npm - @authup/server-core - Versions diffs - 1.0.0-beta.54 → 1.0.0-beta.55 - Mend

@authup/server-core 1.0.0-beta.54 → 1.0.0-beta.55

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (328) hide show

package/dist/core/entities/permission-policy/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","PermissionPolicyValidator","JunctionEntityService","decodeQuery","permissionPolicySchema","PermissionPolicyService","ownerRealmKey","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permissionId","policyId","permission","permissionRealmId","realmId","policy","policyRealmId","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/permission-policy/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, PermissionPolicyValidator } from '@authup/core-kit';\nimport type { PermissionPolicy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository, IPermissionPolicyService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { permissionPolicySchema } from './schema.ts';\n\nexport type PermissionPolicyServiceContext = {\n repository: IPermissionPolicyRepository;\n};\n\nexport class PermissionPolicyService extends JunctionEntityService implements IPermissionPolicyService {\n protected readonly ownerRealmKey = 'permissionRealmId';\n\n protected repository: IPermissionPolicyRepository;\n\n protected validator: PermissionPolicyValidator;\n\n constructor(ctx: PermissionPolicyServiceContext) {\n super();\n this.repository = ctx.repository;\n this.validator = new PermissionPolicyValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<PermissionPolicy>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: permissionPolicySchema, actor }));\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<PermissionPolicy> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<PermissionPolicy> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n permissionId: validated.permissionId,\n policyId: validated.policyId,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'permission-policy' });\n }\n\n if (validated.permission) {\n validated.permissionRealmId = validated.permission.realmId;\n }\n\n if (validated.policy) {\n validated.policyRealmId = validated.policy.realmId;\n }\n\n // Stamp the owner (permission) realm so the realmScope factor gates cross-realm writes.\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<PermissionPolicy> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n // Stamp the owner (permission) realm so the realmScope factor gates cross-realm writes.\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;AAsBA,IAAaU,0BAAb,cAA6CH,sBAAAA;CACtBI,gBAAgB;CAEzBC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIP,0BAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFf,eAAegB,iBACfhB,eAAeiB,~~iBAAAA~~,~~EAEvB~~,CAAA;EAEA,OAAO,KAAKV,WAAWW,SAAS,MAAMf,YAAYQ,OAAO;GAAEQ,QAAQf;GAAwBQ;EAAM,CAAA,CAAA;CACrG;CAEA,MAAMQ,OACFC,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFf,eAAegB,iBACfhB,eAAeiB,~~iBAAAA~~,~~EAEvB~~,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKf,WAAWgB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIxB,oBAAAA;EAGd,OAAOwB;CACX;CAEA,MAAME,OACFC,MACAb,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMf,eAAeiB,kBAAkB,CAAA;EAErF,MAAMU,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAO9B,eAAe+B,OAAO,CAAA;EAEhF,MAAM,KAAKvB,WAAWwB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAKzB,WAAWgB,UAAU;GAC7CU,cAAcN,UAAUM;GACxBC,UAAUP,UAAUO;EACxB,CAAA,GAEI,MAAM,IAAIrC,oBAAoB,EAAEyB,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YACVR,UAAUS,oBAAoBT,UAAUQ,WAAWE;EAGvD,IAAIV,UAAUW,QACVX,UAAUY,gBAAgBZ,UAAUW,OAAOD;EAI/C,MAAMzB,MAAMC,oBAAoB2B,SAAS;GACrCzB,MAAMf,eAAeiB;GACrBQ,MAAM7B,iBAAiB;KAClBD,kBAAkB8C,aAAa,KAAKC,mBAAmBf,SAAAA;KACvDhC,kBAAkBgD,cAAc,KAAKC,sBAAsBjB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKf,WAAWiB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKf,WAAWsC,KAAKvB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMwB,OACFzB,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMf,eAAeiB,kBAAkB,CAAA;EAErF,MAAMK,SAAS,MAAM,KAAKf,WAAWgB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIxB,oBAAAA;EAId,MAAMc,MAAMC,oBAAoB2B,SAAS;GACrCzB,MAAMf,eAAeiB;GACrBQ,MAAM7B,iBAAiB;KAClBD,kBAAkB8C,aAAa,KAAKC,mBAAmBpB,MAAAA;KACvD3B,kBAAkBgD,cAAc,KAAKC,sBAAsBtB,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI0B,aAAazB;EACzB,MAAM,KAAKf,WAAWyC,OAAO1B,MAAAA;EAC7BA,OAAOD,KAAK0B;EAEZ,OAAOzB;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","PermissionPolicyValidator","JunctionEntityService","decodeQuery","permissionPolicySchema","PermissionPolicyService","ownerRealmKey","repository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","validated","run","group","CREATE","validateJoinColumns","existing","permissionId","policyId","permission","permissionRealmId","realmId","policy","policyRealmId","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","delete","entityId","remove"],"sources":["../../../../src/core/entities/permission-policy/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport { PermissionName, PermissionPolicyValidator } from '@authup/core-kit';\nimport type { PermissionPolicy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository, IPermissionPolicyService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { permissionPolicySchema } from './schema.ts';\n\nexport type PermissionPolicyServiceContext = {\n repository: IPermissionPolicyRepository;\n};\n\nexport class PermissionPolicyService extends JunctionEntityService implements IPermissionPolicyService {\n protected readonly ownerRealmKey = 'permissionRealmId';\n\n protected repository: IPermissionPolicyRepository;\n\n protected validator: PermissionPolicyValidator;\n\n constructor(ctx: PermissionPolicyServiceContext) {\n super();\n this.repository = ctx.repository;\n this.validator = new PermissionPolicyValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<PermissionPolicy>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: permissionPolicySchema, actor }));\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<PermissionPolicy> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<PermissionPolicy> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n permissionId: validated.permissionId,\n policyId: validated.policyId,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'permission-policy' });\n }\n\n if (validated.permission) {\n validated.permissionRealmId = validated.permission.realmId;\n }\n\n if (validated.policy) {\n validated.policyRealmId = validated.policy.realmId;\n }\n\n // Stamp the owner (permission) realm so the realmScope factor gates cross-realm writes.\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<PermissionPolicy> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n // Stamp the owner (permission) realm so the realmScope factor gates cross-realm writes.\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;AAsBA,IAAaU,0BAAb,cAA6CH,sBAAAA;CACtBI,gBAAgB;CAEzBC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,YAAY,IAAIP,0BAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OACyD;EACzD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFf,eAAegB,iBACfhB,eAAeiB,iBAClB,EACL,CAAA;EAEA,OAAO,KAAKV,WAAWW,SAAS,MAAMf,YAAYQ,OAAO;GAAEQ,QAAQf;GAAwBQ;EAAM,CAAA,CAAA;CACrG;CAEA,MAAMQ,OACFC,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFf,eAAegB,iBACfhB,eAAeiB,iBAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKf,WAAWgB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIxB,oBAAAA;EAGd,OAAOwB;CACX;CAEA,MAAME,OACFC,MACAb,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMf,eAAeiB,kBAAkB,CAAA;EAErF,MAAMU,YAAY,MAAM,KAAKnB,UAAUoB,IAAIH,MAAM,EAAEI,OAAO9B,eAAe+B,OAAO,CAAA;EAEhF,MAAM,KAAKvB,WAAWwB,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAKzB,WAAWgB,UAAU;GAC7CU,cAAcN,UAAUM;GACxBC,UAAUP,UAAUO;EACxB,CAAA,GAEI,MAAM,IAAIrC,oBAAoB,EAAEyB,QAAQ,oBAAoB,CAAA;EAGhE,IAAIK,UAAUQ,YACVR,UAAUS,oBAAoBT,UAAUQ,WAAWE;EAGvD,IAAIV,UAAUW,QACVX,UAAUY,gBAAgBZ,UAAUW,OAAOD;EAI/C,MAAMzB,MAAMC,oBAAoB2B,SAAS;GACrCzB,MAAMf,eAAeiB;GACrBQ,MAAM7B,iBAAiB;KAClBD,kBAAkB8C,aAAa,KAAKC,mBAAmBf,SAAAA;KACvDhC,kBAAkBgD,cAAc,KAAKC,sBAAsBjB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIL,SAAS,KAAKf,WAAWiB,OAAOG,SAAAA;EACpCL,SAAS,MAAM,KAAKf,WAAWsC,KAAKvB,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMwB,OACFzB,IACAT,OACyB;EACzB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMf,eAAeiB,kBAAkB,CAAA;EAErF,MAAMK,SAAS,MAAM,KAAKf,WAAWgB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIxB,oBAAAA;EAId,MAAMc,MAAMC,oBAAoB2B,SAAS;GACrCzB,MAAMf,eAAeiB;GACrBQ,MAAM7B,iBAAiB;KAClBD,kBAAkB8C,aAAa,KAAKC,mBAAmBpB,MAAAA;KACvD3B,kBAAkBgD,cAAc,KAAKC,sBAAsBtB,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI0B,aAAazB;EACzB,MAAM,KAAKf,WAAWyC,OAAO1B,MAAAA;EAC7BA,OAAOD,KAAK0B;EAEZ,OAAOzB;CACX;AACJ"}

package/dist/core/entities/policy/schema.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","children","POLICY","realm","REALM","policySchema","name","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/policy/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Policy } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { children: EntityType.POLICY, realm: EntityType.REALM };\n\nexport const policySchema = defineSchema<Policy>({\n name: EntityType.POLICY,\n fields: {\n default: [\n 'id',\n 'builtIn',\n 'type',\n 'displayName',\n 'name',\n 'description',\n 'invert',\n 'parentId',\n 'realmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['id', 'name', 'type', 'parentId', 'realmId'] },\n relations: { allowed: ['children', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,UAAUH,WAAWI;CAAQC,OAAOL,WAAWM;AAAM;AAE7E,MAAaC,eAAeR,aAAqB;CAC7CS,MAAMR,WAAWI;CACjBK,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;~~GAER~~;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAM;EAAQ;EAAQ;EAAY;~~GAAW~~;CAClEC,WAAW;EAAED,SAAS,CAAC,YAAY,~~OAAA~~;~~EAAUE~~,UAAUb,wBAAwBC,aAAAA;CAAe;CAC9Fa,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;~~GAAa~~;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}
1	+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","children","POLICY","realm","REALM","policySchema","name","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/policy/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Policy } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { children: EntityType.POLICY, realm: EntityType.REALM };\n\nexport const policySchema = defineSchema<Policy>({\n name: EntityType.POLICY,\n fields: {\n default: [\n 'id',\n 'builtIn',\n 'type',\n 'displayName',\n 'name',\n 'description',\n 'invert',\n 'parentId',\n 'realmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['id', 'name', 'type', 'parentId', 'realmId'] },\n relations: { allowed: ['children', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,UAAUH,WAAWI;CAAQC,OAAOL,WAAWM;AAAM;AAE7E,MAAaC,eAAeR,aAAqB;CAC7CS,MAAMR,WAAWI;CACjBK,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAM;EAAQ;EAAQ;EAAY;CAAU,EAAC;CAClEC,WAAW;EAAED,SAAS,CAAC,YAAY,OAAQ;EAAEE,UAAUb,wBAAwBC,aAAAA;CAAe;CAC9Fa,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}

package/dist/core/entities/policy/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","extendObject","isPropertySet","isUUID","removeObjectProperty","EntityNotFoundError","ValidationError","PermissionName","PolicyValidator","AbstractEntityService","PolicyAttributesValidator","decodeQuery","policySchema","PolicyService","repository","realmRepository","validator","attributesValidator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","PERMISSION_DELETE","findMany","schema","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","PERMISSION_CREATE","CREATE","validated","validate","validateJoinColumns","parent","type","COMPOSITE","builtIn","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","saveWithEA","created","identity","getActorRealmId","resourceRealmMatch","run","attributes","Array","isArray","children","promises","map","child","Promise","all","delete","entityId","deleteFromTree"],"sources":["../../../../src/core/entities/policy/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n ValidatorGroup,\n extendObject,\n isPropertySet,\n isUUID,\n removeObjectProperty,\n} from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n PermissionName,\n PolicyValidator,\n} from '@authup/core-kit';\nimport type { Policy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { PolicyAttributesValidator } from './attributes-validator.ts';\nimport type { IPolicyRepository, IPolicyService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { policySchema } from './schema.ts';\n\nexport type PolicyServiceContext = {\n repository: IPolicyRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class PolicyService extends AbstractEntityService implements IPolicyService {\n protected repository: IPolicyRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: PolicyValidator;\n\n protected attributesValidator: PolicyAttributesValidator;\n\n constructor(ctx: PolicyServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new PolicyValidator();\n this.attributesValidator = new PolicyAttributesValidator({});\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Policy>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: policySchema, actor }));\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n realm?: string,\n ): Promise<Policy> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Policy> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Policy> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Policy,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realmId === 'string' ?\n await this.realmRepository.resolve(data.realmId) :\n undefined;\n\n let entity: Policy \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realmId = realm.id;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n if (entity) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validate(data, group);\n\n await this.repository.validateJoinColumns(validated);\n\n if (\n validated.parent &&\n validated.parent.type !== BuiltInPolicyType.COMPOSITE\n ) {\n throw new ValidationError('The parent policy must be of type group.');\n }\n\n if (entity) {\n if (entity.builtIn) {\n throw new ValidationError('A built-in policy can not be updated.');\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n }),\n });\n\n await this.repository.checkUniqueness(validated, entity);\n\n extendObject(entity, validated);\n\n await this.repository.saveWithEA(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!isPropertySet(validated, 'realmId') && actor.identity) {\n validated.realmId = this.getActorRealmId(actor) \|\| null;\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n\n await this.repository.checkUniqueness(validated);\n\n entity = this.repository.create(validated);\n await this.repository.saveWithEA(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n private async validate(\n data: Record<string, any>,\n group: string,\n ): Promise<Policy> {\n const validated = await this.validator.run(data, { group });\n\n const attributes = await this.attributesValidator.run(data);\n extendObject(validated, attributes);\n\n if (Array.isArray(data.children)) {\n if (data.type === BuiltInPolicyType.COMPOSITE) {\n const promises = data.children.map(\n (child) => this.validate(child, group),\n );\n validated.children = await Promise.all(promises);\n }\n }\n\n return validated;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Policy> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (entity.builtIn) {\n throw new ValidationError('A built-in policy can not be deleted.');\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n\n await this.repository.deleteFromTree(entity);\n\n entity.id = entityId;\n\n // todo: remove after PolicyEntity - parent delete on cascade\n removeObjectProperty(entity, 'children');\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAkCA,IAAae,gBAAb,cAAmCJ,sBAAAA;CACrBK;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,YAAY,IAAIR,gBAAAA;EACrB,KAAKS,sBAAsB,IAAIP,0BAA0B,CAAC,CAAA;CAC9D;CAEA,MAAMS,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFjB,eAAekB;GACflB,eAAemB;GACfnB,eAAeoB;IAEvB,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAAS,MAAMjB,YAAYS,OAAO;GAAES,QAAQjB;GAAcS;EAAM,CAAA,CAAA;CAC3F;CAEA,MAAMS,OACFC,UACAV,OACAW,OACe;EACf,MAAMX,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFjB,eAAekB;GACflB,eAAemB;GACfnB,eAAeoB;IAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKnB,WAAWoB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,OAAO4B;CACX;CAEA,MAAME,OACFC,MACAf,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMf,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMM,OACFR,UACAK,MACAf,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMf,OAAO,EAAEmB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAf,OACAoB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,YAAY,WAClC,MAAM,KAAK5B,gBAAgB6B,QAAQR,KAAKO,OAAO,IAC/CL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAI1C,OAAO4B,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMrB,OAAOO;GAGjB,IAAIC,OACAa,MAAMF,UAAUX,MAAMc;GAG1Bb,SAAS,MAAM,KAAKnB,WAAWiC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAInC,oBAAAA;EAElB,OAAO,IAAIoC,QAAQD,YACf,MAAM,IAAInC,oBAAAA;EAGd,IAAI4B,QAAQ;GACR,MAAMZ,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMjB,eAAemB,kBAAkB,CAAA;GACrFgB,QAAQ1C,eAAeiD;EAC3B,OAAO;GACH,MAAM5B,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMjB,eAAe2C,kBAAkB,CAAA;GACrFR,QAAQ1C,eAAemD;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKC,SAASjB,MAAMM,KAAAA;EAE5C,MAAM,KAAK5B,WAAWwC,oBAAoBF,SAAAA;EAE1C,IACIA,UAAUG,UACVH,UAAUG,OAAOC,SAAS1D,kBAAkB2D,WAE5C,MAAM,IAAInD,gBAAgB,0CAAA;EAG9B,IAAI2B,QAAQ;GACR,IAAIA,OAAOyB,SACP,MAAM,IAAIpD,gBAAgB,uCAAA;GAG9B,MAAMe,MAAMC,oBAAoBqC,SAAS;IACrCnC,MAAMjB,eAAemB;IACrBU,MAAMrC,iBAAiB;MAClBD,kBAAkB8D,aAAa;MAC5B,GAAG3B;MACH,GAAGmB;KACP;MACCtD,kBAAkB+D,cAAcT,UAAUT,WAAWV,OAAOU,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK7B,WAAWgD,gBAAgBV,WAAWnB,MAAAA;GAEjDhC,aAAagC,QAAQmB,SAAAA;GAErB,MAAM,KAAKtC,WAAWiD,WAAW9B,MAAAA;GAEjC,OAAO;IACHA;IACA+B,SAAS;GACb;EACJ;EAEA,IAAI,CAAC9D,cAAckD,WAAW,SAAA,KAAc/B,MAAM4C,UAC9Cb,UAAUT,UAAU,KAAKuB,gBAAgB7C,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAe2C;GACrBd,MAAMrC,iBAAiB;KAAGD,kBAAkB8D,aAAaR;IAAW,GAAG,KAAKe,mBAAmBf,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKtC,WAAWgD,gBAAgBV,SAAAA;EAEtCnB,SAAS,KAAKnB,WAAWqB,OAAOiB,SAAAA;EAChC,MAAM,KAAKtC,WAAWiD,WAAW9B,MAAAA;EAEjC,OAAO;GACHA;GACA+B,SAAS;EACb;CACJ;CAEA,MAAcX,SACVjB,MACAM,OACe;EACf,MAAMU,YAAY,MAAM,KAAKpC,UAAUoD,IAAIhC,MAAM,EAAEM,MAAM,CAAA;EAGzDzC,aAAamD,WAAWiB,MADC,KAAKpD,oBAAoBmD,IAAIhC,IAAAA,CAC9BiC;EAExB,IAAIC,MAAMC,QAAQnC,KAAKoC,QAAQ;OACvBpC,KAAKoB,SAAS1D,kBAAkB2D,WAAW;IAC3C,MAAMgB,WAAWrC,KAAKoC,SAASE,KAC1BC,UAAU,KAAKtB,SAASsB,OAAOjC,KAAAA,CAAAA;IAEpCU,UAAUoB,WAAW,MAAMI,QAAQC,IAAIJ,QAAAA;GAC3C;;EAGJ,OAAOrB;CACX;CAEA,MAAM0B,OACFhC,IACAzB,OACe;EACf,MAAMA,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMjB,eAAeoB,kBAAkB,CAAA;EAErF,MAAMM,SAAS,MAAM,KAAKnB,WAAWiC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAI5B,oBAAAA;EAGd,IAAI4B,OAAOyB,SACP,MAAM,IAAIpD,gBAAgB,uCAAA;EAG9B,MAAMe,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAeoB;GACrBS,MAAMrC,iBAAiB;KAAGD,kBAAkB8D,aAAa3B;IAAQ,GAAG,KAAKkC,mBAAmBlC,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEa,IAAIiC,aAAa9C;EAEzB,MAAM,KAAKnB,WAAWkE,eAAe/C,MAAAA;EAErCA,OAAOa,KAAKiC;EAGZ3E,qBAAqB6B,QAAQ,UAAA;EAE7B,OAAOA;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","extendObject","isPropertySet","isUUID","removeObjectProperty","EntityNotFoundError","ValidationError","PermissionName","PolicyValidator","AbstractEntityService","PolicyAttributesValidator","decodeQuery","policySchema","PolicyService","repository","realmRepository","validator","attributesValidator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","PERMISSION_DELETE","findMany","schema","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","PERMISSION_CREATE","CREATE","validated","validate","validateJoinColumns","parent","type","COMPOSITE","builtIn","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","saveWithEA","created","identity","getActorRealmId","resourceRealmMatch","run","attributes","Array","isArray","children","promises","map","child","Promise","all","delete","entityId","deleteFromTree"],"sources":["../../../../src/core/entities/policy/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n ValidatorGroup,\n extendObject,\n isPropertySet,\n isUUID,\n removeObjectProperty,\n} from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n PermissionName,\n PolicyValidator,\n} from '@authup/core-kit';\nimport type { Policy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { PolicyAttributesValidator } from './attributes-validator.ts';\nimport type { IPolicyRepository, IPolicyService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { policySchema } from './schema.ts';\n\nexport type PolicyServiceContext = {\n repository: IPolicyRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class PolicyService extends AbstractEntityService implements IPolicyService {\n protected repository: IPolicyRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: PolicyValidator;\n\n protected attributesValidator: PolicyAttributesValidator;\n\n constructor(ctx: PolicyServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new PolicyValidator();\n this.attributesValidator = new PolicyAttributesValidator({});\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Policy>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: policySchema, actor }));\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n realm?: string,\n ): Promise<Policy> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.PERMISSION_READ,\n PermissionName.PERMISSION_UPDATE,\n PermissionName.PERMISSION_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Policy> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Policy> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Policy,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realmId === 'string' ?\n await this.realmRepository.resolve(data.realmId) :\n undefined;\n\n let entity: Policy \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realmId = realm.id;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n if (entity) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validate(data, group);\n\n await this.repository.validateJoinColumns(validated);\n\n if (\n validated.parent &&\n validated.parent.type !== BuiltInPolicyType.COMPOSITE\n ) {\n throw new ValidationError('The parent policy must be of type group.');\n }\n\n if (entity) {\n if (entity.builtIn) {\n throw new ValidationError('A built-in policy can not be updated.');\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n }),\n });\n\n await this.repository.checkUniqueness(validated, entity);\n\n extendObject(entity, validated);\n\n await this.repository.saveWithEA(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!isPropertySet(validated, 'realmId') && actor.identity) {\n validated.realmId = this.getActorRealmId(actor) \|\| null;\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n\n await this.repository.checkUniqueness(validated);\n\n entity = this.repository.create(validated);\n await this.repository.saveWithEA(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n private async validate(\n data: Record<string, any>,\n group: string,\n ): Promise<Policy> {\n const validated = await this.validator.run(data, { group });\n\n const attributes = await this.attributesValidator.run(data);\n extendObject(validated, attributes);\n\n if (Array.isArray(data.children)) {\n if (data.type === BuiltInPolicyType.COMPOSITE) {\n const promises = data.children.map(\n (child) => this.validate(child, group),\n );\n validated.children = await Promise.all(promises);\n }\n }\n\n return validated;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Policy> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (entity.builtIn) {\n throw new ValidationError('A built-in policy can not be deleted.');\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.PERMISSION_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n\n await this.repository.deleteFromTree(entity);\n\n entity.id = entityId;\n\n // todo: remove after PolicyEntity - parent delete on cascade\n removeObjectProperty(entity, 'children');\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAkCA,IAAae,gBAAb,cAAmCJ,sBAAAA;CACrBK;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,YAAY,IAAIR,gBAAAA;EACrB,KAAKS,sBAAsB,IAAIP,0BAA0B,CAAC,CAAA;CAC9D;CAEA,MAAMS,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFjB,eAAekB;GACflB,eAAemB;GACfnB,eAAeoB;EAClB,EACL,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAAS,MAAMjB,YAAYS,OAAO;GAAES,QAAQjB;GAAcS;EAAM,CAAA,CAAA;CAC3F;CAEA,MAAMS,OACFC,UACAV,OACAW,OACe;EACf,MAAMX,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFjB,eAAekB;GACflB,eAAemB;GACfnB,eAAeoB;EAClB,EACL,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKnB,WAAWoB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,OAAO4B;CACX;CAEA,MAAME,OACFC,MACAf,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMf,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMM,OACFR,UACAK,MACAf,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMf,OAAO,EAAEmB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAf,OACAoB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,YAAY,WAClC,MAAM,KAAK5B,gBAAgB6B,QAAQR,KAAKO,OAAO,IAC/CL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAI1C,OAAO4B,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMrB,OAAOO;GAGjB,IAAIC,OACAa,MAAMF,UAAUX,MAAMc;GAG1Bb,SAAS,MAAM,KAAKnB,WAAWiC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAInC,oBAAAA;EAElB,OAAO,IAAIoC,QAAQD,YACf,MAAM,IAAInC,oBAAAA;EAGd,IAAI4B,QAAQ;GACR,MAAMZ,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMjB,eAAemB,kBAAkB,CAAA;GACrFgB,QAAQ1C,eAAeiD;EAC3B,OAAO;GACH,MAAM5B,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMjB,eAAe2C,kBAAkB,CAAA;GACrFR,QAAQ1C,eAAemD;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKC,SAASjB,MAAMM,KAAAA;EAE5C,MAAM,KAAK5B,WAAWwC,oBAAoBF,SAAAA;EAE1C,IACIA,UAAUG,UACVH,UAAUG,OAAOC,SAAS1D,kBAAkB2D,WAE5C,MAAM,IAAInD,gBAAgB,0CAAA;EAG9B,IAAI2B,QAAQ;GACR,IAAIA,OAAOyB,SACP,MAAM,IAAIpD,gBAAgB,uCAAA;GAG9B,MAAMe,MAAMC,oBAAoBqC,SAAS;IACrCnC,MAAMjB,eAAemB;IACrBU,MAAMrC,iBAAiB;MAClBD,kBAAkB8D,aAAa;MAC5B,GAAG3B;MACH,GAAGmB;KACP;MACCtD,kBAAkB+D,cAAcT,UAAUT,WAAWV,OAAOU,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK7B,WAAWgD,gBAAgBV,WAAWnB,MAAAA;GAEjDhC,aAAagC,QAAQmB,SAAAA;GAErB,MAAM,KAAKtC,WAAWiD,WAAW9B,MAAAA;GAEjC,OAAO;IACHA;IACA+B,SAAS;GACb;EACJ;EAEA,IAAI,CAAC9D,cAAckD,WAAW,SAAA,KAAc/B,MAAM4C,UAC9Cb,UAAUT,UAAU,KAAKuB,gBAAgB7C,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAe2C;GACrBd,MAAMrC,iBAAiB;KAAGD,kBAAkB8D,aAAaR;IAAW,GAAG,KAAKe,mBAAmBf,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKtC,WAAWgD,gBAAgBV,SAAAA;EAEtCnB,SAAS,KAAKnB,WAAWqB,OAAOiB,SAAAA;EAChC,MAAM,KAAKtC,WAAWiD,WAAW9B,MAAAA;EAEjC,OAAO;GACHA;GACA+B,SAAS;EACb;CACJ;CAEA,MAAcX,SACVjB,MACAM,OACe;EACf,MAAMU,YAAY,MAAM,KAAKpC,UAAUoD,IAAIhC,MAAM,EAAEM,MAAM,CAAA;EAGzDzC,aAAamD,WAAWiB,MADC,KAAKpD,oBAAoBmD,IAAIhC,IAAAA,CAC9BiC;EAExB,IAAIC,MAAMC,QAAQnC,KAAKoC,QAAQ,GACvBpC;OAAAA,KAAKoB,SAAS1D,kBAAkB2D,WAAW;IAC3C,MAAMgB,WAAWrC,KAAKoC,SAASE,KAC1BC,UAAU,KAAKtB,SAASsB,OAAOjC,KAAAA,CAAAA;IAEpCU,UAAUoB,WAAW,MAAMI,QAAQC,IAAIJ,QAAAA;GAC3C;;EAGJ,OAAOrB;CACX;CAEA,MAAM0B,OACFhC,IACAzB,OACe;EACf,MAAMA,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMjB,eAAeoB,kBAAkB,CAAA;EAErF,MAAMM,SAAS,MAAM,KAAKnB,WAAWiC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAI5B,oBAAAA;EAGd,IAAI4B,OAAOyB,SACP,MAAM,IAAIpD,gBAAgB,uCAAA;EAG9B,MAAMe,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAeoB;GACrBS,MAAMrC,iBAAiB;KAAGD,kBAAkB8D,aAAa3B;IAAQ,GAAG,KAAKkC,mBAAmBlC,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEa,IAAIiC,aAAa9C;EAEzB,MAAM,KAAKnB,WAAWkE,eAAe/C,MAAAA;EAErCA,OAAOa,KAAKiC;EAGZ3E,qBAAqB6B,QAAQ,UAAA;EAE7B,OAAOA;CACX;AACJ"}

package/dist/core/entities/realm/schema.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","realmSchema","name","REALM","fields","allowed","filters","relations","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/realm/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Realm } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\n\nexport const realmSchema = defineSchema<Realm>({\n name: EntityType.REALM,\n fields: {\n allowed: [\n 'id',\n 'name',\n 'displayName',\n 'description',\n 'builtIn',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['id', 'builtIn', 'displayName', 'name'] },\n relations: { allowed: [] },\n sort: { allowed: ['id', 'name', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n});\n"],"mappings":";;;;;;AAWA,MAAaE,cAAcF,aAAoB;CAC3CG,MAAMF,WAAWG;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;~~GAER~~;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAW;EAAe;~~GAAQ~~;CAC7DE,WAAW,EAAEF,SAAS,CAAA,EAAG;CACzBG,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAQ;EAAa;~~GAAa~~;CAC1DI,YAAY,EAAEC,UAAU,GAAG;AAC/B,CAAA"}
1	+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","realmSchema","name","REALM","fields","allowed","filters","relations","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/realm/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Realm } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\n\nexport const realmSchema = defineSchema<Realm>({\n name: EntityType.REALM,\n fields: {\n allowed: [\n 'id',\n 'name',\n 'displayName',\n 'description',\n 'builtIn',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['id', 'builtIn', 'displayName', 'name'] },\n relations: { allowed: [] },\n sort: { allowed: ['id', 'name', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n});\n"],"mappings":";;;;;;AAWA,MAAaE,cAAcF,aAAoB;CAC3CG,MAAMF,WAAWG;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAW;EAAe;CAAO,EAAC;CAC7DE,WAAW,EAAEF,SAAS,CAAA,EAAG;CACzBG,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAQ;EAAa;CAAY,EAAC;CAC1DI,YAAY,EAAEC,UAAU,GAAG;AAC/B,CAAA"}

package/dist/core/entities/role/schema.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","roleSchema","name","ROLE","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/role/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Role } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const roleSchema = defineSchema<Role>({\n name: EntityType.ROLE,\n fields: {\n allowed: [\n 'id',\n 'name',\n 'displayName',\n 'target',\n 'description',\n 'realmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['id', 'name', 'target', 'realmId'] },\n relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'name', 'updatedAt', 'createdAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,aAAaN,aAAmB;CACzCO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;~~GAER~~;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;EAAU;~~GAAW~~;CACxDE,WAAW;EAAEF,SAAS,CAAC,~~OAAA~~;~~EAAUG~~,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAa;~~GAAa~~;CAC1DK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}
1	+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","roleSchema","name","ROLE","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/role/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Role } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const roleSchema = defineSchema<Role>({\n name: EntityType.ROLE,\n fields: {\n allowed: [\n 'id',\n 'name',\n 'displayName',\n 'target',\n 'description',\n 'realmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['id', 'name', 'target', 'realmId'] },\n relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'name', 'updatedAt', 'createdAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,aAAaN,aAAmB;CACzCO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;EAAU;CAAU,EAAC;CACxDE,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAa;CAAY,EAAC;CAC1DK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}

package/dist/core/entities/role/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","ValidationError","PermissionName","ROLE_ADMIN_NAME","RoleValidator","AbstractEntityService","decodeQuery","roleSchema","RoleService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","ROLE_READ","ROLE_UPDATE","ROLE_DELETE","findMany","schema","getOne","idOrName","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","ROLE_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","REALM_MATCH","merge","checkUniqueness","created","identity","getActorRealmId","resourceRealmMatch","delete","entityId","remove"],"sources":["../../../../src/core/entities/role/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n PermissionName,\n ROLE_ADMIN_NAME,\n RoleValidator,\n} from '@authup/core-kit';\nimport type { Role } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRoleRepository, IRoleService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { roleSchema } from './schema.ts';\n\nexport type RoleServiceContext = {\n repository: IRoleRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class RoleService extends AbstractEntityService implements IRoleService {\n protected repository: IRoleRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: RoleValidator;\n\n constructor(ctx: RoleServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new RoleValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Role>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.ROLE_READ,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: roleSchema, actor }));\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n ): Promise<Role> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.ROLE_READ,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneByIdOrName(idOrName);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Role> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Role> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Role,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realmId === 'string' ?\n await this.realmRepository.resolve(data.realmId) :\n undefined;\n\n let entity: Role \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realmId = realm.id;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n if (entity) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n await this.repository.validateJoinColumns(validated);\n\n if (entity) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n }),\n });\n\n entity = this.repository.merge(entity, validated);\n await this.repository.checkUniqueness(validated, entity);\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!isPropertySet(validated, 'realmId') && actor.identity) {\n validated.realmId = this.getActorRealmId(actor) \|\| null;\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n\n await this.repository.checkUniqueness(validated);\n\n entity = this.repository.create(validated);\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Role> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (entity.name === ROLE_ADMIN_NAME) {\n throw new ValidationError('The default admin role can not be deleted.');\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;AA4BA,IAAaa,cAAb,cAAiCH,sBAAAA;CACnBI;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,cAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC6C;EAC7C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMhB,YAAYQ,OAAO;GAAES,QAAQhB;GAAYQ;EAAM,CAAA,CAAA;CACzF;CAEA,MAAMS,OACFC,UACAV,OACa;EACb,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;IAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAd,OACa;EACb,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMd,KAAAA;EACpD,OAAOW;CACX;CAEA,MAAMM,OACFP,UACAI,MACAd,OACa;EACb,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKL,UAAUI,MAAMd,OAAO,EAAEkB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFL,UACAI,MACAd,OACAmB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOP,KAAKQ,YAAY,WAClC,MAAM,KAAK3B,gBAAgB4B,QAAQT,KAAKQ,OAAO,IAC/CN,KAAAA;EAEJ,IAAIL;EACJ,IAAID,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAIxC,OAAO0B,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMrB,OAAOO;GAGjB,IAAIW,OACAG,MAAMF,UAAUD,MAAMI;GAG1Bd,SAAS,MAAM,KAAKjB,WAAWgC,UAAUF,KAAAA;GACzC,IAAI,CAACb,UAAUQ,QAAQD,YACnB,MAAM,IAAIjC,oBAAAA;EAElB,OAAO,IAAIkC,QAAQD,YACf,MAAM,IAAIjC,oBAAAA;EAGd,IAAI0B,QAAQ;GACR,MAAMX,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMhB,eAAekB,YAAY,CAAA;GAC/Ee,QAAQtC,eAAe8C;EAC3B,OAAO;GACH,MAAM5B,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMhB,eAAe0C,YAAY,CAAA;GAC/ET,QAAQtC,eAAegD;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKnC,UAAUoC,IAAIlB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK1B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIpB,QAAQ;GACR,MAAMX,MAAMC,oBAAoBiC,SAAS;IACrC/B,MAAMhB,eAAekB;IACrBS,MAAMjC,iBAAiB;MAClBD,kBAAkBuD,aAAa;MAC5B,GAAGxB;MACH,GAAGoB;KACP;MACCnD,kBAAkBwD,cAAcL,UAAUT,WAAWX,OAAOW,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEAX,SAAS,KAAKjB,WAAW2C,MAAM1B,QAAQoB,SAAAA;GACvC,MAAM,KAAKrC,WAAW4C,gBAAgBP,WAAWpB,MAAAA;GACjD,MAAM,KAAKjB,WAAWqB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA4B,SAAS;GACb;EACJ;EAEA,IAAI,CAACxD,cAAcgD,WAAW,SAAA,KAAc/B,MAAMwC,UAC9CT,UAAUT,UAAU,KAAKmB,gBAAgBzC,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMhB,eAAe0C;GACrBf,MAAMjC,iBAAiB;KAAGD,kBAAkBuD,aAAaJ;IAAW,GAAG,KAAKW,mBAAmBX,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,SAAAA;EAEtCpB,SAAS,KAAKjB,WAAWmB,OAAOkB,SAAAA;EAChC,MAAM,KAAKrC,WAAWqB,KAAKJ,MAAAA;EAE3B,OAAO;GACHA;GACA4B,SAAS;EACb;CACJ;CAEA,MAAMI,OACFlB,IACAzB,OACa;EACb,MAAMA,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMhB,eAAemB,YAAY,CAAA;EAE/E,MAAMK,SAAS,MAAM,KAAKjB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAI1B,oBAAAA;EAGd,IAAI0B,OAAOR,SAASf,iBAChB,MAAM,IAAIF,gBAAgB,4CAAA;EAG9B,MAAMc,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMhB,eAAemB;GACrBQ,MAAMjC,iBAAiB;KAAGD,kBAAkBuD,aAAaxB;IAAQ,GAAG,KAAK+B,mBAAmB/B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAImB,aAAajC;EACzB,MAAM,KAAKjB,WAAWmD,OAAOlC,MAAAA;EAC7BA,OAAOc,KAAKmB;EAEZ,OAAOjC;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","ValidationError","PermissionName","ROLE_ADMIN_NAME","RoleValidator","AbstractEntityService","decodeQuery","roleSchema","RoleService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","ROLE_READ","ROLE_UPDATE","ROLE_DELETE","findMany","schema","getOne","idOrName","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","ROLE_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","REALM_MATCH","merge","checkUniqueness","created","identity","getActorRealmId","resourceRealmMatch","delete","entityId","remove"],"sources":["../../../../src/core/entities/role/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n PermissionName,\n ROLE_ADMIN_NAME,\n RoleValidator,\n} from '@authup/core-kit';\nimport type { Role } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRoleRepository, IRoleService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { roleSchema } from './schema.ts';\n\nexport type RoleServiceContext = {\n repository: IRoleRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class RoleService extends AbstractEntityService implements IRoleService {\n protected repository: IRoleRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: RoleValidator;\n\n constructor(ctx: RoleServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new RoleValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Role>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.ROLE_READ,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: roleSchema, actor }));\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n ): Promise<Role> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.ROLE_READ,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneByIdOrName(idOrName);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Role> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Role> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Role,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realmId === 'string' ?\n await this.realmRepository.resolve(data.realmId) :\n undefined;\n\n let entity: Role \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realmId = realm.id;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n if (entity) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n await this.repository.validateJoinColumns(validated);\n\n if (entity) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n }),\n });\n\n entity = this.repository.merge(entity, validated);\n await this.repository.checkUniqueness(validated, entity);\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!isPropertySet(validated, 'realmId') && actor.identity) {\n validated.realmId = this.getActorRealmId(actor) \|\| null;\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n\n await this.repository.checkUniqueness(validated);\n\n entity = this.repository.create(validated);\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Role> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (entity.name === ROLE_ADMIN_NAME) {\n throw new ValidationError('The default admin role can not be deleted.');\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;AA4BA,IAAaa,cAAb,cAAiCH,sBAAAA;CACnBI;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,cAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC6C;EAC7C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;EAClB,EACL,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMhB,YAAYQ,OAAO;GAAES,QAAQhB;GAAYQ;EAAM,CAAA,CAAA;CACzF;CAEA,MAAMS,OACFC,UACAV,OACa;EACb,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;EAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAd,OACa;EACb,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMd,KAAAA;EACpD,OAAOW;CACX;CAEA,MAAMM,OACFP,UACAI,MACAd,OACa;EACb,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKL,UAAUI,MAAMd,OAAO,EAAEkB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFL,UACAI,MACAd,OACAmB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOP,KAAKQ,YAAY,WAClC,MAAM,KAAK3B,gBAAgB4B,QAAQT,KAAKQ,OAAO,IAC/CN,KAAAA;EAEJ,IAAIL;EACJ,IAAID,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAIxC,OAAO0B,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMrB,OAAOO;GAGjB,IAAIW,OACAG,MAAMF,UAAUD,MAAMI;GAG1Bd,SAAS,MAAM,KAAKjB,WAAWgC,UAAUF,KAAAA;GACzC,IAAI,CAACb,UAAUQ,QAAQD,YACnB,MAAM,IAAIjC,oBAAAA;EAElB,OAAO,IAAIkC,QAAQD,YACf,MAAM,IAAIjC,oBAAAA;EAGd,IAAI0B,QAAQ;GACR,MAAMX,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMhB,eAAekB,YAAY,CAAA;GAC/Ee,QAAQtC,eAAe8C;EAC3B,OAAO;GACH,MAAM5B,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMhB,eAAe0C,YAAY,CAAA;GAC/ET,QAAQtC,eAAegD;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKnC,UAAUoC,IAAIlB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK1B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIpB,QAAQ;GACR,MAAMX,MAAMC,oBAAoBiC,SAAS;IACrC/B,MAAMhB,eAAekB;IACrBS,MAAMjC,iBAAiB;MAClBD,kBAAkBuD,aAAa;MAC5B,GAAGxB;MACH,GAAGoB;KACP;MACCnD,kBAAkBwD,cAAcL,UAAUT,WAAWX,OAAOW,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEAX,SAAS,KAAKjB,WAAW2C,MAAM1B,QAAQoB,SAAAA;GACvC,MAAM,KAAKrC,WAAW4C,gBAAgBP,WAAWpB,MAAAA;GACjD,MAAM,KAAKjB,WAAWqB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA4B,SAAS;GACb;EACJ;EAEA,IAAI,CAACxD,cAAcgD,WAAW,SAAA,KAAc/B,MAAMwC,UAC9CT,UAAUT,UAAU,KAAKmB,gBAAgBzC,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMhB,eAAe0C;GACrBf,MAAMjC,iBAAiB;KAAGD,kBAAkBuD,aAAaJ;IAAW,GAAG,KAAKW,mBAAmBX,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,SAAAA;EAEtCpB,SAAS,KAAKjB,WAAWmB,OAAOkB,SAAAA;EAChC,MAAM,KAAKrC,WAAWqB,KAAKJ,MAAAA;EAE3B,OAAO;GACHA;GACA4B,SAAS;EACb;CACJ;CAEA,MAAMI,OACFlB,IACAzB,OACa;EACb,MAAMA,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMhB,eAAemB,YAAY,CAAA;EAE/E,MAAMK,SAAS,MAAM,KAAKjB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAI1B,oBAAAA;EAGd,IAAI0B,OAAOR,SAASf,iBAChB,MAAM,IAAIF,gBAAgB,4CAAA;EAG9B,MAAMc,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMhB,eAAemB;GACrBQ,MAAMjC,iBAAiB;KAAGD,kBAAkBuD,aAAaxB;IAAQ,GAAG,KAAK+B,mBAAmB/B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAImB,aAAajC;EACzB,MAAM,KAAKjB,WAAWmD,OAAOlC,MAAAA;EAC7BA,OAAOc,KAAKmB;EAEZ,OAAOjC;CACX;AACJ"}

package/dist/core/entities/role-attribute/schema.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","role","ROLE","realm","REALM","roleAttributeSchema","name","ROLE_ATTRIBUTE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/role-attribute/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { RoleAttribute } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { role: EntityType.ROLE, realm: EntityType.REALM };\n\nexport const roleAttributeSchema = defineSchema<RoleAttribute>({\n name: EntityType.ROLE_ATTRIBUTE,\n // see user-role schema — explicit root projection for include= decodes\n fields: {\n default: [\n 'id',\n 'name',\n 'value',\n 'roleId',\n 'realmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['id', 'name', 'roleId', 'realmId'] },\n relations: { allowed: ['role', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: {\n allowed: [\n 'id',\n 'name',\n 'roleId',\n 'realmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,sBAAsBR,aAA4B;CAC3DS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;~~GAER~~;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAM;EAAQ;EAAU;~~GAAW~~;CACxDC,WAAW;EAAED,SAAS,CAAC,QAAQ,~~OAAA~~;~~EAAUE~~,UAAUd,wBAAwBC,aAAAA;CAAe;CAC1Fc,MAAM,EACFH,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;~~GAER~~;CACAI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
1	+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","role","ROLE","realm","REALM","roleAttributeSchema","name","ROLE_ATTRIBUTE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/role-attribute/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { RoleAttribute } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { role: EntityType.ROLE, realm: EntityType.REALM };\n\nexport const roleAttributeSchema = defineSchema<RoleAttribute>({\n name: EntityType.ROLE_ATTRIBUTE,\n // see user-role schema — explicit root projection for include= decodes\n fields: {\n default: [\n 'id',\n 'name',\n 'value',\n 'roleId',\n 'realmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['id', 'name', 'roleId', 'realmId'] },\n relations: { allowed: ['role', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: {\n allowed: [\n 'id',\n 'name',\n 'roleId',\n 'realmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,sBAAsBR,aAA4B;CAC3DS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAM;EAAQ;EAAU;CAAU,EAAC;CACxDC,WAAW;EAAED,SAAS,CAAC,QAAQ,OAAQ;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC1Fc,MAAM,EACFH,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/role-attribute/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityNotFoundError","ValidationError","inArray","PermissionName","AbstractEntityService","appendQueryConditions","decodeQuery","roleAttributeSchema","RoleAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionNames","ROLE_READ","ROLE_UPDATE","ROLE_DELETE","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","compiled","compile","verdict","condition","findMany","data","entities","meta","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","id","findOneBy","create","preEvaluate","validateJoinColumns","has","realmId","role","evaluate","value","save","update","roleId","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/role-attribute/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { inArray } from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { RoleAttribute } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRoleAttributeRepository, IRoleAttributeService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { roleAttributeSchema } from './schema.ts';\n\nexport type RoleAttributeServiceContext = {\n repository: IRoleAttributeRepository;\n reservedNames?: ReadonlySet<string>;\n};\n\nexport class RoleAttributeService extends AbstractEntityService implements IRoleAttributeService {\n protected repository: IRoleAttributeRepository;\n\n protected reservedNames: ReadonlySet<string>;\n\n constructor(ctx: RoleAttributeServiceContext) {\n super();\n this.repository = ctx.repository;\n this.reservedNames = ctx.reservedNames ?? new Set();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<RoleAttribute>> {\n const permissionNames = [\n PermissionName.ROLE_READ,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n ];\n\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n\n let parsed = await decodeQuery(query, { schema: roleAttributeSchema, actor });\n\n // Compile the read permissions into a row condition (#3286 phase 3): the\n // authorization runs as WHERE, so pagination and totals stay exact. A\n // non-expressible policy falls back to the per-row loop below.\n const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });\n if (compiled.verdict === 'deny') {\n // no row can pass — a constant-false condition keeps the meta shape\n parsed = appendQueryConditions(parsed, inArray('id', []));\n } else if (compiled.verdict === 'conditional') {\n parsed = appendQueryConditions(parsed, compiled.condition);\n }\n\n if (compiled.verdict !== 'post') {\n return this.repository.findMany(parsed);\n }\n\n const {\n data: entities,\n meta,\n } = await this.repository.findMany(parsed);\n\n const data: RoleAttribute[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.ROLE_READ,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n ],\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n data.push(entity);\n } catch {\n total--;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<RoleAttribute> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.ROLE_READ,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.ROLE_READ,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n ],\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<RoleAttribute> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n await this.repository.validateJoinColumns(data);\n\n if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n throw new ValidationError(`The role-attribute name '${data.name}' collides with a Role entity column.`);\n }\n\n data.realmId = data.role.realmId;\n\n const entity = this.repository.create(data);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value },\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<RoleAttribute> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n await this.repository.validateJoinColumns(data);\n\n if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n throw new ValidationError(`The role-attribute name '${data.name}' collides with a Role entity column.`);\n }\n\n let entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n // An attribute belongs to a fixed role; its owner (and the role-derived realmId) is\n // IMMUTABLE on update — strip both from the body. This blocks reassigning the attribute\n // to another role (which would otherwise be authorized against the new realm, not the\n // one the attribute currently lives in) and blocks a caller-supplied realmId that would\n // gate ROLE_UPDATE against a realm of their choosing. To move an attribute, delete + recreate.\n delete data.roleId;\n delete data.role;\n delete data.realmId;\n\n entity = this.repository.merge(entity, data);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value },\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<RoleAttribute> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;AAuBA,IAAaU,uBAAb,cAA0CJ,sBAAAA;CAC5BK;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMC,kBAAkB;GACpBb,eAAec;GACfd,eAAee;GACff,eAAegB;;EAGnB,MAAMJ,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAEzE,IAAIO,SAAS,MAAMjB,YAAYQ,OAAO;GAAEU,QAAQjB;GAAqBQ;EAAM,CAAA;EAK3E,MAAMU,WAAW,MAAMV,MAAMK,oBAAoBM,QAAQ,EAAEJ,MAAMN,gBAAgB,CAAA;EACjF,IAAIS,SAASE,YAAY,QAErBJ,SAASlB,sBAAsBkB,QAAQrB,QAAQ,MAAM,CAAA,CAAE,CAAA;OACpD,IAAIuB,SAASE,YAAY,eAC5BJ,SAASlB,sBAAsBkB,QAAQE,SAASG,SAAS;EAG7D,IAAIH,SAASE,YAAY,QACrB,OAAO,KAAKlB,WAAWoB,SAASN,MAAAA;EAGpC,MAAM,EACFO,MAAMC,UACNC,SACA,MAAM,KAAKvB,WAAWoB,SAASN,MAAAA;EAEnC,MAAMO,OAAwB,CAAA;EAC9B,IAAI,EAAEG,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UACjB,IAAI;GACA,MAAMhB,MAAMK,oBAAoBe,cAAc;IAC1Cb,MAAM;KACFnB,eAAec;KACfd,eAAee;KACff,eAAegB;;IAEnBW,MAAM/B,iBAAiB;MAAGD,kBAAkBsC,aAAaF;KAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;IAAQ,CAAA;GACxG,CAAA;GACAJ,KAAKQ,KAAKJ,MAAAA;EACd,QAAQ;GACJD;EACJ;EAGJ,OAAO;GACHH;GACAE,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,IACAzB,OACsB;EACtB,MAAMA,MAAMK,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFnB,eAAec;GACfd,eAAee;GACff,eAAegB;IAEvB,CAAA;EAEA,MAAMe,SAAS,MAAM,KAAKzB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACN,QACD,MAAM,IAAIlC,oBAAAA;EAGd,MAAMe,MAAMK,oBAAoBe,cAAc;GAC1Cb,MAAM;IACFnB,eAAec;IACfd,eAAee;IACff,eAAegB;;GAEnBW,MAAM/B,iBAAiB;KAAGD,kBAAkBsC,aAAaF;IAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMQ,OACFZ,MACAf,OACsB;EACtB,MAAMA,MAAMK,oBAAoBuB,YAAY,EAAErB,MAAMnB,eAAee,YAAY,CAAA;EAE/E,MAAM,KAAKT,WAAWmC,oBAAoBd,IAAAA;EAE1C,IAAI,OAAOA,KAAKR,SAAS,YAAY,KAAKZ,cAAcmC,IAAIf,KAAKR,IAAI,GACjE,MAAM,IAAIrB,gBAAgB,4BAA4B6B,KAAKR,KAAK,sCAAsC;EAG1GQ,KAAKgB,UAAUhB,KAAKiB,KAAKD;EAEzB,MAAMZ,SAAS,KAAKzB,WAAWiC,OAAOZ,IAAAA;EAEtC,MAAMf,MAAMK,oBAAoB4B,SAAS;GACrC1B,MAAMnB,eAAee;GACrBY,MAAM/B,iBAAiB;KAClBD,kBAAkBsC,aAAa,GAAGN,KAAKR,OAAOQ,KAAKmB,MAAM;IAC1D,GAAG,KAAKZ,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKzB,WAAWyC,KAAKhB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMiB,OACFX,IACAV,MACAf,OACsB;EACtB,MAAMA,MAAMK,oBAAoBuB,YAAY,EAAErB,MAAMnB,eAAee,YAAY,CAAA;EAE/E,MAAM,KAAKT,WAAWmC,oBAAoBd,IAAAA;EAE1C,IAAI,OAAOA,KAAKR,SAAS,YAAY,KAAKZ,cAAcmC,IAAIf,KAAKR,IAAI,GACjE,MAAM,IAAIrB,gBAAgB,4BAA4B6B,KAAKR,KAAK,sCAAsC;EAG1G,IAAIY,SAAS,MAAM,KAAKzB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EAClD,IAAI,CAACN,QACD,MAAM,IAAIlC,oBAAAA;EAQd,OAAO8B,KAAKsB;EACZ,OAAOtB,KAAKiB;EACZ,OAAOjB,KAAKgB;EAEZZ,SAAS,KAAKzB,WAAW4C,MAAMnB,QAAQJ,IAAAA;EAEvC,MAAMf,MAAMK,oBAAoB4B,SAAS;GACrC1B,MAAMnB,eAAee;GACrBY,MAAM/B,iBAAiB;KAClBD,kBAAkBsC,aAAa,GAAGF,OAAOZ,OAAOY,OAAOe,MAAM;IAC9D,GAAG,KAAKZ,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKzB,WAAWyC,KAAKhB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMoB,OACFd,IACAzB,OACsB;EACtB,MAAMA,MAAMK,oBAAoBuB,YAAY,EAAErB,MAAMnB,eAAee,YAAY,CAAA;EAE/E,MAAMgB,SAAS,MAAM,KAAKzB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACN,QACD,MAAM,IAAIlC,oBAAAA;EAGd,MAAMe,MAAMK,oBAAoB4B,SAAS;GACrC1B,MAAMnB,eAAee;GACrBY,MAAM/B,iBAAiB;KAAGD,kBAAkBsC,aAAaF;IAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEM,IAAIe,aAAarB;EACzB,MAAM,KAAKzB,WAAW+C,OAAOtB,MAAAA;EAC7BA,OAAOM,KAAKe;EAEZ,OAAOrB;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityNotFoundError","ValidationError","inArray","PermissionName","AbstractEntityService","appendQueryConditions","decodeQuery","roleAttributeSchema","RoleAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionNames","ROLE_READ","ROLE_UPDATE","ROLE_DELETE","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","compiled","compile","verdict","condition","findMany","data","entities","meta","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","id","findOneBy","create","preEvaluate","validateJoinColumns","has","realmId","role","evaluate","value","save","update","roleId","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/role-attribute/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { inArray } from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { RoleAttribute } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRoleAttributeRepository, IRoleAttributeService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { roleAttributeSchema } from './schema.ts';\n\nexport type RoleAttributeServiceContext = {\n repository: IRoleAttributeRepository;\n reservedNames?: ReadonlySet<string>;\n};\n\nexport class RoleAttributeService extends AbstractEntityService implements IRoleAttributeService {\n protected repository: IRoleAttributeRepository;\n\n protected reservedNames: ReadonlySet<string>;\n\n constructor(ctx: RoleAttributeServiceContext) {\n super();\n this.repository = ctx.repository;\n this.reservedNames = ctx.reservedNames ?? new Set();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<RoleAttribute>> {\n const permissionNames = [\n PermissionName.ROLE_READ,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n ];\n\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n\n let parsed = await decodeQuery(query, { schema: roleAttributeSchema, actor });\n\n // Compile the read permissions into a row condition (#3286 phase 3): the\n // authorization runs as WHERE, so pagination and totals stay exact. A\n // non-expressible policy falls back to the per-row loop below.\n const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });\n if (compiled.verdict === 'deny') {\n // no row can pass — a constant-false condition keeps the meta shape\n parsed = appendQueryConditions(parsed, inArray('id', []));\n } else if (compiled.verdict === 'conditional') {\n parsed = appendQueryConditions(parsed, compiled.condition);\n }\n\n if (compiled.verdict !== 'post') {\n return this.repository.findMany(parsed);\n }\n\n const {\n data: entities,\n meta,\n } = await this.repository.findMany(parsed);\n\n const data: RoleAttribute[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.ROLE_READ,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n ],\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n data.push(entity);\n } catch {\n total--;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<RoleAttribute> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.ROLE_READ,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.ROLE_READ,\n PermissionName.ROLE_UPDATE,\n PermissionName.ROLE_DELETE,\n ],\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<RoleAttribute> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n await this.repository.validateJoinColumns(data);\n\n if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n throw new ValidationError(`The role-attribute name '${data.name}' collides with a Role entity column.`);\n }\n\n data.realmId = data.role.realmId;\n\n const entity = this.repository.create(data);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value },\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<RoleAttribute> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n await this.repository.validateJoinColumns(data);\n\n if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n throw new ValidationError(`The role-attribute name '${data.name}' collides with a Role entity column.`);\n }\n\n let entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n // An attribute belongs to a fixed role; its owner (and the role-derived realmId) is\n // IMMUTABLE on update — strip both from the body. This blocks reassigning the attribute\n // to another role (which would otherwise be authorized against the new realm, not the\n // one the attribute currently lives in) and blocks a caller-supplied realmId that would\n // gate ROLE_UPDATE against a realm of their choosing. To move an attribute, delete + recreate.\n delete data.roleId;\n delete data.role;\n delete data.realmId;\n\n entity = this.repository.merge(entity, data);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value },\n ...this.resourceRealmMatch(entity),\n }),\n });\n\n await this.repository.save(entity);\n\n return entity;\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<RoleAttribute> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;AAuBA,IAAaU,uBAAb,cAA0CJ,sBAAAA;CAC5BK;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMC,kBAAkB;GACpBb,eAAec;GACfd,eAAee;GACff,eAAegB;EAClB;EAED,MAAMJ,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAEzE,IAAIO,SAAS,MAAMjB,YAAYQ,OAAO;GAAEU,QAAQjB;GAAqBQ;EAAM,CAAA;EAK3E,MAAMU,WAAW,MAAMV,MAAMK,oBAAoBM,QAAQ,EAAEJ,MAAMN,gBAAgB,CAAA;EACjF,IAAIS,SAASE,YAAY,QAErBJ,SAASlB,sBAAsBkB,QAAQrB,QAAQ,MAAM,CAAA,CAAE,CAAA;OACpD,IAAIuB,SAASE,YAAY,eAC5BJ,SAASlB,sBAAsBkB,QAAQE,SAASG,SAAS;EAG7D,IAAIH,SAASE,YAAY,QACrB,OAAO,KAAKlB,WAAWoB,SAASN,MAAAA;EAGpC,MAAM,EACFO,MAAMC,UACNC,SACA,MAAM,KAAKvB,WAAWoB,SAASN,MAAAA;EAEnC,MAAMO,OAAwB,CAAA;EAC9B,IAAI,EAAEG,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UACjB,IAAI;GACA,MAAMhB,MAAMK,oBAAoBe,cAAc;IAC1Cb,MAAM;KACFnB,eAAec;KACfd,eAAee;KACff,eAAegB;IAClB;IACDW,MAAM/B,iBAAiB;MAAGD,kBAAkBsC,aAAaF;KAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;IAAQ,CAAA;GACxG,CAAA;GACAJ,KAAKQ,KAAKJ,MAAAA;EACd,QAAQ;GACJD;EACJ;EAGJ,OAAO;GACHH;GACAE,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,IACAzB,OACsB;EACtB,MAAMA,MAAMK,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFnB,eAAec;GACfd,eAAee;GACff,eAAegB;EAClB,EACL,CAAA;EAEA,MAAMe,SAAS,MAAM,KAAKzB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACN,QACD,MAAM,IAAIlC,oBAAAA;EAGd,MAAMe,MAAMK,oBAAoBe,cAAc;GAC1Cb,MAAM;IACFnB,eAAec;IACfd,eAAee;IACff,eAAegB;GAClB;GACDW,MAAM/B,iBAAiB;KAAGD,kBAAkBsC,aAAaF;IAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMQ,OACFZ,MACAf,OACsB;EACtB,MAAMA,MAAMK,oBAAoBuB,YAAY,EAAErB,MAAMnB,eAAee,YAAY,CAAA;EAE/E,MAAM,KAAKT,WAAWmC,oBAAoBd,IAAAA;EAE1C,IAAI,OAAOA,KAAKR,SAAS,YAAY,KAAKZ,cAAcmC,IAAIf,KAAKR,IAAI,GACjE,MAAM,IAAIrB,gBAAgB,4BAA4B6B,KAAKR,KAAK,sCAAsC;EAG1GQ,KAAKgB,UAAUhB,KAAKiB,KAAKD;EAEzB,MAAMZ,SAAS,KAAKzB,WAAWiC,OAAOZ,IAAAA;EAEtC,MAAMf,MAAMK,oBAAoB4B,SAAS;GACrC1B,MAAMnB,eAAee;GACrBY,MAAM/B,iBAAiB;KAClBD,kBAAkBsC,aAAa,GAAGN,KAAKR,OAAOQ,KAAKmB,MAAM;IAC1D,GAAG,KAAKZ,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKzB,WAAWyC,KAAKhB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMiB,OACFX,IACAV,MACAf,OACsB;EACtB,MAAMA,MAAMK,oBAAoBuB,YAAY,EAAErB,MAAMnB,eAAee,YAAY,CAAA;EAE/E,MAAM,KAAKT,WAAWmC,oBAAoBd,IAAAA;EAE1C,IAAI,OAAOA,KAAKR,SAAS,YAAY,KAAKZ,cAAcmC,IAAIf,KAAKR,IAAI,GACjE,MAAM,IAAIrB,gBAAgB,4BAA4B6B,KAAKR,KAAK,sCAAsC;EAG1G,IAAIY,SAAS,MAAM,KAAKzB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EAClD,IAAI,CAACN,QACD,MAAM,IAAIlC,oBAAAA;EAQd,OAAO8B,KAAKsB;EACZ,OAAOtB,KAAKiB;EACZ,OAAOjB,KAAKgB;EAEZZ,SAAS,KAAKzB,WAAW4C,MAAMnB,QAAQJ,IAAAA;EAEvC,MAAMf,MAAMK,oBAAoB4B,SAAS;GACrC1B,MAAMnB,eAAee;GACrBY,MAAM/B,iBAAiB;KAClBD,kBAAkBsC,aAAa,GAAGF,OAAOZ,OAAOY,OAAOe,MAAM;IAC9D,GAAG,KAAKZ,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKzB,WAAWyC,KAAKhB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMoB,OACFd,IACAzB,OACsB;EACtB,MAAMA,MAAMK,oBAAoBuB,YAAY,EAAErB,MAAMnB,eAAee,YAAY,CAAA;EAE/E,MAAMgB,SAAS,MAAM,KAAKzB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACN,QACD,MAAM,IAAIlC,oBAAAA;EAGd,MAAMe,MAAMK,oBAAoB4B,SAAS;GACrC1B,MAAMnB,eAAee;GACrBY,MAAM/B,iBAAiB;KAAGD,kBAAkBsC,aAAaF;IAAQ,GAAG,KAAKG,mBAAmBH,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEM,IAAIe,aAAarB;EACzB,MAAM,KAAKzB,WAAW+C,OAAOtB,MAAAA;EAC7BA,OAAOM,KAAKe;EAEZ,OAAOrB;CACX;AACJ"}

package/dist/core/entities/role-permission/schema.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","role","ROLE","permission","PERMISSION","rolePermissionSchema","name","ROLE_PERMISSION","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/role-permission/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { RolePermission } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { role: EntityType.ROLE, permission: EntityType.PERMISSION };\n\nexport const rolePermissionSchema = defineSchema<RolePermission>({\n name: EntityType.ROLE_PERMISSION,\n // see user-role schema — explicit root projection for include= decodes\n fields: {\n default: [\n 'id',\n 'policyId',\n 'realmScope',\n 'permissionId',\n 'permissionRealmId',\n 'roleId',\n 'roleRealmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['roleId', 'permissionId'] },\n relations: { allowed: ['role', 'permission'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,YAAYL,WAAWM;AAAW;AAEjF,MAAaC,uBAAuBR,aAA6B;CAC7DS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;~~GAER~~;CACAC,SAAS,EAAEC,SAAS,CAAC,UAAU,~~cAAA~~,~~EAAgB~~;CAC/CC,WAAW;EAAED,SAAS,CAAC,QAAQ,~~YAAA~~;~~EAAeE~~,UAAUd,wBAAwBC,aAAAA;CAAe;CAC/Fc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;~~GAAa~~;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
1	+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","role","ROLE","permission","PERMISSION","rolePermissionSchema","name","ROLE_PERMISSION","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/role-permission/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { RolePermission } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { role: EntityType.ROLE, permission: EntityType.PERMISSION };\n\nexport const rolePermissionSchema = defineSchema<RolePermission>({\n name: EntityType.ROLE_PERMISSION,\n // see user-role schema — explicit root projection for include= decodes\n fields: {\n default: [\n 'id',\n 'policyId',\n 'realmScope',\n 'permissionId',\n 'permissionRealmId',\n 'roleId',\n 'roleRealmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['roleId', 'permissionId'] },\n relations: { allowed: ['role', 'permission'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,YAAYL,WAAWM;AAAW;AAEjF,MAAaC,uBAAuBR,aAA6B;CAC7DS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS,CAAC,UAAU,cAAe,EAAC;CAC/CC,WAAW;EAAED,SAAS,CAAC,QAAQ,YAAa;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC/Fc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/role-permission/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","RolePermissionValidator","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","decodeQuery","rolePermissionSchema","RolePermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","ROLE_PERMISSION_DELETE","ROLE_PERMISSION_READ","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","ROLE_PERMISSION_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","roleId","permissionId","permission","permissionRealmId","realmId","clientId","role","roleRealmId","identity","grant","resolveJunctionGrant","type","realmScope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","ROLE_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/role-permission/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n BuiltInPolicyType,\n RealmScope,\n definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport {\n PermissionName,\n RolePermissionValidator,\n} from '@authup/core-kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IRolePermissionRepository, IRolePermissionService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { rolePermissionSchema } from './schema.ts';\n\nexport type RolePermissionServiceContext = {\n repository: IRolePermissionRepository;\n permissionRepository: IEntityRepository<Permission>;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class RolePermissionService extends JunctionEntityService implements IRolePermissionService {\n protected readonly ownerRealmKey = 'roleRealmId';\n\n protected repository: IRolePermissionRepository;\n\n protected permissionRepository: IEntityRepository<Permission>;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: RolePermissionValidator;\n\n constructor(ctx: RolePermissionServiceContext) {\n super();\n this.repository = ctx.repository;\n this.permissionRepository = ctx.permissionRepository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new RolePermissionValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<RolePermission>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.ROLE_PERMISSION_DELETE,\n PermissionName.ROLE_PERMISSION_READ,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: rolePermissionSchema, actor }));\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<RolePermission> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.ROLE_PERMISSION_DELETE,\n PermissionName.ROLE_PERMISSION_READ,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<RolePermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n roleId: validated.roleId,\n permissionId: validated.permissionId,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'role-permission' });\n }\n\n if (validated.permission) {\n validated.permissionRealmId = validated.permission.realmId;\n\n // Q4: the superset gate runs uniformly — no ROLE_ADMIN_NAME bypass.\n await actor.permissionEvaluator.preEvaluate({\n name: validated.permission.name,\n realmId: validated.permission.realmId,\n clientId: validated.permission.clientId,\n });\n }\n\n if (validated.role) {\n validated.roleRealmId = validated.role.realmId;\n }\n\n if (validated.permission && actor.identity) {\n const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n name: validated.permission.name,\n realmId: validated.permission.realmId,\n clientId: validated.permission.clientId,\n realmScope: validated.realmScope ?? RealmScope.OWN,\n },\n );\n\n applyJunctionCreateGrant(validated, grant);\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_PERMISSION_CREATE,\n // Stamp the owner (role) realm as the canonical `realmId` so the realmScope\n // factor gates this junction write against the actor's reach (no cross-realm).\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<RolePermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n // Resolve the actor's grant for this junction's permission (the existing entity only\n // carries scalar FKs — load the permission relation to derive it).\n const permission = await this.permissionRepository.findOneById(entity.permissionId);\n if (permission) {\n // Member-permission gate: an actor may only modify a binding for a permission it\n // holds (mirrors create()).\n await actor.permissionEvaluator.preEvaluate({\n name: permission.name,\n realmId: permission.realmId,\n clientId: permission.clientId,\n });\n }\n\n // No actor identity (system context) is not realm-gated here; the operation is still\n // authorized by the evaluate() below.\n let actorScope: `${RealmScope}` = RealmScope.ANY;\n let actorPolicyFree = true;\n let actorPolicyId: string \| null = null;\n if (actor.identity && permission) {\n const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n { type: actor.identity.type, id: actor.identity.data.id },\n {\n name: permission.name,\n realmId: permission.realmId,\n clientId: permission.clientId,\n realmScope: validated.realmScope ?? entity.realmScope,\n },\n );\n actorScope = grant.realmScope;\n actorPolicyFree = !grant.policy;\n actorPolicyId = grant.policy ? grant.policy.id : null;\n } else if (actor.identity) {\n actorScope = RealmScope.OWN;\n }\n\n const updateData = buildJunctionUpdateData({\n data: validated,\n existingScope: entity.realmScope,\n actorScope,\n actorPolicyFree,\n actorPolicyId,\n });\n\n await this.repository.validateJoinColumns(updateData);\n\n const merged = this.repository.merge(entity, updateData);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_PERMISSION_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n }),\n });\n\n return this.repository.save(merged);\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<RolePermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_PERMISSION_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAiCA,IAAaa,wBAAb,cAA2CH,sBAAAA;CACpBI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIX,wBAAAA;CACzB;CAEA,MAAMa,QACFC,OACAC,OACuD;EACvD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFnB,eAAeoB,wBACfpB,eAAeqB,oBAAAA,EAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYU,OAAO;GAAEQ,QAAQjB;GAAsBU;EAAM,CAAA,CAAA;CACnG;CAEA,MAAMQ,OACFC,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFnB,eAAeoB,wBACfpB,eAAeqB,oBAAAA,EAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,OAAO4B;CACX;CAEA,MAAME,OACFC,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMnB,eAAe+B,uBAAuB,CAAA;EAE1F,MAAMC,YAAY,MAAM,KAAKpB,UAAUqB,IAAIJ,MAAM,EAAEK,OAAOnC,eAAeoC,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,QAAQN,UAAUM;GAClBC,cAAcP,UAAUO;EAC5B,CAAA,GAEI,MAAM,IAAI1C,oBAAoB,EAAE6B,QAAQ,kBAAkB,CAAA;EAG9D,IAAIM,UAAUQ,YAAY;GACtBR,UAAUS,oBAAoBT,UAAUQ,WAAWE;GAGnD,MAAM1B,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMa,UAAUQ,WAAWrB;IAC3BuB,SAASV,UAAUQ,WAAWE;IAC9BC,UAAUX,UAAUQ,WAAWG;GACnC,CAAA;EACJ;EAEA,IAAIX,UAAUY,MACVZ,UAAUa,cAAcb,UAAUY,KAAKF;EAG3C,IAAIV,UAAUQ,cAAcxB,MAAM8B,UAc9B5C,yBAAyB8B,WAAWe,MAbhB,KAAKpC,2BAA2BqC,qBAChD;GACIC,MAAMjC,MAAM8B,SAASG;GACrBxB,IAAIT,MAAM8B,SAASjB,KAAKJ;EAC5B,GACA;GACIN,MAAMa,UAAUQ,WAAWrB;GAC3BuB,SAASV,UAAUQ,WAAWE;GAC9BC,UAAUX,UAAUQ,WAAWG;GAC/BO,YAAYlB,UAAUkB,cAAcvD,WAAWwD;EACnD,CAAA,CAGgCJ;EAGxC,MAAM/B,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAe+B;GAGrBF,MAAMjC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBtB,SAAAA;KACvDtC,kBAAkB6D,cAAc,KAAKC,sBAAsBxB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAWgD,KAAK/B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMgC,OACFjC,IACAI,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMnB,eAAe2D,uBAAuB,CAAA;EAE1F,MAAMjC,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMkC,YAAY,MAAM,KAAKpB,UAAUqB,IAAIJ,MAAM,EAAEK,OAAOnC,eAAe6D,OAAO,CAAA;EAIhF,MAAMpB,aAAa,MAAM,KAAK9B,qBAAqBmD,YAAYnC,OAAOa,YAAY;EAClF,IAAIC,YAGA,MAAMxB,MAAMC,oBAAoBa,YAAY;GACxCX,MAAMqB,WAAWrB;GACjBuB,SAASF,WAAWE;GACpBC,UAAUH,WAAWG;EACzB,CAAA;EAKJ,IAAImB,aAA8BnE,WAAWoE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAIjD,MAAM8B,YAAYN,YAAY;GAC9B,MAAMO,QAAQ,MAAM,KAAKpC,2BAA2BqC,qBAChD;IAAEC,MAAMjC,MAAM8B,SAASG;IAAMxB,IAAIT,MAAM8B,SAASjB,KAAKJ;GAAG,GACxD;IACIN,MAAMqB,WAAWrB;IACjBuB,SAASF,WAAWE;IACpBC,UAAUH,WAAWG;IACrBO,YAAYlB,UAAUkB,cAAcxB,OAAOwB;GAC/C,CAAA;GAEJY,aAAaf,MAAMG;GACnBc,kBAAkB,CAACjB,MAAMmB;GACzBD,gBAAgBlB,MAAMmB,SAASnB,MAAMmB,OAAOzC,KAAK;EACrD,OAAO,IAAIT,MAAM8B,UACbgB,aAAanE,WAAWwD;EAG5B,MAAMgB,aAAahE,wBAAwB;GACvC0B,MAAMG;GACNoC,eAAe1C,OAAOwB;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAKxD,WAAW2B,oBAAoB+B,UAAAA;EAE1C,MAAME,SAAS,KAAK5D,WAAW6D,MAAM5C,QAAQyC,UAAAA;EAE7C,MAAMnD,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAe2D;GACrB9B,MAAMjC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBe,MAAAA;KACvD3E,kBAAkB6D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK5D,WAAWgD,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACF9C,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMnB,eAAeoB,uBAAuB,CAAA;EAE1F,MAAMM,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAeoB;GACrBS,MAAMjC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmB5B,MAAAA;KACvDhC,kBAAkB6D,cAAc,KAAKC,sBAAsB9B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI+C,aAAa9C;EACzB,MAAM,KAAKjB,WAAWgE,OAAO/C,MAAAA;EAC7BA,OAAOD,KAAK+C;EAEZ,OAAO9C;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","RolePermissionValidator","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","decodeQuery","rolePermissionSchema","RolePermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","ROLE_PERMISSION_DELETE","ROLE_PERMISSION_READ","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","ROLE_PERMISSION_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","roleId","permissionId","permission","permissionRealmId","realmId","clientId","role","roleRealmId","identity","grant","resolveJunctionGrant","type","realmScope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","ROLE_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/role-permission/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n BuiltInPolicyType,\n RealmScope,\n definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport {\n PermissionName,\n RolePermissionValidator,\n} from '@authup/core-kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IRolePermissionRepository, IRolePermissionService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { rolePermissionSchema } from './schema.ts';\n\nexport type RolePermissionServiceContext = {\n repository: IRolePermissionRepository;\n permissionRepository: IEntityRepository<Permission>;\n identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class RolePermissionService extends JunctionEntityService implements IRolePermissionService {\n protected readonly ownerRealmKey = 'roleRealmId';\n\n protected repository: IRolePermissionRepository;\n\n protected permissionRepository: IEntityRepository<Permission>;\n\n protected identityPermissionProvider: IIdentityPermissionProvider;\n\n protected validator: RolePermissionValidator;\n\n constructor(ctx: RolePermissionServiceContext) {\n super();\n this.repository = ctx.repository;\n this.permissionRepository = ctx.permissionRepository;\n this.identityPermissionProvider = ctx.identityPermissionProvider;\n this.validator = new RolePermissionValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<RolePermission>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.ROLE_PERMISSION_DELETE,\n PermissionName.ROLE_PERMISSION_READ,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: rolePermissionSchema, actor }));\n }\n\n async getOne(\n id: string,\n actor: ActorContext,\n ): Promise<RolePermission> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.ROLE_PERMISSION_DELETE,\n PermissionName.ROLE_PERMISSION_READ,\n ],\n });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<RolePermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_CREATE });\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n await this.repository.validateJoinColumns(validated);\n\n const existing = await this.repository.findOneBy({\n roleId: validated.roleId,\n permissionId: validated.permissionId,\n });\n if (existing) {\n throw new EntityConflictError({ entity: 'role-permission' });\n }\n\n if (validated.permission) {\n validated.permissionRealmId = validated.permission.realmId;\n\n // Q4: the superset gate runs uniformly — no ROLE_ADMIN_NAME bypass.\n await actor.permissionEvaluator.preEvaluate({\n name: validated.permission.name,\n realmId: validated.permission.realmId,\n clientId: validated.permission.clientId,\n });\n }\n\n if (validated.role) {\n validated.roleRealmId = validated.role.realmId;\n }\n\n if (validated.permission && actor.identity) {\n const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n {\n type: actor.identity.type,\n id: actor.identity.data.id,\n },\n {\n name: validated.permission.name,\n realmId: validated.permission.realmId,\n clientId: validated.permission.clientId,\n realmScope: validated.realmScope ?? RealmScope.OWN,\n },\n );\n\n applyJunctionCreateGrant(validated, grant);\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_PERMISSION_CREATE,\n // Stamp the owner (role) realm as the canonical `realmId` so the realmScope\n // factor gates this junction write against the actor's reach (no cross-realm).\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n }),\n });\n\n let entity = this.repository.create(validated);\n entity = await this.repository.save(entity);\n\n return entity;\n }\n\n async update(\n id: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<RolePermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_UPDATE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n // Resolve the actor's grant for this junction's permission (the existing entity only\n // carries scalar FKs — load the permission relation to derive it).\n const permission = await this.permissionRepository.findOneById(entity.permissionId);\n if (permission) {\n // Member-permission gate: an actor may only modify a binding for a permission it\n // holds (mirrors create()).\n await actor.permissionEvaluator.preEvaluate({\n name: permission.name,\n realmId: permission.realmId,\n clientId: permission.clientId,\n });\n }\n\n // No actor identity (system context) is not realm-gated here; the operation is still\n // authorized by the evaluate() below.\n let actorScope: `${RealmScope}` = RealmScope.ANY;\n let actorPolicyFree = true;\n let actorPolicyId: string \| null = null;\n if (actor.identity && permission) {\n const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n { type: actor.identity.type, id: actor.identity.data.id },\n {\n name: permission.name,\n realmId: permission.realmId,\n clientId: permission.clientId,\n realmScope: validated.realmScope ?? entity.realmScope,\n },\n );\n actorScope = grant.realmScope;\n actorPolicyFree = !grant.policy;\n actorPolicyId = grant.policy ? grant.policy.id : null;\n } else if (actor.identity) {\n actorScope = RealmScope.OWN;\n }\n\n const updateData = buildJunctionUpdateData({\n data: validated,\n existingScope: entity.realmScope,\n actorScope,\n actorPolicyFree,\n actorPolicyId,\n });\n\n await this.repository.validateJoinColumns(updateData);\n\n const merged = this.repository.merge(entity, updateData);\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_PERMISSION_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n }),\n });\n\n return this.repository.save(merged);\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<RolePermission> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.ROLE_PERMISSION_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAiCA,IAAaa,wBAAb,cAA2CH,sBAAAA;CACpBI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIX,wBAAAA;CACzB;CAEA,MAAMa,QACFC,OACAC,OACuD;EACvD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFnB,eAAeoB,wBACfpB,eAAeqB,oBAClB,EACL,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYU,OAAO;GAAEQ,QAAQjB;GAAsBU;EAAM,CAAA,CAAA;CACnG;CAEA,MAAMQ,OACFC,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFnB,eAAeoB,wBACfpB,eAAeqB,oBAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,OAAO4B;CACX;CAEA,MAAME,OACFC,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMnB,eAAe+B,uBAAuB,CAAA;EAE1F,MAAMC,YAAY,MAAM,KAAKpB,UAAUqB,IAAIJ,MAAM,EAAEK,OAAOnC,eAAeoC,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,QAAQN,UAAUM;GAClBC,cAAcP,UAAUO;EAC5B,CAAA,GAEI,MAAM,IAAI1C,oBAAoB,EAAE6B,QAAQ,kBAAkB,CAAA;EAG9D,IAAIM,UAAUQ,YAAY;GACtBR,UAAUS,oBAAoBT,UAAUQ,WAAWE;GAGnD,MAAM1B,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMa,UAAUQ,WAAWrB;IAC3BuB,SAASV,UAAUQ,WAAWE;IAC9BC,UAAUX,UAAUQ,WAAWG;GACnC,CAAA;EACJ;EAEA,IAAIX,UAAUY,MACVZ,UAAUa,cAAcb,UAAUY,KAAKF;EAG3C,IAAIV,UAAUQ,cAAcxB,MAAM8B,UAc9B5C,yBAAyB8B,WAAWe,MAbhB,KAAKpC,2BAA2BqC,qBAChD;GACIC,MAAMjC,MAAM8B,SAASG;GACrBxB,IAAIT,MAAM8B,SAASjB,KAAKJ;EAC5B,GACA;GACIN,MAAMa,UAAUQ,WAAWrB;GAC3BuB,SAASV,UAAUQ,WAAWE;GAC9BC,UAAUX,UAAUQ,WAAWG;GAC/BO,YAAYlB,UAAUkB,cAAcvD,WAAWwD;EACnD,CAAA,CAGgCJ;EAGxC,MAAM/B,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAe+B;GAGrBF,MAAMjC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBtB,SAAAA;KACvDtC,kBAAkB6D,cAAc,KAAKC,sBAAsBxB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAWgD,KAAK/B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMgC,OACFjC,IACAI,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMnB,eAAe2D,uBAAuB,CAAA;EAE1F,MAAMjC,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMkC,YAAY,MAAM,KAAKpB,UAAUqB,IAAIJ,MAAM,EAAEK,OAAOnC,eAAe6D,OAAO,CAAA;EAIhF,MAAMpB,aAAa,MAAM,KAAK9B,qBAAqBmD,YAAYnC,OAAOa,YAAY;EAClF,IAAIC,YAGA,MAAMxB,MAAMC,oBAAoBa,YAAY;GACxCX,MAAMqB,WAAWrB;GACjBuB,SAASF,WAAWE;GACpBC,UAAUH,WAAWG;EACzB,CAAA;EAKJ,IAAImB,aAA8BnE,WAAWoE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAIjD,MAAM8B,YAAYN,YAAY;GAC9B,MAAMO,QAAQ,MAAM,KAAKpC,2BAA2BqC,qBAChD;IAAEC,MAAMjC,MAAM8B,SAASG;IAAMxB,IAAIT,MAAM8B,SAASjB,KAAKJ;GAAG,GACxD;IACIN,MAAMqB,WAAWrB;IACjBuB,SAASF,WAAWE;IACpBC,UAAUH,WAAWG;IACrBO,YAAYlB,UAAUkB,cAAcxB,OAAOwB;GAC/C,CAAA;GAEJY,aAAaf,MAAMG;GACnBc,kBAAkB,CAACjB,MAAMmB;GACzBD,gBAAgBlB,MAAMmB,SAASnB,MAAMmB,OAAOzC,KAAK;EACrD,OAAO,IAAIT,MAAM8B,UACbgB,aAAanE,WAAWwD;EAG5B,MAAMgB,aAAahE,wBAAwB;GACvC0B,MAAMG;GACNoC,eAAe1C,OAAOwB;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAKxD,WAAW2B,oBAAoB+B,UAAAA;EAE1C,MAAME,SAAS,KAAK5D,WAAW6D,MAAM5C,QAAQyC,UAAAA;EAE7C,MAAMnD,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAe2D;GACrB9B,MAAMjC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBe,MAAAA;KACvD3E,kBAAkB6D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK5D,WAAWgD,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACF9C,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMnB,eAAeoB,uBAAuB,CAAA;EAE1F,MAAMM,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAeoB;GACrBS,MAAMjC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmB5B,MAAAA;KACvDhC,kBAAkB6D,cAAc,KAAKC,sBAAsB9B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI+C,aAAa9C;EACzB,MAAM,KAAKjB,WAAWgE,OAAO/C,MAAAA;EAC7BA,OAAOD,KAAK+C;EAEZ,OAAO9C;CACX;AACJ"}

package/dist/core/entities/scope/schema.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","scopeSchema","name","SCOPE","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/scope/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Scope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const scopeSchema = defineSchema<Scope>({\n name: EntityType.SCOPE,\n fields: {\n allowed: [\n 'id',\n 'builtIn',\n 'name',\n 'displayName',\n 'description',\n 'realmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['id', 'builtIn', 'name', 'realmId'] },\n relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'name', 'updatedAt', 'createdAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,cAAcN,aAAoB;CAC3CO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;~~GAER~~;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAW;EAAQ;~~GAAW~~;CACzDE,WAAW;EAAEF,SAAS,CAAC,~~OAAA~~;~~EAAUG~~,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAa;~~GAAa~~;CAC1DK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}
1	+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","scopeSchema","name","SCOPE","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/scope/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Scope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const scopeSchema = defineSchema<Scope>({\n name: EntityType.SCOPE,\n fields: {\n allowed: [\n 'id',\n 'builtIn',\n 'name',\n 'displayName',\n 'description',\n 'realmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['id', 'builtIn', 'name', 'realmId'] },\n relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'name', 'updatedAt', 'createdAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,cAAcN,aAAoB;CAC3CO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAW;EAAQ;CAAU,EAAC;CACzDE,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAa;CAAY,EAAC;CAC1DK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}

package/dist/core/entities/scope/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","PermissionName","ScopeValidator","AbstractEntityService","decodeQuery","scopeSchema","ScopeService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","SCOPE_READ","SCOPE_UPDATE","SCOPE_DELETE","findMany","schema","getOne","idOrName","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","SCOPE_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","merge","created","identity","getActorRealmId","resourceRealmMatch","delete","entityId","remove"],"sources":["../../../../src/core/entities/scope/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport {\n PermissionName,\n ScopeValidator,\n} from '@authup/core-kit';\nimport type { Scope } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IScopeRepository, IScopeService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { scopeSchema } from './schema.ts';\n\nexport type ScopeServiceContext = {\n repository: IScopeRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ScopeService extends AbstractEntityService implements IScopeService {\n protected repository: IScopeRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ScopeValidator;\n\n constructor(ctx: ScopeServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ScopeValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Scope>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.SCOPE_READ,\n PermissionName.SCOPE_UPDATE,\n PermissionName.SCOPE_DELETE,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: scopeSchema, actor }));\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n ): Promise<Scope> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.SCOPE_READ,\n PermissionName.SCOPE_UPDATE,\n PermissionName.SCOPE_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneByIdOrName(idOrName);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Scope> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Scope> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Scope,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realmId === 'string' ?\n await this.realmRepository.resolve(data.realmId) :\n undefined;\n\n let entity: Scope \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realmId = realm.id;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n if (entity) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_UPDATE });\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n await this.repository.validateJoinColumns(validated);\n\n if (entity) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SCOPE_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n }),\n });\n\n await this.repository.checkUniqueness(validated, entity);\n\n entity = this.repository.merge(entity, validated);\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!isPropertySet(validated, 'realmId') && actor.identity) {\n validated.realmId = this.getActorRealmId(actor) \|\| null;\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SCOPE_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n\n await this.repository.checkUniqueness(validated);\n\n entity = this.repository.create(validated);\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Scope> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SCOPE_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;AA2BA,IAAaW,eAAb,cAAkCH,sBAAAA;CACpBI;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,eAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC8C;EAC9C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMhB,YAAYQ,OAAO;GAAES,QAAQhB;GAAaQ;EAAM,CAAA,CAAA;CAC1F;CAEA,MAAMS,OACFC,UACAV,OACc;EACd,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;IAEvB,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIxB,oBAAAA;EAGd,OAAOwB;CACX;CAEA,MAAME,OACFC,MACAd,OACc;EACd,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMd,KAAAA;EACpD,OAAOW;CACX;CAEA,MAAMM,OACFP,UACAI,MACAd,OACc;EACd,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKL,UAAUI,MAAMd,OAAO,EAAEkB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFL,UACAI,MACAd,OACAmB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOP,KAAKQ,YAAY,WAClC,MAAM,KAAK3B,gBAAgB4B,QAAQT,KAAKQ,OAAO,IAC/CN,KAAAA;EAEJ,IAAIL;EACJ,IAAID,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAItC,OAAOwB,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMrB,OAAOO;GAGjB,IAAIW,OACAG,MAAMF,UAAUD,MAAMI;GAG1Bd,SAAS,MAAM,KAAKjB,WAAWgC,UAAUF,KAAAA;GACzC,IAAI,CAACb,UAAUQ,QAAQD,YACnB,MAAM,IAAI/B,oBAAAA;EAElB,OAAO,IAAIgC,QAAQD,YACf,MAAM,IAAI/B,oBAAAA;EAGd,IAAIwB,QAAQ;GACR,MAAMX,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMf,eAAeiB,aAAa,CAAA;GAChFe,QAAQpC,eAAe4C;EAC3B,OAAO;GACH,MAAM5B,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMf,eAAeyC,aAAa,CAAA;GAChFT,QAAQpC,eAAe8C;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKnC,UAAUoC,IAAIlB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK1B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIpB,QAAQ;GACR,MAAMX,MAAMC,oBAAoBiC,SAAS;IACrC/B,MAAMf,eAAeiB;IACrBS,MAAM/B,iBAAiB;MAClBD,kBAAkBqD,aAAa;MAC5B,GAAGxB;MACH,GAAGoB;KACP;MACCjD,kBAAkBsD,cAAcL,UAAUT,WAAWX,OAAOW,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK5B,WAAW2C,gBAAgBN,WAAWpB,MAAAA;GAEjDA,SAAS,KAAKjB,WAAW4C,MAAM3B,QAAQoB,SAAAA;GACvC,MAAM,KAAKrC,WAAWqB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA4B,SAAS;GACb;EACJ;EAEA,IAAI,CAACtD,cAAc8C,WAAW,SAAA,KAAc/B,MAAMwC,UAC9CT,UAAUT,UAAU,KAAKmB,gBAAgBzC,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMf,eAAeyC;GACrBf,MAAM/B,iBAAiB;KAAGD,kBAAkBqD,aAAaJ;IAAW,GAAG,KAAKW,mBAAmBX,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW2C,gBAAgBN,SAAAA;EAEtCpB,SAAS,KAAKjB,WAAWmB,OAAOkB,SAAAA;EAChC,MAAM,KAAKrC,WAAWqB,KAAKJ,MAAAA;EAE3B,OAAO;GACHA;GACA4B,SAAS;EACb;CACJ;CAEA,MAAMI,OACFlB,IACAzB,OACc;EACd,MAAMA,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMf,eAAekB,aAAa,CAAA;EAEhF,MAAMK,SAAS,MAAM,KAAKjB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAIxB,oBAAAA;EAGd,MAAMa,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMf,eAAekB;GACrBQ,MAAM/B,iBAAiB;KAAGD,kBAAkBqD,aAAaxB;IAAQ,GAAG,KAAK+B,mBAAmB/B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAImB,aAAajC;EACzB,MAAM,KAAKjB,WAAWmD,OAAOlC,MAAAA;EAC7BA,OAAOc,KAAKmB;EAEZ,OAAOjC;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","PermissionName","ScopeValidator","AbstractEntityService","decodeQuery","scopeSchema","ScopeService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","SCOPE_READ","SCOPE_UPDATE","SCOPE_DELETE","findMany","schema","getOne","idOrName","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","SCOPE_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","merge","created","identity","getActorRealmId","resourceRealmMatch","delete","entityId","remove"],"sources":["../../../../src/core/entities/scope/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport {\n PermissionName,\n ScopeValidator,\n} from '@authup/core-kit';\nimport type { Scope } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IScopeRepository, IScopeService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { scopeSchema } from './schema.ts';\n\nexport type ScopeServiceContext = {\n repository: IScopeRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ScopeService extends AbstractEntityService implements IScopeService {\n protected repository: IScopeRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ScopeValidator;\n\n constructor(ctx: ScopeServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ScopeValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Scope>> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.SCOPE_READ,\n PermissionName.SCOPE_UPDATE,\n PermissionName.SCOPE_DELETE,\n ],\n });\n\n return this.repository.findMany(await decodeQuery(query, { schema: scopeSchema, actor }));\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n ): Promise<Scope> {\n await actor.permissionEvaluator.preEvaluateOneOf({\n name: [\n PermissionName.SCOPE_READ,\n PermissionName.SCOPE_UPDATE,\n PermissionName.SCOPE_DELETE,\n ],\n });\n\n const entity = await this.repository.findOneByIdOrName(idOrName);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Scope> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Scope> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Scope,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realmId === 'string' ?\n await this.realmRepository.resolve(data.realmId) :\n undefined;\n\n let entity: Scope \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realmId = realm.id;\n }\n\n entity = await this.repository.findOneBy(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n if (entity) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_UPDATE });\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n await this.repository.validateJoinColumns(validated);\n\n if (entity) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SCOPE_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...validated,\n },\n [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n }),\n });\n\n await this.repository.checkUniqueness(validated, entity);\n\n entity = this.repository.merge(entity, validated);\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!isPropertySet(validated, 'realmId') && actor.identity) {\n validated.realmId = this.getActorRealmId(actor) \|\| null;\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SCOPE_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n\n await this.repository.checkUniqueness(validated);\n\n entity = this.repository.create(validated);\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Scope> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SCOPE_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;AA2BA,IAAaW,eAAb,cAAkCH,sBAAAA;CACpBI;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,eAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC8C;EAC9C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;EAClB,EACL,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMhB,YAAYQ,OAAO;GAAES,QAAQhB;GAAaQ;EAAM,CAAA,CAAA;CAC1F;CAEA,MAAMS,OACFC,UACAV,OACc;EACd,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;EAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIxB,oBAAAA;EAGd,OAAOwB;CACX;CAEA,MAAME,OACFC,MACAd,OACc;EACd,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMd,KAAAA;EACpD,OAAOW;CACX;CAEA,MAAMM,OACFP,UACAI,MACAd,OACc;EACd,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKL,UAAUI,MAAMd,OAAO,EAAEkB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFL,UACAI,MACAd,OACAmB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOP,KAAKQ,YAAY,WAClC,MAAM,KAAK3B,gBAAgB4B,QAAQT,KAAKQ,OAAO,IAC/CN,KAAAA;EAEJ,IAAIL;EACJ,IAAID,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAItC,OAAOwB,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMrB,OAAOO;GAGjB,IAAIW,OACAG,MAAMF,UAAUD,MAAMI;GAG1Bd,SAAS,MAAM,KAAKjB,WAAWgC,UAAUF,KAAAA;GACzC,IAAI,CAACb,UAAUQ,QAAQD,YACnB,MAAM,IAAI/B,oBAAAA;EAElB,OAAO,IAAIgC,QAAQD,YACf,MAAM,IAAI/B,oBAAAA;EAGd,IAAIwB,QAAQ;GACR,MAAMX,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMf,eAAeiB,aAAa,CAAA;GAChFe,QAAQpC,eAAe4C;EAC3B,OAAO;GACH,MAAM5B,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMf,eAAeyC,aAAa,CAAA;GAChFT,QAAQpC,eAAe8C;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKnC,UAAUoC,IAAIlB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK1B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIpB,QAAQ;GACR,MAAMX,MAAMC,oBAAoBiC,SAAS;IACrC/B,MAAMf,eAAeiB;IACrBS,MAAM/B,iBAAiB;MAClBD,kBAAkBqD,aAAa;MAC5B,GAAGxB;MACH,GAAGoB;KACP;MACCjD,kBAAkBsD,cAAcL,UAAUT,WAAWX,OAAOW,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK5B,WAAW2C,gBAAgBN,WAAWpB,MAAAA;GAEjDA,SAAS,KAAKjB,WAAW4C,MAAM3B,QAAQoB,SAAAA;GACvC,MAAM,KAAKrC,WAAWqB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA4B,SAAS;GACb;EACJ;EAEA,IAAI,CAACtD,cAAc8C,WAAW,SAAA,KAAc/B,MAAMwC,UAC9CT,UAAUT,UAAU,KAAKmB,gBAAgBzC,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMf,eAAeyC;GACrBf,MAAM/B,iBAAiB;KAAGD,kBAAkBqD,aAAaJ;IAAW,GAAG,KAAKW,mBAAmBX,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW2C,gBAAgBN,SAAAA;EAEtCpB,SAAS,KAAKjB,WAAWmB,OAAOkB,SAAAA;EAChC,MAAM,KAAKrC,WAAWqB,KAAKJ,MAAAA;EAE3B,OAAO;GACHA;GACA4B,SAAS;EACb;CACJ;CAEA,MAAMI,OACFlB,IACAzB,OACc;EACd,MAAMA,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMf,eAAekB,aAAa,CAAA;EAEhF,MAAMK,SAAS,MAAM,KAAKjB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAIxB,oBAAAA;EAGd,MAAMa,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMf,eAAekB;GACrBQ,MAAM/B,iBAAiB;KAAGD,kBAAkBqD,aAAaxB;IAAQ,GAAG,KAAK+B,mBAAmB/B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAImB,aAAajC;EACzB,MAAM,KAAKjB,WAAWmD,OAAOlC,MAAAA;EAC7BA,OAAOc,KAAKmB;EAEZ,OAAOjC;CACX;AACJ"}

package/dist/core/entities/session/schema.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","SESSION_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","sessionSchema","name","SESSION","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/session/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Session } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { SESSION_FILTER_KEYS } from '../../authentication/session/types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const sessionSchema = defineSchema<Session>({\n name: EntityType.SESSION,\n fields: {\n allowed: [\n 'id',\n 'sub',\n 'subKind',\n 'ipAddress',\n 'userAgent',\n 'expiresAt',\n 'refreshedAt',\n 'seenAt',\n 'createdAt',\n 'updatedAt',\n 'userId',\n 'clientId',\n 'realmId',\n ],\n },\n filters: { allowed: [...SESSION_FILTER_KEYS] },\n relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['seenAt', 'expiresAt', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;~~GAER~~;CACAC,SAAS,EAAED,SAAS,~~CAAA~~,~~GAAIT~~,~~mBAAAA~~,~~EAAqB~~;CAC7CW,WAAW;EAAEF,SAAS,CAAC,~~OAAA~~;~~EAAUG~~,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAU;EAAa;EAAa;~~GAAa~~;CACnEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}
1	+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","SESSION_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","sessionSchema","name","SESSION","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/session/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Session } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { SESSION_FILTER_KEYS } from '../../authentication/session/types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const sessionSchema = defineSchema<Session>({\n name: EntityType.SESSION,\n fields: {\n allowed: [\n 'id',\n 'sub',\n 'subKind',\n 'ipAddress',\n 'userAgent',\n 'expiresAt',\n 'refreshedAt',\n 'seenAt',\n 'createdAt',\n 'updatedAt',\n 'userId',\n 'clientId',\n 'realmId',\n ],\n },\n filters: { allowed: [...SESSION_FILTER_KEYS] },\n relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['seenAt', 'expiresAt', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS,CAAIT,GAAAA,mBAAoB,EAAC;CAC7CW,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAU;EAAa;EAAa;CAAY,EAAC;CACnEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}

package/dist/core/entities/session/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","AuthupError","EntityNotFoundError","ErrorCode","isObject","createURLCodec","and","eq","inArray","isFilter","isFilters","or","PermissionName","AbstractEntityService","SESSION_FILTER_KEYS","appendQueryConditions","decodeQuery","sessionSchema","SessionService","repository","ctx","isOwnedBy","session","actor","identity","sub","data","id","subKind","type","getMany","query","parsed","schema","canReadAll","permissionEvaluator","preEvaluate","name","SESSION_READ","e","findMany","owner","compiled","compile","verdict","ownership","scoped","condition","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","delete","SESSION_DELETE","entityId","remove","deleteMany","options","code","IDENTITY_UNAUTHORIZED","message","hasTargetFilter","deleteManyByQuery","deleteManyForSelf","currentSessionId","queryCodec","decode","hasTargetCondition","filters","value","some","child","includes","field","sessions","findAllByOwner","count","findAllByQuery","parameters"],"sources":["../../../../src/core/entities/session/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { AuthupError, EntityNotFoundError, ErrorCode } from '@authup/errors';\nimport { isObject } from '@authup/kit';\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type { ICondition } from '@rapiq/core';\nimport {\n and, \n eq, \n inArray, \n isFilter, \n isFilters, \n or,\n} from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Session } from '@authup/core-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { ISessionRepository } from '../../authentication/index.ts';\nimport { SESSION_FILTER_KEYS } from '../../authentication/index.ts';\nimport type { ISessionService, SessionDeleteManyOptions, SessionDeleteManyResult } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { sessionSchema } from './schema.ts';\n\nexport type SessionServiceContext = {\n repository: ISessionRepository,\n};\n\nexport class SessionService extends AbstractEntityService implements ISessionService {\n protected repository: ISessionRepository;\n\n constructor(ctx: SessionServiceContext) {\n super();\n this.repository = ctx.repository;\n }\n\n protected isOwnedBy(session: Session, actor: ActorContext): boolean {\n return !!actor.identity &&\n session.sub === actor.identity.data.id &&\n session.subKind === actor.identity.type;\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Session>> {\n const parsed = await decodeQuery(query, { schema: sessionSchema, actor });\n\n let canReadAll = true;\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n } catch (e) {\n if (!actor.identity) {\n throw e;\n }\n canReadAll = false;\n }\n\n if (!canReadAll) {\n // self-service: only the actor's own sessions\n return this.repository.findMany(parsed, {\n owner: {\n sub: actor.identity!.data.id,\n subKind: actor.identity!.type,\n },\n });\n }\n\n // Compile SESSION_READ into a row condition (#3286 phase 3). Own sessions\n // are always readable, so ownership composes as an OR-alternative — the\n // whole gate runs as WHERE and pagination/totals stay exact. Only a\n // non-expressible policy falls back to the per-row loop below.\n const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.SESSION_READ });\n if (compiled.verdict !== 'post') {\n const ownership = actor.identity ?\n and(eq('sub', actor.identity.data.id), eq('subKind', actor.identity.type)) :\n null;\n\n let scoped = parsed;\n if (compiled.verdict === 'deny') {\n scoped = appendQueryConditions(parsed, ownership ?? inArray('id', []));\n } else if (compiled.verdict === 'conditional') {\n scoped = appendQueryConditions(\n parsed,\n ownership ? or(ownership, compiled.condition) : compiled.condition,\n );\n }\n\n return this.repository.findMany(scoped);\n }\n\n const { data: entities, meta } = await this.repository.findMany(parsed);\n\n const data: Session[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n if (this.isOwnedBy(entity, actor)) {\n data.push(entity);\n continue;\n }\n\n try {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_READ,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total,\n },\n };\n }\n\n async getOne(id: string, actor: ActorContext): Promise<Session> {\n const entity = await this.repository.findOneById(id);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (!this.isOwnedBy(entity, actor)) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_READ,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n }\n\n return entity;\n }\n\n async delete(id: string, actor: ActorContext): Promise<Session> {\n const entity = await this.repository.findOneById(id);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (!this.isOwnedBy(entity, actor)) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n }\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n\n async deleteMany(\n actor: ActorContext,\n options: SessionDeleteManyOptions = {},\n ): Promise<SessionDeleteManyResult> {\n if (!actor.identity) {\n throw new AuthupError({ code: ErrorCode.IDENTITY_UNAUTHORIZED, message: 'Authentication required.' });\n }\n\n if (this.hasTargetFilter(options.query)) {\n return this.deleteManyByQuery(actor, options.query!);\n }\n\n return this.deleteManyForSelf(actor, options.currentSessionId);\n }\n\n /\n True when the query carries at least one recognized target filter — the\n * discriminator between the admin bulk-revoke path and self-service. An\n * unrecognized / empty filter falls through to self-service (fail-safe: a\n * typo can never trigger an unconstrained mass delete).\n \n The wire may carry either dialect (v2 expression or legacy bracket\n * filters), so the decision decodes to the rapiq IR and inspects the\n * condition tree instead of poking at the raw payload.\n /\n protected hasTargetFilter(query?: Record<string, any>): boolean {\n if (!isObject(query)) {\n return false;\n }\n\n let parsed;\n try {\n parsed = SessionService.queryCodec.decode(query);\n } catch {\n // unreadable filter — fail-safe to self-service\n return false;\n }\n\n if (!parsed) {\n return false;\n }\n\n return this.hasTargetCondition(parsed.filters);\n }\n\n protected hasTargetCondition(condition: ICondition): boolean {\n if (isFilters(condition)) {\n return condition.value.some((child) => this.hasTargetCondition(child));\n }\n\n if (isFilter(condition)) {\n return (SESSION_FILTER_KEYS as readonly string[]).includes(condition.field) &&\n condition.value !== '';\n }\n\n return false;\n }\n\n /\n Schemaless decode — dialect detection only. The allow-list is\n * enforced downstream by the repository's schema-bound decode.\n */\n protected static queryCodec = createURLCodec();\n\n protected async deleteManyForSelf(\n actor: ActorContext,\n currentSessionId?: string,\n ): Promise<SessionDeleteManyResult> {\n const sessions = await this.repository.findAllByOwner({\n sub: actor.identity!.data.id,\n subKind: actor.identity!.type,\n });\n\n let count = 0;\n for (const session of sessions) {\n if (currentSessionId && session.id === currentSessionId) {\n continue;\n }\n await this.repository.remove(session);\n count += 1;\n }\n\n return { count };\n }\n\n protected async deleteManyByQuery(\n actor: ActorContext,\n query: Record<string, any>,\n ): Promise<SessionDeleteManyResult> {\n // Gate: an actor without SESSION_DELETE cannot force-logout anyone → 403.\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n\n const sessions = await this.repository.findAllByQuery(\n await decodeQuery(query, {\n schema: sessionSchema, \n parameters: ['filters'], \n actor, \n }),\n );\n\n let count = 0;\n for (const session of sessions) {\n // Own sessions are always deletable by the actor (mirrors getMany).\n // Otherwise per-session realm-match: a realm_admin only reaches\n // sessions in its realm — cross-realm rows are skipped, not failed,\n // so filter breadth cannot escalate beyond the actor's reach.\n if (!this.isOwnedBy(session, actor)) {\n try {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: session,\n ...this.resourceRealmMatch(session),\n }),\n });\n } catch {\n continue;\n }\n }\n\n await this.repository.remove(session);\n count += 1;\n }\n\n return { count };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkCA,IAAamB,iBAAb,MAAaA,uBAAuBL,sBAAAA;CACtBM;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,YAAYL,MAAMC,SAASK;CAC3C;CAEA,MAAMC,QACFC,OACAR,OACgD;EAChD,MAAMS,SAAS,MAAMhB,YAAYe,OAAO;GAAEE,QAAQhB;GAAeM;EAAM,CAAA;EAEvE,IAAIW,aAAa;EACjB,IAAI;GACA,MAAMX,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe0B,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAAChB,MAAMC,UACP,MAAMe;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKf,WAAWqB,SAASR,QAAQ,EACpCS,OAAO;GACHhB,KAAKF,MAAMC,SAAUE,KAAKC;GAC1BC,SAASL,MAAMC,SAAUK;EAC7B,EACJ,CAAA;EAOJ,MAAMa,WAAW,MAAMnB,MAAMY,oBAAoBQ,QAAQ,EAAEN,MAAMzB,eAAe0B,aAAa,CAAA;EAC7F,IAAII,SAASE,YAAY,QAAQ;GAC7B,MAAMC,YAAYtB,MAAMC,WACpBlB,IAAIC,GAAG,OAAOgB,MAAMC,SAASE,KAAKC,EAAE,GAAGpB,GAAG,WAAWgB,MAAMC,SAASK,IAAI,CAAA,IACxE;GAEJ,IAAIiB,SAASd;GACb,IAAIU,SAASE,YAAY,QACrBE,SAAS/B,sBAAsBiB,QAAQa,aAAarC,QAAQ,MAAM,CAAA,CAAE,CAAA;QACjE,IAAIkC,SAASE,YAAY,eAC5BE,SAAS/B,sBACLiB,QACAa,YAAYlC,GAAGkC,WAAWH,SAASK,SAAS,IAAIL,SAASK,SAAS;GAI1E,OAAO,KAAK5B,WAAWqB,SAASM,MAAAA;EACpC;EAEA,MAAM,EAAEpB,MAAMsB,UAAUC,SAAS,MAAM,KAAK9B,WAAWqB,SAASR,MAAAA;EAEhE,MAAMN,OAAkB,CAAA;EACxB,IAAI,EAAEwB,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAK3B,UAAU8B,QAAQ5B,KAAAA,GAAQ;IAC/BG,KAAK0B,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAM5B,MAAMY,oBAAoBkB,SAAS;KACrChB,MAAMzB,eAAe0B;KACrBZ,MAAM1B,iBAAiB;OAClBD,kBAAkBuD,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAzB,KAAK0B,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHxB;GACAuB,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAO7B,IAAYJ,OAAuC;EAC5D,MAAM4B,SAAS,MAAM,KAAKhC,WAAWsC,YAAY9B,EAAAA;EACjD,IAAI,CAACwB,QACD,MAAM,IAAIjD,oBAAAA;EAGd,IAAI,CAAC,KAAKmB,UAAU8B,QAAQ5B,KAAAA,GAAQ;GAChC,MAAMA,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe0B,aAAa,CAAA;GAChF,MAAMf,MAAMY,oBAAoBkB,SAAS;IACrChB,MAAMzB,eAAe0B;IACrBZ,MAAM1B,iBAAiB;MAClBD,kBAAkBuD,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMO,OAAO/B,IAAYJ,OAAuC;EAC5D,MAAM4B,SAAS,MAAM,KAAKhC,WAAWsC,YAAY9B,EAAAA;EACjD,IAAI,CAACwB,QACD,MAAM,IAAIjD,oBAAAA;EAGd,IAAI,CAAC,KAAKmB,UAAU8B,QAAQ5B,KAAAA,GAAQ;GAChC,MAAMA,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe+C,eAAe,CAAA;GAClF,MAAMpC,MAAMY,oBAAoBkB,SAAS;IACrChB,MAAMzB,eAAe+C;IACrBjC,MAAM1B,iBAAiB;MAClBD,kBAAkBuD,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAExB,IAAIiC,aAAaT;EACzB,MAAM,KAAKhC,WAAW0C,OAAOV,MAAAA;EAC7BA,OAAOxB,KAAKiC;EAEZ,OAAOT;CACX;CAEA,MAAMW,WACFvC,OACAwC,UAAoC,CAAC,GACL;EAChC,IAAI,CAACxC,MAAMC,UACP,MAAM,IAAIvB,YAAY;GAAE+D,MAAM7D,UAAU8D;GAAuBC,SAAS;EAA2B,CAAA;EAGvG,IAAI,KAAKC,gBAAgBJ,QAAQhC,KAAK,GAClC,OAAO,KAAKqC,kBAAkB7C,OAAOwC,QAAQhC,KAAK;EAGtD,OAAO,KAAKsC,kBAAkB9C,OAAOwC,QAAQO,gBAAgB;CACjE;;;;;;;;;;IAYA,gBAA0BvC,OAAsC;EAC5D,IAAI,CAAC3B,SAAS2B,KAAAA,GACV,OAAO;EAGX,IAAIC;EACJ,IAAI;GACAA,SAASd,eAAeqD,WAAWC,OAAOzC,KAAAA;EAC9C,QAAQ;GAEJ,OAAO;EACX;EAEA,IAAI,CAACC,QACD,OAAO;EAGX,OAAO,KAAKyC,mBAAmBzC,OAAO0C,OAAO;CACjD;CAEUD,mBAAmB1B,WAAgC;EACzD,IAAIrC,UAAUqC,SAAAA,GACV,OAAOA,UAAU4B,MAAMC,MAAMC,UAAU,KAAKJ,mBAAmBI,KAAAA,CAAAA;EAGnE,IAAIpE,SAASsC,SAAAA,GACT,OAAO,oBAA2C+B,SAAS/B,UAAUgC,KAAK,KACtEhC,UAAU4B,UAAU;EAG5B,OAAO;CACX;;;;IAMA,OAAiBJ,aAAalE,eAAAA;CAE9B,MAAgBgE,kBACZ9C,OACA+C,kBACgC;EAChC,MAAMU,WAAW,MAAM,KAAK7D,WAAW8D,eAAe;GAClDxD,KAAKF,MAAMC,SAAUE,KAAKC;GAC1BC,SAASL,MAAMC,SAAUK;EAC7B,CAAA;EAEA,IAAIqD,QAAQ;EACZ,KAAK,MAAM5D,WAAW0D,UAAU;GAC5B,IAAIV,oBAAoBhD,QAAQK,OAAO2C,kBACnC;GAEJ,MAAM,KAAKnD,WAAW0C,OAAOvC,OAAAA;GAC7B4D,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;CAEA,MAAgBd,kBACZ7C,OACAQ,OACgC;EAEhC,MAAMR,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe+C,eAAe,CAAA;EAElF,MAAMqB,WAAW,MAAM,KAAK7D,WAAWgE,eACnC,MAAMnE,YAAYe,OAAO;GACrBE,QAAQhB;GACRmE,YAAY,CAAC,SAAA;GACb7D;EACJ,CAAA,CAAA;EAGJ,IAAI2D,QAAQ;EACZ,KAAK,MAAM5D,WAAW0D,UAAU;GAK5B,IAAI,CAAC,KAAK3D,UAAUC,SAASC,KAAAA,GACzB,IAAI;IACA,MAAMA,MAAMY,oBAAoBkB,SAAS;KACrChB,MAAMzB,eAAe+C;KACrBjC,MAAM1B,iBAAiB;OAClBD,kBAAkBuD,aAAahC;MAChC,GAAG,KAAKiC,mBAAmBjC,OAAAA;KAC/B,CAAA;IACJ,CAAA;GACJ,QAAQ;IACJ;GACJ;GAGJ,MAAM,KAAKH,WAAW0C,OAAOvC,OAAAA;GAC7B4D,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","AuthupError","EntityNotFoundError","ErrorCode","isObject","createURLCodec","and","eq","inArray","isFilter","isFilters","or","PermissionName","AbstractEntityService","SESSION_FILTER_KEYS","appendQueryConditions","decodeQuery","sessionSchema","SessionService","repository","ctx","isOwnedBy","session","actor","identity","sub","data","id","subKind","type","getMany","query","parsed","schema","canReadAll","permissionEvaluator","preEvaluate","name","SESSION_READ","e","findMany","owner","compiled","compile","verdict","ownership","scoped","condition","entities","meta","total","entity","push","evaluate","ATTRIBUTES","resourceRealmMatch","getOne","findOneById","delete","SESSION_DELETE","entityId","remove","deleteMany","options","code","IDENTITY_UNAUTHORIZED","message","hasTargetFilter","deleteManyByQuery","deleteManyForSelf","currentSessionId","queryCodec","decode","hasTargetCondition","filters","value","some","child","includes","field","sessions","findAllByOwner","count","findAllByQuery","parameters"],"sources":["../../../../src/core/entities/session/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { AuthupError, EntityNotFoundError, ErrorCode } from '@authup/errors';\nimport { isObject } from '@authup/kit';\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type { ICondition } from '@rapiq/core';\nimport {\n and, \n eq, \n inArray, \n isFilter, \n isFilters, \n or,\n} from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Session } from '@authup/core-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { ISessionRepository } from '../../authentication/index.ts';\nimport { SESSION_FILTER_KEYS } from '../../authentication/index.ts';\nimport type { ISessionService, SessionDeleteManyOptions, SessionDeleteManyResult } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { sessionSchema } from './schema.ts';\n\nexport type SessionServiceContext = {\n repository: ISessionRepository,\n};\n\nexport class SessionService extends AbstractEntityService implements ISessionService {\n protected repository: ISessionRepository;\n\n constructor(ctx: SessionServiceContext) {\n super();\n this.repository = ctx.repository;\n }\n\n protected isOwnedBy(session: Session, actor: ActorContext): boolean {\n return !!actor.identity &&\n session.sub === actor.identity.data.id &&\n session.subKind === actor.identity.type;\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Session>> {\n const parsed = await decodeQuery(query, { schema: sessionSchema, actor });\n\n let canReadAll = true;\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n } catch (e) {\n if (!actor.identity) {\n throw e;\n }\n canReadAll = false;\n }\n\n if (!canReadAll) {\n // self-service: only the actor's own sessions\n return this.repository.findMany(parsed, {\n owner: {\n sub: actor.identity!.data.id,\n subKind: actor.identity!.type,\n },\n });\n }\n\n // Compile SESSION_READ into a row condition (#3286 phase 3). Own sessions\n // are always readable, so ownership composes as an OR-alternative — the\n // whole gate runs as WHERE and pagination/totals stay exact. Only a\n // non-expressible policy falls back to the per-row loop below.\n const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.SESSION_READ });\n if (compiled.verdict !== 'post') {\n const ownership = actor.identity ?\n and(eq('sub', actor.identity.data.id), eq('subKind', actor.identity.type)) :\n null;\n\n let scoped = parsed;\n if (compiled.verdict === 'deny') {\n scoped = appendQueryConditions(parsed, ownership ?? inArray('id', []));\n } else if (compiled.verdict === 'conditional') {\n scoped = appendQueryConditions(\n parsed,\n ownership ? or(ownership, compiled.condition) : compiled.condition,\n );\n }\n\n return this.repository.findMany(scoped);\n }\n\n const { data: entities, meta } = await this.repository.findMany(parsed);\n\n const data: Session[] = [];\n let { total } = meta;\n\n for (const entity of entities) {\n if (this.isOwnedBy(entity, actor)) {\n data.push(entity);\n continue;\n }\n\n try {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_READ,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n }\n\n return {\n data,\n meta: {\n ...meta,\n total,\n },\n };\n }\n\n async getOne(id: string, actor: ActorContext): Promise<Session> {\n const entity = await this.repository.findOneById(id);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (!this.isOwnedBy(entity, actor)) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_READ });\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_READ,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n }\n\n return entity;\n }\n\n async delete(id: string, actor: ActorContext): Promise<Session> {\n const entity = await this.repository.findOneById(id);\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (!this.isOwnedBy(entity, actor)) {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: entity,\n ...this.resourceRealmMatch(entity),\n }),\n });\n }\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n\n async deleteMany(\n actor: ActorContext,\n options: SessionDeleteManyOptions = {},\n ): Promise<SessionDeleteManyResult> {\n if (!actor.identity) {\n throw new AuthupError({ code: ErrorCode.IDENTITY_UNAUTHORIZED, message: 'Authentication required.' });\n }\n\n if (this.hasTargetFilter(options.query)) {\n return this.deleteManyByQuery(actor, options.query!);\n }\n\n return this.deleteManyForSelf(actor, options.currentSessionId);\n }\n\n /\n True when the query carries at least one recognized target filter — the\n * discriminator between the admin bulk-revoke path and self-service. An\n * unrecognized / empty filter falls through to self-service (fail-safe: a\n * typo can never trigger an unconstrained mass delete).\n \n The wire may carry either dialect (v2 expression or legacy bracket\n * filters), so the decision decodes to the rapiq IR and inspects the\n * condition tree instead of poking at the raw payload.\n /\n protected hasTargetFilter(query?: Record<string, any>): boolean {\n if (!isObject(query)) {\n return false;\n }\n\n let parsed;\n try {\n parsed = SessionService.queryCodec.decode(query);\n } catch {\n // unreadable filter — fail-safe to self-service\n return false;\n }\n\n if (!parsed) {\n return false;\n }\n\n return this.hasTargetCondition(parsed.filters);\n }\n\n protected hasTargetCondition(condition: ICondition): boolean {\n if (isFilters(condition)) {\n return condition.value.some((child) => this.hasTargetCondition(child));\n }\n\n if (isFilter(condition)) {\n return (SESSION_FILTER_KEYS as readonly string[]).includes(condition.field) &&\n condition.value !== '';\n }\n\n return false;\n }\n\n /\n Schemaless decode — dialect detection only. The allow-list is\n * enforced downstream by the repository's schema-bound decode.\n */\n protected static queryCodec = createURLCodec();\n\n protected async deleteManyForSelf(\n actor: ActorContext,\n currentSessionId?: string,\n ): Promise<SessionDeleteManyResult> {\n const sessions = await this.repository.findAllByOwner({\n sub: actor.identity!.data.id,\n subKind: actor.identity!.type,\n });\n\n let count = 0;\n for (const session of sessions) {\n if (currentSessionId && session.id === currentSessionId) {\n continue;\n }\n await this.repository.remove(session);\n count += 1;\n }\n\n return { count };\n }\n\n protected async deleteManyByQuery(\n actor: ActorContext,\n query: Record<string, any>,\n ): Promise<SessionDeleteManyResult> {\n // Gate: an actor without SESSION_DELETE cannot force-logout anyone → 403.\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SESSION_DELETE });\n\n const sessions = await this.repository.findAllByQuery(\n await decodeQuery(query, {\n schema: sessionSchema, \n parameters: ['filters'], \n actor, \n }),\n );\n\n let count = 0;\n for (const session of sessions) {\n // Own sessions are always deletable by the actor (mirrors getMany).\n // Otherwise per-session realm-match: a realm_admin only reaches\n // sessions in its realm — cross-realm rows are skipped, not failed,\n // so filter breadth cannot escalate beyond the actor's reach.\n if (!this.isOwnedBy(session, actor)) {\n try {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.SESSION_DELETE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: session,\n ...this.resourceRealmMatch(session),\n }),\n });\n } catch {\n continue;\n }\n }\n\n await this.repository.remove(session);\n count += 1;\n }\n\n return { count };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkCA,IAAamB,iBAAb,MAAaA,uBAAuBL,sBAAAA;CACtBM;CAEV,YAAYC,KAA4B;EACpC,MAAK;EACL,KAAKD,aAAaC,IAAID;CAC1B;CAEUE,UAAUC,SAAkBC,OAA8B;EAChE,OAAO,CAAC,CAACA,MAAMC,YACXF,QAAQG,QAAQF,MAAMC,SAASE,KAAKC,MACpCL,QAAQM,YAAYL,MAAMC,SAASK;CAC3C;CAEA,MAAMC,QACFC,OACAR,OACgD;EAChD,MAAMS,SAAS,MAAMhB,YAAYe,OAAO;GAAEE,QAAQhB;GAAeM;EAAM,CAAA;EAEvE,IAAIW,aAAa;EACjB,IAAI;GACA,MAAMX,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe0B,aAAa,CAAA;EACpF,SAASC,GAAG;GACR,IAAI,CAAChB,MAAMC,UACP,MAAMe;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKf,WAAWqB,SAASR,QAAQ,EACpCS,OAAO;GACHhB,KAAKF,MAAMC,SAAUE,KAAKC;GAC1BC,SAASL,MAAMC,SAAUK;EAC7B,EACJ,CAAA;EAOJ,MAAMa,WAAW,MAAMnB,MAAMY,oBAAoBQ,QAAQ,EAAEN,MAAMzB,eAAe0B,aAAa,CAAA;EAC7F,IAAII,SAASE,YAAY,QAAQ;GAC7B,MAAMC,YAAYtB,MAAMC,WACpBlB,IAAIC,GAAG,OAAOgB,MAAMC,SAASE,KAAKC,EAAE,GAAGpB,GAAG,WAAWgB,MAAMC,SAASK,IAAI,CAAA,IACxE;GAEJ,IAAIiB,SAASd;GACb,IAAIU,SAASE,YAAY,QACrBE,SAAS/B,sBAAsBiB,QAAQa,aAAarC,QAAQ,MAAM,CAAA,CAAE,CAAA;QACjE,IAAIkC,SAASE,YAAY,eAC5BE,SAAS/B,sBACLiB,QACAa,YAAYlC,GAAGkC,WAAWH,SAASK,SAAS,IAAIL,SAASK,SAAS;GAI1E,OAAO,KAAK5B,WAAWqB,SAASM,MAAAA;EACpC;EAEA,MAAM,EAAEpB,MAAMsB,UAAUC,SAAS,MAAM,KAAK9B,WAAWqB,SAASR,MAAAA;EAEhE,MAAMN,OAAkB,CAAA;EACxB,IAAI,EAAEwB,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IAAI,KAAK3B,UAAU8B,QAAQ5B,KAAAA,GAAQ;IAC/BG,KAAK0B,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAM5B,MAAMY,oBAAoBkB,SAAS;KACrChB,MAAMzB,eAAe0B;KACrBZ,MAAM1B,iBAAiB;OAClBD,kBAAkBuD,aAAaH;MAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAzB,KAAK0B,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHxB;GACAuB,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OAAO7B,IAAYJ,OAAuC;EAC5D,MAAM4B,SAAS,MAAM,KAAKhC,WAAWsC,YAAY9B,EAAAA;EACjD,IAAI,CAACwB,QACD,MAAM,IAAIjD,oBAAAA;EAGd,IAAI,CAAC,KAAKmB,UAAU8B,QAAQ5B,KAAAA,GAAQ;GAChC,MAAMA,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe0B,aAAa,CAAA;GAChF,MAAMf,MAAMY,oBAAoBkB,SAAS;IACrChB,MAAMzB,eAAe0B;IACrBZ,MAAM1B,iBAAiB;MAClBD,kBAAkBuD,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;CAEA,MAAMO,OAAO/B,IAAYJ,OAAuC;EAC5D,MAAM4B,SAAS,MAAM,KAAKhC,WAAWsC,YAAY9B,EAAAA;EACjD,IAAI,CAACwB,QACD,MAAM,IAAIjD,oBAAAA;EAGd,IAAI,CAAC,KAAKmB,UAAU8B,QAAQ5B,KAAAA,GAAQ;GAChC,MAAMA,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe+C,eAAe,CAAA;GAClF,MAAMpC,MAAMY,oBAAoBkB,SAAS;IACrChB,MAAMzB,eAAe+C;IACrBjC,MAAM1B,iBAAiB;MAClBD,kBAAkBuD,aAAaH;KAChC,GAAG,KAAKI,mBAAmBJ,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,MAAM,EAAExB,IAAIiC,aAAaT;EACzB,MAAM,KAAKhC,WAAW0C,OAAOV,MAAAA;EAC7BA,OAAOxB,KAAKiC;EAEZ,OAAOT;CACX;CAEA,MAAMW,WACFvC,OACAwC,UAAoC,CAAC,GACL;EAChC,IAAI,CAACxC,MAAMC,UACP,MAAM,IAAIvB,YAAY;GAAE+D,MAAM7D,UAAU8D;GAAuBC,SAAS;EAA2B,CAAA;EAGvG,IAAI,KAAKC,gBAAgBJ,QAAQhC,KAAK,GAClC,OAAO,KAAKqC,kBAAkB7C,OAAOwC,QAAQhC,KAAK;EAGtD,OAAO,KAAKsC,kBAAkB9C,OAAOwC,QAAQO,gBAAgB;CACjE;;;;;;;;;;IAYA,gBAA0BvC,OAAsC;EAC5D,IAAI,CAAC3B,SAAS2B,KAAAA,GACV,OAAO;EAGX,IAAIC;EACJ,IAAI;GACAA,SAASd,eAAeqD,WAAWC,OAAOzC,KAAAA;EAC9C,QAAQ;GAEJ,OAAO;EACX;EAEA,IAAI,CAACC,QACD,OAAO;EAGX,OAAO,KAAKyC,mBAAmBzC,OAAO0C,OAAO;CACjD;CAEUD,mBAAmB1B,WAAgC;EACzD,IAAIrC,UAAUqC,SAAAA,GACV,OAAOA,UAAU4B,MAAMC,MAAMC,UAAU,KAAKJ,mBAAmBI,KAAAA,CAAAA;EAGnE,IAAIpE,SAASsC,SAAAA,GACT,OAAO,oBAA2C+B,SAAS/B,UAAUgC,KAAK,KACtEhC,UAAU4B,UAAU;EAG5B,OAAO;CACX;;;;IAMA,OAAiBJ,aAAalE,eAAAA;CAE9B,MAAgBgE,kBACZ9C,OACA+C,kBACgC;EAChC,MAAMU,WAAW,MAAM,KAAK7D,WAAW8D,eAAe;GAClDxD,KAAKF,MAAMC,SAAUE,KAAKC;GAC1BC,SAASL,MAAMC,SAAUK;EAC7B,CAAA;EAEA,IAAIqD,QAAQ;EACZ,KAAK,MAAM5D,WAAW0D,UAAU;GAC5B,IAAIV,oBAAoBhD,QAAQK,OAAO2C,kBACnC;GAEJ,MAAM,KAAKnD,WAAW0C,OAAOvC,OAAAA;GAC7B4D,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;CAEA,MAAgBd,kBACZ7C,OACAQ,OACgC;EAEhC,MAAMR,MAAMY,oBAAoBC,YAAY,EAAEC,MAAMzB,eAAe+C,eAAe,CAAA;EAElF,MAAMqB,WAAW,MAAM,KAAK7D,WAAWgE,eACnC,MAAMnE,YAAYe,OAAO;GACrBE,QAAQhB;GACRmE,YAAY,CAAC,SAAU;GACvB7D;EACJ,CAAA,CAAA;EAGJ,IAAI2D,QAAQ;EACZ,KAAK,MAAM5D,WAAW0D,UAAU;GAK5B,IAAI,CAAC,KAAK3D,UAAUC,SAASC,KAAAA,GACzB,IAAI;IACA,MAAMA,MAAMY,oBAAoBkB,SAAS;KACrChB,MAAMzB,eAAe+C;KACrBjC,MAAM1B,iBAAiB;OAClBD,kBAAkBuD,aAAahC;MAChC,GAAG,KAAKiC,mBAAmBjC,OAAAA;KAC/B,CAAA;IACJ,CAAA;GACJ,QAAQ;IACJ;GACJ;GAGJ,MAAM,KAAKH,WAAW0C,OAAOvC,OAAAA;GAC7B4D,SAAS;EACb;EAEA,OAAO,EAAEA,MAAM;CACnB;AACJ"}

package/dist/core/entities/trust-anchor/schema.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","trustAnchorSchema","name","TRUST_ANCHOR","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/trust-anchor/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const trustAnchorSchema = defineSchema<TrustAnchor>({\n name: EntityType.TRUST_ANCHOR,\n fields: {\n allowed: [\n 'id',\n 'name',\n 'certificate',\n 'enabled',\n 'realmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['id', 'name', 'enabled', 'realmId'] },\n relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'name', 'enabled', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,oBAAoBN,aAA0B;CACvDO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;~~GAER~~;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;EAAW;~~GAAW~~;CACzDE,WAAW;EAAEF,SAAS,CAAC,~~OAAA~~;~~EAAUG~~,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAW;EAAa;~~GAAa~~;CACrEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}
1	+ {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","trustAnchorSchema","name","TRUST_ANCHOR","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/trust-anchor/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const trustAnchorSchema = defineSchema<TrustAnchor>({\n name: EntityType.TRUST_ANCHOR,\n fields: {\n allowed: [\n 'id',\n 'name',\n 'certificate',\n 'enabled',\n 'realmId',\n 'createdAt',\n 'updatedAt',\n ],\n },\n filters: { allowed: ['id', 'name', 'enabled', 'realmId'] },\n relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'name', 'enabled', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,oBAAoBN,aAA0B;CACvDO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;EAAW;CAAU,EAAC;CACzDE,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAW;EAAa;CAAY,EAAC;CACrEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}