OAUTH2;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n    }\n\n    async setup(container: IContainer) : Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        container.register(OAuth2InjectionToken.ClientRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n                return new OAuth2ClientRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.ScopeRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n                return new OAuth2ScopeRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationCodeRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationStateRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2TokenRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.SessionTokenRepository, {\n            useFactory: (c) => new SessionTokenRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.ConsentRepository, {\n            useFactory: (c) => new ConsentRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.KeyStore, {\n            // todo: cache use here\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n\n                let secretsCipher : SymmetricCipher | null = null;\n                if (config.secretsEncryptionKey) {\n                    secretsCipher = new SymmetricCipher(config.secretsEncryptionKey);\n                } else if (config.env === 'production') {\n                    // parity posture without a KEK (Keycloak/authentik store key\n                    // material plaintext too) — but say so once, loudly.\n                    const logger = c.resolve(LoggerInjectionKey);\n                    logger.warn(\n                        'The realm key store persists key material unwrapped; ' +\n                        'set SECRETS_ENCRYPTION_KEY to wrap it at rest.',\n                    );\n                }\n\n                return new KeyRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource), { secretsCipher });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenSigner, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                return new OAuth2TokenSigner(keyStore);\n            },\n        });\n\n        // authorization code issuer\n        container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeIssuer(\n                    codeRepository,\n                    {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                    },\n                );\n            },\n        });\n        container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeVerifier(codeRepository);\n            },\n        });\n\n        // authorization code request verifier\n        container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n            useFactory: (c) => {\n                const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n                const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n                return new OAuth2AuthorizationCodeRequestVerifier({\n                    clientRepository,\n                    scopeRepository: clientScopeRepository,\n                });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n            useFactory: (c) => {\n                const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n                return new OAuth2AuthorizationStateManager(stateRepository);\n            },\n        });\n\n        // token revoker\n        container.register(OAuth2InjectionToken.TokenRevoker, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2TokenRevoker(tokenRepository, sessionTokenRepository);\n            },\n        });\n\n        // token verifier\n        container.register(OAuth2InjectionToken.TokenVerifier, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n                return new OAuth2TokenVerifier(keyStore, tokenRepository);\n            },\n        });\n\n        // access token issuer\n        container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2AccessTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    identityRoleProvider,\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // mfa login-ticket issuer\n        container.register(OAuth2InjectionToken.MfaTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n                return new OAuth2MfaTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.mfaTicketMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                );\n            },\n        });\n\n        // refresh token issuer\n        container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n\n                return new OAuth2RefreshTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenRefreshMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // open-id token issuer\n        container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n            useFactory: (c) => {\n                const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n                return new OAuth2OpenIDTokenIssuer({\n                    repository,\n                    signer,\n\n                    identityResolver,\n\n                    options: {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,IAAa6B,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAO5B,WAAW8B;EACvB,KAAKD,eAAe;GAAC7B,WAAW+B;GAAU/B,WAAWgC;GAAOhC,WAAWiC;GAAQjC,WAAWkC;;CAC9F;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GAET,OAAO,IAAIrC,uBADQqC,EAAEJ,QAAkCf,YACrBoB,CAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GAET,OAAO,IAAIpC,sBADQoC,EAAEJ,QAAuCd,iBAC3BmB,CAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GAET,OAAO,IAAIvC,kCADGuC,EAAEJ,QAAQvC,iBACqB+C,CAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GAET,OAAO,IAAItC,mCADGsC,EAAEJ,QAAQvC,iBACsB+C,CAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GAET,OAAO,IAAInC,sBADGmC,EAAEJ,QAAQvC,iBACS+C,CAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,wBAAwB,EAC5DR,aAAaC,MAAM,IAAIlC,8BACnBkC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,mBAAmB,EACvDV,aAAaC,MAAM,IAAIxC,yBACnBwC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB+B,UAAU,EAE9CX,aAAaC,MAAAA;GACT,MAAML,SAASK,EAAEJ,QAAQb,kBAAAA;GAEzB,IAAI4B,gBAAyC;GAC7C,IAAIhB,OAAOiB,sBACPD,gBAAgB,IAAIvD,gBAAgBuC,OAAOiB,oBAAoB;QAC5D,IAAIjB,OAAOkB,QAAQ,cAItBC,EADiBlB,QAAQrC,kBACzBuD,CAAAA,CAAOC,KACH,qGACA;GAIR,OAAO,IAAIhD,qBAAqBiC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,GAAG,EAAEG,cAAc,CAAA;EAChG,EACJ,CAAA;EAEAjB,UAAUG,SAASlB,qBAAqBqC,aAAa,EACjDjB,aAAaC,MAAAA;GAET,OAAO,IAAIvB,kBADMuB,EAAEJ,QAAQjB,qBAAqB+B,QACnBO,CAAAA;EACjC,EACJ,CAAA;EAGAvB,UAAUG,SAASlB,qBAAqBuC,yBAAyB,EAC7DnB,aAAaC,MAAAA;GAGT,OAAO,IAAI/B,8BAFY+B,EAAEJ,QAAQjB,qBAAqBwB,2BAGlDgB,GACA,EAEIC,QAAQzB,OAAO0B,kBACnB,CAAA;EAER,EACJ,CAAA;EACA3B,UAAUG,SAASlB,qBAAqB2C,2BAA2B,EAC/DvB,aAAaC,MAAAA;GAGT,OAAO,IAAI7B,gCAFY6B,EAAEJ,QAAQjB,qBAAqBwB,2BAEXgB,CAAAA;EAC/C,EACJ,CAAA;EAGAzB,UAAUG,SAASlB,qBAAqB4C,kCAAkC,EACtExB,aAAaC,MAAAA;GAIT,OAAO,IAAI9B,uCAAuC;IAC9CsD,kBAJqBxB,EAAEJ,QAAQjB,qBAAqBmB,gBAIpD0B;IACAE,iBAJ0B1B,EAAEJ,QAAQjB,qBAAqBuB,eAIxCuB;GACrB,CAAA;EACJ,EACJ,CAAA;EAEA/B,UAAUG,SAASlB,qBAAqBgD,2BAA2B,EAC/D5B,aAAaC,MAAAA;GAGT,OAAO,IAAI5B,gCAFa4B,EAAEJ,QAAQjB,qBAAqB0B,4BAEZuB,CAAAA;EAC/C,EACJ,CAAA;EAGAlC,UAAUG,SAASlB,qBAAqBkD,cAAc,EAClD9B,aAAaC,MAAAA;GAGT,OAAO,IAAIxB,mBAFawB,EAAEJ,QAAQjB,qBAAqB2B,eAEzBwB,GADC9B,EAAEJ,QAAQjB,qBAAqB4B,sBACfwB,CAAAA;EACnD,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBqD,eAAe,EACnDjC,aAAaC,MAAAA;GAIT,OAAO,IAAItB,oBAHMsB,EAAEJ,QAAQjB,qBAAqB+B,QAGjBO,GAFPjB,EAAEJ,QAAQjB,qBAAqB2B,eAEdwB,CAAAA;EAC7C,EACJ,CAAA;EAGApC,UAAUG,SAASlB,qBAAqBsD,mBAAmB,EACvDlC,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMmB,uBAAuBnC,EAAEJ,QAAQhB,qBAAqBwD,YAAY;GACxE,MAAML,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAIvC,wBACP8D,iBACAI,aACA;IACId,QAAQzB,OAAO0B;IACfgB,QAAQ1C,OAAO2C;GACnB,GACAH,sBACAJ,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqB4D,gBAAgB,EACpDxC,aAAaC,MAAAA;GAIT,OAAO,IAAI3B,qBAHa2B,EAAEJ,QAAQjB,qBAAqB2B,eAInDwB,GAHgB9B,EAAEJ,QAAQjB,qBAAqBqC,WAI/CkB,GACA;IACId,QAAQzB,OAAO6C;IACfH,QAAQ1C,OAAO2C;GACnB,CAAA;EAER,EACJ,CAAA;EAGA5C,UAAUG,SAASlB,qBAAqB8D,oBAAoB,EACxD1C,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMe,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GAEpF,OAAO,IAAIhC,yBACPuD,iBACAI,aACA;IACId,QAAQzB,OAAO+C;IACfL,QAAQ1C,OAAO2C;GACnB,GACAP,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBgE,mBAAmB,EACvD5C,aAAaC,MAAAA;GAKT,OAAO,IAAI1B,wBAAwB;IAC/B2B,YALeD,EAAEJ,QAAQjB,qBAAqB2B,eAK9CL;IACA2C,QALW5C,EAAEJ,QAAQjB,qBAAqBqC,WAK1C4B;IAEAC,kBANqB7C,EAAEJ,QAAQhB,qBAAqBkE,QAMpDD;IAEAE,SAAS;KAEL3B,QAAQzB,OAAO0B;KACfgB,QAAQ1C,OAAO2C;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["SymmetricCipher","CacheInjectionKey","ModuleName","LoggerInjectionKey","ConsentRepositoryAdapter","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2ScopeRepository","OAuth2TokenRepository","SessionTokenRepositoryAdapter","KeyRepositoryAdapter","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2MfaTokenIssuer","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","SessionTokenRepository","DataSource","ConsentRepository","KeyStore","secretsCipher","secretsEncryptionKey","env","logger","warn","TokenSigner","keyStore","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","sessionTokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","MfaTokenIssuer","mfaTicketMaxAge","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { SymmetricCipher } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nimport {\n    ConsentRepositoryAdapter,\n    OAuth2AuthorizationCodeRepository,\n    OAuth2AuthorizationStateRepository,\n    OAuth2ClientRepository,\n    OAuth2ScopeRepository,\n    OAuth2TokenRepository,\n    SessionTokenRepositoryAdapter,\n} from './repositories/index.ts';\nimport { KeyRepositoryAdapter } from '../database/repositories/index.ts';\nimport {\n    OAuth2AccessTokenIssuer,\n    OAuth2AuthorizationCodeIssuer,\n    OAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeVerifier,\n    OAuth2AuthorizationStateManager,\n    OAuth2MfaTokenIssuer,\n    OAuth2OpenIDTokenIssuer,\n    OAuth2RefreshTokenIssuer,\n    OAuth2TokenRevoker,\n    OAuth2TokenSigner,\n    OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.OAUTH2;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n    }\n\n    async setup(container: IContainer) : Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        container.register(OAuth2InjectionToken.ClientRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n                return new OAuth2ClientRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.ScopeRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n                return new OAuth2ScopeRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationCodeRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationStateRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2TokenRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.SessionTokenRepository, {\n            useFactory: (c) => new SessionTokenRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.ConsentRepository, {\n            useFactory: (c) => new ConsentRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.KeyStore, {\n            // todo: cache use here\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n\n                let secretsCipher : SymmetricCipher | null = null;\n                if (config.secretsEncryptionKey) {\n                    secretsCipher = new SymmetricCipher(config.secretsEncryptionKey);\n                } else if (config.env === 'production') {\n                    // parity posture without a KEK (Keycloak/authentik store key\n                    // material plaintext too) — but say so once, loudly.\n                    const logger = c.resolve(LoggerInjectionKey);\n                    logger.warn(\n                        'The realm key store persists key material unwrapped; ' +\n                        'set SECRETS_ENCRYPTION_KEY to wrap it at rest.',\n                    );\n                }\n\n                return new KeyRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource), { secretsCipher });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenSigner, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                return new OAuth2TokenSigner(keyStore);\n            },\n        });\n\n        // authorization code issuer\n        container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeIssuer(\n                    codeRepository,\n                    {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                    },\n                );\n            },\n        });\n        container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeVerifier(codeRepository);\n            },\n        });\n\n        // authorization code request verifier\n        container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n            useFactory: (c) => {\n                const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n                const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n                return new OAuth2AuthorizationCodeRequestVerifier({\n                    clientRepository,\n                    scopeRepository: clientScopeRepository,\n                });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n            useFactory: (c) => {\n                const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n                return new OAuth2AuthorizationStateManager(stateRepository);\n            },\n        });\n\n        // token revoker\n        container.register(OAuth2InjectionToken.TokenRevoker, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2TokenRevoker(tokenRepository, sessionTokenRepository);\n            },\n        });\n\n        // token verifier\n        container.register(OAuth2InjectionToken.TokenVerifier, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n                return new OAuth2TokenVerifier(keyStore, tokenRepository);\n            },\n        });\n\n        // access token issuer\n        container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2AccessTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    identityRoleProvider,\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // mfa login-ticket issuer\n        container.register(OAuth2InjectionToken.MfaTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n                return new OAuth2MfaTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.mfaTicketMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                );\n            },\n        });\n\n        // refresh token issuer\n        container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n\n                return new OAuth2RefreshTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenRefreshMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // open-id token issuer\n        container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n            useFactory: (c) => {\n                const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n                return new OAuth2OpenIDTokenIssuer({\n                    repository,\n                    signer,\n\n                    identityResolver,\n\n                    options: {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,IAAa6B,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAO5B,WAAW8B;EACvB,KAAKD,eAAe;GAAC7B,WAAW+B;GAAU/B,WAAWgC;GAAOhC,WAAWiC;GAAQjC,WAAWkC;EAAS;CACvG;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GAET,OAAO,IAAIrC,uBADQqC,EAAEJ,QAAkCf,YACrBoB,CAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GAET,OAAO,IAAIpC,sBADQoC,EAAEJ,QAAuCd,iBAC3BmB,CAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GAET,OAAO,IAAIvC,kCADGuC,EAAEJ,QAAQvC,iBACqB+C,CAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GAET,OAAO,IAAItC,mCADGsC,EAAEJ,QAAQvC,iBACsB+C,CAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GAET,OAAO,IAAInC,sBADGmC,EAAEJ,QAAQvC,iBACS+C,CAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,wBAAwB,EAC5DR,aAAaC,MAAM,IAAIlC,8BACnBkC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,mBAAmB,EACvDV,aAAaC,MAAM,IAAIxC,yBACnBwC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB+B,UAAU,EAE9CX,aAAaC,MAAAA;GACT,MAAML,SAASK,EAAEJ,QAAQb,kBAAAA;GAEzB,IAAI4B,gBAAyC;GAC7C,IAAIhB,OAAOiB,sBACPD,gBAAgB,IAAIvD,gBAAgBuC,OAAOiB,oBAAoB;QAC5D,IAAIjB,OAAOkB,QAAQ,cAItBC,EADiBlB,QAAQrC,kBACzBuD,CAAAA,CAAOC,KACH,qGACA;GAIR,OAAO,IAAIhD,qBAAqBiC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,GAAG,EAAEG,cAAc,CAAA;EAChG,EACJ,CAAA;EAEAjB,UAAUG,SAASlB,qBAAqBqC,aAAa,EACjDjB,aAAaC,MAAAA;GAET,OAAO,IAAIvB,kBADMuB,EAAEJ,QAAQjB,qBAAqB+B,QACnBO,CAAAA;EACjC,EACJ,CAAA;EAGAvB,UAAUG,SAASlB,qBAAqBuC,yBAAyB,EAC7DnB,aAAaC,MAAAA;GAGT,OAAO,IAAI/B,8BAFY+B,EAAEJ,QAAQjB,qBAAqBwB,2BAGlDgB,GACA,EAEIC,QAAQzB,OAAO0B,kBACnB,CAAA;EAER,EACJ,CAAA;EACA3B,UAAUG,SAASlB,qBAAqB2C,2BAA2B,EAC/DvB,aAAaC,MAAAA;GAGT,OAAO,IAAI7B,gCAFY6B,EAAEJ,QAAQjB,qBAAqBwB,2BAEXgB,CAAAA;EAC/C,EACJ,CAAA;EAGAzB,UAAUG,SAASlB,qBAAqB4C,kCAAkC,EACtExB,aAAaC,MAAAA;GAIT,OAAO,IAAI9B,uCAAuC;IAC9CsD,kBAJqBxB,EAAEJ,QAAQjB,qBAAqBmB,gBAIpD0B;IACAE,iBAJ0B1B,EAAEJ,QAAQjB,qBAAqBuB,eAIxCuB;GACrB,CAAA;EACJ,EACJ,CAAA;EAEA/B,UAAUG,SAASlB,qBAAqBgD,2BAA2B,EAC/D5B,aAAaC,MAAAA;GAGT,OAAO,IAAI5B,gCAFa4B,EAAEJ,QAAQjB,qBAAqB0B,4BAEZuB,CAAAA;EAC/C,EACJ,CAAA;EAGAlC,UAAUG,SAASlB,qBAAqBkD,cAAc,EAClD9B,aAAaC,MAAAA;GAGT,OAAO,IAAIxB,mBAFawB,EAAEJ,QAAQjB,qBAAqB2B,eAEzBwB,GADC9B,EAAEJ,QAAQjB,qBAAqB4B,sBACfwB,CAAAA;EACnD,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBqD,eAAe,EACnDjC,aAAaC,MAAAA;GAIT,OAAO,IAAItB,oBAHMsB,EAAEJ,QAAQjB,qBAAqB+B,QAGjBO,GAFPjB,EAAEJ,QAAQjB,qBAAqB2B,eAEdwB,CAAAA;EAC7C,EACJ,CAAA;EAGApC,UAAUG,SAASlB,qBAAqBsD,mBAAmB,EACvDlC,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMmB,uBAAuBnC,EAAEJ,QAAQhB,qBAAqBwD,YAAY;GACxE,MAAML,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAIvC,wBACP8D,iBACAI,aACA;IACId,QAAQzB,OAAO0B;IACfgB,QAAQ1C,OAAO2C;GACnB,GACAH,sBACAJ,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqB4D,gBAAgB,EACpDxC,aAAaC,MAAAA;GAIT,OAAO,IAAI3B,qBAHa2B,EAAEJ,QAAQjB,qBAAqB2B,eAInDwB,GAHgB9B,EAAEJ,QAAQjB,qBAAqBqC,WAI/CkB,GACA;IACId,QAAQzB,OAAO6C;IACfH,QAAQ1C,OAAO2C;GACnB,CAAA;EAER,EACJ,CAAA;EAGA5C,UAAUG,SAASlB,qBAAqB8D,oBAAoB,EACxD1C,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMe,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GAEpF,OAAO,IAAIhC,yBACPuD,iBACAI,aACA;IACId,QAAQzB,OAAO+C;IACfL,QAAQ1C,OAAO2C;GACnB,GACAP,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBgE,mBAAmB,EACvD5C,aAAaC,MAAAA;GAKT,OAAO,IAAI1B,wBAAwB;IAC/B2B,YALeD,EAAEJ,QAAQjB,qBAAqB2B,eAK9CL;IACA2C,QALW5C,EAAEJ,QAAQjB,qBAAqBqC,WAK1C4B;IAEAC,kBANqB7C,EAAEJ,QAAQhB,qBAAqBkE,QAMpDD;IAEAE,SAAS;KAEL3B,QAAQzB,OAAO0B;KACfgB,QAAQ1C,OAAO2C;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}

package/dist/app/modules/oauth2/repositories/consent/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["IdentityType","buildRedisKeyPath","applyQuery","CachePrefix","ConsentEntity","isUniqueConstraintDatabaseError","applyRealmScopeSelect","ConsentRepositoryAdapter","repository","dataSource","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","leftJoin","addSelect","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","realmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findAllBySubjectClient","clientId","where","cache","prefix","CONSENT_COVERING","key","getMany","insertMissing","input","existing","existingTokens","Set","map","row","scope","missing","scopes","filter","token","has","userId","USER","entity","create","expiresAt","save","e","remove"],"sources":["../../../../../../src/app/modules/oauth2/repositories/consent/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { IdentityType  } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { applyQuery } from '../../../database/repositories/query.ts';\nimport { CachePrefix, ConsentEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isUniqueConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport type {\n    ConsentFindManyOptions,\n    ConsentOwner,\n    IConsentRepository,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../../database/repositories/helpers.ts';\n\nexport class ConsentRepositoryAdapter implements IConsentRepository {\n    protected repository: Repository<ConsentEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(ConsentEntity);\n    }\n\n    async findMany(\n        query: IQuery,\n        options: ConsentFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Consent>> {\n        const qb = this.repository.createQueryBuilder('consent');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'consent', ['sub', 'subKind']);\n\n        // Always expose only a client SUMMARY (id / name / displayName /\n        // builtIn) — NEVER the full ClientEntity (redirectUri + post-logout\n        // patterns = the trusted-origin set, grantTypes, baseUrl/rootUrl,\n        // secret-storage flags, accessPolicyId). `client` is deliberately\n        // absent from relations.allowed so a raw ?include=client cannot force\n        // the full-column join; the self-service Applications tab still gets\n        // the display name from this fixed projection.\n        qb.leftJoin('consent.client', 'client')\n            .addSelect([\n                'client.id',\n                'client.name',\n                'client.displayName',\n                'client.builtIn',\n            ]);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('consent.sub = :ownerSub AND consent.subKind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        if (options.realmId) {\n            // nested `/realms/:realmId/consents` mount — mandatory constraint,\n            // not overridable by a rapiq filter\n            qb.andWhere('consent.realmId = :realmId', { realmId: options.realmId });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Consent | null> {\n        return this.repository.findOneBy({ id });\n    }\n\n    async findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]> {\n        const qb = this.repository.createQueryBuilder('consent');\n        qb.where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n            clientId,\n            sub: owner.sub,\n            subKind: owner.subKind,\n        });\n        qb.cache(\n            buildRedisKeyPath({\n                prefix: CachePrefix.CONSENT_COVERING,\n                key: `${clientId}:${owner.subKind}:${owner.sub}`,\n            }),\n            60_000,\n        );\n\n        return qb.getMany();\n    }\n\n    async insertMissing(input: {\n        clientId: string,\n        realmId: string,\n        owner: ConsentOwner,\n        scopes: string[]\n    }): Promise<void> {\n        // uncached read — the diff must see the latest rows, and the covering\n        // cache entry must not be refreshed on the write path.\n        const existing = await this.repository.createQueryBuilder('consent')\n            .where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n                clientId: input.clientId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n            })\n            .getMany();\n\n        const existingTokens = new Set(existing.map((row) => row.scope));\n        const missing = input.scopes.filter((token) => !existingTokens.has(token));\n\n        // save-per-row (never a raw qb insert): entity-manager saves fire the\n        // ConsentEntitySubscriber — covering-cache invalidation, realtime\n        // destinations and audit mirroring depend on it. A duplicate-key\n        // violation is the benign race outcome under the unique index.\n        // Set the userId FK only when the subject is a user, so a user\n        // deletion cascade-drops its consent rows; non-user subjects leave it\n        // null (the row is still cleaned up when its client/realm is deleted).\n        const userId = input.owner.subKind === IdentityType.USER ?\n            input.owner.sub :\n            null;\n\n        for (const scope of missing) {\n            const entity = this.repository.create({\n                clientId: input.clientId,\n                realmId: input.realmId,\n                userId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n                scope,\n                expiresAt: null,\n            });\n\n            try {\n                await this.repository.save(entity);\n            } catch (e) {\n                if (!isUniqueConstraintDatabaseError(e)) {\n                    throw e;\n                }\n            }\n        }\n    }\n\n    async remove(entity: Consent): Promise<void> {\n        await this.repository.remove(entity as ConsentEntity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,IAAaO,2BAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcN,aAAAA;CAC/C;CAEA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAed,WAAWY,IAAIF,KAAAA;EAEtCN,sBAAsBQ,IAAI,WAAW,CAAC,OAAO,SAAA,CAAU;EASvDA,GAAGG,SAAS,kBAAkB,QAAA,CAAA,CACzBC,UAAU;GACP;GACA;GACA;GACA;GACH;EAEL,IAAIL,QAAQM,OAERL,GAAGM,SAAS,+DAA+D;GACvEC,UAAUR,QAAQM,MAAMG;GACxBC,cAAcV,QAAQM,MAAMK;EAChC,CAAA;EAGJ,IAAIX,QAAQY,SAGRX,GAAGM,SAAS,8BAA8B,EAAEK,SAASZ,QAAQY,QAAQ,CAAA;EAGzE,MAAM,CAACC,UAAUC,SAAS,MAAMb,GAAGc,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGX;GACP;EACJ;CACJ;CAEA,MAAMe,YAAYC,IAAqC;EACnD,OAAO,KAAKxB,WAAWyB,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,uBAAuBC,UAAkBhB,OAAyC;EACpF,MAAML,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAC9CD,GAAGsB,MAAM,sFAAsF;GAC3FD;GACAb,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA;EACAV,GAAGuB,MACCpC,kBAAkB;GACdqC,QAAQnC,YAAYoC;GACpBC,KAAK,GAAGL,SAAS,GAAGhB,MAAMK,QAAQ,GAAGL,MAAMG;EAC/C,CAAA,GACA,GAAA;EAGJ,OAAOR,GAAG2B,QAAO;CACrB;CAEA,MAAMC,cAAcC,OAKF;EAGd,MAAMC,WAAW,MAAM,KAAKpC,WAAWO,mBAAmB,SAAA,CAAA,CACrDqB,MAAM,sFAAsF;GACzFD,UAAUQ,MAAMR;GAChBb,KAAKqB,MAAMxB,MAAMG;GACjBE,SAASmB,MAAMxB,MAAMK;EACzB,CAAA,CAAA,CACCiB,QAAO;EAEZ,MAAMI,iBAAiB,IAAIC,IAAIF,SAASG,KAAKC,QAAQA,IAAIC,KAAK,CAAA;EAC9D,MAAMC,UAAUP,MAAMQ,OAAOC,QAAQC,UAAU,CAACR,eAAeS,IAAID,KAAAA,CAAAA;EASnE,MAAME,SAASZ,MAAMxB,MAAMK,YAAYxB,aAAawD,OAChDb,MAAMxB,MAAMG,MACZ;EAEJ,KAAK,MAAM2B,SAASC,SAAS;GACzB,MAAMO,SAAS,KAAKjD,WAAWkD,OAAO;IAClCvB,UAAUQ,MAAMR;IAChBV,SAASkB,MAAMlB;IACf8B;IACAjC,KAAKqB,MAAMxB,MAAMG;IACjBE,SAASmB,MAAMxB,MAAMK;IACrByB;IACAU,WAAW;GACf,CAAA;GAEA,IAAI;IACA,MAAM,KAAKnD,WAAWoD,KAAKH,MAAAA;GAC/B,SAASI,GAAG;IACR,IAAI,CAACxD,gCAAgCwD,CAAAA,GACjC,MAAMA;GAEd;EACJ;CACJ;CAEA,MAAMC,OAAOL,QAAgC;EACzC,MAAM,KAAKjD,WAAWsD,OAAOL,MAAAA;CACjC;AACJ"}
+{"version":3,"file":"repository.mjs","names":["IdentityType","buildRedisKeyPath","applyQuery","CachePrefix","ConsentEntity","isUniqueConstraintDatabaseError","applyRealmScopeSelect","ConsentRepositoryAdapter","repository","dataSource","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","leftJoin","addSelect","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","realmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findAllBySubjectClient","clientId","where","cache","prefix","CONSENT_COVERING","key","getMany","insertMissing","input","existing","existingTokens","Set","map","row","scope","missing","scopes","filter","token","has","userId","USER","entity","create","expiresAt","save","e","remove"],"sources":["../../../../../../src/app/modules/oauth2/repositories/consent/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { IdentityType  } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { applyQuery } from '../../../database/repositories/query.ts';\nimport { CachePrefix, ConsentEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isUniqueConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport type {\n    ConsentFindManyOptions,\n    ConsentOwner,\n    IConsentRepository,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../../database/repositories/helpers.ts';\n\nexport class ConsentRepositoryAdapter implements IConsentRepository {\n    protected repository: Repository<ConsentEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(ConsentEntity);\n    }\n\n    async findMany(\n        query: IQuery,\n        options: ConsentFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Consent>> {\n        const qb = this.repository.createQueryBuilder('consent');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'consent', ['sub', 'subKind']);\n\n        // Always expose only a client SUMMARY (id / name / displayName /\n        // builtIn) — NEVER the full ClientEntity (redirectUri + post-logout\n        // patterns = the trusted-origin set, grantTypes, baseUrl/rootUrl,\n        // secret-storage flags, accessPolicyId). `client` is deliberately\n        // absent from relations.allowed so a raw ?include=client cannot force\n        // the full-column join; the self-service Applications tab still gets\n        // the display name from this fixed projection.\n        qb.leftJoin('consent.client', 'client')\n            .addSelect([\n                'client.id',\n                'client.name',\n                'client.displayName',\n                'client.builtIn',\n            ]);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('consent.sub = :ownerSub AND consent.subKind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        if (options.realmId) {\n            // nested `/realms/:realmId/consents` mount — mandatory constraint,\n            // not overridable by a rapiq filter\n            qb.andWhere('consent.realmId = :realmId', { realmId: options.realmId });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Consent | null> {\n        return this.repository.findOneBy({ id });\n    }\n\n    async findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]> {\n        const qb = this.repository.createQueryBuilder('consent');\n        qb.where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n            clientId,\n            sub: owner.sub,\n            subKind: owner.subKind,\n        });\n        qb.cache(\n            buildRedisKeyPath({\n                prefix: CachePrefix.CONSENT_COVERING,\n                key: `${clientId}:${owner.subKind}:${owner.sub}`,\n            }),\n            60_000,\n        );\n\n        return qb.getMany();\n    }\n\n    async insertMissing(input: {\n        clientId: string,\n        realmId: string,\n        owner: ConsentOwner,\n        scopes: string[]\n    }): Promise<void> {\n        // uncached read — the diff must see the latest rows, and the covering\n        // cache entry must not be refreshed on the write path.\n        const existing = await this.repository.createQueryBuilder('consent')\n            .where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n                clientId: input.clientId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n            })\n            .getMany();\n\n        const existingTokens = new Set(existing.map((row) => row.scope));\n        const missing = input.scopes.filter((token) => !existingTokens.has(token));\n\n        // save-per-row (never a raw qb insert): entity-manager saves fire the\n        // ConsentEntitySubscriber — covering-cache invalidation, realtime\n        // destinations and audit mirroring depend on it. A duplicate-key\n        // violation is the benign race outcome under the unique index.\n        // Set the userId FK only when the subject is a user, so a user\n        // deletion cascade-drops its consent rows; non-user subjects leave it\n        // null (the row is still cleaned up when its client/realm is deleted).\n        const userId = input.owner.subKind === IdentityType.USER ?\n            input.owner.sub :\n            null;\n\n        for (const scope of missing) {\n            const entity = this.repository.create({\n                clientId: input.clientId,\n                realmId: input.realmId,\n                userId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n                scope,\n                expiresAt: null,\n            });\n\n            try {\n                await this.repository.save(entity);\n            } catch (e) {\n                if (!isUniqueConstraintDatabaseError(e)) {\n                    throw e;\n                }\n            }\n        }\n    }\n\n    async remove(entity: Consent): Promise<void> {\n        await this.repository.remove(entity as ConsentEntity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,IAAaO,2BAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcN,aAAAA;CAC/C;CAEA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAed,WAAWY,IAAIF,KAAAA;EAEtCN,sBAAsBQ,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EASvDA,GAAGG,SAAS,kBAAkB,QAAA,CAAA,CACzBC,UAAU;GACP;GACA;GACA;GACA;EACH,CAAA;EAEL,IAAIL,QAAQM,OAERL,GAAGM,SAAS,+DAA+D;GACvEC,UAAUR,QAAQM,MAAMG;GACxBC,cAAcV,QAAQM,MAAMK;EAChC,CAAA;EAGJ,IAAIX,QAAQY,SAGRX,GAAGM,SAAS,8BAA8B,EAAEK,SAASZ,QAAQY,QAAQ,CAAA;EAGzE,MAAM,CAACC,UAAUC,SAAS,MAAMb,GAAGc,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGX;GACP;EACJ;CACJ;CAEA,MAAMe,YAAYC,IAAqC;EACnD,OAAO,KAAKxB,WAAWyB,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,uBAAuBC,UAAkBhB,OAAyC;EACpF,MAAML,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAC9CD,GAAGsB,MAAM,sFAAsF;GAC3FD;GACAb,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA;EACAV,GAAGuB,MACCpC,kBAAkB;GACdqC,QAAQnC,YAAYoC;GACpBC,KAAK,GAAGL,SAAS,GAAGhB,MAAMK,QAAQ,GAAGL,MAAMG;EAC/C,CAAA,GACA,GAAA;EAGJ,OAAOR,GAAG2B,QAAO;CACrB;CAEA,MAAMC,cAAcC,OAKF;EAGd,MAAMC,WAAW,MAAM,KAAKpC,WAAWO,mBAAmB,SAAA,CAAA,CACrDqB,MAAM,sFAAsF;GACzFD,UAAUQ,MAAMR;GAChBb,KAAKqB,MAAMxB,MAAMG;GACjBE,SAASmB,MAAMxB,MAAMK;EACzB,CAAA,CAAA,CACCiB,QAAO;EAEZ,MAAMI,iBAAiB,IAAIC,IAAIF,SAASG,KAAKC,QAAQA,IAAIC,KAAK,CAAA;EAC9D,MAAMC,UAAUP,MAAMQ,OAAOC,QAAQC,UAAU,CAACR,eAAeS,IAAID,KAAAA,CAAAA;EASnE,MAAME,SAASZ,MAAMxB,MAAMK,YAAYxB,aAAawD,OAChDb,MAAMxB,MAAMG,MACZ;EAEJ,KAAK,MAAM2B,SAASC,SAAS;GACzB,MAAMO,SAAS,KAAKjD,WAAWkD,OAAO;IAClCvB,UAAUQ,MAAMR;IAChBV,SAASkB,MAAMlB;IACf8B;IACAjC,KAAKqB,MAAMxB,MAAMG;IACjBE,SAASmB,MAAMxB,MAAMK;IACrByB;IACAU,WAAW;GACf,CAAA;GAEA,IAAI;IACA,MAAM,KAAKnD,WAAWoD,KAAKH,MAAAA;GAC/B,SAASI,GAAG;IACR,IAAI,CAACxD,gCAAgCwD,CAAAA,GACjC,MAAMA;GAEd;EACJ;CACJ;CAEA,MAAMC,OAAOL,QAAgC;EACzC,MAAM,KAAKjD,WAAWsD,OAAOL,MAAAA;CACjC;AACJ"}

package/dist/app/modules/oauth2/repositories/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["CacheOAuth2Prefix"],"sources":["../../../../../src/app/modules/oauth2/repositories/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nexport enum CacheOAuth2Prefix {\n    AUTHORIZATION_STATE = 'oauth2_authorization_state',\n    AUTHORIZATION_CODE = 'oauth2_authorization_code',\n    TOKEN = 'oauth2_token',\n    TOKEN_CLAIMS = 'oauth2_token_claims',\n    TOKEN_INACTIVE = 'oauth2_token_blocked',\n}\n"],"mappings":";;;;AAOA,IAAO,oBAAKA,uBAAAA,mBAAAA;;;;;;QAAAA"}
+{"version":3,"file":"constants.mjs","names":["CacheOAuth2Prefix"],"sources":["../../../../../src/app/modules/oauth2/repositories/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nexport enum CacheOAuth2Prefix {\n    AUTHORIZATION_STATE = 'oauth2_authorization_state',\n    AUTHORIZATION_CODE = 'oauth2_authorization_code',\n    TOKEN = 'oauth2_token',\n    TOKEN_CLAIMS = 'oauth2_token_claims',\n    TOKEN_INACTIVE = 'oauth2_token_blocked',\n}\n"],"mappings":";;;;AAOA,IAAO,oBAAKA,uBAAAA,mBAAAA;;;;;;CAAAA,OAAAA;AAMX,EAAA,CAAA,CAAA"}

package/dist/app/modules/provisioning/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","WebClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    PermissionEntity,\n    RealmEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({\n                cwd: provisioningDir,\n                logger: container.resolve(LoggerInjectionKey),\n            }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm public `web` client. Single provisioning mechanism:\n        // list every realm (incl. pre-existing) and upsert its web client.\n        // Idempotent; guarded on builtIn inside the provisioner.\n        // ---------------------------------------------------------------\n        const webClientProvisioner = new WebClientProvisioner({\n            clientRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use. The\n        // adapter is constructed locally (NOT resolved from the oauth2\n        // module's registration) so provisioning stays runnable in minimal\n        // module graphs (test setup, CLI); the KEK handling is identical.\n        const keyProvisioner = new KeyProvisioner({\n            keyStore: new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            }),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await webClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permissionId: permission.id,\n                    permissionRealmId: permission.realmId,\n                    policyId: defaultPolicy.id,\n                    policyRealmId: defaultPolicy.realmId,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6EA,IAAagD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAAA;EACnD,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAA,GAAI,KAAKA,OAAAA;EAEzB,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMwB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAElC,MAAMa,aAAab,UAAUE,QAAQtB,qBAAqBkC,UAAU;EACpE,MAAMC,kBAAkBf,UAAUE,QAA2BtD,WAAAA;EAE7D,MAAMoE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYjB,UAAUE,QAAsCvD,gBAAAA;GAC5DoE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI7D,iBAAiByD,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC8B,UAAUE,QAAsC/C,sBAAAA,CAAAA;EAGpD,MAAMiE,qBAAqB,IAAI3D,+BAA+B;GAC1DwD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI9C,sBAAsB;GAC7C0C,YAAYjB,UAAUE,QAA0BrD,UAAAA;GAChDkE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAIvD,wBAAwB;GACjDkD,YAAYjB,UAAUE,QAA4B1D,YAAAA;GAClDuE;EACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI/D,mCAAmC;GAClEyD,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAI7D,6BAA6B;GACtDsD,YAAYI;GACZL;GACAS,0BAA0B,IAAInD,gCAC1B0B,UAAUE,QAAoCpD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM4E,qBAAqB,IAAIpE,+BAA+B;GAC1DgE;GACAK,sBAAsB,IAAI3D,4BACtBgC,UAAUE,QAAgCxD,gBAAAA,CAAAA;GAE9CkF,4BAA4B,IAAI9D,kCAC5BkC,UAAUE,QAAsCzD,sBAAAA,CAAAA;GAGpD4E;GACAL;GAEAQ;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAIhE,6BAA6B;GACtDiE,gBAAgB,IAAIpD,sBAAsB;IACtCuC,YAAY,IAAI5D,eAAewD,UAAAA;IAC/BE;GACJ,CAAA;GACAgB,oBAAoB,IAAIpD,0BACpBqB,UAAUE,QAA8BjD,cAAAA,CAAAA;GAE5C+E,0BAA0B,IAAIvD,gCAC1BuB,UAAUE,QAAoClD,oBAAAA,CAAAA;GAGlDsE;GACAD;GACAL;EACJ,CAAA;EAOA,MAAMkB,oBAAoB,IAAItE,8BAA8B,EAAEqD,YAAYgB,IAL9CzD,uBAAuB;GAC/CyC,YAAYjB,UAAUE,QAA2BnD,WAAAA;GACjDgE;EACJ,CAE0EkB,EAAgB,CAAA;EAoB1F,MAAMG,IARuB7E,8BAA8B;GACvD6D;GACAG;GACAC;GACAW,mBAAAA,IAd0BzE,8BAA8B;IACxDuD,YAAY,IAAI5C,uBAAuB0C,eAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAK;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY1B,IAAAA;EAOnC,MAAM2B,uBAAuB,IAAIlD,qBAAqB;GAClDkC;GACAiB,YAAYtD,cAAcgB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMqD,iBAAiB,IAAInD,eAAe;GACtCoD,UAAU,IAAIxE,qBAAqB4C,YAAY,EAC3C6B,eAAezC,OAAO0C,uBAClB,IAAIzD,gBAAgBe,OAAO0C,oBAAoB,IAC/C,KACR,CAAA;GACAlC,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAEA,MAAMyD,SAAS,MAAM7B,gBAAgB8B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMN,qBAAqBS,eAAeD,KAAAA;GAC1C,MAAMN,eAAeO,eAAeD,KAAAA;EACxC;EAEA,IAAI7C,OAAO+C,oCACP,MAAM,KAAKC,oBAAoBpC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgB+B,oBACZpC,YACAK,kBACa;EACb,MAAMgC,gBAAgB,MAAMhC,iBAAiBiC,cAAcjG,iBAAiBkG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBxC,WAAWyC,cAAc3G,gBAAAA;EAChD,MAAM4G,eAAe1C,WAAWyC,cAAcnG,sBAAAA;EAE9C,MAAMqG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}
+{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","WebClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    PermissionEntity,\n    RealmEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({\n                cwd: provisioningDir,\n                logger: container.resolve(LoggerInjectionKey),\n            }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm public `web` client. Single provisioning mechanism:\n        // list every realm (incl. pre-existing) and upsert its web client.\n        // Idempotent; guarded on builtIn inside the provisioner.\n        // ---------------------------------------------------------------\n        const webClientProvisioner = new WebClientProvisioner({\n            clientRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use. The\n        // adapter is constructed locally (NOT resolved from the oauth2\n        // module's registration) so provisioning stays runnable in minimal\n        // module graphs (test setup, CLI); the KEK handling is identical.\n        const keyProvisioner = new KeyProvisioner({\n            keyStore: new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            }),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await webClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permissionId: permission.id,\n                    permissionRealmId: permission.realmId,\n                    policyId: defaultPolicy.id,\n                    policyRealmId: defaultPolicy.realmId,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6EA,IAAagD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMwB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAElC,MAAMa,aAAab,UAAUE,QAAQtB,qBAAqBkC,UAAU;EACpE,MAAMC,kBAAkBf,UAAUE,QAA2BtD,WAAAA;EAE7D,MAAMoE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYjB,UAAUE,QAAsCvD,gBAAAA;GAC5DoE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI7D,iBAAiByD,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC8B,UAAUE,QAAsC/C,sBAAAA,CAAAA;EAGpD,MAAMiE,qBAAqB,IAAI3D,+BAA+B;GAC1DwD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI9C,sBAAsB;GAC7C0C,YAAYjB,UAAUE,QAA0BrD,UAAAA;GAChDkE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAIvD,wBAAwB;GACjDkD,YAAYjB,UAAUE,QAA4B1D,YAAAA;GAClDuE;EACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI/D,mCAAmC;GAClEyD,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAI7D,6BAA6B;GACtDsD,YAAYI;GACZL;GACAS,0BAA0B,IAAInD,gCAC1B0B,UAAUE,QAAoCpD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM4E,qBAAqB,IAAIpE,+BAA+B;GAC1DgE;GACAK,sBAAsB,IAAI3D,4BACtBgC,UAAUE,QAAgCxD,gBAAAA,CAAAA;GAE9CkF,4BAA4B,IAAI9D,kCAC5BkC,UAAUE,QAAsCzD,sBAAAA,CAAAA;GAGpD4E;GACAL;GAEAQ;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAIhE,6BAA6B;GACtDiE,gBAAgB,IAAIpD,sBAAsB;IACtCuC,YAAY,IAAI5D,eAAewD,UAAAA;IAC/BE;GACJ,CAAA;GACAgB,oBAAoB,IAAIpD,0BACpBqB,UAAUE,QAA8BjD,cAAAA,CAAAA;GAE5C+E,0BAA0B,IAAIvD,gCAC1BuB,UAAUE,QAAoClD,oBAAAA,CAAAA;GAGlDsE;GACAD;GACAL;EACJ,CAAA;EAOA,MAAMkB,oBAAoB,IAAItE,8BAA8B,EAAEqD,YAAYgB,IAL9CzD,uBAAuB;GAC/CyC,YAAYjB,UAAUE,QAA2BnD,WAAAA;GACjDgE;EACJ,CAE0EkB,EAAgB,CAAA;EAoB1F,MAAMG,IARuB7E,8BAA8B;GACvD6D;GACAG;GACAC;GACAW,mBAAAA,IAd0BzE,8BAA8B;IACxDuD,YAAY,IAAI5C,uBAAuB0C,eAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAK;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY1B,IAAAA;EAOnC,MAAM2B,uBAAuB,IAAIlD,qBAAqB;GAClDkC;GACAiB,YAAYtD,cAAcgB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMqD,iBAAiB,IAAInD,eAAe;GACtCoD,UAAU,IAAIxE,qBAAqB4C,YAAY,EAC3C6B,eAAezC,OAAO0C,uBAClB,IAAIzD,gBAAgBe,OAAO0C,oBAAoB,IAC/C,KACR,CAAA;GACAlC,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAEA,MAAMyD,SAAS,MAAM7B,gBAAgB8B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMN,qBAAqBS,eAAeD,KAAAA;GAC1C,MAAMN,eAAeO,eAAeD,KAAAA;EACxC;EAEA,IAAI7C,OAAO+C,oCACP,MAAM,KAAKC,oBAAoBpC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgB+B,oBACZpC,YACAK,kBACa;EACb,MAAMgC,gBAAgB,MAAMhC,iBAAiBiC,cAAcjG,iBAAiBkG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBxC,WAAWyC,cAAc3G,gBAAAA;EAChD,MAAM4G,eAAe1C,WAAWyC,cAAcnG,sBAAAA;EAE9C,MAAMqG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}

package/dist/app/modules/provisioning/sources/composite/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["isObject","CompositeProvisioningSource","sources","load","container","output","sourcesData","Promise","all","map","source","sourceData","merge","target","policies","mergeEntities","permissions","roles","scopes","realms","buildEntityKey","attributes","name","undefined","realmId","clientId","result","forEach","item","key","push","idx","findIndex","r","mergeEntity","strategy","relations","mergeRecord","extraAttributes","children","Object","keys","mergeValue","Array","isArray","isEntityArray","Set","value","some"],"sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport type { IContainer } from 'eldin';\n\n/**\n * Structural view of a provisioning entity used by the composite merge.\n * Covers every entity shape (realm, client, user, role, permission, scope,\n * policy): the composite-key attribute bag plus the deep-mergeable groups.\n */\ntype MergeableProvisioningEntity = {\n    attributes: {\n        name?: string,\n        realmId?: string | null,\n        clientId?: string | null,\n    },\n    strategy?: unknown,\n    relations?: Record<string, unknown>,\n    children?: MergeableProvisioningEntity[],\n    extraAttributes?: Record<string, unknown>,\n};\n\nexport class CompositeProvisioningSource implements IProvisioningSource {\n    protected sources : IProvisioningSource[];\n\n    constructor(sources : IProvisioningSource[]) {\n        this.sources = sources;\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const output : RootProvisioningEntity = {};\n\n        const sourcesData = await Promise.all(\n            (this.sources).map((source) => source.load(container)),\n        );\n\n        sourcesData.map((sourceData) => this.merge(output, sourceData));\n\n        return output;\n    }\n\n    merge(target: RootProvisioningEntity, source: RootProvisioningEntity) {\n        target.policies = this.mergeEntities(target.policies, source.policies);\n        target.permissions = this.mergeEntities(target.permissions, source.permissions);\n        target.roles = this.mergeEntities(target.roles, source.roles);\n        target.scopes = this.mergeEntities(target.scopes, source.scopes);\n        target.realms = this.mergeEntities(target.realms, source.realms);\n    }\n\n    private buildEntityKey(\n        attributes: MergeableProvisioningEntity['attributes'],\n    ): string | undefined {\n        if (!attributes.name) return undefined;\n        return `${attributes.name}:${attributes.realmId || ''}:${attributes.clientId || ''}`;\n    }\n\n    private mergeEntities<T extends MergeableProvisioningEntity>(\n        target: T[] | undefined,\n        source: T[] | undefined,\n    ): T[] | undefined {\n        if (!source) return target;\n        if (!target) return [...source];\n\n        const result = [...target];\n        source.forEach((item) => {\n            const key = this.buildEntityKey(item.attributes);\n            if (!key) {\n                result.push(item);\n                return;\n            }\n\n            const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);\n            if (idx !== -1) {\n                result[idx] = this.mergeEntity(result[idx], item) as T;\n            } else {\n                result.push(item);\n            }\n        });\n        return result;\n    }\n\n    /**\n     * Deep-merge two entries sharing a composite key. The later source wins\n     * per attribute, but relations are UNIONED — a later source (e.g. a\n     * mounted provisioning file) extending a built-in entry (the default\n     * source's master realm) must not silently drop the built-in relations\n     * (admin user, system client).\n     *\n     * Policy extraAttributes merge per key with the later source winning —\n     * like attributes, NOT like relations: an EA value (a names denylist,\n     * an ATTRIBUTES query tree) is policy configuration, and unioning would\n     * make shrinking a list impossible and fabricate predicates neither\n     * source authored.\n     */\n    private mergeEntity(\n        target: MergeableProvisioningEntity,\n        source: MergeableProvisioningEntity,\n    ): MergeableProvisioningEntity {\n        const output = { ...target, ...source };\n\n        output.attributes = { ...target.attributes, ...source.attributes };\n\n        if (target.strategy && !source.strategy) {\n            output.strategy = target.strategy;\n        }\n\n        if (target.relations && source.relations) {\n            output.relations = this.mergeRecord(target.relations, source.relations);\n        } else if (target.relations && !source.relations) {\n            output.relations = target.relations;\n        }\n\n        if (target.extraAttributes && source.extraAttributes) {\n            output.extraAttributes = { ...target.extraAttributes, ...source.extraAttributes };\n        } else if (target.extraAttributes && !source.extraAttributes) {\n            output.extraAttributes = target.extraAttributes;\n        }\n\n        if (target.children && source.children) {\n            output.children = this.mergeEntities(target.children, source.children);\n        } else if (target.children && !source.children) {\n            output.children = target.children;\n        }\n\n        return output;\n    }\n\n    private mergeRecord(\n        target: Record<string, unknown>,\n        source: Record<string, unknown>,\n    ): Record<string, unknown> {\n        const output : Record<string, unknown> = { ...target };\n        for (const key of Object.keys(source)) {\n            output[key] = key in target ?\n                this.mergeValue(target[key], source[key]) :\n                source[key];\n        }\n        return output;\n    }\n\n    private mergeValue(target: unknown, source: unknown): unknown {\n        if (typeof target === 'undefined') return source;\n        if (typeof source === 'undefined') return target;\n\n        if (Array.isArray(target) && Array.isArray(source)) {\n            if (this.isEntityArray(target) || this.isEntityArray(source)) {\n                return this.mergeEntities(\n                    target as MergeableProvisioningEntity[],\n                    source as MergeableProvisioningEntity[],\n                );\n            }\n            return [...new Set([...target, ...source])];\n        }\n\n        if (isObject(target) && isObject(source)) {\n            return this.mergeRecord(target, source);\n        }\n\n        return source;\n    }\n\n    private isEntityArray(value: unknown[]): value is MergeableProvisioningEntity[] {\n        return value.some(\n            (item) => isObject(item) && 'attributes' in item,\n        );\n    }\n}\n"],"mappings":";;;;;AA6BA,IAAaC,8BAAb,MAAaA;CACCC;CAEV,YAAYA,SAAiC;EACzC,KAAKA,UAAUA;CACnB;CAEA,MAAMC,KAAKC,WAAwD;EAC/D,MAAMC,SAAkC,CAAC;EAMzCC,CAAAA,MAJ0BC,QAAQC,IAC9B,KAAMN,QAASO,KAAKC,WAAWA,OAAOP,KAAKC,SAAAA,CAAAA,CAAAA,EAAAA,CAGnCK,KAAKE,eAAe,KAAKC,MAAMP,QAAQM,UAAAA,CAAAA;EAEnD,OAAON;CACX;CAEAO,MAAMC,QAAgCH,QAAgC;EAClEG,OAAOC,WAAW,KAAKC,cAAcF,OAAOC,UAAUJ,OAAOI,QAAQ;EACrED,OAAOG,cAAc,KAAKD,cAAcF,OAAOG,aAAaN,OAAOM,WAAW;EAC9EH,OAAOI,QAAQ,KAAKF,cAAcF,OAAOI,OAAOP,OAAOO,KAAK;EAC5DJ,OAAOK,SAAS,KAAKH,cAAcF,OAAOK,QAAQR,OAAOQ,MAAM;EAC/DL,OAAOM,SAAS,KAAKJ,cAAcF,OAAOM,QAAQT,OAAOS,MAAM;CACnE;CAEQC,eACJC,YACkB;EAClB,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;EAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,WAAW,GAAG,GAAGH,WAAWI,YAAY;CACpF;CAEQV,cACJF,QACAH,QACe;EACf,IAAI,CAACA,QAAQ,OAAOG;EACpB,IAAI,CAACA,QAAQ,OAAO,CAAA,GAAIH,MAAAA;EAExB,MAAMgB,SAAS,CAAA,GAAIb,MAAAA;EACnBH,OAAOiB,SAASC,SAAAA;GACZ,MAAMC,MAAM,KAAKT,eAAeQ,KAAKP,UAAU;GAC/C,IAAI,CAACQ,KAAK;IACNH,OAAOI,KAAKF,IAAAA;IACZ;GACJ;GAEA,MAAMG,MAAML,OAAOM,WAAWC,MAAM,KAAKb,eAAea,EAAEZ,UAAU,MAAMQ,GAAAA;GAC1E,IAAIE,QAAQ,IACRL,OAAOK,OAAO,KAAKG,YAAYR,OAAOK,MAAMH,IAAAA;QAE5CF,OAAOI,KAAKF,IAAAA;EAEpB,CAAA;EACA,OAAOF;CACX;;;;;;;;;;;;;IAeA,YACIb,QACAH,QAC2B;EAC3B,MAAML,SAAS;GAAE,GAAGQ;GAAQ,GAAGH;EAAO;EAEtCL,OAAOgB,aAAa;GAAE,GAAGR,OAAOQ;GAAY,GAAGX,OAAOW;EAAW;EAEjE,IAAIR,OAAOsB,YAAY,CAACzB,OAAOyB,UAC3B9B,OAAO8B,WAAWtB,OAAOsB;EAG7B,IAAItB,OAAOuB,aAAa1B,OAAO0B,WAC3B/B,OAAO+B,YAAY,KAAKC,YAAYxB,OAAOuB,WAAW1B,OAAO0B,SAAS;OACnE,IAAIvB,OAAOuB,aAAa,CAAC1B,OAAO0B,WACnC/B,OAAO+B,YAAYvB,OAAOuB;EAG9B,IAAIvB,OAAOyB,mBAAmB5B,OAAO4B,iBACjCjC,OAAOiC,kBAAkB;GAAE,GAAGzB,OAAOyB;GAAiB,GAAG5B,OAAO4B;EAAgB;OAC7E,IAAIzB,OAAOyB,mBAAmB,CAAC5B,OAAO4B,iBACzCjC,OAAOiC,kBAAkBzB,OAAOyB;EAGpC,IAAIzB,OAAO0B,YAAY7B,OAAO6B,UAC1BlC,OAAOkC,WAAW,KAAKxB,cAAcF,OAAO0B,UAAU7B,OAAO6B,QAAQ;OAClE,IAAI1B,OAAO0B,YAAY,CAAC7B,OAAO6B,UAClClC,OAAOkC,WAAW1B,OAAO0B;EAG7B,OAAOlC;CACX;CAEQgC,YACJxB,QACAH,QACuB;EACvB,MAAML,SAAmC,EAAE,GAAGQ,OAAO;EACrD,KAAK,MAAMgB,OAAOW,OAAOC,KAAK/B,MAAAA,GAC1BL,OAAOwB,OAAOA,OAAOhB,SACjB,KAAK6B,WAAW7B,OAAOgB,MAAMnB,OAAOmB,IAAI,IACxCnB,OAAOmB;EAEf,OAAOxB;CACX;CAEQqC,WAAW7B,QAAiBH,QAA0B;EAC1D,IAAI,OAAOG,WAAW,aAAa,OAAOH;EAC1C,IAAI,OAAOA,WAAW,aAAa,OAAOG;EAE1C,IAAI8B,MAAMC,QAAQ/B,MAAAA,KAAW8B,MAAMC,QAAQlC,MAAAA,GAAS;GAChD,IAAI,KAAKmC,cAAchC,MAAAA,KAAW,KAAKgC,cAAcnC,MAAAA,GACjD,OAAO,KAAKK,cACRF,QACAH,MAAAA;GAGR,OAAO,CAAA,mBAAI,IAAIoC,IAAI,CAAA,GAAIjC,QAAAA,GAAWH,MAAAA,CAAO,CAAA;EAC7C;EAEA,IAAIV,SAASa,MAAAA,KAAWb,SAASU,MAAAA,GAC7B,OAAO,KAAK2B,YAAYxB,QAAQH,MAAAA;EAGpC,OAAOA;CACX;CAEQmC,cAAcE,OAA0D;EAC5E,OAAOA,MAAMC,MACRpB,SAAS5B,SAAS4B,IAAAA,KAAS,gBAAgBA,IAAAA;CAEpD;AACJ"}
+{"version":3,"file":"module.mjs","names":["isObject","CompositeProvisioningSource","sources","load","container","output","sourcesData","Promise","all","map","source","sourceData","merge","target","policies","mergeEntities","permissions","roles","scopes","realms","buildEntityKey","attributes","name","undefined","realmId","clientId","result","forEach","item","key","push","idx","findIndex","r","mergeEntity","strategy","relations","mergeRecord","extraAttributes","children","Object","keys","mergeValue","Array","isArray","isEntityArray","Set","value","some"],"sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport type { IContainer } from 'eldin';\n\n/**\n * Structural view of a provisioning entity used by the composite merge.\n * Covers every entity shape (realm, client, user, role, permission, scope,\n * policy): the composite-key attribute bag plus the deep-mergeable groups.\n */\ntype MergeableProvisioningEntity = {\n    attributes: {\n        name?: string,\n        realmId?: string | null,\n        clientId?: string | null,\n    },\n    strategy?: unknown,\n    relations?: Record<string, unknown>,\n    children?: MergeableProvisioningEntity[],\n    extraAttributes?: Record<string, unknown>,\n};\n\nexport class CompositeProvisioningSource implements IProvisioningSource {\n    protected sources : IProvisioningSource[];\n\n    constructor(sources : IProvisioningSource[]) {\n        this.sources = sources;\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const output : RootProvisioningEntity = {};\n\n        const sourcesData = await Promise.all(\n            (this.sources).map((source) => source.load(container)),\n        );\n\n        sourcesData.map((sourceData) => this.merge(output, sourceData));\n\n        return output;\n    }\n\n    merge(target: RootProvisioningEntity, source: RootProvisioningEntity) {\n        target.policies = this.mergeEntities(target.policies, source.policies);\n        target.permissions = this.mergeEntities(target.permissions, source.permissions);\n        target.roles = this.mergeEntities(target.roles, source.roles);\n        target.scopes = this.mergeEntities(target.scopes, source.scopes);\n        target.realms = this.mergeEntities(target.realms, source.realms);\n    }\n\n    private buildEntityKey(\n        attributes: MergeableProvisioningEntity['attributes'],\n    ): string | undefined {\n        if (!attributes.name) return undefined;\n        return `${attributes.name}:${attributes.realmId || ''}:${attributes.clientId || ''}`;\n    }\n\n    private mergeEntities<T extends MergeableProvisioningEntity>(\n        target: T[] | undefined,\n        source: T[] | undefined,\n    ): T[] | undefined {\n        if (!source) return target;\n        if (!target) return [...source];\n\n        const result = [...target];\n        source.forEach((item) => {\n            const key = this.buildEntityKey(item.attributes);\n            if (!key) {\n                result.push(item);\n                return;\n            }\n\n            const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);\n            if (idx !== -1) {\n                result[idx] = this.mergeEntity(result[idx], item) as T;\n            } else {\n                result.push(item);\n            }\n        });\n        return result;\n    }\n\n    /**\n     * Deep-merge two entries sharing a composite key. The later source wins\n     * per attribute, but relations are UNIONED — a later source (e.g. a\n     * mounted provisioning file) extending a built-in entry (the default\n     * source's master realm) must not silently drop the built-in relations\n     * (admin user, system client).\n     *\n     * Policy extraAttributes merge per key with the later source winning —\n     * like attributes, NOT like relations: an EA value (a names denylist,\n     * an ATTRIBUTES query tree) is policy configuration, and unioning would\n     * make shrinking a list impossible and fabricate predicates neither\n     * source authored.\n     */\n    private mergeEntity(\n        target: MergeableProvisioningEntity,\n        source: MergeableProvisioningEntity,\n    ): MergeableProvisioningEntity {\n        const output = { ...target, ...source };\n\n        output.attributes = { ...target.attributes, ...source.attributes };\n\n        if (target.strategy && !source.strategy) {\n            output.strategy = target.strategy;\n        }\n\n        if (target.relations && source.relations) {\n            output.relations = this.mergeRecord(target.relations, source.relations);\n        } else if (target.relations && !source.relations) {\n            output.relations = target.relations;\n        }\n\n        if (target.extraAttributes && source.extraAttributes) {\n            output.extraAttributes = { ...target.extraAttributes, ...source.extraAttributes };\n        } else if (target.extraAttributes && !source.extraAttributes) {\n            output.extraAttributes = target.extraAttributes;\n        }\n\n        if (target.children && source.children) {\n            output.children = this.mergeEntities(target.children, source.children);\n        } else if (target.children && !source.children) {\n            output.children = target.children;\n        }\n\n        return output;\n    }\n\n    private mergeRecord(\n        target: Record<string, unknown>,\n        source: Record<string, unknown>,\n    ): Record<string, unknown> {\n        const output : Record<string, unknown> = { ...target };\n        for (const key of Object.keys(source)) {\n            output[key] = key in target ?\n                this.mergeValue(target[key], source[key]) :\n                source[key];\n        }\n        return output;\n    }\n\n    private mergeValue(target: unknown, source: unknown): unknown {\n        if (typeof target === 'undefined') return source;\n        if (typeof source === 'undefined') return target;\n\n        if (Array.isArray(target) && Array.isArray(source)) {\n            if (this.isEntityArray(target) || this.isEntityArray(source)) {\n                return this.mergeEntities(\n                    target as MergeableProvisioningEntity[],\n                    source as MergeableProvisioningEntity[],\n                );\n            }\n            return [...new Set([...target, ...source])];\n        }\n\n        if (isObject(target) && isObject(source)) {\n            return this.mergeRecord(target, source);\n        }\n\n        return source;\n    }\n\n    private isEntityArray(value: unknown[]): value is MergeableProvisioningEntity[] {\n        return value.some(\n            (item) => isObject(item) && 'attributes' in item,\n        );\n    }\n}\n"],"mappings":";;;;;AA6BA,IAAaC,8BAAb,MAAaA;CACCC;CAEV,YAAYA,SAAiC;EACzC,KAAKA,UAAUA;CACnB;CAEA,MAAMC,KAAKC,WAAwD;EAC/D,MAAMC,SAAkC,CAAC;EAMzCC,CAAAA,MAJ0BC,QAAQC,IAC9B,KAAMN,QAASO,KAAKC,WAAWA,OAAOP,KAAKC,SAAAA,CAAAA,CAAAA,EAAAA,CAGnCK,KAAKE,eAAe,KAAKC,MAAMP,QAAQM,UAAAA,CAAAA;EAEnD,OAAON;CACX;CAEAO,MAAMC,QAAgCH,QAAgC;EAClEG,OAAOC,WAAW,KAAKC,cAAcF,OAAOC,UAAUJ,OAAOI,QAAQ;EACrED,OAAOG,cAAc,KAAKD,cAAcF,OAAOG,aAAaN,OAAOM,WAAW;EAC9EH,OAAOI,QAAQ,KAAKF,cAAcF,OAAOI,OAAOP,OAAOO,KAAK;EAC5DJ,OAAOK,SAAS,KAAKH,cAAcF,OAAOK,QAAQR,OAAOQ,MAAM;EAC/DL,OAAOM,SAAS,KAAKJ,cAAcF,OAAOM,QAAQT,OAAOS,MAAM;CACnE;CAEQC,eACJC,YACkB;EAClB,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;EAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,WAAW,GAAG,GAAGH,WAAWI,YAAY;CACpF;CAEQV,cACJF,QACAH,QACe;EACf,IAAI,CAACA,QAAQ,OAAOG;EACpB,IAAI,CAACA,QAAQ,OAAO,CAAIH,GAAAA,MAAO;EAE/B,MAAMgB,SAAS,CAAIb,GAAAA,MAAO;EAC1BH,OAAOiB,SAASC,SAAAA;GACZ,MAAMC,MAAM,KAAKT,eAAeQ,KAAKP,UAAU;GAC/C,IAAI,CAACQ,KAAK;IACNH,OAAOI,KAAKF,IAAAA;IACZ;GACJ;GAEA,MAAMG,MAAML,OAAOM,WAAWC,MAAM,KAAKb,eAAea,EAAEZ,UAAU,MAAMQ,GAAAA;GAC1E,IAAIE,QAAQ,IACRL,OAAOK,OAAO,KAAKG,YAAYR,OAAOK,MAAMH,IAAAA;QAE5CF,OAAOI,KAAKF,IAAAA;EAEpB,CAAA;EACA,OAAOF;CACX;;;;;;;;;;;;;IAeA,YACIb,QACAH,QAC2B;EAC3B,MAAML,SAAS;GAAE,GAAGQ;GAAQ,GAAGH;EAAO;EAEtCL,OAAOgB,aAAa;GAAE,GAAGR,OAAOQ;GAAY,GAAGX,OAAOW;EAAW;EAEjE,IAAIR,OAAOsB,YAAY,CAACzB,OAAOyB,UAC3B9B,OAAO8B,WAAWtB,OAAOsB;EAG7B,IAAItB,OAAOuB,aAAa1B,OAAO0B,WAC3B/B,OAAO+B,YAAY,KAAKC,YAAYxB,OAAOuB,WAAW1B,OAAO0B,SAAS;OACnE,IAAIvB,OAAOuB,aAAa,CAAC1B,OAAO0B,WACnC/B,OAAO+B,YAAYvB,OAAOuB;EAG9B,IAAIvB,OAAOyB,mBAAmB5B,OAAO4B,iBACjCjC,OAAOiC,kBAAkB;GAAE,GAAGzB,OAAOyB;GAAiB,GAAG5B,OAAO4B;EAAgB;OAC7E,IAAIzB,OAAOyB,mBAAmB,CAAC5B,OAAO4B,iBACzCjC,OAAOiC,kBAAkBzB,OAAOyB;EAGpC,IAAIzB,OAAO0B,YAAY7B,OAAO6B,UAC1BlC,OAAOkC,WAAW,KAAKxB,cAAcF,OAAO0B,UAAU7B,OAAO6B,QAAQ;OAClE,IAAI1B,OAAO0B,YAAY,CAAC7B,OAAO6B,UAClClC,OAAOkC,WAAW1B,OAAO0B;EAG7B,OAAOlC;CACX;CAEQgC,YACJxB,QACAH,QACuB;EACvB,MAAML,SAAmC,EAAE,GAAGQ,OAAO;EACrD,KAAK,MAAMgB,OAAOW,OAAOC,KAAK/B,MAAAA,GAC1BL,OAAOwB,OAAOA,OAAOhB,SACjB,KAAK6B,WAAW7B,OAAOgB,MAAMnB,OAAOmB,IAAI,IACxCnB,OAAOmB;EAEf,OAAOxB;CACX;CAEQqC,WAAW7B,QAAiBH,QAA0B;EAC1D,IAAI,OAAOG,WAAW,aAAa,OAAOH;EAC1C,IAAI,OAAOA,WAAW,aAAa,OAAOG;EAE1C,IAAI8B,MAAMC,QAAQ/B,MAAAA,KAAW8B,MAAMC,QAAQlC,MAAAA,GAAS;GAChD,IAAI,KAAKmC,cAAchC,MAAAA,KAAW,KAAKgC,cAAcnC,MAAAA,GACjD,OAAO,KAAKK,cACRF,QACAH,MAAAA;GAGR,OAAO,CAAI,mBAAA,IAAIoC,IAAI,CAAIjC,GAAAA,QAAWH,GAAAA,MAAO,CAAA,CAAE;EAC/C;EAEA,IAAIV,SAASa,MAAAA,KAAWb,SAASU,MAAAA,GAC7B,OAAO,KAAK2B,YAAYxB,QAAQH,MAAAA;EAGpC,OAAOA;CACX;CAEQmC,cAAcE,OAA0D;EAC5E,OAAOA,MAAMC,MACRpB,SAAS5B,SAAS4B,IAAAA,KAAS,gBAAgBA,IAAAA;CAEpD;AACJ"}

package/dist/app/modules/provisioning/sources/default/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","ClientAuthMethod","ClientTokenBindingMethod","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","builtIn","realmId","extraAttributes","decisionStrategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","CONSENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","KEY_CREATE","KEY_UPDATE","KEY_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","SESSION_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","USER_AUTHENTICATOR_CREATE","USER_AUTHENTICATOR_UPDATE","USER_AUTHENTICATOR_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","authMethod","SECRET","tokenBindingMethod","NONE","secret","clientSystemSecret","secretHashed","clientSystemEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n    Client, \n    Permission, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: { decisionStrategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                ],\n            },\n            // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n            // Each `names` entry is what self-edit must REJECT; everything else\n            // is permitted. New columns added to the entity are self-editable\n            // by default — extend the denylist when adding admin-only state.\n            {\n                attributes: {\n                    name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        // FK + lifecycle\n                        'active',\n                        'realmId',\n                        // Security-critical: a self-edit must not change the\n                        // client's authentication/binding method (changing the\n                        // auth method may clear its secret) or downgrade the\n                        // secret-storage format\n                        // (which would persist the secret in plaintext).\n                        'authMethod',\n                        'tokenBindingMethod',\n                        'secretHashed',\n                        'secretEncrypted',\n                        'accessPolicyId',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'nameLocked',\n                        'status',\n                        'statusMessage',\n                        'realmId',\n                    ],\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        const policiesByPermission: Partial<Record<string, string[]>> = {\n            [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n            [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n        };\n\n        return Object.values(PermissionName)\n            .map((name) => {\n                const entity: PermissionProvisioningEntity = {\n                    strategy: {\n                        type: ProvisioningEntityStrategyType.MERGE,\n                        attributes: ['builtIn'] as (keyof Permission)[],\n                    },\n                    attributes: {\n                        name,\n                        builtIn: true,\n                    },\n                };\n\n                const policies = policiesByPermission[name];\n                if (policies) {\n                    entity.relations = { policies };\n                }\n\n                return entity;\n            });\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    builtIn: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    // Global admin: unrestricted realm reach (any realm + null/global).\n                    globalPermissionsRealmScope: RealmScope.ANY,\n                },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    // realm_admin: own realm + null/global by default (so it can\n                    // read/assign global building blocks), but strictly own-realm for\n                    // direct entity CUD (cannot create/modify global entities).\n                    globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n                    globalPermissionsRealmScopeOverrides: {\n                        [RealmScope.OWN]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.CONSENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.KEY_CREATE,\n                            PermissionName.KEY_UPDATE,\n                            PermissionName.KEY_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.SESSION_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                            PermissionName.USER_AUTHENTICATOR_CREATE,\n                            PermissionName.USER_AUTHENTICATOR_UPDATE,\n                            PermissionName.USER_AUTHENTICATOR_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                builtIn: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod', 'secret', 'secretHashed', 'secretEncrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    builtIn: true,\n                    authMethod: ClientAuthMethod.SECRET,\n                    tokenBindingMethod: ClientTokenBindingMethod.NONE,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secretHashed: false }),\n                    secretHashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA2CA,IAAagB,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMjB,iBAAiBkB;KACvBC,MAAMrB,kBAAkBsB;KACxBC,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EAAEC,kBAAkBvB,iBAAiBwB,UAAU;IAChEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMjB,iBAAiB2B;KACvBR,MAAMrB,kBAAkB6B;KACxBN,SAAS;KACTC,SAAS;IACb,EACJ,GACA,EACIN,YAAY;KACRC,MAAMjB,iBAAiB4B;KACvBT,MAAMrB,kBAAkB8B;KACxBP,SAAS;KACTC,SAAS;IACb,EACJ,CAAA;GAER;GAKA;IACIN,YAAY;KACRC,MAAMjB,iBAAiB6B;KACvBV,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAMA;KACA;KACA;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMjB,iBAAiBiC;KACvBd,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;MAER;GACJ;;CAER;CAEAE,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3D/B,eAAegC,qBAAqB,CAACpC,iBAAiBkB,SAASlB,iBAAiB6B,wBAAAA;IAChFzB,eAAeiC,mBAAmB,CAACrC,iBAAiBkB,SAASlB,iBAAiBiC,sBAAAA;EACnF;EAEA,OAAOK,OAAOC,OAAOnC,cAAAA,CAAAA,CAChBoC,KAAKvB,SAAAA;GACF,MAAMwB,SAAuC;IACzCC,UAAU;KACNvB,MAAMN,+BAA+B8B;KACrC3B,YAAY,CAAC,SAAA;IACjB;IACAA,YAAY;KACRC;KACAI,SAAS;IACb;GACJ;GAEA,MAAMuB,WAAWT,qBAAqBlB;GACtC,IAAI2B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAO/B,SAAAA,CAAAA,CAChBgC,KAAKvB,UAAU;GACZyB,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAA;GACjB;GACAA,YAAY;IACRC;IACAI,SAAS;GACb;EACJ,EAAA;CACR;CAEA0B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAA;GACjB;GACAA,YAAY;IACRC,MAAMX;IACNe,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAA;IAEpBC,6BAA6BlD,WAAWmD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAA;GACjB;GACAA,YAAY;IACRC,MAAMV;IACNc,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAA;IACpBG,0BAA0B;KACtB/C,eAAegD;KACfhD,eAAeiD;KACfjD,eAAekD;;IAKnBL,6BAA6BlD,WAAWwD;IACxCC,sCAAsC,GACjCzD,WAAW0D,MAAM;KACdrD,eAAesD;KACftD,eAAeuD;KACfvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;MAEvB;GACJ;EACJ,CAAA;CAER;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1C5C,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAA;GACjB;GACAA,YAAY;IACRC,MAAMZ;IACNgB,SAAS;GACb;GACAwB,WAAW,CAAC;EAChB;EAEA,MAAM0C,yBAAyB,IAAI5E,uBAAAA;EAEnC,IAAI6E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXrE,MAAMN,+BAA+B8B;GACrC3B,YAAY,CAAC,UAAA;EACjB;EAGJsE,YAAYzC,YAAYyC,YAAYzC,aAAa,CAAC;EAClDyC,YAAYzC,UAAU6C,QAAQ,CAC1B;GACIhD,UAAU8C;GACVxE,YAAY;IACRC,MAAM;IACN0E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOrF,mBAAmB,OAAA;IAC1BsF,QAAQV,OAAOW;GACnB;GACAnD,WAAW,EAAEoD,aAAa,CAAC3F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAM4F,2BAA2B,IAAIxF,yBAAAA;EAErC,IAAIyF;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACbhF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;IAAsB;IAAU;IAAgB;;EAC1F;OAEAmF,iBAAiB;GACbhF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;;EAC1C;EAGJsE,YAAYzC,YAAYyC,YAAYzC,aAAa,CAAC;EAClDyC,YAAYzC,UAAUwD,UAAU,CAC5B;GACI3D,UAAUyD;GACVnF,YAAY;IACRK,SAAS;IACTiF,YAAYpG,iBAAiBqG;IAC7BC,oBAAoBrG,yBAAyBsG;IAC7CxF,MAAM;IACNyF,QAAQ,MAAMR,yBAAyBN,QAAQP,OAAOsB,oBAAoB,EAAEC,cAAc,MAAM,CAAA;IAChGA,cAAc;IACdb,QAAQV,OAAOwB;GACnB;GACAhE,WAAW,EAAEoD,aAAa,CAAC3F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,OAAO,CAACgF,WAAAA;CACZ;CAEA,MAAMwB,KAAKC,WAAwD;EAC/D,MAAM1B,SAAS0B,UAAUC,QAAQpG,kBAAAA;EAEjC,OAAO;GACHgC,UAAU,KAAK7B,cAAa;GAC5BkG,aAAa,KAAK/E,iBAAgB;GAClCgF,QAAQ,KAAKpE,YAAW;GACxBqE,OAAO,KAAKpE,WAAU;GACtBqE,QAAQ,MAAM,KAAKhC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","ClientAuthMethod","ClientTokenBindingMethod","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","builtIn","realmId","extraAttributes","decisionStrategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","CONSENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","KEY_CREATE","KEY_UPDATE","KEY_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","SESSION_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","USER_AUTHENTICATOR_CREATE","USER_AUTHENTICATOR_UPDATE","USER_AUTHENTICATOR_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","authMethod","SECRET","tokenBindingMethod","NONE","secret","clientSystemSecret","secretHashed","clientSystemEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n    Client, \n    Permission, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: { decisionStrategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                ],\n            },\n            // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n            // Each `names` entry is what self-edit must REJECT; everything else\n            // is permitted. New columns added to the entity are self-editable\n            // by default — extend the denylist when adding admin-only state.\n            {\n                attributes: {\n                    name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        // FK + lifecycle\n                        'active',\n                        'realmId',\n                        // Security-critical: a self-edit must not change the\n                        // client's authentication/binding method (changing the\n                        // auth method may clear its secret) or downgrade the\n                        // secret-storage format\n                        // (which would persist the secret in plaintext).\n                        'authMethod',\n                        'tokenBindingMethod',\n                        'secretHashed',\n                        'secretEncrypted',\n                        'accessPolicyId',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'nameLocked',\n                        'status',\n                        'statusMessage',\n                        'realmId',\n                    ],\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        const policiesByPermission: Partial<Record<string, string[]>> = {\n            [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n            [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n        };\n\n        return Object.values(PermissionName)\n            .map((name) => {\n                const entity: PermissionProvisioningEntity = {\n                    strategy: {\n                        type: ProvisioningEntityStrategyType.MERGE,\n                        attributes: ['builtIn'] as (keyof Permission)[],\n                    },\n                    attributes: {\n                        name,\n                        builtIn: true,\n                    },\n                };\n\n                const policies = policiesByPermission[name];\n                if (policies) {\n                    entity.relations = { policies };\n                }\n\n                return entity;\n            });\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    builtIn: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    // Global admin: unrestricted realm reach (any realm + null/global).\n                    globalPermissionsRealmScope: RealmScope.ANY,\n                },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    // realm_admin: own realm + null/global by default (so it can\n                    // read/assign global building blocks), but strictly own-realm for\n                    // direct entity CUD (cannot create/modify global entities).\n                    globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n                    globalPermissionsRealmScopeOverrides: {\n                        [RealmScope.OWN]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.CONSENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.KEY_CREATE,\n                            PermissionName.KEY_UPDATE,\n                            PermissionName.KEY_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.SESSION_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                            PermissionName.USER_AUTHENTICATOR_CREATE,\n                            PermissionName.USER_AUTHENTICATOR_UPDATE,\n                            PermissionName.USER_AUTHENTICATOR_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                builtIn: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod', 'secret', 'secretHashed', 'secretEncrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    builtIn: true,\n                    authMethod: ClientAuthMethod.SECRET,\n                    tokenBindingMethod: ClientTokenBindingMethod.NONE,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secretHashed: false }),\n                    secretHashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA2CA,IAAagB,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMjB,iBAAiBkB;KACvBC,MAAMrB,kBAAkBsB;KACxBC,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EAAEC,kBAAkBvB,iBAAiBwB,UAAU;IAChEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMjB,iBAAiB2B;KACvBR,MAAMrB,kBAAkB6B;KACxBN,SAAS;KACTC,SAAS;IACb,EACJ,GACA,EACIN,YAAY;KACRC,MAAMjB,iBAAiB4B;KACvBT,MAAMrB,kBAAkB8B;KACxBP,SAAS;KACTC,SAAS;IACb,EACJ,CACH;GACL;GAKA;IACIN,YAAY;KACRC,MAAMjB,iBAAiB6B;KACvBV,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAMA;KACA;KACA;KACA;KACA;IACH,EACL;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMjB,iBAAiBiC;KACvBd,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;IACH,EACL;GACJ;EACH;CACL;CAEAE,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3D/B,eAAegC,qBAAqB,CAACpC,iBAAiBkB,SAASlB,iBAAiB6B,wBAAyB;IACzGzB,eAAeiC,mBAAmB,CAACrC,iBAAiBkB,SAASlB,iBAAiBiC,sBAAuB;EAC1G;EAEA,OAAOK,OAAOC,OAAOnC,cAAAA,CAAAA,CAChBoC,KAAKvB,SAAAA;GACF,MAAMwB,SAAuC;IACzCC,UAAU;KACNvB,MAAMN,+BAA+B8B;KACrC3B,YAAY,CAAC,SAAU;IAC3B;IACAA,YAAY;KACRC;KACAI,SAAS;IACb;GACJ;GAEA,MAAMuB,WAAWT,qBAAqBlB;GACtC,IAAI2B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAO/B,SAAAA,CAAAA,CAChBgC,KAAKvB,UAAU;GACZyB,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC;IACAI,SAAS;GACb;EACJ,EAAA;CACR;CAEA0B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMX;IACNe,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAI;IAExBC,6BAA6BlD,WAAWmD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMV;IACNc,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAI;IACxBG,0BAA0B;KACtB/C,eAAegD;KACfhD,eAAeiD;KACfjD,eAAekD;IAClB;IAIDL,6BAA6BlD,WAAWwD;IACxCC,sCAAsC,GACjCzD,WAAW0D,MAAM;KACdrD,eAAesD;KACftD,eAAeuD;KACfvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;IAClB,EACL;GACJ;EACJ,CACH;CACL;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1C5C,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMZ;IACNgB,SAAS;GACb;GACAwB,WAAW,CAAC;EAChB;EAEA,MAAM0C,yBAAyB,IAAI5E,uBAAAA;EAEnC,IAAI6E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXrE,MAAMN,+BAA+B8B;GACrC3B,YAAY,CAAC,UAAW;EAC5B;EAGJsE,YAAYzC,YAAYyC,YAAYzC,aAAa,CAAC;EAClDyC,YAAYzC,UAAU6C,QAAQ,CAC1B;GACIhD,UAAU8C;GACVxE,YAAY;IACRC,MAAM;IACN0E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOrF,mBAAmB,OAAA;IAC1BsF,QAAQV,OAAOW;GACnB;GACAnD,WAAW,EAAEoD,aAAa,CAAC3F,eAAgB,EAAC;EAChD,CACH;EAED,MAAM4F,2BAA2B,IAAIxF,yBAAAA;EAErC,IAAIyF;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACbhF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;IAAsB;IAAU;IAAgB;GAAkB;EAC5G;OAEAmF,iBAAiB;GACbhF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;GAAqB;EAC/D;EAGJsE,YAAYzC,YAAYyC,YAAYzC,aAAa,CAAC;EAClDyC,YAAYzC,UAAUwD,UAAU,CAC5B;GACI3D,UAAUyD;GACVnF,YAAY;IACRK,SAAS;IACTiF,YAAYpG,iBAAiBqG;IAC7BC,oBAAoBrG,yBAAyBsG;IAC7CxF,MAAM;IACNyF,QAAQ,MAAMR,yBAAyBN,QAAQP,OAAOsB,oBAAoB,EAAEC,cAAc,MAAM,CAAA;IAChGA,cAAc;IACdb,QAAQV,OAAOwB;GACnB;GACAhE,WAAW,EAAEoD,aAAa,CAAC3F,eAAgB,EAAC;EAChD,CACH;EAED,OAAO,CAACgF,WAAY;CACxB;CAEA,MAAMwB,KAAKC,WAAwD;EAC/D,MAAM1B,SAAS0B,UAAUC,QAAQpG,kBAAAA;EAEjC,OAAO;GACHgC,UAAU,KAAK7B,cAAa;GAC5BkG,aAAa,KAAK/E,iBAAgB;GAClCgF,QAAQ,KAAKpE,YAAW;GACxBqE,OAAO,KAAKpE,WAAU;GACtBqE,QAAQ,MAAM,KAAKhC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}

package/dist/app/modules/provisioning/sources/file/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ValidatorGroup","isObject","locateMany","read","path","RootProvisioningValidator","CompositeProvisioningSource","MODULE_FILE_EXTENSIONS","Set","FileProvisioningSource","options","rootValidator","load","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","isModule","extension","has","toLowerCase","entity","default","Error","data","run","group","PROVISIONING","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { ValidatorGroup, isObject } from '@authup/kit';\nimport { locateMany, read } from 'locter';\nimport path from 'node:path';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\n// Extensions locter loads as an ES module namespace ({ default, ...named }),\n// as opposed to data files (json/yaml/yml) whose parsed value is returned\n// directly. Only the former should have their `default` export unwrapped.\nconst MODULE_FILE_EXTENSIONS = new Set(['.ts', '.mts', '.cts', '.js', '.mjs', '.cjs']);\n\nexport class FileProvisioningSource implements IProvisioningSource {\n    protected options: FileEntitySchemaImporterOptions;\n\n    protected rootValidator: RootProvisioningValidator;\n\n    constructor(options: FileEntitySchemaImporterOptions) {\n        this.options = options;\n\n        this.rootValidator = new RootProvisioningValidator();\n    }\n\n    async load(): Promise<RootProvisioningEntity> {\n        const cwd = path.isAbsolute(this.options.cwd) ?\n            this.options.cwd :\n            path.join(process.cwd(), this.options.cwd);\n\n        const locations = await locateMany('*.{json,yaml,yml,ts,mts,mjs,js}', { cwd });\n\n        const compositeSource = new CompositeProvisioningSource([]);\n\n        const output : RootProvisioningEntity = {};\n        for (const location of locations) {\n            const raw = await read(location);\n            // Unwrap the default export only for module files; a data file\n            // (json/yaml) whose root legitimately carries a `default` key must\n            // keep all of its keys.\n            const isModule = typeof location.extension === 'string' &&\n                MODULE_FILE_EXTENSIONS.has(location.extension.toLowerCase());\n            const entity = isModule && isObject(raw) && 'default' in raw ?\n                raw.default :\n                raw;\n\n            // Fail closed on a malformed root (top-level list/scalar, or an\n            // empty file parsing to null) instead of silently provisioning\n            // nothing — the same silent-skip class the loader otherwise avoids.\n            if (!isObject(entity)) {\n                throw new Error(`The provisioning file \"${location.path}\" must contain an object at its root.`);\n            }\n\n            // Provisioning files use the camelCase management vocabulary\n            // (plan 073). Keys are NOT rewritten here: a blanket snake->camel\n            // pass cannot tell a schema property from a data-identifier map key\n            // (`clientPermissions`/`clientRoles` are keyed by client name, and\n            // client names may contain underscores), so it would silently\n            // corrupt those keys. Unmounted keys are stripped by the validator.\n            const data = await this.rootValidator.run(\n                entity as Record<string, any>,\n                { group: ValidatorGroup.PROVISIONING },\n            );\n\n            compositeSource.merge(output, data);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;;;AAmBA,MAAMO,yCAAyB,IAAIC,IAAI;CAAC;CAAO;CAAQ;CAAQ;CAAO;CAAQ;CAAO;AAErF,IAAaC,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMO,OAAwC;EAK1C,MAAMK,YAAY,MAAMf,WAAW,mCAAmC,EAAEW,KAJ5DT,KAAKU,WAAW,KAAKJ,QAAQG,GAAG,IACxC,KAAKH,QAAQG,MACbT,KAAKW,KAAKC,QAAQH,IAAG,GAAI,KAAKH,QAAQG,GAAG,EAE+B,CAAA;EAE5E,MAAMK,kBAAkB,IAAIZ,4BAA4B,CAAA,CAAE;EAE1D,MAAMa,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,MAAMlB,KAAKiB,QAAAA;GAMvB,MAAMM,SAFW,OAAON,SAASG,cAAc,YAC3ChB,uBAAuBiB,IAAIJ,SAASG,UAAUE,YAAW,CAAA,KAClCxB,SAASoB,GAAAA,KAAQ,aAAaA,MACrDA,IAAIM,UACJN;GAKJ,IAAI,CAACpB,SAASyB,MAAAA,GACV,MAAM,IAAIE,MAAM,0BAA0BR,SAAShB,KAAK,sCAAsC;GASlG,MAAMyB,OAAO,MAAM,KAAKlB,cAAcmB,IAClCJ,QACA,EAAEK,OAAO/B,eAAegC,aAAa,CAAA;GAGzCd,gBAAgBe,MAAMd,QAAQU,IAAAA;EAClC;EAEA,OAAOV;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["ValidatorGroup","isObject","locateMany","read","path","RootProvisioningValidator","CompositeProvisioningSource","MODULE_FILE_EXTENSIONS","Set","FileProvisioningSource","options","rootValidator","load","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","isModule","extension","has","toLowerCase","entity","default","Error","data","run","group","PROVISIONING","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { ValidatorGroup, isObject } from '@authup/kit';\nimport { locateMany, read } from 'locter';\nimport path from 'node:path';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\n// Extensions locter loads as an ES module namespace ({ default, ...named }),\n// as opposed to data files (json/yaml/yml) whose parsed value is returned\n// directly. Only the former should have their `default` export unwrapped.\nconst MODULE_FILE_EXTENSIONS = new Set(['.ts', '.mts', '.cts', '.js', '.mjs', '.cjs']);\n\nexport class FileProvisioningSource implements IProvisioningSource {\n    protected options: FileEntitySchemaImporterOptions;\n\n    protected rootValidator: RootProvisioningValidator;\n\n    constructor(options: FileEntitySchemaImporterOptions) {\n        this.options = options;\n\n        this.rootValidator = new RootProvisioningValidator();\n    }\n\n    async load(): Promise<RootProvisioningEntity> {\n        const cwd = path.isAbsolute(this.options.cwd) ?\n            this.options.cwd :\n            path.join(process.cwd(), this.options.cwd);\n\n        const locations = await locateMany('*.{json,yaml,yml,ts,mts,mjs,js}', { cwd });\n\n        const compositeSource = new CompositeProvisioningSource([]);\n\n        const output : RootProvisioningEntity = {};\n        for (const location of locations) {\n            const raw = await read(location);\n            // Unwrap the default export only for module files; a data file\n            // (json/yaml) whose root legitimately carries a `default` key must\n            // keep all of its keys.\n            const isModule = typeof location.extension === 'string' &&\n                MODULE_FILE_EXTENSIONS.has(location.extension.toLowerCase());\n            const entity = isModule && isObject(raw) && 'default' in raw ?\n                raw.default :\n                raw;\n\n            // Fail closed on a malformed root (top-level list/scalar, or an\n            // empty file parsing to null) instead of silently provisioning\n            // nothing — the same silent-skip class the loader otherwise avoids.\n            if (!isObject(entity)) {\n                throw new Error(`The provisioning file \"${location.path}\" must contain an object at its root.`);\n            }\n\n            // Provisioning files use the camelCase management vocabulary\n            // (plan 073). Keys are NOT rewritten here: a blanket snake->camel\n            // pass cannot tell a schema property from a data-identifier map key\n            // (`clientPermissions`/`clientRoles` are keyed by client name, and\n            // client names may contain underscores), so it would silently\n            // corrupt those keys. Unmounted keys are stripped by the validator.\n            const data = await this.rootValidator.run(\n                entity as Record<string, any>,\n                { group: ValidatorGroup.PROVISIONING },\n            );\n\n            compositeSource.merge(output, data);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;;;AAmBA,MAAMO,yCAAyB,IAAIC,IAAI;CAAC;CAAO;CAAQ;CAAQ;CAAO;CAAQ;AAAO,CAAA;AAErF,IAAaC,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMO,OAAwC;EAK1C,MAAMK,YAAY,MAAMf,WAAW,mCAAmC,EAAEW,KAJ5DT,KAAKU,WAAW,KAAKJ,QAAQG,GAAG,IACxC,KAAKH,QAAQG,MACbT,KAAKW,KAAKC,QAAQH,IAAG,GAAI,KAAKH,QAAQG,GAAG,EAE+B,CAAA;EAE5E,MAAMK,kBAAkB,IAAIZ,4BAA4B,CAAA,CAAE;EAE1D,MAAMa,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,MAAMlB,KAAKiB,QAAAA;GAMvB,MAAMM,SAFW,OAAON,SAASG,cAAc,YAC3ChB,uBAAuBiB,IAAIJ,SAASG,UAAUE,YAAW,CAAA,KAClCxB,SAASoB,GAAAA,KAAQ,aAAaA,MACrDA,IAAIM,UACJN;GAKJ,IAAI,CAACpB,SAASyB,MAAAA,GACV,MAAM,IAAIE,MAAM,0BAA0BR,SAAShB,KAAK,sCAAsC;GASlG,MAAMyB,OAAO,MAAM,KAAKlB,cAAcmB,IAClCJ,QACA,EAAEK,OAAO/B,eAAegC,aAAa,CAAA;GAGzCd,gBAAgBe,MAAMd,QAAQU,IAAAA;EAClC;EAEA,OAAOV;CACX;AACJ"}

package/dist/app/modules/runtime/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ModuleName","LoggerInjectionKey","ConfigInjectionKey","resolveURL","RuntimeModule","name","dependencies","RUNTIME","CONFIG","LOGGER","setup","container","config","resolve","logger","debug","env","writableDirectoryPath","port","host","publicUrl"],"sources":["../../../../src/app/modules/runtime/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport type { IContainer } from 'eldin';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { resolveURL } from '../../../utils/index.ts';\n\nexport class RuntimeModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.RUNTIME;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        logger.debug(`Environment: ${config.env}`);\n        logger.debug(`WritableDirectoryPath: ${config.writableDirectoryPath}`);\n        logger.debug(`Port: ${config.port}`);\n        logger.debug(`Host: ${config.host}`);\n        logger.debug(`Base-URL: ${config.publicUrl}`);\n        logger.debug(`Docs-URL: ${resolveURL(config.publicUrl, 'docs')}`);\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;;;AAcA,IAAaI,gBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOL,WAAWO;EACvB,KAAKD,eAAe,CAACN,WAAWQ,QAAQR,WAAWS,MAAAA;CACvD;CAEA,MAAMC,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQX,kBAAAA;EACjC,MAAMY,SAASH,UAAUE,QAAQZ,kBAAAA;EAEjCa,OAAOC,MAAM,gBAAgBH,OAAOI,KAAK;EACzCF,OAAOC,MAAM,0BAA0BH,OAAOK,uBAAuB;EACrEH,OAAOC,MAAM,SAASH,OAAOM,MAAM;EACnCJ,OAAOC,MAAM,SAASH,OAAOO,MAAM;EACnCL,OAAOC,MAAM,aAAaH,OAAOQ,WAAW;EAC5CN,OAAOC,MAAM,aAAaZ,WAAWS,OAAOQ,WAAW,MAAA,GAAS;CACpE;AAGJ"}
+{"version":3,"file":"module.mjs","names":["ModuleName","LoggerInjectionKey","ConfigInjectionKey","resolveURL","RuntimeModule","name","dependencies","RUNTIME","CONFIG","LOGGER","setup","container","config","resolve","logger","debug","env","writableDirectoryPath","port","host","publicUrl"],"sources":["../../../../src/app/modules/runtime/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport type { IContainer } from 'eldin';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { resolveURL } from '../../../utils/index.ts';\n\nexport class RuntimeModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.RUNTIME;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        logger.debug(`Environment: ${config.env}`);\n        logger.debug(`WritableDirectoryPath: ${config.writableDirectoryPath}`);\n        logger.debug(`Port: ${config.port}`);\n        logger.debug(`Host: ${config.host}`);\n        logger.debug(`Base-URL: ${config.publicUrl}`);\n        logger.debug(`Docs-URL: ${resolveURL(config.publicUrl, 'docs')}`);\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;;;AAcA,IAAaI,gBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOL,WAAWO;EACvB,KAAKD,eAAe,CAACN,WAAWQ,QAAQR,WAAWS,MAAO;CAC9D;CAEA,MAAMC,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQX,kBAAAA;EACjC,MAAMY,SAASH,UAAUE,QAAQZ,kBAAAA;EAEjCa,OAAOC,MAAM,gBAAgBH,OAAOI,KAAK;EACzCF,OAAOC,MAAM,0BAA0BH,OAAOK,uBAAuB;EACrEH,OAAOC,MAAM,SAASH,OAAOM,MAAM;EACnCJ,OAAOC,MAAM,SAASH,OAAOO,MAAM;EACnCL,OAAOC,MAAM,aAAaH,OAAOQ,WAAW;EAC5CN,OAAOC,MAAM,aAAaZ,WAAWS,OAAOQ,WAAW,MAAA,GAAS;CACpE;AAGJ"}

package/dist/cli/commands/migration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"migration.mjs","names":["defineCommand","path","process","checkDatabase","createDatabase","dropDatabase","generateMigration","transformFilePath","DataSource","DataSourceOptionsBuilder","ApplicationBuilder","ConfigInjectionKey","LoggerInjectionKey","ModuleName","CODE_PATH","MigrationOperation","runMigrationOperation","container","operation","config","resolve","logger","optionsBuilder","options","db","buildWith","buildWithEnv","debug","type","database","Array","isArray","migrations","i","length","check","exists","synchronize","ifNotExist","dataSource","logging","initialize","undoLastMigration","showMigrations","runMigrations","isInitialized","destroy","e","error","generateMigrations","connections","host","port","username","password","baseDirectory","join","timestamp","Date","now","connection","dataSourceOptions","directoryPath","name","prettify","console","defineCLIMigrationCommand","meta","args","required","Object","values","valueHint","setup","context","app","withConfig","withLogger","build","addModule","DATABASE","dependencies","CONFIG","LOGGER","exit"],"sources":["../../../src/cli/commands/migration.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport path from 'node:path';\nimport process from 'node:process';\nimport {\n    checkDatabase,\n    createDatabase, \n    dropDatabase, \n    generateMigration, \n    transformFilePath,\n} from 'typeorm-extension';\nimport { DataSource, type DataSourceOptions } from 'typeorm';\nimport { DataSourceOptionsBuilder } from '../../adapters/database/index.ts';\nimport {\n    ApplicationBuilder, \n    ConfigInjectionKey, \n    LoggerInjectionKey, \n    ModuleName,\n} from '../../app/index.ts';\nimport type { IContainer } from 'eldin';\nimport { CODE_PATH } from '../../path.ts';\n\nenum MigrationOperation {\n    GENERATE = 'generate',\n    REVERT = 'revert',\n    STATUS = 'status',\n    RUN = 'run',\n}\n\nasync function runMigrationOperation(\n    container: IContainer,\n    operation: string,\n): Promise<void> {\n    const config = container.resolve(ConfigInjectionKey);\n    const logger = container.resolve(LoggerInjectionKey);\n\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    let options: DataSourceOptions;\n    if (config.db) {\n        options = optionsBuilder.buildWith(config.db);\n    } else {\n        options = optionsBuilder.buildWithEnv();\n    }\n\n    logger.debug(`Type: ${options.type}`);\n    logger.debug(`Database: ${options.database}`);\n\n    if (Array.isArray(options.migrations)) {\n        for (let i = 0; i < options.migrations.length; i++) {\n            if (typeof options.migrations[i] === 'string') {\n                logger.debug(`Migration-Directory: ${options.migrations[i]}`);\n            }\n        }\n    } else if (typeof options.migrations === 'string') {\n        logger.debug(`Migration-Directory: ${options.migrations}`);\n    }\n\n    const check = await checkDatabase({ options });\n\n    if (!check.exists) {\n        await createDatabase({\n            options,\n            synchronize: false,\n            ifNotExist: true, \n        });\n    }\n\n    const dataSource = new DataSource({\n        ...options,\n        logging: ['error', 'schema', 'migration'],\n    });\n\n    try {\n        await dataSource.initialize();\n\n        if (operation === MigrationOperation.REVERT) {\n            await dataSource.undoLastMigration();\n        } else if (operation === MigrationOperation.STATUS) {\n            await dataSource.showMigrations();\n        } else {\n            await dataSource.runMigrations();\n        }\n    } finally {\n        if (dataSource.isInitialized) {\n            try {\n                await dataSource.destroy();\n            } catch (e) {\n                logger.error(`Failed to destroy data source after migration operation: ${e}`);\n            }\n        }\n    }\n}\n\nasync function generateMigrations(): Promise<void> {\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    const connections: DataSourceOptions[] = [\n        {\n            type: 'postgres',\n            database: 'migrations',\n            host: 'localhost',\n            port: 5432,\n            username: 'postgres',\n            password: 'start123',\n        },\n        {\n            type: 'mysql',\n            database: 'migrations',\n            host: 'localhost',\n            port: 3306,\n            username: 'root',\n            password: 'start123',\n        },\n    ];\n\n    const baseDirectory = transformFilePath(\n        path.join(CODE_PATH, 'adapters', 'database', 'migrations'),\n        './src',\n        './dist',\n    );\n\n    const timestamp = Date.now();\n\n    for (const connection of connections) {\n        const dataSourceOptions = optionsBuilder.buildWith(connection);\n        const directoryPath = path.join(baseDirectory, dataSourceOptions.type);\n\n        await dropDatabase({ options: dataSourceOptions });\n        await createDatabase({\n            options: dataSourceOptions,\n            synchronize: false, \n        });\n\n        const dataSource = new DataSource(dataSourceOptions);\n\n        try {\n            await dataSource.initialize();\n\n            await dataSource.runMigrations();\n\n            await generateMigration({\n                dataSource,\n                name: 'Default',\n                directoryPath,\n                timestamp,\n                prettify: true,\n            });\n        } finally {\n            if (dataSource.isInitialized) {\n                try {\n                    await dataSource.destroy();\n                } catch (e) {\n                    // eslint-disable-next-line no-console\n                    console.error(e);\n                }\n            }\n        }\n    }\n}\n\nexport function defineCLIMigrationCommand() {\n    return defineCommand({\n        meta: { name: 'migration' },\n        args: {\n            operation: {\n                required: true,\n                type: 'positional',\n                options: Object.values(MigrationOperation),\n                valueHint: Object.values(MigrationOperation).join('|'),\n            },\n        },\n        async setup(context) {\n            try {\n                if (context.args.operation === MigrationOperation.GENERATE) {\n                    await generateMigrations();\n                } else {\n                    const app = new ApplicationBuilder()\n                        .withConfig()\n                        .withLogger()\n                        .build();\n\n                    app.addModule({\n                        name: ModuleName.DATABASE,\n                        dependencies: [ModuleName.CONFIG, ModuleName.LOGGER],\n                        async setup(container: IContainer): Promise<void> {\n                            await runMigrationOperation(container, context.args.operation);\n                        },\n                    });\n\n                    await app.setup();\n                }\n\n                process.exit(0);\n            } catch (e) {\n                // eslint-disable-next-line no-console\n                console.error(e);\n\n                process.exit(1);\n            }\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA4BA,IAAA,qBAAKe,uBAAAA,oBAAAA;;;;;QAAAA;EAAAA,sBAAAA,CAAAA,CAAAA;AAOL,eAAeC,sBACXC,WACAC,WAAiB;CAEjB,MAAMC,SAASF,UAAUG,QAAQT,kBAAAA;CACjC,MAAMU,SAASJ,UAAUG,QAAQR,kBAAAA;CAEjC,MAAMU,iBAAiB,IAAIb,yBAAAA;CAE3B,IAAIc;CACJ,IAAIJ,OAAOK,IACPD,UAAUD,eAAeG,UAAUN,OAAOK,EAAE;MAE5CD,UAAUD,eAAeI,aAAY;CAGzCL,OAAOM,MAAM,SAASJ,QAAQK,MAAM;CACpCP,OAAOM,MAAM,aAAaJ,QAAQM,UAAU;CAE5C,IAAIC,MAAMC,QAAQR,QAAQS,UAAU;OAC3B,IAAIC,IAAI,GAAGA,IAAIV,QAAQS,WAAWE,QAAQD,KAC3C,IAAI,OAAOV,QAAQS,WAAWC,OAAO,UACjCZ,OAAOM,MAAM,wBAAwBJ,QAAQS,WAAWC,IAAI;CAAA,OAGjE,IAAI,OAAOV,QAAQS,eAAe,UACrCX,OAAOM,MAAM,wBAAwBJ,QAAQS,YAAY;CAK7D,IAAI,EAACG,MAFehC,cAAc,EAAEoB,QAAQ,CAAA,EAAA,CAEjCa,QACP,MAAMhC,eAAe;EACjBmB;EACAc,aAAa;EACbC,YAAY;CAChB,CAAA;CAGJ,MAAMC,aAAa,IAAI/B,WAAW;EAC9B,GAAGe;EACHiB,SAAS;GAAC;GAAS;GAAU;;CACjC,CAAA;CAEA,IAAI;EACA,MAAMD,WAAWE,WAAU;EAE3B,IAAIvB,cAAAA,UACA,MAAMqB,WAAWG,kBAAiB;OAC/B,IAAIxB,cAAAA,UACP,MAAMqB,WAAWI,eAAc;OAE/B,MAAMJ,WAAWK,cAAa;CAEtC,UAAU;EACN,IAAIL,WAAWM,eACX,IAAI;GACA,MAAMN,WAAWO,QAAO;EAC5B,SAASC,GAAG;GACR1B,OAAO2B,MAAM,4DAA4DD,GAAG;EAChF;CAER;AACJ;AAEA,eAAeE,qBAAAA;CACX,MAAM3B,iBAAiB,IAAIb,yBAAAA;CAE3B,MAAMyC,cAAmC,CACrC;EACItB,MAAM;EACNC,UAAU;EACVsB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,GACA;EACI1B,MAAM;EACNC,UAAU;EACVsB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,CAAA;CAGJ,MAAMC,gBAAgBhD,kBAClBN,KAAKuD,KAAK1C,WAAW,YAAY,YAAY,YAAA,GAC7C,SACA,QAAA;CAGJ,MAAM2C,YAAYC,KAAKC,IAAG;CAE1B,KAAK,MAAMC,cAAcV,aAAa;EAClC,MAAMW,oBAAoBvC,eAAeG,UAAUmC,UAAAA;EACnD,MAAME,gBAAgB7D,KAAKuD,KAAKD,eAAeM,kBAAkBjC,IAAI;EAErE,MAAMvB,aAAa,EAAEkB,SAASsC,kBAAkB,CAAA;EAChD,MAAMzD,eAAe;GACjBmB,SAASsC;GACTxB,aAAa;EACjB,CAAA;EAEA,MAAME,aAAa,IAAI/B,WAAWqD,iBAAAA;EAElC,IAAI;GACA,MAAMtB,WAAWE,WAAU;GAE3B,MAAMF,WAAWK,cAAa;GAE9B,MAAMtC,kBAAkB;IACpBiC;IACAwB,MAAM;IACND;IACAL;IACAO,UAAU;GACd,CAAA;EACJ,UAAU;GACN,IAAIzB,WAAWM,eACX,IAAI;IACA,MAAMN,WAAWO,QAAO;GAC5B,SAASC,GAAG;IAERkB,QAAQjB,MAAMD,CAAAA;GAClB;EAER;CACJ;AACJ;AAEA,SAAgBmB,4BAAAA;CACZ,OAAOlE,cAAc;EACjBmE,MAAM,EAAEJ,MAAM,YAAY;EAC1BK,MAAM,EACFlD,WAAW;GACPmD,UAAU;GACVzC,MAAM;GACNL,SAAS+C,OAAOC,OAAOxD,kBAAAA;GACvByD,WAAWF,OAAOC,OAAOxD,kBAAAA,CAAAA,CAAoByC,KAAK,GAAA;EACtD,EACJ;EACA,MAAMiB,MAAMC,SAAO;GACf,IAAI;IACA,IAAIA,QAAQN,KAAKlD,cAAS,YACtB,MAAM+B,mBAAAA;SACH;KACH,MAAM0B,MAAM,IAAIjE,mBAAAA,CAAAA,CACXkE,WAAU,CAAA,CACVC,WAAU,CAAA,CACVC,MAAK;KAEVH,IAAII,UAAU;MACVhB,MAAMlD,WAAWmE;MACjBC,cAAc,CAACpE,WAAWqE,QAAQrE,WAAWsE,MAAAA;MAC7C,MAAMV,MAAMxD,WAAqB;OAC7B,MAAMD,sBAAsBC,WAAWyD,QAAQN,KAAKlD,SAAS;MACjE;KACJ,CAAA;KAEA,MAAMyD,IAAIF,MAAK;IACnB;IAEAvE,QAAQkF,KAAK,CAAA;GACjB,SAASrC,GAAG;IAERkB,QAAQjB,MAAMD,CAAAA;IAEd7C,QAAQkF,KAAK,CAAA;GACjB;EACJ;CACJ,CAAA;AACJ"}
+{"version":3,"file":"migration.mjs","names":["defineCommand","path","process","checkDatabase","createDatabase","dropDatabase","generateMigration","transformFilePath","DataSource","DataSourceOptionsBuilder","ApplicationBuilder","ConfigInjectionKey","LoggerInjectionKey","ModuleName","CODE_PATH","MigrationOperation","runMigrationOperation","container","operation","config","resolve","logger","optionsBuilder","options","db","buildWith","buildWithEnv","debug","type","database","Array","isArray","migrations","i","length","check","exists","synchronize","ifNotExist","dataSource","logging","initialize","undoLastMigration","showMigrations","runMigrations","isInitialized","destroy","e","error","generateMigrations","connections","host","port","username","password","baseDirectory","join","timestamp","Date","now","connection","dataSourceOptions","directoryPath","name","prettify","console","defineCLIMigrationCommand","meta","args","required","Object","values","valueHint","setup","context","app","withConfig","withLogger","build","addModule","DATABASE","dependencies","CONFIG","LOGGER","exit"],"sources":["../../../src/cli/commands/migration.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport path from 'node:path';\nimport process from 'node:process';\nimport {\n    checkDatabase,\n    createDatabase, \n    dropDatabase, \n    generateMigration, \n    transformFilePath,\n} from 'typeorm-extension';\nimport { DataSource, type DataSourceOptions } from 'typeorm';\nimport { DataSourceOptionsBuilder } from '../../adapters/database/index.ts';\nimport {\n    ApplicationBuilder, \n    ConfigInjectionKey, \n    LoggerInjectionKey, \n    ModuleName,\n} from '../../app/index.ts';\nimport type { IContainer } from 'eldin';\nimport { CODE_PATH } from '../../path.ts';\n\nenum MigrationOperation {\n    GENERATE = 'generate',\n    REVERT = 'revert',\n    STATUS = 'status',\n    RUN = 'run',\n}\n\nasync function runMigrationOperation(\n    container: IContainer,\n    operation: string,\n): Promise<void> {\n    const config = container.resolve(ConfigInjectionKey);\n    const logger = container.resolve(LoggerInjectionKey);\n\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    let options: DataSourceOptions;\n    if (config.db) {\n        options = optionsBuilder.buildWith(config.db);\n    } else {\n        options = optionsBuilder.buildWithEnv();\n    }\n\n    logger.debug(`Type: ${options.type}`);\n    logger.debug(`Database: ${options.database}`);\n\n    if (Array.isArray(options.migrations)) {\n        for (let i = 0; i < options.migrations.length; i++) {\n            if (typeof options.migrations[i] === 'string') {\n                logger.debug(`Migration-Directory: ${options.migrations[i]}`);\n            }\n        }\n    } else if (typeof options.migrations === 'string') {\n        logger.debug(`Migration-Directory: ${options.migrations}`);\n    }\n\n    const check = await checkDatabase({ options });\n\n    if (!check.exists) {\n        await createDatabase({\n            options,\n            synchronize: false,\n            ifNotExist: true, \n        });\n    }\n\n    const dataSource = new DataSource({\n        ...options,\n        logging: ['error', 'schema', 'migration'],\n    });\n\n    try {\n        await dataSource.initialize();\n\n        if (operation === MigrationOperation.REVERT) {\n            await dataSource.undoLastMigration();\n        } else if (operation === MigrationOperation.STATUS) {\n            await dataSource.showMigrations();\n        } else {\n            await dataSource.runMigrations();\n        }\n    } finally {\n        if (dataSource.isInitialized) {\n            try {\n                await dataSource.destroy();\n            } catch (e) {\n                logger.error(`Failed to destroy data source after migration operation: ${e}`);\n            }\n        }\n    }\n}\n\nasync function generateMigrations(): Promise<void> {\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    const connections: DataSourceOptions[] = [\n        {\n            type: 'postgres',\n            database: 'migrations',\n            host: 'localhost',\n            port: 5432,\n            username: 'postgres',\n            password: 'start123',\n        },\n        {\n            type: 'mysql',\n            database: 'migrations',\n            host: 'localhost',\n            port: 3306,\n            username: 'root',\n            password: 'start123',\n        },\n    ];\n\n    const baseDirectory = transformFilePath(\n        path.join(CODE_PATH, 'adapters', 'database', 'migrations'),\n        './src',\n        './dist',\n    );\n\n    const timestamp = Date.now();\n\n    for (const connection of connections) {\n        const dataSourceOptions = optionsBuilder.buildWith(connection);\n        const directoryPath = path.join(baseDirectory, dataSourceOptions.type);\n\n        await dropDatabase({ options: dataSourceOptions });\n        await createDatabase({\n            options: dataSourceOptions,\n            synchronize: false, \n        });\n\n        const dataSource = new DataSource(dataSourceOptions);\n\n        try {\n            await dataSource.initialize();\n\n            await dataSource.runMigrations();\n\n            await generateMigration({\n                dataSource,\n                name: 'Default',\n                directoryPath,\n                timestamp,\n                prettify: true,\n            });\n        } finally {\n            if (dataSource.isInitialized) {\n                try {\n                    await dataSource.destroy();\n                } catch (e) {\n                    // eslint-disable-next-line no-console\n                    console.error(e);\n                }\n            }\n        }\n    }\n}\n\nexport function defineCLIMigrationCommand() {\n    return defineCommand({\n        meta: { name: 'migration' },\n        args: {\n            operation: {\n                required: true,\n                type: 'positional',\n                options: Object.values(MigrationOperation),\n                valueHint: Object.values(MigrationOperation).join('|'),\n            },\n        },\n        async setup(context) {\n            try {\n                if (context.args.operation === MigrationOperation.GENERATE) {\n                    await generateMigrations();\n                } else {\n                    const app = new ApplicationBuilder()\n                        .withConfig()\n                        .withLogger()\n                        .build();\n\n                    app.addModule({\n                        name: ModuleName.DATABASE,\n                        dependencies: [ModuleName.CONFIG, ModuleName.LOGGER],\n                        async setup(container: IContainer): Promise<void> {\n                            await runMigrationOperation(container, context.args.operation);\n                        },\n                    });\n\n                    await app.setup();\n                }\n\n                process.exit(0);\n            } catch (e) {\n                // eslint-disable-next-line no-console\n                console.error(e);\n\n                process.exit(1);\n            }\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA4BA,IAAA,qBAAKe,uBAAAA,oBAAAA;;;;;CAAAA,OAAAA;AAAAA,EAAAA,sBAAAA,CAAAA,CAAAA;AAOL,eAAeC,sBACXC,WACAC,WAAiB;CAEjB,MAAMC,SAASF,UAAUG,QAAQT,kBAAAA;CACjC,MAAMU,SAASJ,UAAUG,QAAQR,kBAAAA;CAEjC,MAAMU,iBAAiB,IAAIb,yBAAAA;CAE3B,IAAIc;CACJ,IAAIJ,OAAOK,IACPD,UAAUD,eAAeG,UAAUN,OAAOK,EAAE;MAE5CD,UAAUD,eAAeI,aAAY;CAGzCL,OAAOM,MAAM,SAASJ,QAAQK,MAAM;CACpCP,OAAOM,MAAM,aAAaJ,QAAQM,UAAU;CAE5C,IAAIC,MAAMC,QAAQR,QAAQS,UAAU,GAC3B;OAAA,IAAIC,IAAI,GAAGA,IAAIV,QAAQS,WAAWE,QAAQD,KAC3C,IAAI,OAAOV,QAAQS,WAAWC,OAAO,UACjCZ,OAAOM,MAAM,wBAAwBJ,QAAQS,WAAWC,IAAI;CAAA,OAGjE,IAAI,OAAOV,QAAQS,eAAe,UACrCX,OAAOM,MAAM,wBAAwBJ,QAAQS,YAAY;CAK7D,IAAI,EAACG,MAFehC,cAAc,EAAEoB,QAAQ,CAAA,EAAA,CAEjCa,QACP,MAAMhC,eAAe;EACjBmB;EACAc,aAAa;EACbC,YAAY;CAChB,CAAA;CAGJ,MAAMC,aAAa,IAAI/B,WAAW;EAC9B,GAAGe;EACHiB,SAAS;GAAC;GAAS;GAAU;EAAY;CAC7C,CAAA;CAEA,IAAI;EACA,MAAMD,WAAWE,WAAU;EAE3B,IAAIvB,cAAAA,UACA,MAAMqB,WAAWG,kBAAiB;OAC/B,IAAIxB,cAAAA,UACP,MAAMqB,WAAWI,eAAc;OAE/B,MAAMJ,WAAWK,cAAa;CAEtC,UAAU;EACN,IAAIL,WAAWM,eACX,IAAI;GACA,MAAMN,WAAWO,QAAO;EAC5B,SAASC,GAAG;GACR1B,OAAO2B,MAAM,4DAA4DD,GAAG;EAChF;CAER;AACJ;AAEA,eAAeE,qBAAAA;CACX,MAAM3B,iBAAiB,IAAIb,yBAAAA;CAE3B,MAAMyC,cAAmC,CACrC;EACItB,MAAM;EACNC,UAAU;EACVsB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,GACA;EACI1B,MAAM;EACNC,UAAU;EACVsB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,CACH;CAED,MAAMC,gBAAgBhD,kBAClBN,KAAKuD,KAAK1C,WAAW,YAAY,YAAY,YAAA,GAC7C,SACA,QAAA;CAGJ,MAAM2C,YAAYC,KAAKC,IAAG;CAE1B,KAAK,MAAMC,cAAcV,aAAa;EAClC,MAAMW,oBAAoBvC,eAAeG,UAAUmC,UAAAA;EACnD,MAAME,gBAAgB7D,KAAKuD,KAAKD,eAAeM,kBAAkBjC,IAAI;EAErE,MAAMvB,aAAa,EAAEkB,SAASsC,kBAAkB,CAAA;EAChD,MAAMzD,eAAe;GACjBmB,SAASsC;GACTxB,aAAa;EACjB,CAAA;EAEA,MAAME,aAAa,IAAI/B,WAAWqD,iBAAAA;EAElC,IAAI;GACA,MAAMtB,WAAWE,WAAU;GAE3B,MAAMF,WAAWK,cAAa;GAE9B,MAAMtC,kBAAkB;IACpBiC;IACAwB,MAAM;IACND;IACAL;IACAO,UAAU;GACd,CAAA;EACJ,UAAU;GACN,IAAIzB,WAAWM,eACX,IAAI;IACA,MAAMN,WAAWO,QAAO;GAC5B,SAASC,GAAG;IAERkB,QAAQjB,MAAMD,CAAAA;GAClB;EAER;CACJ;AACJ;AAEA,SAAgBmB,4BAAAA;CACZ,OAAOlE,cAAc;EACjBmE,MAAM,EAAEJ,MAAM,YAAY;EAC1BK,MAAM,EACFlD,WAAW;GACPmD,UAAU;GACVzC,MAAM;GACNL,SAAS+C,OAAOC,OAAOxD,kBAAAA;GACvByD,WAAWF,OAAOC,OAAOxD,kBAAAA,CAAAA,CAAoByC,KAAK,GAAA;EACtD,EACJ;EACA,MAAMiB,MAAMC,SAAO;GACf,IAAI;IACA,IAAIA,QAAQN,KAAKlD,cAAS,YACtB,MAAM+B,mBAAAA;SACH;KACH,MAAM0B,MAAM,IAAIjE,mBAAAA,CAAAA,CACXkE,WAAU,CAAA,CACVC,WAAU,CAAA,CACVC,MAAK;KAEVH,IAAII,UAAU;MACVhB,MAAMlD,WAAWmE;MACjBC,cAAc,CAACpE,WAAWqE,QAAQrE,WAAWsE,MAAO;MACpD,MAAMV,MAAMxD,WAAqB;OAC7B,MAAMD,sBAAsBC,WAAWyD,QAAQN,KAAKlD,SAAS;MACjE;KACJ,CAAA;KAEA,MAAMyD,IAAIF,MAAK;IACnB;IAEAvE,QAAQkF,KAAK,CAAA;GACjB,SAASrC,GAAG;IAERkB,QAAQjB,MAAMD,CAAAA;IAEd7C,QAAQkF,KAAK,CAAA;GACjB;EACJ;CACJ,CAAA;AACJ"}

package/dist/components/database/unique-entries/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["PermissionEntity","RoleEntity","DatabaseUniqueEntriesComponent","dataSource","start","enforceUniqueRoles","enforceUniquePermissions","repository","getRepository","queryBuilder","createQueryBuilder","orderBy","entities","getMany","aggregated","reduce","prev","curr","key","buildKey","name","clientId","realmId","Array","isArray","push","keys","Object","rest","length","remove","props","map","join"],"sources":["../../../../src/components/database/unique-entries/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { DataSource } from 'typeorm';\nimport { PermissionEntity, RoleEntity } from '../../../adapters/database/domains/index.ts';\nimport type { Component } from '../../types.ts';\n\nexport class DatabaseUniqueEntriesComponent implements Component {\n    protected dataSource: DataSource;\n\n    constructor(dataSource: DataSource) {\n        this.dataSource = dataSource;\n    }\n\n    /**\n     * Thus a unique check failed for mysql driver,\n     * existing duplicate entries must be removed.\n     */\n    async start() {\n        await this.enforceUniqueRoles();\n        await this.enforceUniquePermissions();\n    }\n\n    async enforceUniqueRoles() {\n        const repository = this.dataSource.getRepository(RoleEntity);\n        const queryBuilder = repository.createQueryBuilder('role');\n\n        queryBuilder.orderBy('role.createdAt', 'ASC');\n\n        const entities = await queryBuilder.getMany();\n        const aggregated = entities.reduce((prev, curr) => {\n            const key = this.buildKey({\n                name: curr.name,\n                clientId: curr.clientId,\n                realmId: curr.realmId,\n            });\n\n            if (Array.isArray(prev[key])) {\n                prev[key].push(curr);\n            } else {\n                prev[key] = [curr];\n            }\n\n            return prev;\n        }, {} as Record<string, RoleEntity[]>);\n\n        const keys = Object.keys(aggregated);\n        for (const key of keys) {\n            const [, ...rest] = aggregated[key];\n            if (rest.length === 0) {\n                continue;\n            }\n\n            await repository.remove(rest);\n        }\n    }\n\n    async enforceUniquePermissions() {\n        const repository = this.dataSource.getRepository(PermissionEntity);\n        const queryBuilder = repository.createQueryBuilder('permission');\n\n        queryBuilder.orderBy('permission.createdAt', 'ASC');\n\n        const entities = await queryBuilder.getMany();\n        const aggregated = entities.reduce((prev, curr) => {\n            const key = this.buildKey({\n                name: curr.name,\n                clientId: curr.clientId,\n                realmId: curr.realmId,\n            });\n\n            if (Array.isArray(prev[key])) {\n                prev[key].push(curr);\n            } else {\n                prev[key] = [curr];\n            }\n\n            return prev;\n        }, {} as Record<string, PermissionEntity[]>);\n\n        const keys = Object.keys(aggregated);\n        for (const key of keys) {\n            const [, ...rest] = aggregated[key];\n            if (rest.length === 0) {\n                continue;\n            }\n\n            await repository.remove(rest);\n        }\n    }\n\n    protected buildKey(props: Record<string, string | null>) {\n        const keys = Object.keys(props);\n\n        return keys\n            .map((key) => (typeof props[key] === 'string' ? props[key] : `${props[key]}`))\n            .join(':');\n    }\n}\n"],"mappings":";;;;;;;AAWA,IAAaE,iCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAwB;EAChC,KAAKA,aAAaA;CACtB;;;;IAMA,MAAMC,QAAQ;EACV,MAAM,KAAKC,mBAAkB;EAC7B,MAAM,KAAKC,yBAAwB;CACvC;CAEA,MAAMD,qBAAqB;EACvB,MAAME,aAAa,KAAKJ,WAAWK,cAAcP,UAAAA;EACjD,MAAMQ,eAAeF,WAAWG,mBAAmB,MAAA;EAEnDD,aAAaE,QAAQ,kBAAkB,KAAA;EAGvC,MAAMG,cAAaF,MADIH,aAAaI,QAAO,EAAA,CACfE,QAAQC,MAAMC,SAAAA;GACtC,MAAMC,MAAM,KAAKC,SAAS;IACtBC,MAAMH,KAAKG;IACXC,UAAUJ,KAAKI;IACfC,SAASL,KAAKK;GAClB,CAAA;GAEA,IAAIC,MAAMC,QAAQR,KAAKE,IAAI,GACvBF,KAAKE,IAAI,CAACO,KAAKR,IAAAA;QAEfD,KAAKE,OAAO,CAACD,IAAAA;GAGjB,OAAOD;EACX,GAAG,CAAC,CAAA;EAEJ,MAAMU,OAAOC,OAAOD,KAAKZ,UAAAA;EACzB,KAAK,MAAMI,OAAOQ,MAAM;GACpB,MAAM,GAAG,GAAGE,QAAQd,WAAWI;GAC/B,IAAIU,KAAKC,WAAW,GAChB;GAGJ,MAAMtB,WAAWuB,OAAOF,IAAAA;EAC5B;CACJ;CAEA,MAAMtB,2BAA2B;EAC7B,MAAMC,aAAa,KAAKJ,WAAWK,cAAcR,gBAAAA;EACjD,MAAMS,eAAeF,WAAWG,mBAAmB,YAAA;EAEnDD,aAAaE,QAAQ,wBAAwB,KAAA;EAG7C,MAAMG,cAAaF,MADIH,aAAaI,QAAO,EAAA,CACfE,QAAQC,MAAMC,SAAAA;GACtC,MAAMC,MAAM,KAAKC,SAAS;IACtBC,MAAMH,KAAKG;IACXC,UAAUJ,KAAKI;IACfC,SAASL,KAAKK;GAClB,CAAA;GAEA,IAAIC,MAAMC,QAAQR,KAAKE,IAAI,GACvBF,KAAKE,IAAI,CAACO,KAAKR,IAAAA;QAEfD,KAAKE,OAAO,CAACD,IAAAA;GAGjB,OAAOD;EACX,GAAG,CAAC,CAAA;EAEJ,MAAMU,OAAOC,OAAOD,KAAKZ,UAAAA;EACzB,KAAK,MAAMI,OAAOQ,MAAM;GACpB,MAAM,GAAG,GAAGE,QAAQd,WAAWI;GAC/B,IAAIU,KAAKC,WAAW,GAChB;GAGJ,MAAMtB,WAAWuB,OAAOF,IAAAA;EAC5B;CACJ;CAEUT,SAASY,OAAsC;EAGrD,OAFaJ,OAAOD,KAAKK,KAElBL,CAAAA,CACFM,KAAKd,QAAS,OAAOa,MAAMb,SAAS,WAAWa,MAAMb,OAAO,GAAGa,MAAMb,MAAM,CAAA,CAC3Ee,KAAK,GAAA;CACd;AACJ"}
+{"version":3,"file":"module.mjs","names":["PermissionEntity","RoleEntity","DatabaseUniqueEntriesComponent","dataSource","start","enforceUniqueRoles","enforceUniquePermissions","repository","getRepository","queryBuilder","createQueryBuilder","orderBy","entities","getMany","aggregated","reduce","prev","curr","key","buildKey","name","clientId","realmId","Array","isArray","push","keys","Object","rest","length","remove","props","map","join"],"sources":["../../../../src/components/database/unique-entries/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { DataSource } from 'typeorm';\nimport { PermissionEntity, RoleEntity } from '../../../adapters/database/domains/index.ts';\nimport type { Component } from '../../types.ts';\n\nexport class DatabaseUniqueEntriesComponent implements Component {\n    protected dataSource: DataSource;\n\n    constructor(dataSource: DataSource) {\n        this.dataSource = dataSource;\n    }\n\n    /**\n     * Thus a unique check failed for mysql driver,\n     * existing duplicate entries must be removed.\n     */\n    async start() {\n        await this.enforceUniqueRoles();\n        await this.enforceUniquePermissions();\n    }\n\n    async enforceUniqueRoles() {\n        const repository = this.dataSource.getRepository(RoleEntity);\n        const queryBuilder = repository.createQueryBuilder('role');\n\n        queryBuilder.orderBy('role.createdAt', 'ASC');\n\n        const entities = await queryBuilder.getMany();\n        const aggregated = entities.reduce((prev, curr) => {\n            const key = this.buildKey({\n                name: curr.name,\n                clientId: curr.clientId,\n                realmId: curr.realmId,\n            });\n\n            if (Array.isArray(prev[key])) {\n                prev[key].push(curr);\n            } else {\n                prev[key] = [curr];\n            }\n\n            return prev;\n        }, {} as Record<string, RoleEntity[]>);\n\n        const keys = Object.keys(aggregated);\n        for (const key of keys) {\n            const [, ...rest] = aggregated[key];\n            if (rest.length === 0) {\n                continue;\n            }\n\n            await repository.remove(rest);\n        }\n    }\n\n    async enforceUniquePermissions() {\n        const repository = this.dataSource.getRepository(PermissionEntity);\n        const queryBuilder = repository.createQueryBuilder('permission');\n\n        queryBuilder.orderBy('permission.createdAt', 'ASC');\n\n        const entities = await queryBuilder.getMany();\n        const aggregated = entities.reduce((prev, curr) => {\n            const key = this.buildKey({\n                name: curr.name,\n                clientId: curr.clientId,\n                realmId: curr.realmId,\n            });\n\n            if (Array.isArray(prev[key])) {\n                prev[key].push(curr);\n            } else {\n                prev[key] = [curr];\n            }\n\n            return prev;\n        }, {} as Record<string, PermissionEntity[]>);\n\n        const keys = Object.keys(aggregated);\n        for (const key of keys) {\n            const [, ...rest] = aggregated[key];\n            if (rest.length === 0) {\n                continue;\n            }\n\n            await repository.remove(rest);\n        }\n    }\n\n    protected buildKey(props: Record<string, string | null>) {\n        const keys = Object.keys(props);\n\n        return keys\n            .map((key) => (typeof props[key] === 'string' ? props[key] : `${props[key]}`))\n            .join(':');\n    }\n}\n"],"mappings":";;;;;;;AAWA,IAAaE,iCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAwB;EAChC,KAAKA,aAAaA;CACtB;;;;IAMA,MAAMC,QAAQ;EACV,MAAM,KAAKC,mBAAkB;EAC7B,MAAM,KAAKC,yBAAwB;CACvC;CAEA,MAAMD,qBAAqB;EACvB,MAAME,aAAa,KAAKJ,WAAWK,cAAcP,UAAAA;EACjD,MAAMQ,eAAeF,WAAWG,mBAAmB,MAAA;EAEnDD,aAAaE,QAAQ,kBAAkB,KAAA;EAGvC,MAAMG,cAAaF,MADIH,aAAaI,QAAO,EAAA,CACfE,QAAQC,MAAMC,SAAAA;GACtC,MAAMC,MAAM,KAAKC,SAAS;IACtBC,MAAMH,KAAKG;IACXC,UAAUJ,KAAKI;IACfC,SAASL,KAAKK;GAClB,CAAA;GAEA,IAAIC,MAAMC,QAAQR,KAAKE,IAAI,GACvBF,KAAKE,IAAI,CAACO,KAAKR,IAAAA;QAEfD,KAAKE,OAAO,CAACD,IAAK;GAGtB,OAAOD;EACX,GAAG,CAAC,CAAA;EAEJ,MAAMU,OAAOC,OAAOD,KAAKZ,UAAAA;EACzB,KAAK,MAAMI,OAAOQ,MAAM;GACpB,MAAM,GAAG,GAAGE,QAAQd,WAAWI;GAC/B,IAAIU,KAAKC,WAAW,GAChB;GAGJ,MAAMtB,WAAWuB,OAAOF,IAAAA;EAC5B;CACJ;CAEA,MAAMtB,2BAA2B;EAC7B,MAAMC,aAAa,KAAKJ,WAAWK,cAAcR,gBAAAA;EACjD,MAAMS,eAAeF,WAAWG,mBAAmB,YAAA;EAEnDD,aAAaE,QAAQ,wBAAwB,KAAA;EAG7C,MAAMG,cAAaF,MADIH,aAAaI,QAAO,EAAA,CACfE,QAAQC,MAAMC,SAAAA;GACtC,MAAMC,MAAM,KAAKC,SAAS;IACtBC,MAAMH,KAAKG;IACXC,UAAUJ,KAAKI;IACfC,SAASL,KAAKK;GAClB,CAAA;GAEA,IAAIC,MAAMC,QAAQR,KAAKE,IAAI,GACvBF,KAAKE,IAAI,CAACO,KAAKR,IAAAA;QAEfD,KAAKE,OAAO,CAACD,IAAK;GAGtB,OAAOD;EACX,GAAG,CAAC,CAAA;EAEJ,MAAMU,OAAOC,OAAOD,KAAKZ,UAAAA;EACzB,KAAK,MAAMI,OAAOQ,MAAM;GACpB,MAAM,GAAG,GAAGE,QAAQd,WAAWI;GAC/B,IAAIU,KAAKC,WAAW,GAChB;GAGJ,MAAMtB,WAAWuB,OAAOF,IAAAA;EAC5B;CACJ;CAEUT,SAASY,OAAsC;EAGrD,OAFaJ,OAAOD,KAAKK,KAElBL,CAAAA,CACFM,KAAKd,QAAS,OAAOa,MAAMb,SAAS,WAAWa,MAAMb,OAAO,GAAGa,MAAMb,MAAM,CAAA,CAC3Ee,KAAK,GAAA;CACd;AACJ"}

package/dist/core/authentication/entities/client/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ClientAuthMethod","IdentityType","EntityCredentialsInvalidError","EntityInactiveError","OAuth2ClientError","ClientCredentialsService","BaseCredentialsAuthenticator","ClientAuthenticator","identityResolver","credentialsService","authenticate","key","secret","realmId","identity","resolve","CLIENT","type","entity","data","active","authMethod","SECRET","verified","verify","invalid"],"sources":["../../../../../src/core/authentication/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { ClientAuthMethod, IdentityType } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError, EntityInactiveError } from '@authup/errors';\nimport { OAuth2ClientError } from '@authup/specs';\nimport type { IIdentityResolver } from '../../../identity/index.ts';\nimport { ClientCredentialsService } from '../../credential/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../base.ts';\n\nexport class ClientAuthenticator extends BaseCredentialsAuthenticator<Client> {\n    protected identityResolver : IIdentityResolver;\n\n    protected credentialsService : ClientCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        super();\n\n        this.identityResolver = identityResolver;\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(key: string, secret: string, realmId?: string): Promise<Client> {\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw new EntityCredentialsInvalidError({ entity: 'client' });\n        }\n\n        if (!identity.data.active) {\n            throw new EntityInactiveError({ entity: 'client' });\n        }\n\n        if (identity.data.authMethod === ClientAuthMethod.SECRET) {\n            const verified = await this.credentialsService.verify(secret, identity.data);\n            if (!verified) {\n                throw new EntityCredentialsInvalidError({ entity: 'client' });\n            }\n        } else {\n            throw OAuth2ClientError.invalid();\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;;;;;;AAeA,IAAaO,sBAAb,cAAyCD,6BAAAA;CAC3BE;CAEAC;CAEV,YAAYD,kBAAqC;EAC7C,MAAK;EAEL,KAAKA,mBAAmBA;EACxB,KAAKC,qBAAqB,IAAIJ,yBAAAA;CAClC;CAEA,MAAMK,aAAaC,KAAaC,QAAgBC,SAAmC;EAC/E,MAAMC,WAAW,MAAM,KAAKN,iBAAiBO,QAAQd,aAAae,QAAQL,KAAKE,OAAAA;EAC/E,IAAI,CAACC,YAAYA,SAASG,SAAShB,aAAae,QAC5C,MAAM,IAAId,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAG/D,IAAI,CAACJ,SAASK,KAAKC,QACf,MAAM,IAAIjB,oBAAoB,EAAEe,QAAQ,SAAS,CAAA;EAGrD,IAAIJ,SAASK,KAAKE,eAAerB,iBAAiBsB;OAE1C,CAACC,MADkB,KAAKd,mBAAmBe,OAAOZ,QAAQE,SAASK,IAAI,GAEvE,MAAM,IAAIjB,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAAA,OAG/D,MAAMd,kBAAkBqB,QAAO;EAGnC,OAAOX,SAASK;CACpB;AACJ"}
+{"version":3,"file":"module.mjs","names":["ClientAuthMethod","IdentityType","EntityCredentialsInvalidError","EntityInactiveError","OAuth2ClientError","ClientCredentialsService","BaseCredentialsAuthenticator","ClientAuthenticator","identityResolver","credentialsService","authenticate","key","secret","realmId","identity","resolve","CLIENT","type","entity","data","active","authMethod","SECRET","verified","verify","invalid"],"sources":["../../../../../src/core/authentication/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { ClientAuthMethod, IdentityType } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError, EntityInactiveError } from '@authup/errors';\nimport { OAuth2ClientError } from '@authup/specs';\nimport type { IIdentityResolver } from '../../../identity/index.ts';\nimport { ClientCredentialsService } from '../../credential/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../base.ts';\n\nexport class ClientAuthenticator extends BaseCredentialsAuthenticator<Client> {\n    protected identityResolver : IIdentityResolver;\n\n    protected credentialsService : ClientCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        super();\n\n        this.identityResolver = identityResolver;\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(key: string, secret: string, realmId?: string): Promise<Client> {\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw new EntityCredentialsInvalidError({ entity: 'client' });\n        }\n\n        if (!identity.data.active) {\n            throw new EntityInactiveError({ entity: 'client' });\n        }\n\n        if (identity.data.authMethod === ClientAuthMethod.SECRET) {\n            const verified = await this.credentialsService.verify(secret, identity.data);\n            if (!verified) {\n                throw new EntityCredentialsInvalidError({ entity: 'client' });\n            }\n        } else {\n            throw OAuth2ClientError.invalid();\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;;;;;;AAeA,IAAaO,sBAAb,cAAyCD,6BAAAA;CAC3BE;CAEAC;CAEV,YAAYD,kBAAqC;EAC7C,MAAK;EAEL,KAAKA,mBAAmBA;EACxB,KAAKC,qBAAqB,IAAIJ,yBAAAA;CAClC;CAEA,MAAMK,aAAaC,KAAaC,QAAgBC,SAAmC;EAC/E,MAAMC,WAAW,MAAM,KAAKN,iBAAiBO,QAAQd,aAAae,QAAQL,KAAKE,OAAAA;EAC/E,IAAI,CAACC,YAAYA,SAASG,SAAShB,aAAae,QAC5C,MAAM,IAAId,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAG/D,IAAI,CAACJ,SAASK,KAAKC,QACf,MAAM,IAAIjB,oBAAoB,EAAEe,QAAQ,SAAS,CAAA;EAGrD,IAAIJ,SAASK,KAAKE,eAAerB,iBAAiBsB,QAE1C;OAAA,CAACC,MADkB,KAAKd,mBAAmBe,OAAOZ,QAAQE,SAASK,IAAI,GAEvE,MAAM,IAAIjB,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAAA,OAG/D,MAAMd,kBAAkBqB,QAAO;EAGnC,OAAOX,SAASK;CACpB;AACJ"}