npm - @authup/server-core - Versions diffs - 1.0.0-beta.54 → 1.0.0-beta.55 - Mend

@authup/server-core 1.0.0-beta.54 → 1.0.0-beta.55

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (328) hide show

package/dist/core/authentication/session/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ipAddress","userAgent","expiresAt","Date","now","maxAge","toISOString","subKind","CLIENT","clientId","sub","USER","userId","save","ping","session","seenAt","getTime","threshold","refresh","refreshedAt","markMfaVerified","mfaAt","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n ISessionManager, \n ISessionRepository, \n SessionManagerContext, \n SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n protected options: SessionManagerOptions;\n\n protected repository: ISessionRepository;\n\n // -----------------------------------------------------\n\n constructor(ctx: SessionManagerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n }\n\n // -----------------------------------------------------\n\n /\n Create/Update session\n \n @param input\n /\n async create(input: Partial<Session>): Promise<Session> {\n input.ipAddress = input.ipAddress \|\| '127.0.0.1';\n input.userAgent = input.userAgent \|\| 'system';\n input.expiresAt = input.expiresAt \|\| new Date(\n Date.now() + (this.options.maxAge 1_000),\n ).toISOString();\n\n switch (input.subKind) {\n case IdentityType.CLIENT: {\n input.clientId = input.sub;\n break;\n }\n case IdentityType.USER: {\n input.userId = input.sub;\n break;\n }\n }\n\n return this.repository.save(input);\n }\n\n // -----------------------------------------------------\n\n async ping(session: Session): Promise<Session> {\n if (session.seenAt) {\n const seenAt = new Date(session.seenAt).getTime();\n const threshold = seenAt + (5 * 1_000);\n\n if (threshold > Date.now()) {\n return session;\n }\n }\n\n session.seenAt = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async refresh(session: Session): Promise<Session> {\n const now = new Date().toISOString();\n session.refreshedAt = now;\n session.seenAt = now;\n\n session.expiresAt = new Date(\n Date.now() + (this.options.maxAge * 1_000),\n ).toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async markMfaVerified(session: Session): Promise<Session> {\n session.mfaAt = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n /*\n Verify session on token inspection/verification.\n \n @param id\n * @throws JWTError\n */\n async findOneById(id: string): Promise<Session \| null> {\n return this.repository.findOneById(id);\n }\n\n // -----------------------------------------------------\n\n async revoke(id: string): Promise<void> {\n await this.repository.removeById(id);\n }\n\n // -----------------------------------------------------\n\n async verify(session: Session): Promise<void> {\n const ms = new Date(session.expiresAt).getTime();\n if (Date.now() > ms) {\n await this.repository.remove(session);\n\n // todo: better error\n throw JWTError.expired();\n }\n }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,YAAYD,MAAMC,aAAa;EACrCD,MAAME,YAAYF,MAAME,aAAa;EACrCF,MAAMG,YAAYH,MAAMG,aAAa,IAAIC,KACrCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,SAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,WAAWV,MAAMW;IACvB;GAEJ,KAAKlB,aAAamB;IACdZ,MAAMa,SAASb,MAAMW;IACrB;EAER;EAEA,OAAO,KAAKd,WAAWiB,KAAKd,KAAAA;CAChC;CAIA,MAAMe,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC;~~OACO~~,IAAIb,KAAKY,QAAQC,MAAM,CAAA,CAAEC,QACtBD,IAAU,IAAI,MAEhBb,KAAKC,IAAG,GACpB,OAAOW;EAAAA;EAIfA,QAAQC,0BAAS,IAAIb,KAAAA,EAAAA,CAAOG,YAAW;EAEvC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMI,QAAQJ,SAAoC;EAC9C,MAAMX,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCS,QAAQK,cAAchB;EACtBW,QAAQC,SAASZ;EAEjBW,QAAQb,YAAY,IAAIC,KACpBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMM,gBAAgBN,SAAoC;EACtDA,QAAQO,yBAAQ,IAAInB,KAAAA,EAAAA,CAAOG,YAAW;EAEtC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMQ,YAAYC,IAAqC;EACnD,OAAO,KAAK5B,WAAW2B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,KAAK5B,WAAW8B,WAAWF,EAAAA;CACrC;CAIA,MAAMG,OAAOZ,SAAiC;EAC1C,MAAMa,KAAK,IAAIzB,KAAKY,QAAQb,SAAS,CAAA,CAAEe,QAAO;EAC9C,IAAId,KAAKC,IAAG,IAAKwB,IAAI;GACjB,MAAM,KAAKhC,WAAWiC,OAAOd,OAAAA;GAG7B,MAAMtB,SAASqC,QAAO;EAC1B;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ipAddress","userAgent","expiresAt","Date","now","maxAge","toISOString","subKind","CLIENT","clientId","sub","USER","userId","save","ping","session","seenAt","getTime","threshold","refresh","refreshedAt","markMfaVerified","mfaAt","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n ISessionManager, \n ISessionRepository, \n SessionManagerContext, \n SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n protected options: SessionManagerOptions;\n\n protected repository: ISessionRepository;\n\n // -----------------------------------------------------\n\n constructor(ctx: SessionManagerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n }\n\n // -----------------------------------------------------\n\n /\n Create/Update session\n \n @param input\n /\n async create(input: Partial<Session>): Promise<Session> {\n input.ipAddress = input.ipAddress \|\| '127.0.0.1';\n input.userAgent = input.userAgent \|\| 'system';\n input.expiresAt = input.expiresAt \|\| new Date(\n Date.now() + (this.options.maxAge 1_000),\n ).toISOString();\n\n switch (input.subKind) {\n case IdentityType.CLIENT: {\n input.clientId = input.sub;\n break;\n }\n case IdentityType.USER: {\n input.userId = input.sub;\n break;\n }\n }\n\n return this.repository.save(input);\n }\n\n // -----------------------------------------------------\n\n async ping(session: Session): Promise<Session> {\n if (session.seenAt) {\n const seenAt = new Date(session.seenAt).getTime();\n const threshold = seenAt + (5 * 1_000);\n\n if (threshold > Date.now()) {\n return session;\n }\n }\n\n session.seenAt = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async refresh(session: Session): Promise<Session> {\n const now = new Date().toISOString();\n session.refreshedAt = now;\n session.seenAt = now;\n\n session.expiresAt = new Date(\n Date.now() + (this.options.maxAge * 1_000),\n ).toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async markMfaVerified(session: Session): Promise<Session> {\n session.mfaAt = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n /*\n Verify session on token inspection/verification.\n \n @param id\n * @throws JWTError\n */\n async findOneById(id: string): Promise<Session \| null> {\n return this.repository.findOneById(id);\n }\n\n // -----------------------------------------------------\n\n async revoke(id: string): Promise<void> {\n await this.repository.removeById(id);\n }\n\n // -----------------------------------------------------\n\n async verify(session: Session): Promise<void> {\n const ms = new Date(session.expiresAt).getTime();\n if (Date.now() > ms) {\n await this.repository.remove(session);\n\n // todo: better error\n throw JWTError.expired();\n }\n }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,YAAYD,MAAMC,aAAa;EACrCD,MAAME,YAAYF,MAAME,aAAa;EACrCF,MAAMG,YAAYH,MAAMG,aAAa,IAAIC,KACrCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,SAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,WAAWV,MAAMW;IACvB;GAEJ,KAAKlB,aAAamB;IACdZ,MAAMa,SAASb,MAAMW;IACrB;EAER;EAEA,OAAO,KAAKd,WAAWiB,KAAKd,KAAAA;CAChC;CAIA,MAAMe,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC,QACO;OAAA,IAAIb,KAAKY,QAAQC,MAAM,CAAA,CAAEC,QACtBD,IAAU,IAAI,MAEhBb,KAAKC,IAAG,GACpB,OAAOW;EAAAA;EAIfA,QAAQC,0BAAS,IAAIb,KAAAA,EAAAA,CAAOG,YAAW;EAEvC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMI,QAAQJ,SAAoC;EAC9C,MAAMX,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCS,QAAQK,cAAchB;EACtBW,QAAQC,SAASZ;EAEjBW,QAAQb,YAAY,IAAIC,KACpBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMM,gBAAgBN,SAAoC;EACtDA,QAAQO,yBAAQ,IAAInB,KAAAA,EAAAA,CAAOG,YAAW;EAEtC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMQ,YAAYC,IAAqC;EACnD,OAAO,KAAK5B,WAAW2B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,KAAK5B,WAAW8B,WAAWF,EAAAA;CACrC;CAIA,MAAMG,OAAOZ,SAAiC;EAC1C,MAAMa,KAAK,IAAIzB,KAAKY,QAAQb,SAAS,CAAA,CAAEe,QAAO;EAC9C,IAAId,KAAKC,IAAG,IAAKwB,IAAI;GACjB,MAAM,KAAKhC,WAAWiC,OAAOd,OAAAA;GAG7B,MAAMtB,SAASqC,QAAO;EAC1B;CACJ;AACJ"}

package/dist/core/authentication/session/types.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.mjs","names":["SESSION_FILTER_KEYS"],"sources":["../../../../src/core/authentication/session/types.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Session } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type SessionOwner = {\n sub: string,\n subKind: string,\n};\n\n/\n Filter keys a session query (list + bulk revoke) may target. Shared by the\n * repository's rapiq `filters.allowed` and the service's \"is this a targeted\n * bulk revoke?\" discriminator, so the two can never drift.\n /\nexport const SESSION_FILTER_KEYS = [\n 'id',\n 'sub',\n 'subKind',\n 'userId',\n 'clientId',\n 'realmId',\n] as const;\n\nexport type SessionFindManyOptions = {\n /\n Force the result to a single subject (self-service). Applied as a\n * mandatory WHERE that a rapiq query filter cannot override.\n /\n owner?: SessionOwner,\n};\n\nexport interface ISessionRepository {\n findOneById(id: string): Promise<Session \| null> \| null;\n\n findMany(query: IQuery, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;\n\n findAllByOwner(owner: SessionOwner): Promise<Session[]>;\n\n /\n Load EVERY session matching a rapiq query filter — unbounded (no\n * pagination cap), because a bulk revoke must reach every match. Used by\n * the admin \"force-logout\" path; per-session authorization is enforced by\n * the caller (`SessionService`).\n /\n findAllByQuery(query: IQuery): Promise<Session[]>;\n\n save(session: Partial<Session>): Promise<Session>;\n\n removeById(id: string): Promise<void>;\n\n remove(session: Session) : Promise<void>;\n}\n\nexport type SessionManagerOptions = {\n /\n Max age in seconds (sec).\n /\n maxAge: number\n};\n\nexport type SessionManagerContext = {\n options: SessionManagerOptions,\n repository: ISessionRepository,\n};\n\nexport interface ISessionManager {\n /\n Create new session.\n \n @param session\n /\n create(session: Partial<Session>): Promise<Session>;\n\n /\n Updates seenAt with current time.\n \n @param session\n /\n ping(session: Session) : Promise<Session>;\n\n /\n Updates refreshedAt, seenAt with current time.\n \n @param session\n /\n refresh(session: Session) : Promise<Session>;\n\n /\n Stamp a successful second-factor challenge (mfaAt) onto the session.\n \n @param session\n /\n markMfaVerified(session: Session) : Promise<Session>;\n\n /\n Check if session exists and is valid.\n \n @throws JWTError\n * @param session\n /\n verify(session: Session): Promise<void>;\n\n /\n Find session by id.\n \n @param id\n /\n findOneById(id: string): Promise<Session \| null>;\n\n /\n Revoke (delete) a session by id, forcing re-authentication. Idempotent —\n * a no-op when the session does not exist.\n \n @param id\n */\n revoke(id: string): Promise<void>;\n}\n"],"mappings":";;;;;;;;GAqBA,MAAaA,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA"}
1	+ {"version":3,"file":"types.mjs","names":["SESSION_FILTER_KEYS"],"sources":["../../../../src/core/authentication/session/types.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Session } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type SessionOwner = {\n sub: string,\n subKind: string,\n};\n\n/\n Filter keys a session query (list + bulk revoke) may target. Shared by the\n * repository's rapiq `filters.allowed` and the service's \"is this a targeted\n * bulk revoke?\" discriminator, so the two can never drift.\n /\nexport const SESSION_FILTER_KEYS = [\n 'id',\n 'sub',\n 'subKind',\n 'userId',\n 'clientId',\n 'realmId',\n] as const;\n\nexport type SessionFindManyOptions = {\n /\n Force the result to a single subject (self-service). Applied as a\n * mandatory WHERE that a rapiq query filter cannot override.\n /\n owner?: SessionOwner,\n};\n\nexport interface ISessionRepository {\n findOneById(id: string): Promise<Session \| null> \| null;\n\n findMany(query: IQuery, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;\n\n findAllByOwner(owner: SessionOwner): Promise<Session[]>;\n\n /\n Load EVERY session matching a rapiq query filter — unbounded (no\n * pagination cap), because a bulk revoke must reach every match. Used by\n * the admin \"force-logout\" path; per-session authorization is enforced by\n * the caller (`SessionService`).\n /\n findAllByQuery(query: IQuery): Promise<Session[]>;\n\n save(session: Partial<Session>): Promise<Session>;\n\n removeById(id: string): Promise<void>;\n\n remove(session: Session) : Promise<void>;\n}\n\nexport type SessionManagerOptions = {\n /\n Max age in seconds (sec).\n /\n maxAge: number\n};\n\nexport type SessionManagerContext = {\n options: SessionManagerOptions,\n repository: ISessionRepository,\n};\n\nexport interface ISessionManager {\n /\n Create new session.\n \n @param session\n /\n create(session: Partial<Session>): Promise<Session>;\n\n /\n Updates seenAt with current time.\n \n @param session\n /\n ping(session: Session) : Promise<Session>;\n\n /\n Updates refreshedAt, seenAt with current time.\n \n @param session\n /\n refresh(session: Session) : Promise<Session>;\n\n /\n Stamp a successful second-factor challenge (mfaAt) onto the session.\n \n @param session\n /\n markMfaVerified(session: Session) : Promise<Session>;\n\n /\n Check if session exists and is valid.\n \n @throws JWTError\n * @param session\n /\n verify(session: Session): Promise<void>;\n\n /\n Find session by id.\n \n @param id\n /\n findOneById(id: string): Promise<Session \| null>;\n\n /\n Revoke (delete) a session by id, forcing re-authentication. Idempotent —\n * a no-op when the session does not exist.\n \n @param id\n */\n revoke(id: string): Promise<void>;\n}\n"],"mappings":";;;;;;;;GAqBA,MAAaA,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;AACH"}

package/dist/core/client-certificate/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["AuthorityKeyIdentifierExtension","BasicConstraintsExtension","ExtendedKeyUsage","ExtendedKeyUsageExtension","URL","GENERAL_NAME_URL","KeyUsageFlags","KeyUsagesExtension","SubjectAlternativeNameExtension","SubjectKeyIdentifierExtension","X509Certificate","CLIENT_CERTIFICATE_URI_PREFIX","buildClientCertificateURI","ValidationError","base64URLEncode","MAX_CHAIN_DEPTH","CERTIFICATE_BLOCK_PATTERN","MAX_PATH_SIGNATURE_VERIFICATIONS","HANDLED_CRITICAL_EXTENSION_OIDS","Set","WEAK_SIGNATURE_HASHES","ANY_EXTENDED_KEY_USAGE_OID","ClientCertificateValidator","trustAnchorRepository","crypto","ctx","validateForBinding","evidence","assertClientCertificateEvidenceValidForBinding","validateForAuthentication","client","assertClientCertificatePurpose","certificate","assertClientCertificateIdentity","id","assertCertificateExtensionsUnderstood","assertStrongSignature","anchors","findManyBy","realmId","enabled","anchor","anchorCertificate","parseAnchorCertificate","budget","remaining","path","buildPath","chain","assertCertificationPath","assertCertificateCurrent","constraints","getExtension","ca","parseClientCertificateChain","pem","blocks","match","length","map","block","buildClientCertificateThumbprint","digest","getThumbprint","String","fromCharCode","Uint8Array","undefined","leaf","intermediates","continuePath","current","available","sameCertificate","isIssuedBy","index","candidate","next","filter","_item","candidateIndex","issuer","subject","authorityKeyIdentifier","keyId","subjectKeyIdentifier","verify","publicKey","signatureOnly","left","right","leftRaw","rawData","rightRaw","every","value","isAnchor","assertIssuerExtendedKeyUsage","keyUsage","usages","keyCertSign","pathLength","extendedKeyUsage","includes","clientAuth","digitalSignature","clientId","subjectAlternativeName","authupUris","names","items","name","type","startsWith","expected","now","Date","notBefore","getTime","notAfter","extension","extensions","critical","has","hash","signatureAlgorithm","toUpperCase"],"sources":["../../../src/core/client-certificate/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport './reflect.ts';\nimport {\n AuthorityKeyIdentifierExtension,\n BasicConstraintsExtension,\n ExtendedKeyUsage,\n ExtendedKeyUsageExtension,\n URL as GENERAL_NAME_URL,\n KeyUsageFlags,\n KeyUsagesExtension,\n SubjectAlternativeNameExtension,\n SubjectKeyIdentifierExtension,\n X509Certificate,\n} from '@peculiar/x509';\nimport type { Client, TrustAnchor } from '@authup/core-kit';\nimport {\n CLIENT_CERTIFICATE_URI_PREFIX,\n buildClientCertificateURI,\n} from '@authup/core-kit';\nimport { ValidationError } from '@authup/errors';\nimport { base64URLEncode } from '@authup/kit';\nimport type {\n ClientCertificateEvidence,\n ClientCertificateValidatorContext,\n IClientCertificateValidator,\n} from './types.ts';\n\nconst MAX_CHAIN_DEPTH = 10;\nconst CERTIFICATE_BLOCK_PATTERN = /-----BEGIN CERTIFICATE-----[\\s\\S]?-----END CERTIFICATE-----/g;\n\n/*\n Hard ceiling on signature verifications performed while building a single\n * certification path. A legitimate chain of the maximum accepted length only\n * needs O(depth²) verifications; the ceiling exists purely to defuse the\n * factorial backtracking blow-up an attacker can induce with certificates\n * that mutually \"issue\" one another (shared key, identical subject/issuer\n * DNs). Reaching the ceiling is treated as \"no path found\" (fail closed).\n /\nconst MAX_PATH_SIGNATURE_VERIFICATIONS = 64;\n\n/\n OIDs of the certificate extensions this validator actually processes. A\n * certificate carrying a critical extension outside this set is rejected\n * (RFC 5280 §4.2): an unprocessed critical constraint must never be silently\n * ignored. Because RFC 5280 requires the NameConstraints extension to be\n * marked critical, this also fails a name-constrained CA closed rather than\n * trusting a chain whose name constraints we do not evaluate.\n /\nconst HANDLED_CRITICAL_EXTENSION_OIDS = new Set<string>([\n '2.5.29.19', // basicConstraints\n '2.5.29.15', // keyUsage\n '2.5.29.37', // extKeyUsage\n '2.5.29.17', // subjectAltName\n '2.5.29.35', // authorityKeyIdentifier\n '2.5.29.14', // subjectKeyIdentifier\n]);\n\nconst WEAK_SIGNATURE_HASHES = new Set<string>(['SHA-1', 'MD5', 'MD2', 'MD4']);\n\n// anyExtendedKeyUsage (RFC 5280 §4.2.1.12) — a CA carrying it is unconstrained.\nconst ANY_EXTENDED_KEY_USAGE_OID = '2.5.29.37.0';\n\ntype SignatureVerificationBudget = { remaining: number };\n\n/\n Validates client certificates without performing network I/O. AIA, CRL,\n * and OCSP retrieval are deliberately outside the external-PKI first slice.\n /\nexport class ClientCertificateValidator implements IClientCertificateValidator {\n protected trustAnchorRepository: ClientCertificateValidatorContext['trustAnchorRepository'];\n\n protected crypto?: Crypto;\n\n constructor(ctx: ClientCertificateValidatorContext) {\n this.trustAnchorRepository = ctx.trustAnchorRepository;\n this.crypto = ctx.crypto;\n }\n\n validateForBinding(evidence: ClientCertificateEvidence): void {\n assertClientCertificateEvidenceValidForBinding(evidence);\n }\n\n async validateForAuthentication(\n client: Pick<Client, 'id' \| 'realmId'>,\n evidence: ClientCertificateEvidence,\n ): Promise<void> {\n this.validateForBinding(evidence);\n assertClientCertificatePurpose(evidence.certificate);\n assertClientCertificateIdentity(evidence.certificate, client.id);\n assertCertificateExtensionsUnderstood(evidence.certificate);\n assertStrongSignature(evidence.certificate);\n\n const anchors = await this.trustAnchorRepository.findManyBy({\n realmId: client.realmId,\n enabled: true,\n });\n\n for (const anchor of anchors) {\n const anchorCertificate = parseAnchorCertificate(anchor);\n if (!anchorCertificate) {\n continue;\n }\n\n const budget: SignatureVerificationBudget = { remaining: MAX_PATH_SIGNATURE_VERIFICATIONS };\n const path = await buildPath(\n evidence.certificate,\n evidence.chain,\n anchorCertificate,\n budget,\n this.crypto,\n );\n if (!path) {\n continue;\n }\n\n try {\n assertCertificationPath(path);\n return;\n } catch {\n // A chain reaching this anchor failed its CA constraints;\n // another enabled anchor may still yield a valid path.\n continue;\n }\n }\n\n throw new ValidationError('The client certificate is not trusted in this realm.');\n }\n}\n\nexport function assertClientCertificateEvidenceValidForBinding(\n evidence: ClientCertificateEvidence,\n): void {\n assertCertificateCurrent(evidence.certificate);\n\n const constraints = evidence.certificate.getExtension(BasicConstraintsExtension);\n if (constraints?.ca) {\n throw new ValidationError('A CA certificate cannot be used as a client certificate.');\n }\n}\n\nexport function parseClientCertificateChain(pem: string): X509Certificate[] {\n const blocks = pem.match(CERTIFICATE_BLOCK_PATTERN);\n if (!blocks \|\| blocks.length === 0) {\n throw new ValidationError('The certificate chain could not be parsed.');\n }\n\n try {\n return blocks.map((block) => new X509Certificate(block));\n } catch {\n throw new ValidationError('The certificate chain could not be parsed.');\n }\n}\n\nexport async function buildClientCertificateThumbprint(\n certificate: X509Certificate,\n crypto?: Crypto,\n): Promise<string> {\n const digest = await certificate.getThumbprint('SHA-256', crypto);\n\n return base64URLEncode(\n String.fromCharCode(...new Uint8Array(digest)),\n );\n}\n\nfunction parseAnchorCertificate(anchor: TrustAnchor): X509Certificate \| undefined {\n try {\n return parseClientCertificateChain(anchor.certificate)[0];\n } catch {\n // Rows are validated on create. Treat a corrupt legacy/database row as\n // unusable trust material instead of turning client authentication into\n // a 500 or accidentally trusting another certificate in its PEM chain.\n return undefined;\n }\n}\n\nasync function buildPath(\n leaf: X509Certificate,\n intermediates: X509Certificate[],\n anchor: X509Certificate,\n budget: SignatureVerificationBudget,\n crypto?: Crypto,\n): Promise<X509Certificate[] \| undefined> {\n return continuePath(leaf, intermediates, anchor, [leaf], budget, crypto);\n}\n\nasync function continuePath(\n current: X509Certificate,\n available: X509Certificate[],\n anchor: X509Certificate,\n path: X509Certificate[],\n budget: SignatureVerificationBudget,\n crypto?: Crypto,\n): Promise<X509Certificate[] \| undefined> {\n if (path.length > MAX_CHAIN_DEPTH) {\n return undefined;\n }\n\n if (sameCertificate(current, anchor)) {\n return path;\n }\n\n if (await isIssuedBy(current, anchor, budget, crypto)) {\n return [...path, anchor];\n }\n\n for (let index = 0; index < available.length; index += 1) {\n const candidate = available[index];\n if (\n !candidate \|\|\n sameCertificate(current, candidate) \|\|\n !await isIssuedBy(current, candidate, budget, crypto)\n ) {\n continue;\n }\n\n const next = await continuePath(\n candidate,\n available.filter((_item, candidateIndex) => candidateIndex !== index),\n anchor,\n [...path, candidate],\n budget,\n crypto,\n );\n if (next) {\n return next;\n }\n }\n\n return undefined;\n}\n\nasync function isIssuedBy(\n certificate: X509Certificate,\n issuer: X509Certificate,\n budget: SignatureVerificationBudget,\n crypto?: Crypto,\n): Promise<boolean> {\n if (certificate.issuer !== issuer.subject) {\n return false;\n }\n\n const authorityKeyIdentifier = certificate.getExtension(AuthorityKeyIdentifierExtension);\n if (authorityKeyIdentifier?.keyId) {\n const subjectKeyIdentifier = issuer.getExtension(SubjectKeyIdentifierExtension);\n if (subjectKeyIdentifier && subjectKeyIdentifier.keyId !== authorityKeyIdentifier.keyId) {\n return false;\n }\n }\n\n // Spend from the shared verification budget only for the expensive\n // cryptographic check (the DN / key-id pre-filters above are cheap). Once\n // exhausted, treat every further edge as unverified so a maliciously\n // crafted mutually-issuing certificate set cannot force factorial work.\n if (budget.remaining <= 0) {\n return false;\n }\n budget.remaining -= 1;\n\n try {\n return await certificate.verify({\n publicKey: issuer,\n signatureOnly: true,\n }, crypto);\n } catch {\n return false;\n }\n}\n\nfunction sameCertificate(left: X509Certificate, right: X509Certificate): boolean {\n const leftRaw = new Uint8Array(left.rawData);\n const rightRaw = new Uint8Array(right.rawData);\n\n return leftRaw.length === rightRaw.length &&\n leftRaw.every((value, index) => value === rightRaw[index]);\n}\n\nfunction assertCertificationPath(path: X509Certificate[]): void {\n if (path.length < 2) {\n throw new ValidationError('The client certificate chain is invalid.');\n }\n\n for (let index = 1; index < path.length; index += 1) {\n const certificate = path[index];\n if (!certificate) {\n throw new ValidationError('The client certificate chain is invalid.');\n }\n\n // The last path element is the configured trust anchor, trusted a\n // priori — its self-signature algorithm and any critical extensions\n // it carries are the operator's responsibility, so the RFC 5280\n // conformance checks below apply only to the issued intermediates.\n const isAnchor = index === path.length - 1;\n if (!isAnchor) {\n assertCertificateExtensionsUnderstood(certificate);\n assertStrongSignature(certificate);\n assertIssuerExtendedKeyUsage(certificate);\n }\n\n assertCertificateCurrent(certificate);\n const constraints = certificate.getExtension(BasicConstraintsExtension);\n if (!constraints?.ca) {\n throw new ValidationError('The client certificate chain contains a non-CA issuer.');\n }\n\n const keyUsage = certificate.getExtension(KeyUsagesExtension);\n if (keyUsage && (keyUsage.usages & KeyUsageFlags.keyCertSign) === 0) {\n throw new ValidationError('A client certificate issuer cannot sign certificates.');\n }\n\n // `index - 1` is the number of non-leaf CA certificates below this\n // issuer in the selected path. A pathLenConstraint of zero therefore\n // permits a directly-issued client leaf and no subordinate CA.\n if (\n typeof constraints.pathLength === 'number' &&\n (index - 1) > constraints.pathLength\n ) {\n throw new ValidationError('The client certificate chain exceeds a CA path-length constraint.');\n }\n }\n}\n\nfunction assertClientCertificatePurpose(certificate: X509Certificate): void {\n const extendedKeyUsage = certificate.getExtension(ExtendedKeyUsageExtension);\n if (\n extendedKeyUsage &&\n !extendedKeyUsage.usages.includes(ExtendedKeyUsage.clientAuth)\n ) {\n throw new ValidationError('The certificate is not valid for TLS client authentication.');\n }\n\n const keyUsage = certificate.getExtension(KeyUsagesExtension);\n if (keyUsage && (keyUsage.usages & KeyUsageFlags.digitalSignature) === 0) {\n throw new ValidationError('The certificate cannot prove possession of its private key.');\n }\n}\n\n/\n EKU chaining (RFC 5280 §4.2.1.12): a CA whose Extended Key Usage is present\n * but omits both `clientAuth` and `anyExtendedKeyUsage` is not permitted to\n * issue TLS-client-authentication certificates, so a leaf beneath it must be\n * rejected. (A CA's EKU may be non-critical, so the critical-extension check\n * does not cover this.) A CA with no EKU extension is unconstrained.\n */\nfunction assertIssuerExtendedKeyUsage(certificate: X509Certificate): void {\n const extendedKeyUsage = certificate.getExtension(ExtendedKeyUsageExtension);\n if (\n extendedKeyUsage &&\n !extendedKeyUsage.usages.includes(ExtendedKeyUsage.clientAuth) &&\n !extendedKeyUsage.usages.includes(ANY_EXTENDED_KEY_USAGE_OID)\n ) {\n throw new ValidationError('A client certificate issuer is not permitted to issue TLS client-authentication certificates.');\n }\n}\n\nfunction assertClientCertificateIdentity(certificate: X509Certificate, clientId: string): void {\n const subjectAlternativeName = certificate.getExtension(SubjectAlternativeNameExtension);\n const authupUris = subjectAlternativeName ?\n subjectAlternativeName.names.items\n .filter((name) => name.type === GENERAL_NAME_URL)\n .map((name) => name.value)\n .filter((value) => value.startsWith(CLIENT_CERTIFICATE_URI_PREFIX)) :\n [];\n\n const expected = buildClientCertificateURI(clientId);\n if (authupUris.length !== 1 \|\| authupUris[0] !== expected) {\n throw new ValidationError(`The certificate must contain exactly one Authup client URI SAN: ${expected}.`);\n }\n}\n\nfunction assertCertificateCurrent(certificate: X509Certificate): void {\n const now = Date.now();\n if (\n certificate.notBefore.getTime() > now \|\|\n certificate.notAfter.getTime() < now\n ) {\n throw new ValidationError('The client certificate is not currently valid.');\n }\n}\n\nfunction assertCertificateExtensionsUnderstood(certificate: X509Certificate): void {\n for (const extension of certificate.extensions) {\n if (extension.critical && !HANDLED_CRITICAL_EXTENSION_OIDS.has(extension.type)) {\n throw new ValidationError(\n `The certificate carries an unsupported critical extension (${extension.type}).`,\n );\n }\n }\n}\n\nfunction assertStrongSignature(certificate: X509Certificate): void {\n const hash = certificate.signatureAlgorithm?.hash?.name;\n if (typeof hash === 'string' && WEAK_SIGNATURE_HASHES.has(hash.toUpperCase())) {\n throw new ValidationError(`The certificate is signed with a weak algorithm (${hash}).`);\n }\n}\n"],"mappings":";;;;;;;;;AAiCA,MAAMe,kBAAkB;AACxB,MAAMC,4BAA4B;;;;;;;;GAUlC,MAAMC,mCAAmC;;;;;;;;GAUzC,MAAMC,kDAAkC,IAAIC,IAAY;CACpD;CACA;CACA;CACA;CACA;CACA;CACH;AAED,MAAMC,wCAAwB,IAAID,IAAY;CAAC;CAAS;CAAO;CAAO;CAAM;AAG5E,MAAME,6BAA6B;;;;GAQnC,IAAaC,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKF,wBAAwBE,IAAIF;EACjC,KAAKC,SAASC,IAAID;CACtB;CAEAE,mBAAmBC,UAA2C;EAC1DC,+CAA+CD,QAAAA;CACnD;CAEA,MAAME,0BACFC,QACAH,UACa;EACb,KAAKD,mBAAmBC,QAAAA;EACxBI,+BAA+BJ,SAASK,WAAW;EACnDC,gCAAgCN,SAASK,aAAaF,OAAOI,EAAE;EAC/DC,sCAAsCR,SAASK,WAAW;EAC1DI,sBAAsBT,SAASK,WAAW;EAE1C,MAAMK,UAAU,MAAM,KAAKd,sBAAsBe,WAAW;GACxDC,SAAST,OAAOS;GAChBC,SAAS;EACb,CAAA;EAEA,KAAK,MAAMC,UAAUJ,SAAS;GAC1B,MAAMK,oBAAoBC,uBAAuBF,MAAAA;GACjD,IAAI,CAACC,mBACD;GAGJ,MAAME,SAAsC,EAAEC,WAAW5B,iCAAiC;GAC1F,MAAM6B,OAAO,MAAMC,UACfpB,SAASK,aACTL,SAASqB,OACTN,mBACAE,QACA,KAAKpB,MAAM;GAEf,IAAI,CAACsB,MACD;GAGJ,IAAI;IACAG,wBAAwBH,IAAAA;IACxB;GACJ,QAAQ;IAGJ;GACJ;EACJ;EAEA,MAAM,IAAIjC,gBAAgB,sDAAA;CAC9B;AACJ;AAEA,SAAgBe,+CACZD,UAAmC;CAEnCuB,yBAAyBvB,SAASK,WAAW;CAG7C,IADoBL,SAASK,YAAYoB,aAAanD,yBAClDkD,CAAAA,EAAaE,IACb,MAAM,IAAIxC,gBAAgB,0DAAA;AAElC;AAEA,SAAgByC,4BAA4BC,KAAW;CACnD,MAAMC,SAASD,IAAIE,MAAMzC,yBAAAA;CACzB,IAAI,CAACwC,UAAUA,OAAOE,WAAW,GAC7B,MAAM,IAAI7C,gBAAgB,4CAAA;CAG9B,IAAI;EACA,OAAO2C,OAAOG,KAAKC,UAAU,IAAIlD,gBAAgBkD,KAAAA,CAAAA;CACrD,QAAQ;EACJ,MAAM,IAAI/C,gBAAgB,4CAAA;CAC9B;AACJ;AAEA,eAAsBgD,iCAClB7B,aACAR,QAAe;CAEf,MAAMsC,SAAS,MAAM9B,YAAY+B,cAAc,WAAWvC,MAAAA;CAE1D,OAAOV,gBACHkD,OAAOC,aAAY,GAAI,IAAIC,WAAWJ,MAAAA,CAAAA,CAAAA;AAE9C;AAEA,SAASnB,uBAAuBF,QAAmB;CAC/C,IAAI;EACA,OAAOa,4BAA4Bb,OAAOT,WAAW,CAAC,CAAC;CAC3D,QAAQ;EAIJ;CACJ;AACJ;AAEA,eAAee,UACXqB,MACAC,eACA5B,QACAG,QACApB,QAAe;CAEf,OAAO8C,aAAaF,MAAMC,eAAe5B,QAAQ,CAAC2B,IAAAA,GAAOxB,QAAQpB,MAAAA;AACrE;AAEA,eAAe8C,aACXC,SACAC,WACA/B,QACAK,MACAF,QACApB,QAAe;CAEf,IAAIsB,KAAKY,SAAS3C,iBACd;CAGJ,IAAI0D,gBAAgBF,SAAS9B,MAAAA,GACzB,OAAOK;CAGX,IAAI,MAAM4B,WAAWH,SAAS9B,QAAQG,QAAQpB,MAAAA,GAC1C,OAAO,CAAA,GAAIsB,MAAML,MAAAA;CAGrB,KAAK,IAAIkC,QAAQ,GAAGA,QAAQH,UAAUd,QAAQiB,SAAS,GAAG;EACtD,MAAMC,YAAYJ,UAAUG;EAC5B,IACI,CAACC,aACDH,gBAAgBF,SAASK,SAAAA,KACzB,CAAC,MAAMF,WAAWH,SAASK,WAAWhC,QAAQpB,MAAAA,GAE9C;EAGJ,MAAMqD,OAAO,MAAMP,aACfM,WACAJ,UAAUM,QAAQC,OAAOC,mBAAmBA,mBAAmBL,KAAAA,GAC/DlC,QACA,CAAA,GAAIK,MAAM8B,SAAAA,GACVhC,QACApB,MAAAA;EAEJ,IAAIqD,MACA,OAAOA;CAEf;AAGJ;AAEA,eAAeH,WACX1C,aACAiD,QACArC,QACApB,QAAe;CAEf,IAAIQ,YAAYiD,WAAWA,OAAOC,SAC9B,OAAO;CAGX,MAAMC,yBAAyBnD,YAAYoB,aAAapD,+BAAAA;CACxD,IAAImF,wBAAwBC,OAAO;EAC/B,MAAMC,uBAAuBJ,OAAO7B,aAAa3C,6BAAAA;EACjD,IAAI4E,wBAAwBA,qBAAqBD,UAAUD,uBAAuBC,OAC9E,OAAO;CAEf;CAMA,IAAIxC,OAAOC,aAAa,GACpB,OAAO;CAEXD,OAAOC,aAAa;CAEpB,IAAI;EACA,OAAO,MAAMb,YAAYsD,OAAO;GAC5BC,WAAWN;GACXO,eAAe;EACnB,GAAGhE,MAAAA;CACP,QAAQ;EACJ,OAAO;CACX;AACJ;AAEA,SAASiD,gBAAgBgB,MAAuBC,OAAsB;CAClE,MAAMC,UAAU,IAAIzB,WAAWuB,KAAKG,OAAO;CAC3C,MAAMC,WAAW,IAAI3B,WAAWwB,MAAME,OAAO;CAE7C,OAAOD,QAAQjC,WAAWmC,SAASnC,UAC/BiC,QAAQG,OAAOC,OAAOpB,UAAUoB,UAAUF,SAASlB,MAAM;AACjE;AAEA,SAAS1B,wBAAwBH,MAAuB;CACpD,IAAIA,KAAKY,SAAS,GACd,MAAM,IAAI7C,gBAAgB,0CAAA;CAG9B,KAAK,IAAI8D,QAAQ,GAAGA,QAAQ7B,KAAKY,QAAQiB,SAAS,GAAG;EACjD,MAAM3C,cAAcc,KAAK6B;EACzB,IAAI,CAAC3C,aACD,MAAM,IAAInB,gBAAgB,0CAAA;EAQ9B,IAAI,EADa8D,UAAU7B,KAAKY,SAAS,IAC1B;GACXvB,sCAAsCH,WAAAA;GACtCI,sBAAsBJ,WAAAA;GACtBiE,6BAA6BjE,WAAAA;EACjC;EAEAkB,yBAAyBlB,WAAAA;EACzB,MAAMmB,cAAcnB,YAAYoB,aAAanD,yBAAAA;EAC7C,IAAI,CAACkD,aAAaE,IACd,MAAM,IAAIxC,gBAAgB,wDAAA;EAG9B,MAAMqF,WAAWlE,YAAYoB,aAAa7C,kBAAAA;EAC1C,IAAI2F,aAAaA,SAASC,SAAS7F,cAAc8F,iBAAiB,GAC9D,MAAM,IAAIvF,gBAAgB,uDAAA;EAM9B,IACI,OAAOsC,YAAYkD,eAAe,YAClC,QAAS,IAAKlD,YAAYkD,YAE1B,MAAM,IAAIxF,gBAAgB,mEAAA;CAElC;AACJ;AAEA,SAASkB,+BAA+BC,aAA4B;CAChE,MAAMsE,mBAAmBtE,YAAYoB,aAAajD,yBAAAA;CAClD,IACImG,oBACA,CAACA,iBAAiBH,OAAOI,SAASrG,iBAAiBsG,UAAU,GAE7D,MAAM,IAAI3F,gBAAgB,6DAAA;CAG9B,MAAMqF,WAAWlE,YAAYoB,aAAa7C,kBAAAA;CAC1C,IAAI2F,aAAaA,SAASC,SAAS7F,cAAcmG,sBAAsB,GACnE,MAAM,IAAI5F,gBAAgB,6DAAA;AAElC;;;;;;;GASA,SAASoF,6BAA6BjE,aAA4B;CAC9D,MAAMsE,mBAAmBtE,YAAYoB,aAAajD,yBAAAA;CAClD,IACImG,oBACA,CAACA,iBAAiBH,OAAOI,SAASrG,iBAAiBsG,UAAU,KAC7D,CAACF,iBAAiBH,OAAOI,SAASlF,0BAAAA,GAElC,MAAM,IAAIR,gBAAgB,+FAAA;AAElC;AAEA,SAASoB,gCAAgCD,aAA8B0E,UAAgB;CACnF,MAAMC,yBAAyB3E,YAAYoB,aAAa5C,+BAAAA;CACxD,MAAMoG,aAAaD,yBACfA,uBAAuBE,MAAMC,MACxBhC,QAAQiC,SAASA,KAAKC,SAAS3G,GAAAA,CAAAA,CAC/BsD,KAAKoD,SAASA,KAAKhB,KAAK,CAAA,CACxBjB,QAAQiB,UAAUA,MAAMkB,WAAWtG,6BAAAA,CAAAA,IACxC,CAAA;CAEJ,MAAMuG,WAAWtG,0BAA0B8F,QAAAA;CAC3C,IAAIE,WAAWlD,WAAW,KAAKkD,WAAW,OAAOM,UAC7C,MAAM,IAAIrG,gBAAgB,mEAAmEqG,SAAS,EAAE;AAEhH;AAEA,SAAShE,yBAAyBlB,aAA4B;CAC1D,MAAMmF,MAAMC,KAAKD,IAAG;CACpB,IACInF,YAAYqF,UAAUC,QAAO,IAAKH,OAClCnF,YAAYuF,SAASD,QAAO,IAAKH,KAEjC,MAAM,IAAItG,gBAAgB,gDAAA;AAElC;AAEA,SAASsB,sCAAsCH,aAA4B;CACvE,KAAK,MAAMwF,aAAaxF,YAAYyF,YAChC,IAAID,UAAUE,YAAY,CAACxG,gCAAgCyG,IAAIH,UAAUR,IAAI,GACzE,MAAM,IAAInG,gBACN,8DAA8D2G,UAAUR,KAAK,GAAG;AAIhG;AAEA,SAAS5E,sBAAsBJ,aAA4B;CACvD,MAAM4F,OAAO5F,YAAY6F,oBAAoBD,MAAMb;CACnD,IAAI,OAAOa,SAAS,YAAYxG,sBAAsBuG,IAAIC,KAAKE,YAAW,CAAA,GACtE,MAAM,IAAIjH,gBAAgB,oDAAoD+G,KAAK,GAAG;AAE9F"}
1	+ {"version":3,"file":"module.mjs","names":["AuthorityKeyIdentifierExtension","BasicConstraintsExtension","ExtendedKeyUsage","ExtendedKeyUsageExtension","URL","GENERAL_NAME_URL","KeyUsageFlags","KeyUsagesExtension","SubjectAlternativeNameExtension","SubjectKeyIdentifierExtension","X509Certificate","CLIENT_CERTIFICATE_URI_PREFIX","buildClientCertificateURI","ValidationError","base64URLEncode","MAX_CHAIN_DEPTH","CERTIFICATE_BLOCK_PATTERN","MAX_PATH_SIGNATURE_VERIFICATIONS","HANDLED_CRITICAL_EXTENSION_OIDS","Set","WEAK_SIGNATURE_HASHES","ANY_EXTENDED_KEY_USAGE_OID","ClientCertificateValidator","trustAnchorRepository","crypto","ctx","validateForBinding","evidence","assertClientCertificateEvidenceValidForBinding","validateForAuthentication","client","assertClientCertificatePurpose","certificate","assertClientCertificateIdentity","id","assertCertificateExtensionsUnderstood","assertStrongSignature","anchors","findManyBy","realmId","enabled","anchor","anchorCertificate","parseAnchorCertificate","budget","remaining","path","buildPath","chain","assertCertificationPath","assertCertificateCurrent","constraints","getExtension","ca","parseClientCertificateChain","pem","blocks","match","length","map","block","buildClientCertificateThumbprint","digest","getThumbprint","String","fromCharCode","Uint8Array","undefined","leaf","intermediates","continuePath","current","available","sameCertificate","isIssuedBy","index","candidate","next","filter","_item","candidateIndex","issuer","subject","authorityKeyIdentifier","keyId","subjectKeyIdentifier","verify","publicKey","signatureOnly","left","right","leftRaw","rawData","rightRaw","every","value","isAnchor","assertIssuerExtendedKeyUsage","keyUsage","usages","keyCertSign","pathLength","extendedKeyUsage","includes","clientAuth","digitalSignature","clientId","subjectAlternativeName","authupUris","names","items","name","type","startsWith","expected","now","Date","notBefore","getTime","notAfter","extension","extensions","critical","has","hash","signatureAlgorithm","toUpperCase"],"sources":["../../../src/core/client-certificate/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport './reflect.ts';\nimport {\n AuthorityKeyIdentifierExtension,\n BasicConstraintsExtension,\n ExtendedKeyUsage,\n ExtendedKeyUsageExtension,\n URL as GENERAL_NAME_URL,\n KeyUsageFlags,\n KeyUsagesExtension,\n SubjectAlternativeNameExtension,\n SubjectKeyIdentifierExtension,\n X509Certificate,\n} from '@peculiar/x509';\nimport type { Client, TrustAnchor } from '@authup/core-kit';\nimport {\n CLIENT_CERTIFICATE_URI_PREFIX,\n buildClientCertificateURI,\n} from '@authup/core-kit';\nimport { ValidationError } from '@authup/errors';\nimport { base64URLEncode } from '@authup/kit';\nimport type {\n ClientCertificateEvidence,\n ClientCertificateValidatorContext,\n IClientCertificateValidator,\n} from './types.ts';\n\nconst MAX_CHAIN_DEPTH = 10;\nconst CERTIFICATE_BLOCK_PATTERN = /-----BEGIN CERTIFICATE-----[\\s\\S]?-----END CERTIFICATE-----/g;\n\n/*\n Hard ceiling on signature verifications performed while building a single\n * certification path. A legitimate chain of the maximum accepted length only\n * needs O(depth²) verifications; the ceiling exists purely to defuse the\n * factorial backtracking blow-up an attacker can induce with certificates\n * that mutually \"issue\" one another (shared key, identical subject/issuer\n * DNs). Reaching the ceiling is treated as \"no path found\" (fail closed).\n /\nconst MAX_PATH_SIGNATURE_VERIFICATIONS = 64;\n\n/\n OIDs of the certificate extensions this validator actually processes. A\n * certificate carrying a critical extension outside this set is rejected\n * (RFC 5280 §4.2): an unprocessed critical constraint must never be silently\n * ignored. Because RFC 5280 requires the NameConstraints extension to be\n * marked critical, this also fails a name-constrained CA closed rather than\n * trusting a chain whose name constraints we do not evaluate.\n /\nconst HANDLED_CRITICAL_EXTENSION_OIDS = new Set<string>([\n '2.5.29.19', // basicConstraints\n '2.5.29.15', // keyUsage\n '2.5.29.37', // extKeyUsage\n '2.5.29.17', // subjectAltName\n '2.5.29.35', // authorityKeyIdentifier\n '2.5.29.14', // subjectKeyIdentifier\n]);\n\nconst WEAK_SIGNATURE_HASHES = new Set<string>(['SHA-1', 'MD5', 'MD2', 'MD4']);\n\n// anyExtendedKeyUsage (RFC 5280 §4.2.1.12) — a CA carrying it is unconstrained.\nconst ANY_EXTENDED_KEY_USAGE_OID = '2.5.29.37.0';\n\ntype SignatureVerificationBudget = { remaining: number };\n\n/\n Validates client certificates without performing network I/O. AIA, CRL,\n * and OCSP retrieval are deliberately outside the external-PKI first slice.\n /\nexport class ClientCertificateValidator implements IClientCertificateValidator {\n protected trustAnchorRepository: ClientCertificateValidatorContext['trustAnchorRepository'];\n\n protected crypto?: Crypto;\n\n constructor(ctx: ClientCertificateValidatorContext) {\n this.trustAnchorRepository = ctx.trustAnchorRepository;\n this.crypto = ctx.crypto;\n }\n\n validateForBinding(evidence: ClientCertificateEvidence): void {\n assertClientCertificateEvidenceValidForBinding(evidence);\n }\n\n async validateForAuthentication(\n client: Pick<Client, 'id' \| 'realmId'>,\n evidence: ClientCertificateEvidence,\n ): Promise<void> {\n this.validateForBinding(evidence);\n assertClientCertificatePurpose(evidence.certificate);\n assertClientCertificateIdentity(evidence.certificate, client.id);\n assertCertificateExtensionsUnderstood(evidence.certificate);\n assertStrongSignature(evidence.certificate);\n\n const anchors = await this.trustAnchorRepository.findManyBy({\n realmId: client.realmId,\n enabled: true,\n });\n\n for (const anchor of anchors) {\n const anchorCertificate = parseAnchorCertificate(anchor);\n if (!anchorCertificate) {\n continue;\n }\n\n const budget: SignatureVerificationBudget = { remaining: MAX_PATH_SIGNATURE_VERIFICATIONS };\n const path = await buildPath(\n evidence.certificate,\n evidence.chain,\n anchorCertificate,\n budget,\n this.crypto,\n );\n if (!path) {\n continue;\n }\n\n try {\n assertCertificationPath(path);\n return;\n } catch {\n // A chain reaching this anchor failed its CA constraints;\n // another enabled anchor may still yield a valid path.\n continue;\n }\n }\n\n throw new ValidationError('The client certificate is not trusted in this realm.');\n }\n}\n\nexport function assertClientCertificateEvidenceValidForBinding(\n evidence: ClientCertificateEvidence,\n): void {\n assertCertificateCurrent(evidence.certificate);\n\n const constraints = evidence.certificate.getExtension(BasicConstraintsExtension);\n if (constraints?.ca) {\n throw new ValidationError('A CA certificate cannot be used as a client certificate.');\n }\n}\n\nexport function parseClientCertificateChain(pem: string): X509Certificate[] {\n const blocks = pem.match(CERTIFICATE_BLOCK_PATTERN);\n if (!blocks \|\| blocks.length === 0) {\n throw new ValidationError('The certificate chain could not be parsed.');\n }\n\n try {\n return blocks.map((block) => new X509Certificate(block));\n } catch {\n throw new ValidationError('The certificate chain could not be parsed.');\n }\n}\n\nexport async function buildClientCertificateThumbprint(\n certificate: X509Certificate,\n crypto?: Crypto,\n): Promise<string> {\n const digest = await certificate.getThumbprint('SHA-256', crypto);\n\n return base64URLEncode(\n String.fromCharCode(...new Uint8Array(digest)),\n );\n}\n\nfunction parseAnchorCertificate(anchor: TrustAnchor): X509Certificate \| undefined {\n try {\n return parseClientCertificateChain(anchor.certificate)[0];\n } catch {\n // Rows are validated on create. Treat a corrupt legacy/database row as\n // unusable trust material instead of turning client authentication into\n // a 500 or accidentally trusting another certificate in its PEM chain.\n return undefined;\n }\n}\n\nasync function buildPath(\n leaf: X509Certificate,\n intermediates: X509Certificate[],\n anchor: X509Certificate,\n budget: SignatureVerificationBudget,\n crypto?: Crypto,\n): Promise<X509Certificate[] \| undefined> {\n return continuePath(leaf, intermediates, anchor, [leaf], budget, crypto);\n}\n\nasync function continuePath(\n current: X509Certificate,\n available: X509Certificate[],\n anchor: X509Certificate,\n path: X509Certificate[],\n budget: SignatureVerificationBudget,\n crypto?: Crypto,\n): Promise<X509Certificate[] \| undefined> {\n if (path.length > MAX_CHAIN_DEPTH) {\n return undefined;\n }\n\n if (sameCertificate(current, anchor)) {\n return path;\n }\n\n if (await isIssuedBy(current, anchor, budget, crypto)) {\n return [...path, anchor];\n }\n\n for (let index = 0; index < available.length; index += 1) {\n const candidate = available[index];\n if (\n !candidate \|\|\n sameCertificate(current, candidate) \|\|\n !await isIssuedBy(current, candidate, budget, crypto)\n ) {\n continue;\n }\n\n const next = await continuePath(\n candidate,\n available.filter((_item, candidateIndex) => candidateIndex !== index),\n anchor,\n [...path, candidate],\n budget,\n crypto,\n );\n if (next) {\n return next;\n }\n }\n\n return undefined;\n}\n\nasync function isIssuedBy(\n certificate: X509Certificate,\n issuer: X509Certificate,\n budget: SignatureVerificationBudget,\n crypto?: Crypto,\n): Promise<boolean> {\n if (certificate.issuer !== issuer.subject) {\n return false;\n }\n\n const authorityKeyIdentifier = certificate.getExtension(AuthorityKeyIdentifierExtension);\n if (authorityKeyIdentifier?.keyId) {\n const subjectKeyIdentifier = issuer.getExtension(SubjectKeyIdentifierExtension);\n if (subjectKeyIdentifier && subjectKeyIdentifier.keyId !== authorityKeyIdentifier.keyId) {\n return false;\n }\n }\n\n // Spend from the shared verification budget only for the expensive\n // cryptographic check (the DN / key-id pre-filters above are cheap). Once\n // exhausted, treat every further edge as unverified so a maliciously\n // crafted mutually-issuing certificate set cannot force factorial work.\n if (budget.remaining <= 0) {\n return false;\n }\n budget.remaining -= 1;\n\n try {\n return await certificate.verify({\n publicKey: issuer,\n signatureOnly: true,\n }, crypto);\n } catch {\n return false;\n }\n}\n\nfunction sameCertificate(left: X509Certificate, right: X509Certificate): boolean {\n const leftRaw = new Uint8Array(left.rawData);\n const rightRaw = new Uint8Array(right.rawData);\n\n return leftRaw.length === rightRaw.length &&\n leftRaw.every((value, index) => value === rightRaw[index]);\n}\n\nfunction assertCertificationPath(path: X509Certificate[]): void {\n if (path.length < 2) {\n throw new ValidationError('The client certificate chain is invalid.');\n }\n\n for (let index = 1; index < path.length; index += 1) {\n const certificate = path[index];\n if (!certificate) {\n throw new ValidationError('The client certificate chain is invalid.');\n }\n\n // The last path element is the configured trust anchor, trusted a\n // priori — its self-signature algorithm and any critical extensions\n // it carries are the operator's responsibility, so the RFC 5280\n // conformance checks below apply only to the issued intermediates.\n const isAnchor = index === path.length - 1;\n if (!isAnchor) {\n assertCertificateExtensionsUnderstood(certificate);\n assertStrongSignature(certificate);\n assertIssuerExtendedKeyUsage(certificate);\n }\n\n assertCertificateCurrent(certificate);\n const constraints = certificate.getExtension(BasicConstraintsExtension);\n if (!constraints?.ca) {\n throw new ValidationError('The client certificate chain contains a non-CA issuer.');\n }\n\n const keyUsage = certificate.getExtension(KeyUsagesExtension);\n if (keyUsage && (keyUsage.usages & KeyUsageFlags.keyCertSign) === 0) {\n throw new ValidationError('A client certificate issuer cannot sign certificates.');\n }\n\n // `index - 1` is the number of non-leaf CA certificates below this\n // issuer in the selected path. A pathLenConstraint of zero therefore\n // permits a directly-issued client leaf and no subordinate CA.\n if (\n typeof constraints.pathLength === 'number' &&\n (index - 1) > constraints.pathLength\n ) {\n throw new ValidationError('The client certificate chain exceeds a CA path-length constraint.');\n }\n }\n}\n\nfunction assertClientCertificatePurpose(certificate: X509Certificate): void {\n const extendedKeyUsage = certificate.getExtension(ExtendedKeyUsageExtension);\n if (\n extendedKeyUsage &&\n !extendedKeyUsage.usages.includes(ExtendedKeyUsage.clientAuth)\n ) {\n throw new ValidationError('The certificate is not valid for TLS client authentication.');\n }\n\n const keyUsage = certificate.getExtension(KeyUsagesExtension);\n if (keyUsage && (keyUsage.usages & KeyUsageFlags.digitalSignature) === 0) {\n throw new ValidationError('The certificate cannot prove possession of its private key.');\n }\n}\n\n/\n EKU chaining (RFC 5280 §4.2.1.12): a CA whose Extended Key Usage is present\n * but omits both `clientAuth` and `anyExtendedKeyUsage` is not permitted to\n * issue TLS-client-authentication certificates, so a leaf beneath it must be\n * rejected. (A CA's EKU may be non-critical, so the critical-extension check\n * does not cover this.) A CA with no EKU extension is unconstrained.\n */\nfunction assertIssuerExtendedKeyUsage(certificate: X509Certificate): void {\n const extendedKeyUsage = certificate.getExtension(ExtendedKeyUsageExtension);\n if (\n extendedKeyUsage &&\n !extendedKeyUsage.usages.includes(ExtendedKeyUsage.clientAuth) &&\n !extendedKeyUsage.usages.includes(ANY_EXTENDED_KEY_USAGE_OID)\n ) {\n throw new ValidationError('A client certificate issuer is not permitted to issue TLS client-authentication certificates.');\n }\n}\n\nfunction assertClientCertificateIdentity(certificate: X509Certificate, clientId: string): void {\n const subjectAlternativeName = certificate.getExtension(SubjectAlternativeNameExtension);\n const authupUris = subjectAlternativeName ?\n subjectAlternativeName.names.items\n .filter((name) => name.type === GENERAL_NAME_URL)\n .map((name) => name.value)\n .filter((value) => value.startsWith(CLIENT_CERTIFICATE_URI_PREFIX)) :\n [];\n\n const expected = buildClientCertificateURI(clientId);\n if (authupUris.length !== 1 \|\| authupUris[0] !== expected) {\n throw new ValidationError(`The certificate must contain exactly one Authup client URI SAN: ${expected}.`);\n }\n}\n\nfunction assertCertificateCurrent(certificate: X509Certificate): void {\n const now = Date.now();\n if (\n certificate.notBefore.getTime() > now \|\|\n certificate.notAfter.getTime() < now\n ) {\n throw new ValidationError('The client certificate is not currently valid.');\n }\n}\n\nfunction assertCertificateExtensionsUnderstood(certificate: X509Certificate): void {\n for (const extension of certificate.extensions) {\n if (extension.critical && !HANDLED_CRITICAL_EXTENSION_OIDS.has(extension.type)) {\n throw new ValidationError(\n `The certificate carries an unsupported critical extension (${extension.type}).`,\n );\n }\n }\n}\n\nfunction assertStrongSignature(certificate: X509Certificate): void {\n const hash = certificate.signatureAlgorithm?.hash?.name;\n if (typeof hash === 'string' && WEAK_SIGNATURE_HASHES.has(hash.toUpperCase())) {\n throw new ValidationError(`The certificate is signed with a weak algorithm (${hash}).`);\n }\n}\n"],"mappings":";;;;;;;;;AAiCA,MAAMe,kBAAkB;AACxB,MAAMC,4BAA4B;;;;;;;;GAUlC,MAAMC,mCAAmC;;;;;;;;GAUzC,MAAMC,kDAAkC,IAAIC,IAAY;CACpD;CACA;CACA;CACA;CACA;CACA;AACH,CAAA;AAED,MAAMC,wCAAwB,IAAID,IAAY;CAAC;CAAS;CAAO;CAAO;AAAM,CAAA;AAG5E,MAAME,6BAA6B;;;;GAQnC,IAAaC,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKF,wBAAwBE,IAAIF;EACjC,KAAKC,SAASC,IAAID;CACtB;CAEAE,mBAAmBC,UAA2C;EAC1DC,+CAA+CD,QAAAA;CACnD;CAEA,MAAME,0BACFC,QACAH,UACa;EACb,KAAKD,mBAAmBC,QAAAA;EACxBI,+BAA+BJ,SAASK,WAAW;EACnDC,gCAAgCN,SAASK,aAAaF,OAAOI,EAAE;EAC/DC,sCAAsCR,SAASK,WAAW;EAC1DI,sBAAsBT,SAASK,WAAW;EAE1C,MAAMK,UAAU,MAAM,KAAKd,sBAAsBe,WAAW;GACxDC,SAAST,OAAOS;GAChBC,SAAS;EACb,CAAA;EAEA,KAAK,MAAMC,UAAUJ,SAAS;GAC1B,MAAMK,oBAAoBC,uBAAuBF,MAAAA;GACjD,IAAI,CAACC,mBACD;GAGJ,MAAME,SAAsC,EAAEC,WAAW5B,iCAAiC;GAC1F,MAAM6B,OAAO,MAAMC,UACfpB,SAASK,aACTL,SAASqB,OACTN,mBACAE,QACA,KAAKpB,MAAM;GAEf,IAAI,CAACsB,MACD;GAGJ,IAAI;IACAG,wBAAwBH,IAAAA;IACxB;GACJ,QAAQ;IAGJ;GACJ;EACJ;EAEA,MAAM,IAAIjC,gBAAgB,sDAAA;CAC9B;AACJ;AAEA,SAAgBe,+CACZD,UAAmC;CAEnCuB,yBAAyBvB,SAASK,WAAW;CAG7C,IADoBL,SAASK,YAAYoB,aAAanD,yBAClDkD,CAAAA,EAAaE,IACb,MAAM,IAAIxC,gBAAgB,0DAAA;AAElC;AAEA,SAAgByC,4BAA4BC,KAAW;CACnD,MAAMC,SAASD,IAAIE,MAAMzC,yBAAAA;CACzB,IAAI,CAACwC,UAAUA,OAAOE,WAAW,GAC7B,MAAM,IAAI7C,gBAAgB,4CAAA;CAG9B,IAAI;EACA,OAAO2C,OAAOG,KAAKC,UAAU,IAAIlD,gBAAgBkD,KAAAA,CAAAA;CACrD,QAAQ;EACJ,MAAM,IAAI/C,gBAAgB,4CAAA;CAC9B;AACJ;AAEA,eAAsBgD,iCAClB7B,aACAR,QAAe;CAEf,MAAMsC,SAAS,MAAM9B,YAAY+B,cAAc,WAAWvC,MAAAA;CAE1D,OAAOV,gBACHkD,OAAOC,aAAY,GAAI,IAAIC,WAAWJ,MAAAA,CAAAA,CAAAA;AAE9C;AAEA,SAASnB,uBAAuBF,QAAmB;CAC/C,IAAI;EACA,OAAOa,4BAA4Bb,OAAOT,WAAW,CAAC,CAAC;CAC3D,QAAQ;EAIJ;CACJ;AACJ;AAEA,eAAee,UACXqB,MACAC,eACA5B,QACAG,QACApB,QAAe;CAEf,OAAO8C,aAAaF,MAAMC,eAAe5B,QAAQ,CAAC2B,IAAK,GAAExB,QAAQpB,MAAAA;AACrE;AAEA,eAAe8C,aACXC,SACAC,WACA/B,QACAK,MACAF,QACApB,QAAe;CAEf,IAAIsB,KAAKY,SAAS3C,iBACd;CAGJ,IAAI0D,gBAAgBF,SAAS9B,MAAAA,GACzB,OAAOK;CAGX,IAAI,MAAM4B,WAAWH,SAAS9B,QAAQG,QAAQpB,MAAAA,GAC1C,OAAO,CAAIsB,GAAAA,MAAML,MAAO;CAG5B,KAAK,IAAIkC,QAAQ,GAAGA,QAAQH,UAAUd,QAAQiB,SAAS,GAAG;EACtD,MAAMC,YAAYJ,UAAUG;EAC5B,IACI,CAACC,aACDH,gBAAgBF,SAASK,SAAAA,KACzB,CAAC,MAAMF,WAAWH,SAASK,WAAWhC,QAAQpB,MAAAA,GAE9C;EAGJ,MAAMqD,OAAO,MAAMP,aACfM,WACAJ,UAAUM,QAAQC,OAAOC,mBAAmBA,mBAAmBL,KAAAA,GAC/DlC,QACA,CAAIK,GAAAA,MAAM8B,SAAU,GACpBhC,QACApB,MAAAA;EAEJ,IAAIqD,MACA,OAAOA;CAEf;AAGJ;AAEA,eAAeH,WACX1C,aACAiD,QACArC,QACApB,QAAe;CAEf,IAAIQ,YAAYiD,WAAWA,OAAOC,SAC9B,OAAO;CAGX,MAAMC,yBAAyBnD,YAAYoB,aAAapD,+BAAAA;CACxD,IAAImF,wBAAwBC,OAAO;EAC/B,MAAMC,uBAAuBJ,OAAO7B,aAAa3C,6BAAAA;EACjD,IAAI4E,wBAAwBA,qBAAqBD,UAAUD,uBAAuBC,OAC9E,OAAO;CAEf;CAMA,IAAIxC,OAAOC,aAAa,GACpB,OAAO;CAEXD,OAAOC,aAAa;CAEpB,IAAI;EACA,OAAO,MAAMb,YAAYsD,OAAO;GAC5BC,WAAWN;GACXO,eAAe;EACnB,GAAGhE,MAAAA;CACP,QAAQ;EACJ,OAAO;CACX;AACJ;AAEA,SAASiD,gBAAgBgB,MAAuBC,OAAsB;CAClE,MAAMC,UAAU,IAAIzB,WAAWuB,KAAKG,OAAO;CAC3C,MAAMC,WAAW,IAAI3B,WAAWwB,MAAME,OAAO;CAE7C,OAAOD,QAAQjC,WAAWmC,SAASnC,UAC/BiC,QAAQG,OAAOC,OAAOpB,UAAUoB,UAAUF,SAASlB,MAAM;AACjE;AAEA,SAAS1B,wBAAwBH,MAAuB;CACpD,IAAIA,KAAKY,SAAS,GACd,MAAM,IAAI7C,gBAAgB,0CAAA;CAG9B,KAAK,IAAI8D,QAAQ,GAAGA,QAAQ7B,KAAKY,QAAQiB,SAAS,GAAG;EACjD,MAAM3C,cAAcc,KAAK6B;EACzB,IAAI,CAAC3C,aACD,MAAM,IAAInB,gBAAgB,0CAAA;EAQ9B,IAAI,EADa8D,UAAU7B,KAAKY,SAAS,IAC1B;GACXvB,sCAAsCH,WAAAA;GACtCI,sBAAsBJ,WAAAA;GACtBiE,6BAA6BjE,WAAAA;EACjC;EAEAkB,yBAAyBlB,WAAAA;EACzB,MAAMmB,cAAcnB,YAAYoB,aAAanD,yBAAAA;EAC7C,IAAI,CAACkD,aAAaE,IACd,MAAM,IAAIxC,gBAAgB,wDAAA;EAG9B,MAAMqF,WAAWlE,YAAYoB,aAAa7C,kBAAAA;EAC1C,IAAI2F,aAAaA,SAASC,SAAS7F,cAAc8F,iBAAiB,GAC9D,MAAM,IAAIvF,gBAAgB,uDAAA;EAM9B,IACI,OAAOsC,YAAYkD,eAAe,YAClC,QAAS,IAAKlD,YAAYkD,YAE1B,MAAM,IAAIxF,gBAAgB,mEAAA;CAElC;AACJ;AAEA,SAASkB,+BAA+BC,aAA4B;CAChE,MAAMsE,mBAAmBtE,YAAYoB,aAAajD,yBAAAA;CAClD,IACImG,oBACA,CAACA,iBAAiBH,OAAOI,SAASrG,iBAAiBsG,UAAU,GAE7D,MAAM,IAAI3F,gBAAgB,6DAAA;CAG9B,MAAMqF,WAAWlE,YAAYoB,aAAa7C,kBAAAA;CAC1C,IAAI2F,aAAaA,SAASC,SAAS7F,cAAcmG,sBAAsB,GACnE,MAAM,IAAI5F,gBAAgB,6DAAA;AAElC;;;;;;;GASA,SAASoF,6BAA6BjE,aAA4B;CAC9D,MAAMsE,mBAAmBtE,YAAYoB,aAAajD,yBAAAA;CAClD,IACImG,oBACA,CAACA,iBAAiBH,OAAOI,SAASrG,iBAAiBsG,UAAU,KAC7D,CAACF,iBAAiBH,OAAOI,SAASlF,0BAAAA,GAElC,MAAM,IAAIR,gBAAgB,+FAAA;AAElC;AAEA,SAASoB,gCAAgCD,aAA8B0E,UAAgB;CACnF,MAAMC,yBAAyB3E,YAAYoB,aAAa5C,+BAAAA;CACxD,MAAMoG,aAAaD,yBACfA,uBAAuBE,MAAMC,MACxBhC,QAAQiC,SAASA,KAAKC,SAAS3G,GAAAA,CAAAA,CAC/BsD,KAAKoD,SAASA,KAAKhB,KAAK,CAAA,CACxBjB,QAAQiB,UAAUA,MAAMkB,WAAWtG,6BAAAA,CAAAA,IACxC,CAAA;CAEJ,MAAMuG,WAAWtG,0BAA0B8F,QAAAA;CAC3C,IAAIE,WAAWlD,WAAW,KAAKkD,WAAW,OAAOM,UAC7C,MAAM,IAAIrG,gBAAgB,mEAAmEqG,SAAS,EAAE;AAEhH;AAEA,SAAShE,yBAAyBlB,aAA4B;CAC1D,MAAMmF,MAAMC,KAAKD,IAAG;CACpB,IACInF,YAAYqF,UAAUC,QAAO,IAAKH,OAClCnF,YAAYuF,SAASD,QAAO,IAAKH,KAEjC,MAAM,IAAItG,gBAAgB,gDAAA;AAElC;AAEA,SAASsB,sCAAsCH,aAA4B;CACvE,KAAK,MAAMwF,aAAaxF,YAAYyF,YAChC,IAAID,UAAUE,YAAY,CAACxG,gCAAgCyG,IAAIH,UAAUR,IAAI,GACzE,MAAM,IAAInG,gBACN,8DAA8D2G,UAAUR,KAAK,GAAG;AAIhG;AAEA,SAAS5E,sBAAsBJ,aAA4B;CACvD,MAAM4F,OAAO5F,YAAY6F,oBAAoBD,MAAMb;CACnD,IAAI,OAAOa,SAAS,YAAYxG,sBAAsBuG,IAAIC,KAAKE,YAAW,CAAA,GACtE,MAAM,IAAIjH,gBAAgB,oDAAoD+G,KAAK,GAAG;AAE9F"}

package/dist/core/entities/client/schema.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","accessPolicy","POLICY","clientSchema","name","CLIENT","fields","default","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Client } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM, accessPolicy: EntityType.POLICY };\n\nexport const clientSchema = defineSchema<Client>({\n name: EntityType.CLIENT,\n fields: {\n default: [\n 'id',\n 'active',\n 'builtIn',\n 'name',\n 'displayName',\n 'description',\n 'secretHashed',\n 'secretEncrypted',\n 'baseUrl',\n 'rootUrl',\n 'redirectUri',\n 'postLogoutRedirectUri',\n 'grantTypes',\n 'scope',\n 'authMethod',\n 'tokenBindingMethod',\n 'accessPolicyId',\n 'realmId',\n 'updatedAt',\n 'createdAt',\n ],\n allowed: ['secret'],\n },\n filters: { allowed: ['id', 'name', 'realmId'] },\n relations: { allowed: ['realm', 'accessPolicy'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,OAAOH,WAAWI;CAAOC,cAAcL,WAAWM;AAAO;AAEjF,MAAaC,eAAeR,aAAqB;CAC7CS,MAAMR,WAAWS;CACjBC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA~~;;EAEJC~~,SAAS,CAAC,~~QAAA~~;~~CACd~~;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;~~GAAW~~;CAC9CE,WAAW;EAAEF,SAAS,CAAC,SAAS,~~cAAA~~;~~EAAiBG~~,UAAUd,wBAAwBC,aAAAA;CAAe;CAClGc,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAa;~~GAAa~~;CAClDK,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
1	+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","accessPolicy","POLICY","clientSchema","name","CLIENT","fields","default","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Client } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM, accessPolicy: EntityType.POLICY };\n\nexport const clientSchema = defineSchema<Client>({\n name: EntityType.CLIENT,\n fields: {\n default: [\n 'id',\n 'active',\n 'builtIn',\n 'name',\n 'displayName',\n 'description',\n 'secretHashed',\n 'secretEncrypted',\n 'baseUrl',\n 'rootUrl',\n 'redirectUri',\n 'postLogoutRedirectUri',\n 'grantTypes',\n 'scope',\n 'authMethod',\n 'tokenBindingMethod',\n 'accessPolicyId',\n 'realmId',\n 'updatedAt',\n 'createdAt',\n ],\n allowed: ['secret'],\n },\n filters: { allowed: ['id', 'name', 'realmId'] },\n relations: { allowed: ['realm', 'accessPolicy'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,OAAOH,WAAWI;CAAOC,cAAcL,WAAWM;AAAO;AAEjF,MAAaC,eAAeR,aAAqB;CAC7CS,MAAMR,WAAWS;CACjBC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,QAAS;CACvB;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;CAAU,EAAC;CAC9CE,WAAW;EAAEF,SAAS,CAAC,SAAS,cAAe;EAAEG,UAAUd,wBAAwBC,aAAAA;CAAe;CAClGc,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDK,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/client/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","and","eq","ne","not","or","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","appendQueryConditions","decodeQuery","clientSchema","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionNames","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","secretSelected","fields","value","some","field","operator","compiled","compile","verdict","scoped","plaintextSecret","condition","findMany","data","entities","meta","total","entity","secret","secretEncrypted","secretHashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","realmId","isMe","identity","type","id","findOne","parameters","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","builtIn","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","authMethod","SECRET","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n and, \n eq, \n ne, \n not, \n or,\n} from '@rapiq/core';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n CLIENT_RESERVED_NAMES,\n ClientAuthMethod,\n ClientValidator,\n PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { clientSchema } from './schema.ts';\n\nexport type ClientServiceContext = {\n repository: IClientRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n protected repository: IClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ClientValidator;\n\n constructor(ctx: ClientServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ClientValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Client>> {\n const permissionNames = [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ];\n\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n\n const parsed = await decodeQuery(query, { schema: clientSchema, actor });\n\n // The per-row gate below only fires for rows exposing a PLAINTEXT secret,\n // and only when the projection actually selects the (non-default) `secret`\n // field — everything else lists freely. Compile the gate into WHERE\n // (#3286 phase 3): a plaintext-secret row is visible iff the compiled\n // permission condition covers it; rows without a plaintext secret always\n // are. A non-expressible policy falls back to the per-row loop below.\n const secretSelected = parsed.fields.value.some(\n (field) => field.name === 'secret' && field.operator !== '-',\n );\n const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });\n if (compiled.verdict !== 'post') {\n let scoped = parsed;\n if (secretSelected && compiled.verdict !== 'allow') {\n const plaintextSecret = and(\n ne('secret', null),\n eq('secretHashed', false),\n eq('secretEncrypted', false),\n );\n\n scoped = appendQueryConditions(\n parsed,\n compiled.verdict === 'conditional' ?\n or(not(plaintextSecret), compiled.condition) :\n not(plaintextSecret),\n );\n }\n\n return this.repository.findMany(scoped);\n }\n\n const {\n data: entities,\n meta,\n } = await this.repository.findMany(parsed);\n let { total } = meta;\n\n const data: Client[] = [];\n for (const entity of entities) {\n if (\n entity.secret &&\n !entity.secretEncrypted &&\n !entity.secretHashed\n ) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n\n continue;\n }\n\n data.push(entity);\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<Client> {\n const permissionNames = [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ];\n\n let isMe = !!actor.identity &&\n actor.identity.type === 'client' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n const entity = await this.repository.findOne(\n idOrName,\n await decodeQuery(query, {\n schema: clientSchema, \n parameters: ['fields', 'relations'], \n actor, \n }),\n realmId,\n );\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n if (\n !isMe &&\n entity.secret &&\n !entity.secretEncrypted &&\n !entity.secretHashed\n ) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: permissionNames,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Client,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realmId === 'string' ?\n await this.realmRepository.resolve(data.realmId) :\n undefined;\n\n let entity: Client \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realmId = realm.id;\n }\n\n entity = await this.repository.findOneWithSecret(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'client' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n }\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n // Reserve the system-provisioned client names (`system`, `web`) so an\n // API caller can't create or rename a client onto them — that would\n // collide on unique(name, realmId) or shadow the builtIn client.\n // Provisioning and runtime hooks bypass this service, so they remain\n // free to manage the reserved clients. builtIn clients are exempt\n // (they ARE the provisioned ones) but API callers can never produce a\n // builtIn client since the validator strips the flag.\n if (\n typeof validated.name === 'string' &&\n CLIENT_RESERVED_NAMES.includes(validated.name) &&\n !(entity && entity.builtIn && entity.name === validated.name)\n ) {\n throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n }\n\n await this.repository.validateJoinColumns(validated);\n await this.repository.checkUniqueness(validated, entity \|\| undefined);\n\n const credentialsService = new ClientCredentialsService();\n\n if (entity) {\n if (\n !isSelfEdit &&\n !validated.realmId &&\n !entity.realmId\n ) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realmId = actorRealmId;\n }\n }\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n if (entity.authMethod === ClientAuthMethod.SECRET) {\n if (!validated.secret && !entity.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n if (validated.secret) {\n entity.secret = await credentialsService.protect(validated.secret, entity);\n }\n } else {\n entity.secret = null;\n entity.secretHashed = false;\n entity.secretEncrypted = false;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realmId) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realmId = actorRealmId;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n\n entity = this.repository.create(validated);\n\n if (entity.authMethod === ClientAuthMethod.SECRET) {\n if (!validated.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n entity.secret = await credentialsService.protect(validated.secret, validated);\n } else {\n entity.secret = null;\n entity.secretHashed = false;\n entity.secretEncrypted = false;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;AAqCA,IAAaoB,gBAAb,cAAmCL,sBAAAA;CACrBM;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIV,gBAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OAC+C;EAC/C,MAAMC,kBAAkB;GACpBd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;;EAGnB,MAAMJ,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAEzE,MAAMO,SAAS,MAAMjB,YAAYQ,OAAO;GAAEU,QAAQjB;GAAcQ;EAAM,CAAA;EAQtE,MAAMU,iBAAiBF,OAAOG,OAAOC,MAAMC,MACtCC,UAAUA,MAAMP,SAAS,YAAYO,MAAMC,aAAa,GAAA;EAE7D,MAAMC,WAAW,MAAMhB,MAAMK,oBAAoBY,QAAQ,EAAEV,MAAMN,gBAAgB,CAAA;EACjF,IAAIe,SAASE,YAAY,QAAQ;GAC7B,IAAIC,SAASX;GACb,IAAIE,kBAAkBM,SAASE,YAAY,SAAS;IAChD,MAAME,kBAAkB7C,IACpBE,GAAG,UAAU,IAAA,GACbD,GAAG,gBAAgB,KAAA,GACnBA,GAAG,mBAAmB,KAAA,CAAA;IAG1B2C,SAAS7B,sBACLkB,QACAQ,SAASE,YAAY,gBACjBvC,GAAGD,IAAI0C,eAAAA,GAAkBJ,SAASK,SAAS,IAC3C3C,IAAI0C,eAAAA,CAAAA;GAEhB;GAEA,OAAO,KAAK1B,WAAW4B,SAASH,MAAAA;EACpC;EAEA,MAAM,EACFI,MAAMC,UACNC,SACA,MAAM,KAAK/B,WAAW4B,SAASd,MAAAA;EACnC,IAAI,EAAEkB,UAAUD;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMI,UAAUH,UAAU;GAC3B,IACIG,OAAOC,UACP,CAACD,OAAOE,mBACR,CAACF,OAAOG,cACV;IACE,IAAI;KACA,MAAM9B,MAAMK,oBAAoB0B,cAAc;MAC1CxB,MAAM;OACFpB,eAAee;OACff,eAAegB;OACfhB,eAAeiB;;MAEnBmB,MAAMjD,iBAAiB;QAAGD,kBAAkB2D,aAAaL;OAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;MAAQ,CAAA;KACxG,CAAA;KACAJ,KAAKW,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAH,KAAKW,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACApC,OACAD,OACAsC,SACe;EACf,MAAMpC,kBAAkB;GACpBd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;;EAGnB,IAAIkC,OAAO,CAAC,CAACtC,MAAMuC,YACfvC,MAAMuC,SAASC,SAAS,aAEpBxC,MAAMuC,SAAShB,KAAKkB,OAAOL,YAC3BpC,MAAMuC,SAAShB,KAAKhB,SAAS6B;EAGrC,IAAI,CAACE,MACD,MAAMtC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAG7E,MAAM0B,SAAS,MAAM,KAAKjC,WAAWgD,QACjCN,UACA,MAAM7C,YAAYQ,OAAO;GACrBU,QAAQjB;GACRmD,YAAY,CAAC,UAAU,WAAA;GACvB3C;EACJ,CAAA,GACAqC,OAAAA;EAEJ,IAAI,CAACV,QACD,MAAM,IAAI7C,oBAAAA;EAGd,IAAIwD,QAAQtC,MAAMuC,SAAUhB,KAAKkB,OAAOd,OAAOc,IAAI;GAC/CH,OAAO;GACP,MAAMtC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACqC,QACDX,OAAOC,UACP,CAACD,OAAOE,mBACR,CAACF,OAAOG,cAER,MAAM9B,MAAMK,oBAAoB0B,cAAc;GAC1CxB,MAAMN;GACNsB,MAAMjD,iBAAiB;KAAGD,kBAAkB2D,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFrB,MACAvB,OACe;EACf,MAAM,EAAE2B,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWvB,MAAMvB,KAAAA;EACpD,OAAO2B;CACX;CAEA,MAAMoB,OACFX,UACAb,MACAvB,OACe;EACf,MAAM,EAAE2B,WAAW,MAAM,KAAKkB,KAAKT,UAAUb,MAAMvB,OAAO,EAAEgD,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAb,MACAvB,OACAiD,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO5B,KAAKc,YAAY,WAClC,MAAM,KAAK1C,gBAAgByD,QAAQ7B,KAAKc,OAAO,IAC/CS,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMiB,QAA6B,CAAC;GACpC,IAAIxE,OAAOuD,QAAAA,GACPiB,MAAMZ,KAAKL;QAEXiB,MAAM9C,OAAO6B;GAGjB,IAAIe,OACAE,MAAMhB,UAAUc,MAAMV;GAG1Bd,SAAS,MAAM,KAAKjC,WAAW4D,kBAAkBD,KAAAA;GACjD,IAAI,CAAC1B,UAAUsB,QAAQD,YACnB,MAAM,IAAIlE,oBAAAA;EAElB,OAAO,IAAImE,QAAQD,YACf,MAAM,IAAIlE,oBAAAA;EAGd,IAAIyE,aAAa;EACjB,IAAI5B,QAAQ;GACR,IAAI;IACA,MAAM3B,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAegB,cAAc,CAAA;GACrF,SAASsD,GAAG;IACR,IACI,CAACzD,MAAMuC,YACPvC,MAAMuC,SAASC,SAAS,YACxBxC,MAAMuC,SAAShB,KAAKkB,OAAOd,OAAOc,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMvD,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAeuE,mBAAmB,CAAA;GAC1F;GACAR,QAAQtE,eAAe+E;EAC3B,OAAO;GACH,MAAM3D,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAeyE,cAAc,CAAA;GACjFV,QAAQtE,eAAeiF;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKlE,UAAUmE,IAAIxC,MAAM,EAAE2B,MAAM,CAAA;EASzD,IACI,OAAOY,UAAUvD,SAAS,YAC1BvB,sBAAsBgF,SAASF,UAAUvD,IAAI,KAC7C,EAAEoB,UAAUA,OAAOsC,WAAWtC,OAAOpB,SAASuD,UAAUvD,OAExD,MAAM,IAAIxB,gBAAgB,oBAAoB+E,UAAUvD,KAAK,eAAe;EAGhF,MAAM,KAAKb,WAAWwE,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKpE,WAAWyE,gBAAgBL,WAAWnC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMsB,qBAAqB,IAAI/E,yBAAAA;EAE/B,IAAIsC,QAAQ;GACR,IACI,CAAC4B,cACD,CAACO,UAAUzB,WACX,CAACV,OAAOU,SACV;IACE,MAAMgC,eAAe,KAAKC,gBAAgBtE,KAAAA;IAC1C,IAAIqE,cACAP,UAAUzB,UAAUgC;GAE5B;GAEA,IAAId,YACA,MAAMvD,MAAMK,oBAAoBkE,SAAS;IACrChE,MAAMpB,eAAeuE;IACrBnC,MAAMjD,iBAAiB;MAAGD,kBAAkB2D,aAAa8B;KAAW,GAAG,KAAK7B,mBAAmB6B,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJnC,SAAS,KAAKjC,WAAW8E,MAAM7C,QAAQmC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMvD,MAAMK,oBAAoBkE,SAAS;IACrChE,MAAMpB,eAAegB;IACrBoB,MAAMjD,iBAAiB;MAAGD,kBAAkB2D,aAAaL;KAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAO8C,eAAexF,iBAAiByF,QAAQ;IAC/C,IAAI,CAACZ,UAAUlC,UAAU,CAACD,OAAOC,QAC7BkC,UAAUlC,SAASwC,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUlC,QACVD,OAAOC,SAAS,MAAMwC,mBAAmBQ,QAAQd,UAAUlC,QAAQD,MAAAA;GAE3E,OAAO;IACHA,OAAOC,SAAS;IAChBD,OAAOG,eAAe;IACtBH,OAAOE,kBAAkB;GAC7B;GAEA,MAAM,KAAKnC,WAAWmD,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAkD,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUzB,SAAS;GACpB,MAAMgC,eAAe,KAAKC,gBAAgBtE,KAAAA;GAC1C,IAAIqE,cACAP,UAAUzB,UAAUgC;EAE5B;EAEA,MAAMrE,MAAMK,oBAAoBkE,SAAS;GACrChE,MAAMpB,eAAeyE;GACrBrC,MAAMjD,iBAAiB;KAAGD,kBAAkB2D,aAAa8B;IAAW,GAAG,KAAK7B,mBAAmB6B,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEAnC,SAAS,KAAKjC,WAAWkD,OAAOkB,SAAAA;EAEhC,IAAInC,OAAO8C,eAAexF,iBAAiByF,QAAQ;GAC/C,IAAI,CAACZ,UAAUlC,QACXkC,UAAUlC,SAASwC,mBAAmBO,eAAc;GAGxDhD,OAAOC,SAAS,MAAMwC,mBAAmBQ,QAAQd,UAAUlC,QAAQkC,SAAAA;EACvE,OAAO;GACHnC,OAAOC,SAAS;GAChBD,OAAOG,eAAe;GACtBH,OAAOE,kBAAkB;EAC7B;EAEA,MAAM,KAAKnC,WAAWmD,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAkD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFrC,IACAzC,OACe;EACf,MAAMA,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAeiB,cAAc,CAAA;EAEjF,MAAMuB,SAAS,MAAM,KAAKjC,WAAWqF,UAAU,EAAEtC,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAI7C,oBAAAA;EAGd,MAAMkB,MAAMK,oBAAoBkE,SAAS;GACrChE,MAAMpB,eAAeiB;GACrBmB,MAAMjD,iBAAiB;KAAGD,kBAAkB2D,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAIuC,aAAarD;EACzB,MAAM,KAAKjC,WAAWuF,OAAOtD,MAAAA;EAC7BA,OAAOc,KAAKuC;EAEZ,OAAOrD;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","and","eq","ne","not","or","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","appendQueryConditions","decodeQuery","clientSchema","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionNames","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","secretSelected","fields","value","some","field","operator","compiled","compile","verdict","scoped","plaintextSecret","condition","findMany","data","entities","meta","total","entity","secret","secretEncrypted","secretHashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","realmId","isMe","identity","type","id","findOne","parameters","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","builtIn","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","authMethod","SECRET","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n and, \n eq, \n ne, \n not, \n or,\n} from '@rapiq/core';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n CLIENT_RESERVED_NAMES,\n ClientAuthMethod,\n ClientValidator,\n PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { clientSchema } from './schema.ts';\n\nexport type ClientServiceContext = {\n repository: IClientRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n protected repository: IClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ClientValidator;\n\n constructor(ctx: ClientServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ClientValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Client>> {\n const permissionNames = [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ];\n\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n\n const parsed = await decodeQuery(query, { schema: clientSchema, actor });\n\n // The per-row gate below only fires for rows exposing a PLAINTEXT secret,\n // and only when the projection actually selects the (non-default) `secret`\n // field — everything else lists freely. Compile the gate into WHERE\n // (#3286 phase 3): a plaintext-secret row is visible iff the compiled\n // permission condition covers it; rows without a plaintext secret always\n // are. A non-expressible policy falls back to the per-row loop below.\n const secretSelected = parsed.fields.value.some(\n (field) => field.name === 'secret' && field.operator !== '-',\n );\n const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });\n if (compiled.verdict !== 'post') {\n let scoped = parsed;\n if (secretSelected && compiled.verdict !== 'allow') {\n const plaintextSecret = and(\n ne('secret', null),\n eq('secretHashed', false),\n eq('secretEncrypted', false),\n );\n\n scoped = appendQueryConditions(\n parsed,\n compiled.verdict === 'conditional' ?\n or(not(plaintextSecret), compiled.condition) :\n not(plaintextSecret),\n );\n }\n\n return this.repository.findMany(scoped);\n }\n\n const {\n data: entities,\n meta,\n } = await this.repository.findMany(parsed);\n let { total } = meta;\n\n const data: Client[] = [];\n for (const entity of entities) {\n if (\n entity.secret &&\n !entity.secretEncrypted &&\n !entity.secretHashed\n ) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n\n continue;\n }\n\n data.push(entity);\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<Client> {\n const permissionNames = [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ];\n\n let isMe = !!actor.identity &&\n actor.identity.type === 'client' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n const entity = await this.repository.findOne(\n idOrName,\n await decodeQuery(query, {\n schema: clientSchema, \n parameters: ['fields', 'relations'], \n actor, \n }),\n realmId,\n );\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n if (\n !isMe &&\n entity.secret &&\n !entity.secretEncrypted &&\n !entity.secretHashed\n ) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: permissionNames,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Client,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realmId === 'string' ?\n await this.realmRepository.resolve(data.realmId) :\n undefined;\n\n let entity: Client \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realmId = realm.id;\n }\n\n entity = await this.repository.findOneWithSecret(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'client' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n }\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n // Reserve the system-provisioned client names (`system`, `web`) so an\n // API caller can't create or rename a client onto them — that would\n // collide on unique(name, realmId) or shadow the builtIn client.\n // Provisioning and runtime hooks bypass this service, so they remain\n // free to manage the reserved clients. builtIn clients are exempt\n // (they ARE the provisioned ones) but API callers can never produce a\n // builtIn client since the validator strips the flag.\n if (\n typeof validated.name === 'string' &&\n CLIENT_RESERVED_NAMES.includes(validated.name) &&\n !(entity && entity.builtIn && entity.name === validated.name)\n ) {\n throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n }\n\n await this.repository.validateJoinColumns(validated);\n await this.repository.checkUniqueness(validated, entity \|\| undefined);\n\n const credentialsService = new ClientCredentialsService();\n\n if (entity) {\n if (\n !isSelfEdit &&\n !validated.realmId &&\n !entity.realmId\n ) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realmId = actorRealmId;\n }\n }\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n if (entity.authMethod === ClientAuthMethod.SECRET) {\n if (!validated.secret && !entity.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n if (validated.secret) {\n entity.secret = await credentialsService.protect(validated.secret, entity);\n }\n } else {\n entity.secret = null;\n entity.secretHashed = false;\n entity.secretEncrypted = false;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realmId) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realmId = actorRealmId;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n\n entity = this.repository.create(validated);\n\n if (entity.authMethod === ClientAuthMethod.SECRET) {\n if (!validated.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n entity.secret = await credentialsService.protect(validated.secret, validated);\n } else {\n entity.secret = null;\n entity.secretHashed = false;\n entity.secretEncrypted = false;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;AAqCA,IAAaoB,gBAAb,cAAmCL,sBAAAA;CACrBM;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIV,gBAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OAC+C;EAC/C,MAAMC,kBAAkB;GACpBd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;EAClB;EAED,MAAMJ,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAEzE,MAAMO,SAAS,MAAMjB,YAAYQ,OAAO;GAAEU,QAAQjB;GAAcQ;EAAM,CAAA;EAQtE,MAAMU,iBAAiBF,OAAOG,OAAOC,MAAMC,MACtCC,UAAUA,MAAMP,SAAS,YAAYO,MAAMC,aAAa,GAAA;EAE7D,MAAMC,WAAW,MAAMhB,MAAMK,oBAAoBY,QAAQ,EAAEV,MAAMN,gBAAgB,CAAA;EACjF,IAAIe,SAASE,YAAY,QAAQ;GAC7B,IAAIC,SAASX;GACb,IAAIE,kBAAkBM,SAASE,YAAY,SAAS;IAChD,MAAME,kBAAkB7C,IACpBE,GAAG,UAAU,IAAA,GACbD,GAAG,gBAAgB,KAAA,GACnBA,GAAG,mBAAmB,KAAA,CAAA;IAG1B2C,SAAS7B,sBACLkB,QACAQ,SAASE,YAAY,gBACjBvC,GAAGD,IAAI0C,eAAAA,GAAkBJ,SAASK,SAAS,IAC3C3C,IAAI0C,eAAAA,CAAAA;GAEhB;GAEA,OAAO,KAAK1B,WAAW4B,SAASH,MAAAA;EACpC;EAEA,MAAM,EACFI,MAAMC,UACNC,SACA,MAAM,KAAK/B,WAAW4B,SAASd,MAAAA;EACnC,IAAI,EAAEkB,UAAUD;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMI,UAAUH,UAAU;GAC3B,IACIG,OAAOC,UACP,CAACD,OAAOE,mBACR,CAACF,OAAOG,cACV;IACE,IAAI;KACA,MAAM9B,MAAMK,oBAAoB0B,cAAc;MAC1CxB,MAAM;OACFpB,eAAee;OACff,eAAegB;OACfhB,eAAeiB;MAClB;MACDmB,MAAMjD,iBAAiB;QAAGD,kBAAkB2D,aAAaL;OAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;MAAQ,CAAA;KACxG,CAAA;KACAJ,KAAKW,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAH,KAAKW,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACApC,OACAD,OACAsC,SACe;EACf,MAAMpC,kBAAkB;GACpBd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;EAClB;EAED,IAAIkC,OAAO,CAAC,CAACtC,MAAMuC,YACfvC,MAAMuC,SAASC,SAAS,aAEpBxC,MAAMuC,SAAShB,KAAKkB,OAAOL,YAC3BpC,MAAMuC,SAAShB,KAAKhB,SAAS6B;EAGrC,IAAI,CAACE,MACD,MAAMtC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAG7E,MAAM0B,SAAS,MAAM,KAAKjC,WAAWgD,QACjCN,UACA,MAAM7C,YAAYQ,OAAO;GACrBU,QAAQjB;GACRmD,YAAY,CAAC,UAAU,WAAY;GACnC3C;EACJ,CAAA,GACAqC,OAAAA;EAEJ,IAAI,CAACV,QACD,MAAM,IAAI7C,oBAAAA;EAGd,IAAIwD,QAAQtC,MAAMuC,SAAUhB,KAAKkB,OAAOd,OAAOc,IAAI;GAC/CH,OAAO;GACP,MAAMtC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACqC,QACDX,OAAOC,UACP,CAACD,OAAOE,mBACR,CAACF,OAAOG,cAER,MAAM9B,MAAMK,oBAAoB0B,cAAc;GAC1CxB,MAAMN;GACNsB,MAAMjD,iBAAiB;KAAGD,kBAAkB2D,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFrB,MACAvB,OACe;EACf,MAAM,EAAE2B,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWvB,MAAMvB,KAAAA;EACpD,OAAO2B;CACX;CAEA,MAAMoB,OACFX,UACAb,MACAvB,OACe;EACf,MAAM,EAAE2B,WAAW,MAAM,KAAKkB,KAAKT,UAAUb,MAAMvB,OAAO,EAAEgD,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAb,MACAvB,OACAiD,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO5B,KAAKc,YAAY,WAClC,MAAM,KAAK1C,gBAAgByD,QAAQ7B,KAAKc,OAAO,IAC/CS,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMiB,QAA6B,CAAC;GACpC,IAAIxE,OAAOuD,QAAAA,GACPiB,MAAMZ,KAAKL;QAEXiB,MAAM9C,OAAO6B;GAGjB,IAAIe,OACAE,MAAMhB,UAAUc,MAAMV;GAG1Bd,SAAS,MAAM,KAAKjC,WAAW4D,kBAAkBD,KAAAA;GACjD,IAAI,CAAC1B,UAAUsB,QAAQD,YACnB,MAAM,IAAIlE,oBAAAA;EAElB,OAAO,IAAImE,QAAQD,YACf,MAAM,IAAIlE,oBAAAA;EAGd,IAAIyE,aAAa;EACjB,IAAI5B,QAAQ;GACR,IAAI;IACA,MAAM3B,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAegB,cAAc,CAAA;GACrF,SAASsD,GAAG;IACR,IACI,CAACzD,MAAMuC,YACPvC,MAAMuC,SAASC,SAAS,YACxBxC,MAAMuC,SAAShB,KAAKkB,OAAOd,OAAOc,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMvD,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAeuE,mBAAmB,CAAA;GAC1F;GACAR,QAAQtE,eAAe+E;EAC3B,OAAO;GACH,MAAM3D,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAeyE,cAAc,CAAA;GACjFV,QAAQtE,eAAeiF;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKlE,UAAUmE,IAAIxC,MAAM,EAAE2B,MAAM,CAAA;EASzD,IACI,OAAOY,UAAUvD,SAAS,YAC1BvB,sBAAsBgF,SAASF,UAAUvD,IAAI,KAC7C,EAAEoB,UAAUA,OAAOsC,WAAWtC,OAAOpB,SAASuD,UAAUvD,OAExD,MAAM,IAAIxB,gBAAgB,oBAAoB+E,UAAUvD,KAAK,eAAe;EAGhF,MAAM,KAAKb,WAAWwE,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKpE,WAAWyE,gBAAgBL,WAAWnC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMsB,qBAAqB,IAAI/E,yBAAAA;EAE/B,IAAIsC,QAAQ;GACR,IACI,CAAC4B,cACD,CAACO,UAAUzB,WACX,CAACV,OAAOU,SACV;IACE,MAAMgC,eAAe,KAAKC,gBAAgBtE,KAAAA;IAC1C,IAAIqE,cACAP,UAAUzB,UAAUgC;GAE5B;GAEA,IAAId,YACA,MAAMvD,MAAMK,oBAAoBkE,SAAS;IACrChE,MAAMpB,eAAeuE;IACrBnC,MAAMjD,iBAAiB;MAAGD,kBAAkB2D,aAAa8B;KAAW,GAAG,KAAK7B,mBAAmB6B,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJnC,SAAS,KAAKjC,WAAW8E,MAAM7C,QAAQmC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMvD,MAAMK,oBAAoBkE,SAAS;IACrChE,MAAMpB,eAAegB;IACrBoB,MAAMjD,iBAAiB;MAAGD,kBAAkB2D,aAAaL;KAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAO8C,eAAexF,iBAAiByF,QAAQ;IAC/C,IAAI,CAACZ,UAAUlC,UAAU,CAACD,OAAOC,QAC7BkC,UAAUlC,SAASwC,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUlC,QACVD,OAAOC,SAAS,MAAMwC,mBAAmBQ,QAAQd,UAAUlC,QAAQD,MAAAA;GAE3E,OAAO;IACHA,OAAOC,SAAS;IAChBD,OAAOG,eAAe;IACtBH,OAAOE,kBAAkB;GAC7B;GAEA,MAAM,KAAKnC,WAAWmD,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAkD,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUzB,SAAS;GACpB,MAAMgC,eAAe,KAAKC,gBAAgBtE,KAAAA;GAC1C,IAAIqE,cACAP,UAAUzB,UAAUgC;EAE5B;EAEA,MAAMrE,MAAMK,oBAAoBkE,SAAS;GACrChE,MAAMpB,eAAeyE;GACrBrC,MAAMjD,iBAAiB;KAAGD,kBAAkB2D,aAAa8B;IAAW,GAAG,KAAK7B,mBAAmB6B,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEAnC,SAAS,KAAKjC,WAAWkD,OAAOkB,SAAAA;EAEhC,IAAInC,OAAO8C,eAAexF,iBAAiByF,QAAQ;GAC/C,IAAI,CAACZ,UAAUlC,QACXkC,UAAUlC,SAASwC,mBAAmBO,eAAc;GAGxDhD,OAAOC,SAAS,MAAMwC,mBAAmBQ,QAAQd,UAAUlC,QAAQkC,SAAAA;EACvE,OAAO;GACHnC,OAAOC,SAAS;GAChBD,OAAOG,eAAe;GACtBH,OAAOE,kBAAkB;EAC7B;EAEA,MAAM,KAAKnC,WAAWmD,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAkD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFrC,IACAzC,OACe;EACf,MAAMA,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAeiB,cAAc,CAAA;EAEjF,MAAMuB,SAAS,MAAM,KAAKjC,WAAWqF,UAAU,EAAEtC,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAI7C,oBAAAA;EAGd,MAAMkB,MAAMK,oBAAoBkE,SAAS;GACrChE,MAAMpB,eAAeiB;GACrBmB,MAAMjD,iBAAiB;KAAGD,kBAAkB2D,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAIuC,aAAarD;EACzB,MAAM,KAAKjC,WAAWuF,OAAOtD,MAAAA;EAC7BA,OAAOc,KAAKuC;EAEZ,OAAOrD;CACX;AACJ"}

package/dist/core/entities/client-permission/schema.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","permission","PERMISSION","clientPermissionSchema","name","CLIENT_PERMISSION","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-permission/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientPermission } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, permission: EntityType.PERMISSION };\n\nexport const clientPermissionSchema = defineSchema<ClientPermission>({\n name: EntityType.CLIENT_PERMISSION,\n // see user-role schema — explicit root projection for include= decodes\n fields: {\n default: [\n 'id',\n 'policyId',\n 'realmScope',\n 'permissionId',\n 'permissionRealmId',\n 'clientId',\n 'clientRealmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['clientId', 'permissionId'] },\n relations: { allowed: ['client', 'permission'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,YAAYL,WAAWM;AAAW;AAErF,MAAaC,yBAAyBR,aAA+B;CACjES,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;~~GAER~~;CACAC,SAAS,EAAEC,SAAS,CAAC,YAAY,~~cAAA~~,~~EAAgB~~;CACjDC,WAAW;EAAED,SAAS,CAAC,UAAU,~~YAAA~~;~~EAAeE~~,UAAUd,wBAAwBC,aAAAA;CAAe;CACjGc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;~~GAAa~~;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
1	+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","permission","PERMISSION","clientPermissionSchema","name","CLIENT_PERMISSION","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-permission/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientPermission } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, permission: EntityType.PERMISSION };\n\nexport const clientPermissionSchema = defineSchema<ClientPermission>({\n name: EntityType.CLIENT_PERMISSION,\n // see user-role schema — explicit root projection for include= decodes\n fields: {\n default: [\n 'id',\n 'policyId',\n 'realmScope',\n 'permissionId',\n 'permissionRealmId',\n 'clientId',\n 'clientRealmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['clientId', 'permissionId'] },\n relations: { allowed: ['client', 'permission'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,YAAYL,WAAWM;AAAW;AAErF,MAAaC,yBAAyBR,aAA+B;CACjES,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS,CAAC,YAAY,cAAe,EAAC;CACjDC,WAAW;EAAED,SAAS,CAAC,UAAU,YAAa;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CACjGc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/client-permission/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientPermissionValidator","PermissionName","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","decodeQuery","clientPermissionSchema","ClientPermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_PERMISSION_CREATE","CLIENT_PERMISSION_DELETE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","clientId","permissionId","permission","permissionRealmId","realmId","client","clientRealmId","identity","grant","resolveJunctionGrant","type","realmScope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","CLIENT_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-permission/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n BuiltInPolicyType,\n RealmScope,\n definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientPermissionValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientPermission, Permission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IClientPermissionRepository, IClientPermissionService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientPermissionSchema } from './schema.ts';\n\nexport type ClientPermissionServiceContext = {\n repository: IClientPermissionRepository;\n permissionRepository: IEntityRepository<Permission>;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientPermissionService extends JunctionEntityService implements IClientPermissionService {\n protected readonly ownerRealmKey = 'clientRealmId';\n\n protected repository: IClientPermissionRepository;\n\n protected permissionRepository: IEntityRepository<Permission>;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: ClientPermissionValidator;\n\n constructor(ctx: ClientPermissionServiceContext) {\n super();\n this.repository = ctx.repository;\n this.permissionRepository = ctx.permissionRepository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new ClientPermissionValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<ClientPermission>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_PERMISSION_CREATE,\n PermissionName.CLIENT_PERMISSION_DELETE,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: clientPermissionSchema, actor }));\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_PERMISSION_CREATE,\n PermissionName.CLIENT_PERMISSION_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n clientId: validated.clientId,\n permissionId: validated.permissionId,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'client-permission' });\n }\n\n if (validated.permission) {\n validated.permissionRealmId = validated.permission.realmId;\n\n await actor.permissionEvaluator.preEvaluate({\n name: validated.permission.name,\n realmId: validated.permission.realmId,\n clientId: validated.permission.clientId,\n });\n }\n\n if (validated.client) {\n validated.clientRealmId = validated.client.realmId;\n }\n\n if (validated.permission && actor.identity) {\n const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n name: validated.permission.name,\n realmId: validated.permission.realmId,\n clientId: validated.permission.clientId,\n realmScope: validated.realmScope ?? RealmScope.OWN,\n },\n );\n\n applyJunctionCreateGrant(validated, grant);\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_PERMISSION_CREATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n const permission = await this.permissionRepository.findOneById(entity.permissionId);\n if (permission) {\n // Member-permission gate: an actor may only modify a binding for a permission it\n // holds (mirrors create()).\n await actor.permissionEvaluator.preEvaluate({\n name: permission.name,\n realmId: permission.realmId,\n clientId: permission.clientId,\n });\n }\n\n let actorScope: `${RealmScope}` = RealmScope.ANY;\n let actorPolicyFree = true;\n let actorPolicyId: string \| null = null;\n if (actor.identity && permission) {\n const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n { type: actor.identity.type, id: actor.identity.data.id },\n {\n name: permission.name,\n realmId: permission.realmId,\n clientId: permission.clientId,\n realmScope: validated.realmScope ?? entity.realmScope,\n },\n );\n actorScope = grant.realmScope;\n actorPolicyFree = !grant.policy;\n actorPolicyId = grant.policy ? grant.policy.id : null;\n } else if (actor.identity) {\n actorScope = RealmScope.OWN;\n }\n\n const updateData = buildJunctionUpdateData({\n data: validated,\n existingScope: entity.realmScope,\n actorScope,\n actorPolicyFree,\n actorPolicyId,\n });\n\n await this.repository.validateJoinColumns(updateData);\n\n const merged = this.repository.merge(entity, updateData);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_PERMISSION_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n }),\n });\n\n return this.repository.save(merged);\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_PERMISSION_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;AA8BA,IAAaa,0BAAb,cAA6CH,sBAAAA;CACtBI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIZ,0BAAAA;CACzB;CAEA,MAAMc,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFlB,eAAemB,0BACfnB,eAAeoB,wBAAAA,EAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYU,OAAO;GAAEQ,QAAQjB;GAAwBU;EAAM,CAAA,CAAA;CACrG;CAEA,MAAMQ,OACFC,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFlB,eAAemB,0BACfnB,eAAeoB,wBAAAA,EAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,OAAO4B;CACX;CAEA,MAAME,OACFC,MACAb,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMlB,eAAemB,yBAAyB,CAAA;EAE5F,MAAMW,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOlC,eAAemC,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWkB,UAAU;GAC7CU,UAAUN,UAAUM;GACpBC,cAAcP,UAAUO;EAC5B,CAAA,GAEI,MAAM,IAAIzC,oBAAoB,EAAE6B,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YAAY;GACtBR,UAAUS,oBAAoBT,UAAUQ,WAAWE;GAEnD,MAAMzB,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMY,UAAUQ,WAAWpB;IAC3BsB,SAASV,UAAUQ,WAAWE;IAC9BJ,UAAUN,UAAUQ,WAAWF;GACnC,CAAA;EACJ;EAEA,IAAIN,UAAUW,QACVX,UAAUY,gBAAgBZ,UAAUW,OAAOD;EAG/C,IAAIV,UAAUQ,cAAcvB,MAAM4B,UAc9B1C,yBAAyB6B,WAAWc,MAbhB,KAAKlC,2BAA2BmC,qBAChD;GACIC,MAAM/B,MAAM4B,SAASG;GACrBtB,IAAIT,MAAM4B,SAASf,KAAKJ;EAC5B,GACA;GACIN,MAAMY,UAAUQ,WAAWpB;GAC3BsB,SAASV,UAAUQ,WAAWE;GAC9BJ,UAAUN,UAAUQ,WAAWF;GAC/BW,YAAYjB,UAAUiB,cAAcrD,WAAWsD;EACnD,CAAA,CAGgCJ;EAGxC,MAAM7B,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMlB,eAAemB;GACrBS,MAAMjC,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBrB,SAAAA;KACvDrC,kBAAkB2D,cAAc,KAAKC,sBAAsBvB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKjB,WAAWmB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKjB,WAAW8C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAI,MACAb,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMlB,eAAewD,yBAAyB,CAAA;EAE5F,MAAM/B,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMiC,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOlC,eAAe2D,OAAO,CAAA;EAEhF,MAAMnB,aAAa,MAAM,KAAK7B,qBAAqBiD,YAAYjC,OAAOY,YAAY;EAClF,IAAIC,YAGA,MAAMvB,MAAMC,oBAAoBa,YAAY;GACxCX,MAAMoB,WAAWpB;GACjBsB,SAASF,WAAWE;GACpBJ,UAAUE,WAAWF;EACzB,CAAA;EAGJ,IAAIuB,aAA8BjE,WAAWkE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAI/C,MAAM4B,YAAYL,YAAY;GAC9B,MAAMM,QAAQ,MAAM,KAAKlC,2BAA2BmC,qBAChD;IAAEC,MAAM/B,MAAM4B,SAASG;IAAMtB,IAAIT,MAAM4B,SAASf,KAAKJ;GAAG,GACxD;IACIN,MAAMoB,WAAWpB;IACjBsB,SAASF,WAAWE;IACpBJ,UAAUE,WAAWF;IACrBW,YAAYjB,UAAUiB,cAActB,OAAOsB;GAC/C,CAAA;GAEJY,aAAaf,MAAMG;GACnBc,kBAAkB,CAACjB,MAAMmB;GACzBD,gBAAgBlB,MAAMmB,SAASnB,MAAMmB,OAAOvC,KAAK;EACrD,OAAO,IAAIT,MAAM4B,UACbgB,aAAajE,WAAWsD;EAG5B,MAAMgB,aAAa9D,wBAAwB;GACvC0B,MAAME;GACNmC,eAAexC,OAAOsB;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAKtD,WAAW0B,oBAAoB8B,UAAAA;EAE1C,MAAME,SAAS,KAAK1D,WAAW2D,MAAM1C,QAAQuC,UAAAA;EAE7C,MAAMjD,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMlB,eAAewD;GACrB5B,MAAMjC,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBe,MAAAA;KACvDzE,kBAAkB2D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK1D,WAAW8C,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACF5C,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMlB,eAAeoB,yBAAyB,CAAA;EAE5F,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMlB,eAAeoB;GACrBQ,MAAMjC,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmB1B,MAAAA;KACvDhC,kBAAkB2D,cAAc,KAAKC,sBAAsB5B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI6C,aAAa5C;EACzB,MAAM,KAAKjB,WAAW8D,OAAO7C,MAAAA;EAC7BA,OAAOD,KAAK6C;EAEZ,OAAO5C;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientPermissionValidator","PermissionName","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","decodeQuery","clientPermissionSchema","ClientPermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_PERMISSION_CREATE","CLIENT_PERMISSION_DELETE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","clientId","permissionId","permission","permissionRealmId","realmId","client","clientRealmId","identity","grant","resolveJunctionGrant","type","realmScope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","CLIENT_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-permission/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n BuiltInPolicyType,\n RealmScope,\n definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientPermissionValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientPermission, Permission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IClientPermissionRepository, IClientPermissionService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientPermissionSchema } from './schema.ts';\n\nexport type ClientPermissionServiceContext = {\n repository: IClientPermissionRepository;\n permissionRepository: IEntityRepository<Permission>;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientPermissionService extends JunctionEntityService implements IClientPermissionService {\n protected readonly ownerRealmKey = 'clientRealmId';\n\n protected repository: IClientPermissionRepository;\n\n protected permissionRepository: IEntityRepository<Permission>;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: ClientPermissionValidator;\n\n constructor(ctx: ClientPermissionServiceContext) {\n super();\n this.repository = ctx.repository;\n this.permissionRepository = ctx.permissionRepository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new ClientPermissionValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<ClientPermission>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_PERMISSION_CREATE,\n PermissionName.CLIENT_PERMISSION_DELETE,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: clientPermissionSchema, actor }));\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_PERMISSION_CREATE,\n PermissionName.CLIENT_PERMISSION_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n clientId: validated.clientId,\n permissionId: validated.permissionId,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'client-permission' });\n }\n\n if (validated.permission) {\n validated.permissionRealmId = validated.permission.realmId;\n\n await actor.permissionEvaluator.preEvaluate({\n name: validated.permission.name,\n realmId: validated.permission.realmId,\n clientId: validated.permission.clientId,\n });\n }\n\n if (validated.client) {\n validated.clientRealmId = validated.client.realmId;\n }\n\n if (validated.permission && actor.identity) {\n const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n name: validated.permission.name,\n realmId: validated.permission.realmId,\n clientId: validated.permission.clientId,\n realmScope: validated.realmScope ?? RealmScope.OWN,\n },\n );\n\n applyJunctionCreateGrant(validated, grant);\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_PERMISSION_CREATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n const permission = await this.permissionRepository.findOneById(entity.permissionId);\n if (permission) {\n // Member-permission gate: an actor may only modify a binding for a permission it\n // holds (mirrors create()).\n await actor.permissionEvaluator.preEvaluate({\n name: permission.name,\n realmId: permission.realmId,\n clientId: permission.clientId,\n });\n }\n\n let actorScope: `${RealmScope}` = RealmScope.ANY;\n let actorPolicyFree = true;\n let actorPolicyId: string \| null = null;\n if (actor.identity && permission) {\n const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n { type: actor.identity.type, id: actor.identity.data.id },\n {\n name: permission.name,\n realmId: permission.realmId,\n clientId: permission.clientId,\n realmScope: validated.realmScope ?? entity.realmScope,\n },\n );\n actorScope = grant.realmScope;\n actorPolicyFree = !grant.policy;\n actorPolicyId = grant.policy ? grant.policy.id : null;\n } else if (actor.identity) {\n actorScope = RealmScope.OWN;\n }\n\n const updateData = buildJunctionUpdateData({\n data: validated,\n existingScope: entity.realmScope,\n actorScope,\n actorPolicyFree,\n actorPolicyId,\n });\n\n await this.repository.validateJoinColumns(updateData);\n\n const merged = this.repository.merge(entity, updateData);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_PERMISSION_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n }),\n });\n\n return this.repository.save(merged);\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<ClientPermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_PERMISSION_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_PERMISSION_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;AA8BA,IAAaa,0BAAb,cAA6CH,sBAAAA;CACtBI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIZ,0BAAAA;CACzB;CAEA,MAAMc,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFlB,eAAemB,0BACfnB,eAAeoB,wBAClB,EACL,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYU,OAAO;GAAEQ,QAAQjB;GAAwBU;EAAM,CAAA,CAAA;CACrG;CAEA,MAAMQ,OACFC,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFlB,eAAemB,0BACfnB,eAAeoB,wBAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,OAAO4B;CACX;CAEA,MAAME,OACFC,MACAb,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMlB,eAAemB,yBAAyB,CAAA;EAE5F,MAAMW,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOlC,eAAemC,OAAO,CAAA;EAEhF,MAAM,KAAKzB,WAAW0B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK3B,WAAWkB,UAAU;GAC7CU,UAAUN,UAAUM;GACpBC,cAAcP,UAAUO;EAC5B,CAAA,GAEI,MAAM,IAAIzC,oBAAoB,EAAE6B,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YAAY;GACtBR,UAAUS,oBAAoBT,UAAUQ,WAAWE;GAEnD,MAAMzB,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMY,UAAUQ,WAAWpB;IAC3BsB,SAASV,UAAUQ,WAAWE;IAC9BJ,UAAUN,UAAUQ,WAAWF;GACnC,CAAA;EACJ;EAEA,IAAIN,UAAUW,QACVX,UAAUY,gBAAgBZ,UAAUW,OAAOD;EAG/C,IAAIV,UAAUQ,cAAcvB,MAAM4B,UAc9B1C,yBAAyB6B,WAAWc,MAbhB,KAAKlC,2BAA2BmC,qBAChD;GACIC,MAAM/B,MAAM4B,SAASG;GACrBtB,IAAIT,MAAM4B,SAASf,KAAKJ;EAC5B,GACA;GACIN,MAAMY,UAAUQ,WAAWpB;GAC3BsB,SAASV,UAAUQ,WAAWE;GAC9BJ,UAAUN,UAAUQ,WAAWF;GAC/BW,YAAYjB,UAAUiB,cAAcrD,WAAWsD;EACnD,CAAA,CAGgCJ;EAGxC,MAAM7B,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMlB,eAAemB;GACrBS,MAAMjC,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBrB,SAAAA;KACvDrC,kBAAkB2D,cAAc,KAAKC,sBAAsBvB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKjB,WAAWmB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKjB,WAAW8C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAI,MACAb,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMlB,eAAewD,yBAAyB,CAAA;EAE5F,MAAM/B,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMiC,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAOlC,eAAe2D,OAAO,CAAA;EAEhF,MAAMnB,aAAa,MAAM,KAAK7B,qBAAqBiD,YAAYjC,OAAOY,YAAY;EAClF,IAAIC,YAGA,MAAMvB,MAAMC,oBAAoBa,YAAY;GACxCX,MAAMoB,WAAWpB;GACjBsB,SAASF,WAAWE;GACpBJ,UAAUE,WAAWF;EACzB,CAAA;EAGJ,IAAIuB,aAA8BjE,WAAWkE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAI/C,MAAM4B,YAAYL,YAAY;GAC9B,MAAMM,QAAQ,MAAM,KAAKlC,2BAA2BmC,qBAChD;IAAEC,MAAM/B,MAAM4B,SAASG;IAAMtB,IAAIT,MAAM4B,SAASf,KAAKJ;GAAG,GACxD;IACIN,MAAMoB,WAAWpB;IACjBsB,SAASF,WAAWE;IACpBJ,UAAUE,WAAWF;IACrBW,YAAYjB,UAAUiB,cAActB,OAAOsB;GAC/C,CAAA;GAEJY,aAAaf,MAAMG;GACnBc,kBAAkB,CAACjB,MAAMmB;GACzBD,gBAAgBlB,MAAMmB,SAASnB,MAAMmB,OAAOvC,KAAK;EACrD,OAAO,IAAIT,MAAM4B,UACbgB,aAAajE,WAAWsD;EAG5B,MAAMgB,aAAa9D,wBAAwB;GACvC0B,MAAME;GACNmC,eAAexC,OAAOsB;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAKtD,WAAW0B,oBAAoB8B,UAAAA;EAE1C,MAAME,SAAS,KAAK1D,WAAW2D,MAAM1C,QAAQuC,UAAAA;EAE7C,MAAMjD,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMlB,eAAewD;GACrB5B,MAAMjC,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmBe,MAAAA;KACvDzE,kBAAkB2D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK1D,WAAW8C,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACF5C,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMlB,eAAeoB,yBAAyB,CAAA;EAE5F,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMlB,eAAeoB;GACrBQ,MAAMjC,iBAAiB;KAClBF,kBAAkByD,aAAa,KAAKC,mBAAmB1B,MAAAA;KACvDhC,kBAAkB2D,cAAc,KAAKC,sBAAsB5B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI6C,aAAa5C;EACzB,MAAM,KAAKjB,WAAW8D,OAAO7C,MAAAA;EAC7BA,OAAOD,KAAK6C;EAEZ,OAAO5C;CACX;AACJ"}

package/dist/core/entities/client-role/schema.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","role","ROLE","clientRoleSchema","name","CLIENT_ROLE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-role/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientRole } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, role: EntityType.ROLE };\n\nexport const clientRoleSchema = defineSchema<ClientRole>({\n name: EntityType.CLIENT_ROLE,\n // see user-role schema — explicit root projection for include= decodes\n fields: {\n default: [\n 'id',\n 'clientId',\n 'clientRealmId',\n 'roleId',\n 'roleRealmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['clientId', 'roleId'] },\n relations: { allowed: ['client', 'role'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,MAAML,WAAWM;AAAK;AAEzE,MAAaC,mBAAmBR,aAAyB;CACrDS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;~~GAER~~;CACAC,SAAS,EAAEC,SAAS,CAAC,YAAY,~~QAAA~~,~~EAAU~~;CAC3CC,WAAW;EAAED,SAAS,CAAC,UAAU,~~MAAA~~;~~EAASE~~,UAAUd,wBAAwBC,aAAAA;CAAe;CAC3Fc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;~~GAAa~~;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
1	+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","role","ROLE","clientRoleSchema","name","CLIENT_ROLE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-role/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientRole } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, role: EntityType.ROLE };\n\nexport const clientRoleSchema = defineSchema<ClientRole>({\n name: EntityType.CLIENT_ROLE,\n // see user-role schema — explicit root projection for include= decodes\n fields: {\n default: [\n 'id',\n 'clientId',\n 'clientRealmId',\n 'roleId',\n 'roleRealmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['clientId', 'roleId'] },\n relations: { allowed: ['client', 'role'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,MAAML,WAAWM;AAAK;AAEzE,MAAaC,mBAAmBR,aAAyB;CACrDS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS,CAAC,YAAY,QAAS,EAAC;CAC3CC,WAAW;EAAED,SAAS,CAAC,UAAU,MAAO;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC3Fc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/client-role/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientRoleValidator","PermissionName","JunctionEntityService","decodeQuery","clientRoleSchema","ClientRoleService","ownerRealmKey","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_ROLE_READ","CLIENT_ROLE_UPDATE","CLIENT_ROLE_DELETE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_ROLE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","roleId","clientId","role","roleRealmId","realmId","client","clientRealmId","identity","hasPermissions","isSuperset","type","message","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-role/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientRoleValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientRole } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IClientRoleRepository, IClientRoleService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientRoleSchema } from './schema.ts';\n\nexport type ClientRoleServiceContext = {\n repository: IClientRoleRepository;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientRoleService extends JunctionEntityService implements IClientRoleService {\n protected readonly ownerRealmKey = 'clientRealmId';\n\n protected repository: IClientRoleRepository;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: ClientRoleValidator;\n\n constructor(ctx: ClientRoleServiceContext) {\n super();\n this.repository = ctx.repository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new ClientRoleValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<ClientRole>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_ROLE_READ,\n PermissionName.CLIENT_ROLE_UPDATE,\n PermissionName.CLIENT_ROLE_DELETE,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: clientRoleSchema, actor }));\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<ClientRole> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_ROLE_READ,\n PermissionName.CLIENT_ROLE_UPDATE,\n PermissionName.CLIENT_ROLE_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientRole> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n roleId: validated.roleId,\n clientId: validated.clientId,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'client-role' });\n }\n\n if (validated.role) {\n validated.roleRealmId = validated.role.realmId;\n }\n\n if (validated.client) {\n validated.clientRealmId = validated.client.realmId;\n }\n\n if (validated.role && actor.identity) {\n const hasPermissions = await this.identityPermissionProvider.isSuperset(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n type: 'role',\n id: validated.roleId,\n clientId: validated.role.clientId,\n },\n );\n if (!hasPermissions) {\n throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n }\n }\n\n // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_ROLE_CREATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<ClientRole> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_ROLE_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;AAwBA,IAAaW,oBAAb,cAAuCH,sBAAAA;CAChBI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIT,oBAAAA;CACzB;CAEA,MAAMW,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;~~IAEvB~~,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYS,OAAO;GAAES,QAAQjB;GAAkBS;EAAM,CAAA,CAAA;CAC/F;CAEA,MAAMS,OACFC,IACAV,OACmB;EACnB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;~~IAEvB~~,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAd,OACmB;EACnB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMf,eAAe4B,mBAAmB,CAAA;EAEtF,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAOjC,eAAekC,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,QAAQN,UAAUM;GAClBC,UAAUP,UAAUO;EACxB,CAAA,GAEI,MAAM,IAAIxC,oBAAoB,EAAE2B,QAAQ,cAAc,CAAA;EAG1D,IAAIM,UAAUQ,MACVR,UAAUS,cAAcT,UAAUQ,KAAKE;EAG3C,IAAIV,UAAUW,QACVX,UAAUY,gBAAgBZ,UAAUW,OAAOD;EAG/C,IAAIV,UAAUQ,QAAQzB,MAAM8B;~~OAYpB~~,CAACC,MAXwB,KAAKpC,2BAA2BqC,WACzD;IACIC,MAAMjC,MAAM8B,SAASG;IACrBvB,IAAIV,MAAM8B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIO,UAAUM;IACdC,UAAUP,UAAUQ,KAAKD;GAC7B,CAAA,GAGA,MAAM,IAAI1C,gBAAgB,EAAEoD,SAAS,0CAA2C,CAAA;EAAA;EAKxF,MAAMlC,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMf,eAAe4B;GACrBF,MAAM/B,iBAAiB;KAClBF,kBAAkBuD,aAAa,KAAKC,mBAAmBpB,SAAAA;KACvDpC,kBAAkByD,cAAc,KAAKC,sBAAsBtB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAW8C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAV,OACmB;EACnB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMf,eAAekB,mBAAmB,CAAA;EAEtF,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAId,MAAMe,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMf,eAAekB;GACrBQ,MAAM/B,iBAAiB;KAClBF,kBAAkBuD,aAAa,KAAKC,mBAAmB1B,MAAAA;KACvD9B,kBAAkByD,cAAc,KAAKC,sBAAsB5B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIgC,aAAa/B;EACzB,MAAM,KAAKjB,WAAWiD,OAAOhC,MAAAA;EAC7BA,OAAOD,KAAKgC;EAEZ,OAAO/B;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientRoleValidator","PermissionName","JunctionEntityService","decodeQuery","clientRoleSchema","ClientRoleService","ownerRealmKey","repository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_ROLE_READ","CLIENT_ROLE_UPDATE","CLIENT_ROLE_DELETE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_ROLE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","roleId","clientId","role","roleRealmId","realmId","client","clientRealmId","identity","hasPermissions","isSuperset","type","message","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/client-role/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientRoleValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientRole } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport type { IClientRoleRepository, IClientRoleService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientRoleSchema } from './schema.ts';\n\nexport type ClientRoleServiceContext = {\n repository: IClientRoleRepository;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class ClientRoleService extends JunctionEntityService implements IClientRoleService {\n protected readonly ownerRealmKey = 'clientRealmId';\n\n protected repository: IClientRoleRepository;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: ClientRoleValidator;\n\n constructor(ctx: ClientRoleServiceContext) {\n super();\n this.repository = ctx.repository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new ClientRoleValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<ClientRole>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_ROLE_READ,\n PermissionName.CLIENT_ROLE_UPDATE,\n PermissionName.CLIENT_ROLE_DELETE,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: clientRoleSchema, actor }));\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<ClientRole> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_ROLE_READ,\n PermissionName.CLIENT_ROLE_UPDATE,\n PermissionName.CLIENT_ROLE_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientRole> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n roleId: validated.roleId,\n clientId: validated.clientId,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'client-role' });\n }\n\n if (validated.role) {\n validated.roleRealmId = validated.role.realmId;\n }\n\n if (validated.client) {\n validated.clientRealmId = validated.client.realmId;\n }\n\n if (validated.role && actor.identity) {\n const hasPermissions = await this.identityPermissionProvider.isSuperset(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n type: 'role',\n id: validated.roleId,\n clientId: validated.role.clientId,\n },\n );\n if (!hasPermissions) {\n throw new PermissionError({ message: 'You don\\'t own the required permissions.' });\n }\n }\n\n // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_ROLE_CREATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<ClientRole> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_ROLE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_ROLE_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;AAwBA,IAAaW,oBAAb,cAAuCH,sBAAAA;CAChBI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIT,oBAAAA;CACzB;CAEA,MAAMW,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;EAClB,EACL,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYS,OAAO;GAAES,QAAQjB;GAAkBS;EAAM,CAAA,CAAA;CAC/F;CAEA,MAAMS,OACFC,IACAV,OACmB;EACnB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;EAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAd,OACmB;EACnB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMf,eAAe4B,mBAAmB,CAAA;EAEtF,MAAMC,YAAY,MAAM,KAAKrB,UAAUsB,IAAIJ,MAAM,EAAEK,OAAOjC,eAAekC,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,QAAQN,UAAUM;GAClBC,UAAUP,UAAUO;EACxB,CAAA,GAEI,MAAM,IAAIxC,oBAAoB,EAAE2B,QAAQ,cAAc,CAAA;EAG1D,IAAIM,UAAUQ,MACVR,UAAUS,cAAcT,UAAUQ,KAAKE;EAG3C,IAAIV,UAAUW,QACVX,UAAUY,gBAAgBZ,UAAUW,OAAOD;EAG/C,IAAIV,UAAUQ,QAAQzB,MAAM8B,UAYpB;OAAA,CAACC,MAXwB,KAAKpC,2BAA2BqC,WACzD;IACIC,MAAMjC,MAAM8B,SAASG;IACrBvB,IAAIV,MAAM8B,SAAShB,KAAKJ;GAC5B,GACA;IACIuB,MAAM;IACNvB,IAAIO,UAAUM;IACdC,UAAUP,UAAUQ,KAAKD;GAC7B,CAAA,GAGA,MAAM,IAAI1C,gBAAgB,EAAEoD,SAAS,0CAA2C,CAAA;EAAA;EAKxF,MAAMlC,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMf,eAAe4B;GACrBF,MAAM/B,iBAAiB;KAClBF,kBAAkBuD,aAAa,KAAKC,mBAAmBpB,SAAAA;KACvDpC,kBAAkByD,cAAc,KAAKC,sBAAsBtB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAW8C,KAAK7B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAM8B,OACF/B,IACAV,OACmB;EACnB,MAAMA,MAAMC,oBAAoBc,YAAY,EAAEZ,MAAMf,eAAekB,mBAAmB,CAAA;EAEtF,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAId,MAAMe,MAAMC,oBAAoBkC,SAAS;GACrChC,MAAMf,eAAekB;GACrBQ,MAAM/B,iBAAiB;KAClBF,kBAAkBuD,aAAa,KAAKC,mBAAmB1B,MAAAA;KACvD9B,kBAAkByD,cAAc,KAAKC,sBAAsB5B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAIgC,aAAa/B;EACzB,MAAM,KAAKjB,WAAWiD,OAAOhC,MAAAA;EAC7BA,OAAOD,KAAKgC;EAEZ,OAAO/B;CACX;AACJ"}

package/dist/core/entities/client-scope/schema.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","scope","SCOPE","clientScopeSchema","name","CLIENT_SCOPE","fields","default","filters","allowed","relations","validate","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-scope/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientScope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, scope: EntityType.SCOPE };\n\nexport const clientScopeSchema = defineSchema<ClientScope>({\n name: EntityType.CLIENT_SCOPE,\n // see user-role schema — explicit root projection for include= decodes\n fields: {\n default: [\n 'id',\n 'default',\n 'clientId',\n 'clientRealmId',\n 'scopeId',\n 'scopeRealmId',\n ],\n },\n filters: { allowed: ['clientId', 'scopeId', 'default'] },\n relations: { allowed: ['client', 'scope'], validate: createRelationsReadGate(schemaMapping) },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,OAAOL,WAAWM;AAAM;AAE3E,MAAaC,oBAAoBR,aAA0B;CACvDS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;~~GAER~~;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAY;EAAW;~~GAAW~~;CACvDC,WAAW;EAAED,SAAS,CAAC,UAAU,~~OAAA~~;~~EAAUE~~,UAAUd,wBAAwBC,aAAAA;CAAe;CAC5Fc,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}
1	+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","scope","SCOPE","clientScopeSchema","name","CLIENT_SCOPE","fields","default","filters","allowed","relations","validate","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-scope/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientScope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, scope: EntityType.SCOPE };\n\nexport const clientScopeSchema = defineSchema<ClientScope>({\n name: EntityType.CLIENT_SCOPE,\n // see user-role schema — explicit root projection for include= decodes\n fields: {\n default: [\n 'id',\n 'default',\n 'clientId',\n 'clientRealmId',\n 'scopeId',\n 'scopeRealmId',\n ],\n },\n filters: { allowed: ['clientId', 'scopeId', 'default'] },\n relations: { allowed: ['client', 'scope'], validate: createRelationsReadGate(schemaMapping) },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,OAAOL,WAAWM;AAAM;AAE3E,MAAaC,oBAAoBR,aAA0B;CACvDS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAY;EAAW;CAAU,EAAC;CACvDC,WAAW;EAAED,SAAS,CAAC,UAAU,OAAQ;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC5Fc,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}

package/dist/core/entities/client-scope/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientScopeValidator","PermissionName","JunctionEntityService","decodeQuery","clientScopeSchema","ClientScopeService","ownerRealmKey","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_SCOPE_READ","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_SCOPE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","clientId","scopeId","client","clientRealmId","realmId","scope","scopeRealmId","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","CLIENT_SCOPE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/client-scope/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientScopeValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientScope } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IClientScopeRepository, IClientScopeService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientScopeSchema } from './schema.ts';\n\nexport type ClientScopeServiceContext = {\n repository: IClientScopeRepository;\n};\n\nexport class ClientScopeService extends JunctionEntityService implements IClientScopeService {\n protected readonly ownerRealmKey = 'clientRealmId';\n\n protected repository: IClientScopeRepository;\n\n protected validator: ClientScopeValidator;\n\n constructor(ctx: ClientScopeServiceContext) {\n super();\n this.repository = ctx.repository;\n this.validator = new ClientScopeValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<ClientScope>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_SCOPE_READ,\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: clientScopeSchema, actor }));\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<ClientScope> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_SCOPE_READ,\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientScope> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n clientId: validated.clientId,\n scopeId: validated.scopeId,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'client-scope' });\n }\n\n if (validated.client) {\n validated.clientRealmId = validated.client.realmId;\n }\n\n if (validated.scope) {\n validated.scopeRealmId = validated.scope.realmId;\n }\n\n // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SCOPE_CREATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<ClientScope> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SCOPE_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;AAsBA,IAAaU,qBAAb,cAAwCH,sBAAAA;CACjBI,gBAAgB;CAEzBC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIR,qBAAAA;CACzB;CAEA,MAAMU,QACFC,OACAC,OACoD;EACpD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;~~IAEvB~~,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYQ,OAAO;GAAEU,QAAQjB;GAAmBQ;EAAM,CAAA,CAAA;CAChG;CAEA,MAAMU,OACFC,IACAX,OACoB;EACpB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;~~IAEvB~~,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAf,OACoB;EACpB,MAAMA,MAAMC,oBAAoBe,YAAY,EAAEb,MAAMd,eAAe4B,oBAAoB,CAAA;EAEvF,MAAMC,YAAY,MAAM,KAAKtB,UAAUuB,IAAIJ,MAAM,EAAEK,OAAOjC,eAAekC,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,UAAUN,UAAUM;GACpBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIxC,oBAAoB,EAAE2B,QAAQ,eAAe,CAAA;EAG3D,IAAIM,UAAUQ,QACVR,UAAUS,gBAAgBT,UAAUQ,OAAOE;EAG/C,IAAIV,UAAUW,OACVX,UAAUY,eAAeZ,UAAUW,MAAMD;EAI7C,MAAM5B,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMd,eAAe4B;GACrBF,MAAM/B,iBAAiB;KAClBD,kBAAkBiD,aAAa,KAAKC,mBAAmBf,SAAAA;KACvDnC,kBAAkBmD,cAAc,KAAKC,sBAAsBjB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMyB,OACF1B,IACAX,OACoB;EACpB,MAAMA,MAAMC,oBAAoBe,YAAY,EAAEb,MAAMd,eAAeiD,oBAAoB,CAAA;EAEvF,MAAM1B,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAId,MAAMc,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMd,eAAeiD;GACrBvB,MAAM/B,iBAAiB;KAClBD,kBAAkBiD,aAAa,KAAKC,mBAAmBrB,MAAAA;KACvD7B,kBAAkBmD,cAAc,KAAKC,sBAAsBvB,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI4B,aAAa3B;EACzB,MAAM,KAAKjB,WAAW6C,OAAO5B,MAAAA;EAC7BA,OAAOD,KAAK4B;EAEZ,OAAO3B;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","ClientScopeValidator","PermissionName","JunctionEntityService","decodeQuery","clientScopeSchema","ClientScopeService","ownerRealmKey","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","CLIENT_SCOPE_READ","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","CLIENT_SCOPE_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","clientId","scopeId","client","clientRealmId","realmId","scope","scopeRealmId","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","CLIENT_SCOPE_DELETE","entityId","remove"],"sources":["../../../../src/core/entities/client-scope/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { ClientScopeValidator, PermissionName } from '@authup/core-kit';\nimport type { ClientScope } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IClientScopeRepository, IClientScopeService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientScopeSchema } from './schema.ts';\n\nexport type ClientScopeServiceContext = {\n repository: IClientScopeRepository;\n};\n\nexport class ClientScopeService extends JunctionEntityService implements IClientScopeService {\n protected readonly ownerRealmKey = 'clientRealmId';\n\n protected repository: IClientScopeRepository;\n\n protected validator: ClientScopeValidator;\n\n constructor(ctx: ClientScopeServiceContext) {\n super();\n this.repository = ctx.repository;\n this.validator = new ClientScopeValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<ClientScope>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_SCOPE_READ,\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: clientScopeSchema, actor }));\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<ClientScope> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.CLIENT_SCOPE_READ,\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<ClientScope> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n clientId: validated.clientId,\n scopeId: validated.scopeId,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'client-scope' });\n }\n\n if (validated.client) {\n validated.clientRealmId = validated.client.realmId;\n }\n\n if (validated.scope) {\n validated.scopeRealmId = validated.scope.realmId;\n }\n\n // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SCOPE_CREATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<ClientScope> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SCOPE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n // Stamp the owner (client) realm so the realmScope factor gates cross-realm writes.\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SCOPE_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;AAsBA,IAAaU,qBAAb,cAAwCH,sBAAAA;CACjBI,gBAAgB;CAEzBC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIR,qBAAAA;CACzB;CAEA,MAAMU,QACFC,OACAC,OACoD;EACpD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;EAClB,EACL,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYQ,OAAO;GAAEU,QAAQjB;GAAmBQ;EAAM,CAAA,CAAA;CAChG;CAEA,MAAMU,OACFC,IACAX,OACoB;EACpB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;EAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAf,OACoB;EACpB,MAAMA,MAAMC,oBAAoBe,YAAY,EAAEb,MAAMd,eAAe4B,oBAAoB,CAAA;EAEvF,MAAMC,YAAY,MAAM,KAAKtB,UAAUuB,IAAIJ,MAAM,EAAEK,OAAOjC,eAAekC,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,UAAUN,UAAUM;GACpBC,SAASP,UAAUO;EACvB,CAAA,GAEI,MAAM,IAAIxC,oBAAoB,EAAE2B,QAAQ,eAAe,CAAA;EAG3D,IAAIM,UAAUQ,QACVR,UAAUS,gBAAgBT,UAAUQ,OAAOE;EAG/C,IAAIV,UAAUW,OACVX,UAAUY,eAAeZ,UAAUW,MAAMD;EAI7C,MAAM5B,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMd,eAAe4B;GACrBF,MAAM/B,iBAAiB;KAClBD,kBAAkBiD,aAAa,KAAKC,mBAAmBf,SAAAA;KACvDnC,kBAAkBmD,cAAc,KAAKC,sBAAsBjB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMyB,OACF1B,IACAX,OACoB;EACpB,MAAMA,MAAMC,oBAAoBe,YAAY,EAAEb,MAAMd,eAAeiD,oBAAoB,CAAA;EAEvF,MAAM1B,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAId,MAAMc,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMd,eAAeiD;GACrBvB,MAAM/B,iBAAiB;KAClBD,kBAAkBiD,aAAa,KAAKC,mBAAmBrB,MAAAA;KACvD7B,kBAAkBmD,cAAc,KAAKC,sBAAsBvB,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI4B,aAAa3B;EACzB,MAAM,KAAKjB,WAAW6C,OAAO5B,MAAAA;EAC7BA,OAAOD,KAAK4B;EAEZ,OAAO3B;CACX;AACJ"}

package/dist/core/entities/consent/schema.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","CONSENT_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","consentSchema","name","CONSENT","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/consent/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Consent } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { CONSENT_FILTER_KEYS } from './types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const consentSchema = defineSchema<Consent>({\n name: EntityType.CONSENT,\n fields: {\n // `default` (not just `allowed`) so the adapter adds an explicit\n // per-column SELECT: it populates expressionMap.selects, which\n // applyRealmScopeSelect dedupes against. Without it the default\n // \"select all\" is implicit (empty selects) and the force-select\n // re-adds consent.sub — a duplicate `consent_sub` alias that\n // mysql rejects under the client join (see helpers.ts).\n default: [\n 'id',\n 'clientId',\n 'realmId',\n 'userId',\n 'sub',\n 'subKind',\n 'scope',\n 'expiresAt',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: [...CONSENT_FILTER_KEYS] },\n relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['createdAt', 'updatedAt', 'scope'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,QAAQ,EAOJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;~~GAER~~;CACAC,SAAS,EAAEC,SAAS,~~CAAA~~,~~GAAIX~~,~~mBAAAA~~,~~EAAqB~~;CAC7CY,WAAW;EAAED,SAAS,CAAC,~~OAAA~~;~~EAAUE~~,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EAAEH,SAAS;EAAC;EAAa;EAAa;~~GAAS~~;CACrDI,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}
1	+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","CONSENT_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","consentSchema","name","CONSENT","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/consent/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Consent } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { CONSENT_FILTER_KEYS } from './types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const consentSchema = defineSchema<Consent>({\n name: EntityType.CONSENT,\n fields: {\n // `default` (not just `allowed`) so the adapter adds an explicit\n // per-column SELECT: it populates expressionMap.selects, which\n // applyRealmScopeSelect dedupes against. Without it the default\n // \"select all\" is implicit (empty selects) and the force-select\n // re-adds consent.sub — a duplicate `consent_sub` alias that\n // mysql rejects under the client join (see helpers.ts).\n default: [\n 'id',\n 'clientId',\n 'realmId',\n 'userId',\n 'sub',\n 'subKind',\n 'scope',\n 'expiresAt',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: [...CONSENT_FILTER_KEYS] },\n relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['createdAt', 'updatedAt', 'scope'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,QAAQ,EAOJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS,CAAIX,GAAAA,mBAAoB,EAAC;CAC7CY,WAAW;EAAED,SAAS,CAAC,OAAQ;EAAEE,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EAAEH,SAAS;EAAC;EAAa;EAAa;CAAQ,EAAC;CACrDI,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}

package/dist/core/entities/consent/types.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.mjs","names":["CONSENT_SCOPE_MAX_LENGTH","CONSENT_FILTER_KEYS"],"sources":["../../../../src/core/entities/consent/types.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Consent } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type ConsentOwner = {\n sub: string,\n subKind: string,\n};\n\n/\n Max length of a single stored scope token — must equal the\n * `auth_consents.scope` column width (varchar 128). A longer token (only\n * reachable via a non-standard scope riding the `global` verifier bypass) is\n * dropped at normalization rather than overflowing the column.\n /\nexport const CONSENT_SCOPE_MAX_LENGTH = 128;\n\n/\n Filter keys a consent list query may target. Shared by the repository's\n * rapiq `filters.allowed` so service and adapter can never drift.\n /\nexport const CONSENT_FILTER_KEYS = [\n 'id',\n 'clientId',\n 'realmId',\n 'sub',\n 'subKind',\n 'scope',\n] as const;\n\nexport type ConsentFindManyOptions = {\n /\n Force the result to a single subject (self-service). Applied as a\n * mandatory WHERE that a rapiq query filter cannot override.\n /\n owner?: ConsentOwner,\n /\n Restrict the result to a single realm (the `/realms/:realmId/consents`\n * nested mount). Mandatory WHERE, not overridable by a rapiq filter.\n /\n realmId?: string,\n};\n\nexport type ConsentServiceReadOptions = {\n realmId?: string,\n};\n\nexport type ConsentRecordInput = {\n clientId: string,\n realmId: string,\n owner: ConsentOwner,\n /\n Raw scope representation(s) — normalized to lowercase tokens via\n * `unwrapOAuth2Scope` before persistence.\n /\n scope: string \| string[] \| null,\n};\n\nexport type ConsentCoveringInput = {\n clientId: string,\n owner: ConsentOwner,\n scope: string \| string[] \| null,\n};\n\nexport interface IConsentRepository {\n findMany(query: IQuery, options?: ConsentFindManyOptions): Promise<EntityRepositoryFindManyResult<Consent>>;\n\n findOneById(id: string): Promise<Consent \| null>;\n\n /\n Covering-lookup source — query-cached\n * (`CachePrefix.CONSENT_COVERING`, 60s), invalidated by the\n * `ConsentEntitySubscriber` on insert/update/remove.\n /\n findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]>;\n\n /\n Union/keep: insert one row per missing scope token, never touching\n * existing rows. Race-safe under the 4-column unique index.\n /\n insertMissing(input: {\n clientId: string, \n realmId: string, \n owner: ConsentOwner, \n scopes: string[] \n }): Promise<void>;\n\n remove(entity: Consent): Promise<void>;\n}\n\nexport interface IConsentService {\n /\n List consents. An actor without `CONSENT_READ` is scoped to its own\n * rows (self-service); an actor with `CONSENT_READ` sees every row its\n * realm reach permits.\n /\n getMany(query: Record<string, any>, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<EntityRepositoryFindManyResult<Consent>>;\n\n /\n Read a single consent by id. Own rows need no permission.\n /\n getOne(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;\n\n /\n Revoke (delete) a single consent by id. Own rows need no permission.\n /\n delete(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;\n\n /\n Flow integration (POST /authorize approval) — no permission checks:\n * the subject consents to its own grant. Inputs are server-derived\n * (verifier-stamped client/realm, token-derived subject), never raw\n * client input.\n /\n record(input: ConsentRecordInput): Promise<void>;\n\n /\n Strict covering: every requested token has an unexpired row.\n */\n isCovering(input: ConsentCoveringInput): Promise<boolean>;\n}\n"],"mappings":";;;;;;;;;GAsBA,MAAaA,2BAA2B;;;;GAMxC,MAAaC,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA"}
1	+ {"version":3,"file":"types.mjs","names":["CONSENT_SCOPE_MAX_LENGTH","CONSENT_FILTER_KEYS"],"sources":["../../../../src/core/entities/consent/types.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Consent } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type ConsentOwner = {\n sub: string,\n subKind: string,\n};\n\n/\n Max length of a single stored scope token — must equal the\n * `auth_consents.scope` column width (varchar 128). A longer token (only\n * reachable via a non-standard scope riding the `global` verifier bypass) is\n * dropped at normalization rather than overflowing the column.\n /\nexport const CONSENT_SCOPE_MAX_LENGTH = 128;\n\n/\n Filter keys a consent list query may target. Shared by the repository's\n * rapiq `filters.allowed` so service and adapter can never drift.\n /\nexport const CONSENT_FILTER_KEYS = [\n 'id',\n 'clientId',\n 'realmId',\n 'sub',\n 'subKind',\n 'scope',\n] as const;\n\nexport type ConsentFindManyOptions = {\n /\n Force the result to a single subject (self-service). Applied as a\n * mandatory WHERE that a rapiq query filter cannot override.\n /\n owner?: ConsentOwner,\n /\n Restrict the result to a single realm (the `/realms/:realmId/consents`\n * nested mount). Mandatory WHERE, not overridable by a rapiq filter.\n /\n realmId?: string,\n};\n\nexport type ConsentServiceReadOptions = {\n realmId?: string,\n};\n\nexport type ConsentRecordInput = {\n clientId: string,\n realmId: string,\n owner: ConsentOwner,\n /\n Raw scope representation(s) — normalized to lowercase tokens via\n * `unwrapOAuth2Scope` before persistence.\n /\n scope: string \| string[] \| null,\n};\n\nexport type ConsentCoveringInput = {\n clientId: string,\n owner: ConsentOwner,\n scope: string \| string[] \| null,\n};\n\nexport interface IConsentRepository {\n findMany(query: IQuery, options?: ConsentFindManyOptions): Promise<EntityRepositoryFindManyResult<Consent>>;\n\n findOneById(id: string): Promise<Consent \| null>;\n\n /\n Covering-lookup source — query-cached\n * (`CachePrefix.CONSENT_COVERING`, 60s), invalidated by the\n * `ConsentEntitySubscriber` on insert/update/remove.\n /\n findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]>;\n\n /\n Union/keep: insert one row per missing scope token, never touching\n * existing rows. Race-safe under the 4-column unique index.\n /\n insertMissing(input: {\n clientId: string, \n realmId: string, \n owner: ConsentOwner, \n scopes: string[] \n }): Promise<void>;\n\n remove(entity: Consent): Promise<void>;\n}\n\nexport interface IConsentService {\n /\n List consents. An actor without `CONSENT_READ` is scoped to its own\n * rows (self-service); an actor with `CONSENT_READ` sees every row its\n * realm reach permits.\n /\n getMany(query: Record<string, any>, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<EntityRepositoryFindManyResult<Consent>>;\n\n /\n Read a single consent by id. Own rows need no permission.\n /\n getOne(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;\n\n /\n Revoke (delete) a single consent by id. Own rows need no permission.\n /\n delete(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;\n\n /\n Flow integration (POST /authorize approval) — no permission checks:\n * the subject consents to its own grant. Inputs are server-derived\n * (verifier-stamped client/realm, token-derived subject), never raw\n * client input.\n /\n record(input: ConsentRecordInput): Promise<void>;\n\n /\n Strict covering: every requested token has an unexpired row.\n */\n isCovering(input: ConsentCoveringInput): Promise<boolean>;\n}\n"],"mappings":";;;;;;;;;GAsBA,MAAaA,2BAA2B;;;;GAMxC,MAAaC,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;AACH"}

package/dist/core/entities/event/diff.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"diff.mjs","names":["isEqual","EVENT_DIFF_SECRET_KEY_REGEX","EVENT_DIFF_VALUE_MAX_LENGTH","isScalar","value","truncateScalar","length","substring","buildEntityDiff","next","previous","output","keys","Set","Object","key","endsWith","test","nextValue","previousValue"],"sources":["../../../../src/core/entities/event/diff.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { isEqual } from 'smob';\n\n/\n Secret denylist for entity-diff keys (fail-closed: losing a\n * \"secretHashed flipped\" diff entry is acceptable, leaking a hash is not).\n * Shared with the sanitizer's `diff` branch so both boundaries agree.\n /\nexport const EVENT_DIFF_SECRET_KEY_REGEX = /(password\|secret\|hash\|token\|credential)/i;\n\nexport const EVENT_DIFF_VALUE_MAX_LENGTH = 512;\n\nexport type EntityDiff = Record<string, { next: unknown, previous: unknown }>;\n\nfunction isScalar(value: unknown): value is string \| number \| boolean \| null {\n return value === null \|\|\n typeof value === 'string' \|\|\n typeof value === 'number' \|\|\n typeof value === 'boolean';\n}\n\nfunction truncateScalar(value: string \| number \| boolean \| null): string \| number \| boolean \| null {\n if (typeof value === 'string' && value.length > EVENT_DIFF_VALUE_MAX_LENGTH) {\n return value.substring(0, EVENT_DIFF_VALUE_MAX_LENGTH);\n }\n\n return value;\n}\n\n/\n PII-safe scalar diff between the updated entity and its pre-mutation\n * snapshot: only keys with scalar values (string/number/boolean/null) on BOTH\n * sides, skipping timestamp columns (`_at` / `At`) and any key matching the\n * secret denylist, including only keys whose value actually changed. String\n * values are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.\n */\nexport function buildEntityDiff(\n next: Record<string, any>,\n previous: Record<string, any>,\n): EntityDiff {\n const output: EntityDiff = {};\n\n const keys = new Set([\n ...Object.keys(next),\n ...Object.keys(previous),\n ]);\n\n for (const key of keys) {\n if (key.endsWith('_at') \|\| key.endsWith('At')) {\n continue;\n }\n\n if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n continue;\n }\n\n const nextValue = next[key];\n const previousValue = previous[key];\n\n if (!isScalar(nextValue) \|\| !isScalar(previousValue)) {\n continue;\n }\n\n if (isEqual(nextValue, previousValue)) {\n continue;\n }\n\n output[key] = {\n next: truncateScalar(nextValue),\n previous: truncateScalar(previousValue),\n };\n }\n\n return output;\n}\n"],"mappings":";;;;;;;;;GAcA,MAAaC,8BAA8B;AAE3C,MAAaC,8BAA8B;AAI3C,SAASC,SAASC,OAAc;CAC5B,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,eAAeD,OAAuC;CAC3D,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAAAA,KACnC,OAAOF,MAAMG,UAAU,GAAA,GAAGL;CAG9B,OAAOE;AACX;;;;;;;GASA,SAAgBI,gBACZC,MACAC,UAA6B;CAE7B,MAAMC,SAAqB,CAAC;CAE5B,MAAMC,uBAAO,IAAIC,IAAI,~~CAAA~~,~~GACdC~~,OAAOF,KAAKH,IAAAA,GAAAA,~~GACZK,~~OAAOF,KAAKF,QAAAA,~~CAAAA~~,~~CAClB~~;CAED,KAAK,MAAMK,OAAOH,MAAM;EACpB,IAAIG,IAAIC,SAAS,KAAA,KAAUD,IAAIC,SAAS,IAAA,GACpC;EAGJ,IAAIf,4BAA4BgB,KAAKF,GAAAA,GACjC;EAGJ,MAAMG,YAAYT,KAAKM;EACvB,MAAMI,gBAAgBT,SAASK;EAE/B,IAAI,CAACZ,SAASe,SAAAA,KAAc,CAACf,SAASgB,aAAAA,GAClC;EAGJ,IAAInB,QAAQkB,WAAWC,aAAAA,GACnB;EAGJR,OAAOI,OAAO;GACVN,MAAMJ,eAAea,SAAAA;GACrBR,UAAUL,eAAec,aAAAA;EAC7B;CACJ;CAEA,OAAOR;AACX"}
1	+ {"version":3,"file":"diff.mjs","names":["isEqual","EVENT_DIFF_SECRET_KEY_REGEX","EVENT_DIFF_VALUE_MAX_LENGTH","isScalar","value","truncateScalar","length","substring","buildEntityDiff","next","previous","output","keys","Set","Object","key","endsWith","test","nextValue","previousValue"],"sources":["../../../../src/core/entities/event/diff.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { isEqual } from 'smob';\n\n/\n Secret denylist for entity-diff keys (fail-closed: losing a\n * \"secretHashed flipped\" diff entry is acceptable, leaking a hash is not).\n * Shared with the sanitizer's `diff` branch so both boundaries agree.\n /\nexport const EVENT_DIFF_SECRET_KEY_REGEX = /(password\|secret\|hash\|token\|credential)/i;\n\nexport const EVENT_DIFF_VALUE_MAX_LENGTH = 512;\n\nexport type EntityDiff = Record<string, { next: unknown, previous: unknown }>;\n\nfunction isScalar(value: unknown): value is string \| number \| boolean \| null {\n return value === null \|\|\n typeof value === 'string' \|\|\n typeof value === 'number' \|\|\n typeof value === 'boolean';\n}\n\nfunction truncateScalar(value: string \| number \| boolean \| null): string \| number \| boolean \| null {\n if (typeof value === 'string' && value.length > EVENT_DIFF_VALUE_MAX_LENGTH) {\n return value.substring(0, EVENT_DIFF_VALUE_MAX_LENGTH);\n }\n\n return value;\n}\n\n/\n PII-safe scalar diff between the updated entity and its pre-mutation\n * snapshot: only keys with scalar values (string/number/boolean/null) on BOTH\n * sides, skipping timestamp columns (`_at` / `At`) and any key matching the\n * secret denylist, including only keys whose value actually changed. String\n * values are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.\n */\nexport function buildEntityDiff(\n next: Record<string, any>,\n previous: Record<string, any>,\n): EntityDiff {\n const output: EntityDiff = {};\n\n const keys = new Set([\n ...Object.keys(next),\n ...Object.keys(previous),\n ]);\n\n for (const key of keys) {\n if (key.endsWith('_at') \|\| key.endsWith('At')) {\n continue;\n }\n\n if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n continue;\n }\n\n const nextValue = next[key];\n const previousValue = previous[key];\n\n if (!isScalar(nextValue) \|\| !isScalar(previousValue)) {\n continue;\n }\n\n if (isEqual(nextValue, previousValue)) {\n continue;\n }\n\n output[key] = {\n next: truncateScalar(nextValue),\n previous: truncateScalar(previousValue),\n };\n }\n\n return output;\n}\n"],"mappings":";;;;;;;;;GAcA,MAAaC,8BAA8B;AAE3C,MAAaC,8BAA8B;AAI3C,SAASC,SAASC,OAAc;CAC5B,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,eAAeD,OAAuC;CAC3D,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAAAA,KACnC,OAAOF,MAAMG,UAAU,GAAA,GAAGL;CAG9B,OAAOE;AACX;;;;;;;GASA,SAAgBI,gBACZC,MACAC,UAA6B;CAE7B,MAAMC,SAAqB,CAAC;CAE5B,MAAMC,uBAAO,IAAIC,IAAI,CACdC,GAAAA,OAAOF,KAAKH,IAAAA,GACZK,GAAAA,OAAOF,KAAKF,QAAAA,CAClB,CAAA;CAED,KAAK,MAAMK,OAAOH,MAAM;EACpB,IAAIG,IAAIC,SAAS,KAAA,KAAUD,IAAIC,SAAS,IAAA,GACpC;EAGJ,IAAIf,4BAA4BgB,KAAKF,GAAAA,GACjC;EAGJ,MAAMG,YAAYT,KAAKM;EACvB,MAAMI,gBAAgBT,SAASK;EAE/B,IAAI,CAACZ,SAASe,SAAAA,KAAc,CAACf,SAASgB,aAAAA,GAClC;EAGJ,IAAInB,QAAQkB,WAAWC,aAAAA,GACnB;EAGJR,OAAOI,OAAO;GACVN,MAAMJ,eAAea,SAAAA;GACrBR,UAAUL,eAAec,aAAAA;EAC7B;CACJ;CAEA,OAAOR;AACX"}