@authup/server-core 1.0.0-beta.54 → 1.0.0-beta.56

package/dist/core/entities/trust-anchor/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","eq","inArray","EntityType","EventName","EventScope","PermissionName","TrustAnchorValidator","EntityNotFoundError","ValidationError","ValidatorGroup","AbstractEntityService","buildEntityDiff","parseCertificateChain","appendQueryConditions","decodeQuery","trustAnchorSchema","PERMISSION_NAMES","KEY_READ","KEY_UPDATE","KEY_DELETE","TrustAnchorService","repository","validator","eventService","requestContext","ctx","getMany","query","actor","options","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","realmId","compiled","compile","verdict","condition","data","entities","meta","findMany","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","findOneByIdOrName","create","preEvaluate","KEY_CREATE","validated","run","group","CREATE","identity","actorRealmId","getActorRealmId","validateJoinColumns","evaluate","checkUniqueness","chain","certificate","ca","enabled","save","recordEvent","CREATED","update","UPDATE","previous","pickAuditFields","merge","diff","UPDATED","Object","keys","length","delete","id","findOneBy","entityId","remove","DELETED","undefined","record","scope","ENTITY","refType","TRUST_ANCHOR","refId","actorType","type","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent"],"sources":["../../../../src/core/entities/trust-anchor/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { eq, inArray } from '@rapiq/core';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport {\n    EntityType,\n    EventName,\n    EventScope,\n    PermissionName,\n    TrustAnchorValidator,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { buildEntityDiff } from '../event/index.ts';\nimport type { EventRequestContext, IEventService } from '../event/index.ts';\nimport { parseCertificateChain } from '../../key/index.ts';\nimport type {\n    ITrustAnchorRepository, \n    ITrustAnchorService, \n    TrustAnchorServiceReadOptions,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { trustAnchorSchema } from './schema.ts';\n\nexport type TrustAnchorServiceContext = {\n    repository: ITrustAnchorRepository,\n    eventService?: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n};\n\nconst PERMISSION_NAMES = [\n    PermissionName.KEY_READ,\n    PermissionName.KEY_UPDATE,\n    PermissionName.KEY_DELETE,\n];\n\nexport class TrustAnchorService extends AbstractEntityService implements ITrustAnchorService {\n    protected repository: ITrustAnchorRepository;\n\n    protected validator: TrustAnchorValidator;\n\n    protected eventService?: IEventService;\n\n    protected requestContext?: () => EventRequestContext | undefined;\n\n    constructor(ctx: TrustAnchorServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new TrustAnchorValidator();\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: TrustAnchorServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<TrustAnchor>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        let parsed = await decodeQuery(query, { schema: trustAnchorSchema, actor });\n        if (options.realmId) {\n            parsed = appendQueryConditions(parsed, eq('realmId', options.realmId));\n        }\n\n        // Compile the read permissions against the knowns (actor identity) into a\n        // row condition (issue #3286 phase 3): the authorization runs as WHERE, so\n        // pagination and totals stay exact. Non-expressible policies fall back to\n        // the per-row post-evaluation below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PERMISSION_NAMES });\n        if (compiled.verdict === 'deny') {\n            // no row can pass — a constant-false condition keeps the meta shape\n            parsed = appendQueryConditions(parsed, inArray('id', []));\n        } else if (compiled.verdict === 'conditional') {\n            parsed = appendQueryConditions(parsed, compiled.condition);\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(parsed);\n\n        if (compiled.verdict !== 'post') {\n            return { data: entities, meta };\n        }\n\n        const data: TrustAnchor[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: PERMISSION_NAMES,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluateOneOf({\n            name: PERMISSION_NAMES,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        if (!validated.realmId && actor.identity) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        if (!validated.realmId) {\n            throw new ValidationError('A realm must be specified.');\n        }\n\n        await this.repository.validateJoinColumns(validated);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: validated,\n                ...this.resourceRealmMatch(validated),\n            }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        const chain = parseCertificateChain(validated.certificate as string);\n        if (!chain[0] || !chain[0].ca) {\n            throw new ValidationError('A trust anchor must contain a CA certificate.');\n        }\n\n        if (typeof validated.enabled !== 'boolean') {\n            validated.enabled = true;\n        }\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        await this.recordEvent(EventName.CREATED, entity, actor);\n\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });\n\n        let entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: {\n                    ...entity,\n                    ...validated,\n                },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        if (validated.name && validated.name !== entity.name) {\n            await this.repository.checkUniqueness({\n                name: validated.name,\n                realmId: entity.realmId,\n            }, entity);\n        }\n\n        const previous = this.pickAuditFields(entity);\n\n        entity = this.repository.merge(entity, validated);\n        entity = await this.repository.save(entity);\n\n        const diff = buildEntityDiff(this.pickAuditFields(entity), previous);\n        await this.recordEvent(EventName.UPDATED, entity, actor, { ...(Object.keys(diff).length > 0 ? { diff } : {}) });\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        await this.recordEvent(EventName.DELETED, entity, actor);\n\n        return entity;\n    }\n\n    // ------------------------------------------------------------------\n\n    /**\n     * Metadata-only audit trail for trust-anchor lifecycle operations\n     * (issue #3269) — trust anchors have no entity subscriber, so the\n     * security-relevant mutations (an enabled CA anchor turns on mTLS client\n     * auth for a realm) are recorded explicitly. The payload never carries\n     * certificate bytes.\n     */\n    protected async recordEvent(\n        name: `${EventName}`,\n        entity: TrustAnchor,\n        actor: ActorContext,\n        data: Record<string, any> = {},\n    ): Promise<void> {\n        const requestContext = this.requestContext ?\n            this.requestContext() :\n            undefined;\n\n        await this.eventService?.record({\n            scope: EventScope.ENTITY,\n            name,\n            refType: EntityType.TRUST_ANCHOR,\n            refId: entity.id,\n            realmId: entity.realmId ?? null,\n            actorType: actor.identity?.type ?? null,\n            actorId: actor.identity?.data.id ?? null,\n            actorName: actor.identity?.data.name ?? null,\n            requestPath: requestContext?.requestPath ?? null,\n            requestMethod: requestContext?.requestMethod ?? null,\n            requestIpAddress: requestContext?.requestIpAddress ?? null,\n            requestUserAgent: requestContext?.requestUserAgent ?? null,\n            data: {\n                name: entity.name,\n                enabled: entity.enabled,\n                ...data,\n            },\n        });\n    }\n\n    protected pickAuditFields(entity: TrustAnchor): Record<string, any> {\n        return {\n            name: entity.name,\n            enabled: entity.enabled,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,MAAMkB,mBAAmB;CACrBX,eAAeY;CACfZ,eAAea;CACfb,eAAec;;AAGnB,IAAaC,qBAAb,cAAwCV,sBAAAA;CAC1BW;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,YAAY,IAAIhB,qBAAAA;EACrB,KAAKiB,eAAeE,IAAIF;EACxB,KAAKC,iBAAiBC,IAAID;CAC9B;CAEA,MAAME,QACFC,OACAC,OACAC,UAAyC,CAAC,GACU;EACpD,MAAMD,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,IAAIiB,SAAS,MAAMnB,YAAYa,OAAO;GAAEO,QAAQnB;GAAmBa;EAAM,CAAA;EACzE,IAAIC,QAAQM,SACRF,SAASpB,sBAAsBoB,QAAQjC,GAAG,WAAW6B,QAAQM,OAAO,CAAA;EAOxE,MAAMC,WAAW,MAAMR,MAAME,oBAAoBO,QAAQ,EAAEL,MAAMhB,iBAAiB,CAAA;EAClF,IAAIoB,SAASE,YAAY,QAErBL,SAASpB,sBAAsBoB,QAAQhC,QAAQ,MAAM,CAAA,CAAE,CAAA;OACpD,IAAImC,SAASE,YAAY,eAC5BL,SAASpB,sBAAsBoB,QAAQG,SAASG,SAAS;EAG7D,MAAM,EAAEC,MAAMC,UAAUC,SAAS,MAAM,KAAKrB,WAAWsB,SAASV,MAAAA;EAEhE,IAAIG,SAASE,YAAY,QACrB,OAAO;GAAEE,MAAMC;GAAUC;EAAK;EAGlC,MAAMF,OAAsB,CAAA;EAC5B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UACjB,IAAI;GACA,MAAMb,MAAME,oBAAoBgB,cAAc;IAC1Cd,MAAMhB;IACNwB,MAAMzC,iBAAiB;MAClBD,kBAAkBiD,aAAaF;KAChC,GAAG,KAAKG,mBAAmBH,MAAAA;IAC/B,CAAA;GACJ,CAAA;GACAL,KAAKS,KAAKJ,MAAAA;EACd,QAAQ;GACJD,SAAS;EACb;EAGJ,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,UACAvB,OACAO,SACoB;EACpB,MAAMP,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,MAAM6B,SAAS,MAAM,KAAKxB,WAAW+B,kBAAkBD,UAAUhB,OAAAA;EACjE,IAAI,CAACU,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMqB,MAAME,oBAAoBgB,cAAc;GAC1Cd,MAAMhB;GACNwB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMQ,OACFb,MACAZ,OACoB;EACpB,MAAMA,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAekD,WAAW,CAAA;EAE9E,MAAMC,YAAY,MAAM,KAAKlC,UAAUmC,IAAIjB,MAAM,EAAEkB,OAAOjD,eAAekD,OAAO,CAAA;EAEhF,IAAI,CAACH,UAAUrB,WAAWP,MAAMgC,UAAU;GACtC,MAAMC,eAAe,KAAKC,gBAAgBlC,KAAAA;GAC1C,IAAIiC,cACAL,UAAUrB,UAAU0B;EAE5B;EAEA,IAAI,CAACL,UAAUrB,SACX,MAAM,IAAI3B,gBAAgB,4BAAA;EAG9B,MAAM,KAAKa,WAAW0C,oBAAoBP,SAAAA;EAE1C,MAAM5B,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAekD;GACrBf,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaS;IAChC,GAAG,KAAKR,mBAAmBQ,SAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKnC,WAAW4C,gBAAgBT,SAAAA;EAEtC,MAAMU,QAAQtD,sBAAsB4C,UAAUW,WAAW;EACzD,IAAI,CAACD,MAAM,MAAM,CAACA,MAAM,EAAE,CAACE,IACvB,MAAM,IAAI5D,gBAAgB,+CAAA;EAG9B,IAAI,OAAOgD,UAAUa,YAAY,WAC7Bb,UAAUa,UAAU;EAGxB,IAAIxB,SAAS,KAAKxB,WAAWgC,OAAOG,SAAAA;EACpCX,SAAS,MAAM,KAAKxB,WAAWiD,KAAKzB,MAAAA;EAEpC,MAAM,KAAK0B,YAAYpE,UAAUqE,SAAS3B,QAAQjB,KAAAA;EAElD,OAAOiB;CACX;CAEA,MAAM4B,OACFtB,UACAX,MACAZ,OACAO,SACoB;EACpB,MAAMP,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAea,WAAW,CAAA;EAE9E,IAAI2B,SAAS,MAAM,KAAKxB,WAAW+B,kBAAkBD,UAAUhB,OAAAA;EAC/D,IAAI,CAACU,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMiD,YAAY,MAAM,KAAKlC,UAAUmC,IAAIjB,MAAM,EAAEkB,OAAOjD,eAAeiE,OAAO,CAAA;EAEhF,MAAM9C,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAea;GACrBsB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAa;KAC5B,GAAGF;KACH,GAAGW;IACP;IACA,GAAG,KAAKR,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIW,UAAUxB,QAAQwB,UAAUxB,SAASa,OAAOb,MAC5C,MAAM,KAAKX,WAAW4C,gBAAgB;GAClCjC,MAAMwB,UAAUxB;GAChBG,SAASU,OAAOV;EACpB,GAAGU,MAAAA;EAGP,MAAM8B,WAAW,KAAKC,gBAAgB/B,MAAAA;EAEtCA,SAAS,KAAKxB,WAAWwD,MAAMhC,QAAQW,SAAAA;EACvCX,SAAS,MAAM,KAAKxB,WAAWiD,KAAKzB,MAAAA;EAEpC,MAAMiC,OAAOnE,gBAAgB,KAAKiE,gBAAgB/B,MAAAA,GAAS8B,QAAAA;EAC3D,MAAM,KAAKJ,YAAYpE,UAAU4E,SAASlC,QAAQjB,OAAO,EAAE,GAAIoD,OAAOC,KAAKH,IAAAA,CAAAA,CAAMI,SAAS,IAAI,EAAEJ,KAAK,IAAI,CAAC,EAAG,CAAA;EAE7G,OAAOjC;CACX;CAEA,MAAMsC,OACFC,IACAxD,OACoB;EACpB,MAAMA,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAec,WAAW,CAAA;EAE9E,MAAM0B,SAAS,MAAM,KAAKxB,WAAWgE,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACvC,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMqB,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAec;GACrBqB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,EAAEuC,IAAIE,aAAazC;EACzB,MAAM,KAAKxB,WAAWkE,OAAO1C,MAAAA;EAC7BA,OAAOuC,KAAKE;EAEZ,MAAM,KAAKf,YAAYpE,UAAUqF,SAAS3C,QAAQjB,KAAAA;EAElD,OAAOiB;CACX;;;;;;;IAWA,MAAgB0B,YACZvC,MACAa,QACAjB,OACAY,OAA4B,CAAC,GAChB;EACb,MAAMhB,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBiE,KAAAA;EAEJ,MAAM,KAAKlE,cAAcmE,OAAO;GAC5BC,OAAOvF,WAAWwF;GAClB5D;GACA6D,SAAS3F,WAAW4F;GACpBC,OAAOlD,OAAOuC;GACdjD,SAASU,OAAOV,WAAW;GAC3B6D,WAAWpE,MAAMgC,UAAUqC,QAAQ;GACnCC,SAAStE,MAAMgC,UAAUpB,KAAK4C,MAAM;GACpCe,WAAWvE,MAAMgC,UAAUpB,KAAKR,QAAQ;GACxCoE,aAAa5E,gBAAgB4E,eAAe;GAC5CC,eAAe7E,gBAAgB6E,iBAAiB;GAChDC,kBAAkB9E,gBAAgB8E,oBAAoB;GACtDC,kBAAkB/E,gBAAgB+E,oBAAoB;GACtD/D,MAAM;IACFR,MAAMa,OAAOb;IACbqC,SAASxB,OAAOwB;IAChB,GAAG7B;GACP;EACJ,CAAA;CACJ;CAEUoC,gBAAgB/B,QAA0C;EAChE,OAAO;GACHb,MAAMa,OAAOb;GACbqC,SAASxB,OAAOwB;EACpB;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","eq","inArray","EntityType","EventName","EventScope","PermissionName","TrustAnchorValidator","EntityNotFoundError","ValidationError","ValidatorGroup","AbstractEntityService","buildEntityDiff","parseCertificateChain","appendQueryConditions","decodeQuery","trustAnchorSchema","PERMISSION_NAMES","KEY_READ","KEY_UPDATE","KEY_DELETE","TrustAnchorService","repository","validator","eventService","requestContext","ctx","getMany","query","actor","options","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","realmId","compiled","compile","verdict","condition","data","entities","meta","findMany","total","entity","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","findOneByIdOrName","create","preEvaluate","KEY_CREATE","validated","run","group","CREATE","identity","actorRealmId","getActorRealmId","validateJoinColumns","evaluate","checkUniqueness","chain","certificate","ca","enabled","save","recordEvent","CREATED","update","UPDATE","previous","pickAuditFields","merge","diff","UPDATED","Object","keys","length","delete","id","findOneBy","entityId","remove","DELETED","undefined","record","scope","ENTITY","refType","TRUST_ANCHOR","refId","actorType","type","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent"],"sources":["../../../../src/core/entities/trust-anchor/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { eq, inArray } from '@rapiq/core';\nimport type { TrustAnchor } from '@authup/core-kit';\nimport {\n    EntityType,\n    EventName,\n    EventScope,\n    PermissionName,\n    TrustAnchorValidator,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { buildEntityDiff } from '../event/index.ts';\nimport type { EventRequestContext, IEventService } from '../event/index.ts';\nimport { parseCertificateChain } from '../../key/index.ts';\nimport type {\n    ITrustAnchorRepository, \n    ITrustAnchorService, \n    TrustAnchorServiceReadOptions,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { trustAnchorSchema } from './schema.ts';\n\nexport type TrustAnchorServiceContext = {\n    repository: ITrustAnchorRepository,\n    eventService?: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n};\n\nconst PERMISSION_NAMES = [\n    PermissionName.KEY_READ,\n    PermissionName.KEY_UPDATE,\n    PermissionName.KEY_DELETE,\n];\n\nexport class TrustAnchorService extends AbstractEntityService implements ITrustAnchorService {\n    protected repository: ITrustAnchorRepository;\n\n    protected validator: TrustAnchorValidator;\n\n    protected eventService?: IEventService;\n\n    protected requestContext?: () => EventRequestContext | undefined;\n\n    constructor(ctx: TrustAnchorServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.validator = new TrustAnchorValidator();\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: TrustAnchorServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<TrustAnchor>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        let parsed = await decodeQuery(query, { schema: trustAnchorSchema, actor });\n        if (options.realmId) {\n            parsed = appendQueryConditions(parsed, eq('realmId', options.realmId));\n        }\n\n        // Compile the read permissions against the knowns (actor identity) into a\n        // row condition (issue #3286 phase 3): the authorization runs as WHERE, so\n        // pagination and totals stay exact. Non-expressible policies fall back to\n        // the per-row post-evaluation below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PERMISSION_NAMES });\n        if (compiled.verdict === 'deny') {\n            // no row can pass — a constant-false condition keeps the meta shape\n            parsed = appendQueryConditions(parsed, inArray('id', []));\n        } else if (compiled.verdict === 'conditional') {\n            parsed = appendQueryConditions(parsed, compiled.condition);\n        }\n\n        const { data: entities, meta } = await this.repository.findMany(parsed);\n\n        if (compiled.verdict !== 'post') {\n            return { data: entities, meta };\n        }\n\n        const data: TrustAnchor[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: PERMISSION_NAMES,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: PERMISSION_NAMES });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluateOneOf({\n            name: PERMISSION_NAMES,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        if (!validated.realmId && actor.identity) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        if (!validated.realmId) {\n            throw new ValidationError('A realm must be specified.');\n        }\n\n        await this.repository.validateJoinColumns(validated);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_CREATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: validated,\n                ...this.resourceRealmMatch(validated),\n            }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        const chain = parseCertificateChain(validated.certificate as string);\n        if (!chain[0] || !chain[0].ca) {\n            throw new ValidationError('A trust anchor must contain a CA certificate.');\n        }\n\n        if (typeof validated.enabled !== 'boolean') {\n            validated.enabled = true;\n        }\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        await this.recordEvent(EventName.CREATED, entity, actor);\n\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n        realmId?: string,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_UPDATE });\n\n        let entity = await this.repository.findOneByIdOrName(idOrName, realmId);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: {\n                    ...entity,\n                    ...validated,\n                },\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        if (validated.name && validated.name !== entity.name) {\n            await this.repository.checkUniqueness({\n                name: validated.name,\n                realmId: entity.realmId,\n            }, entity);\n        }\n\n        const previous = this.pickAuditFields(entity);\n\n        entity = this.repository.merge(entity, validated);\n        entity = await this.repository.save(entity);\n\n        const diff = buildEntityDiff(this.pickAuditFields(entity), previous);\n        await this.recordEvent(EventName.UPDATED, entity, actor, { ...(Object.keys(diff).length > 0 ? { diff } : {}) });\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<TrustAnchor> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.KEY_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.KEY_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: entity,\n                ...this.resourceRealmMatch(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        await this.recordEvent(EventName.DELETED, entity, actor);\n\n        return entity;\n    }\n\n    // ------------------------------------------------------------------\n\n    /**\n     * Metadata-only audit trail for trust-anchor lifecycle operations\n     * (issue #3269) — trust anchors have no entity subscriber, so the\n     * security-relevant mutations (an enabled CA anchor turns on mTLS client\n     * auth for a realm) are recorded explicitly. The payload never carries\n     * certificate bytes.\n     */\n    protected async recordEvent(\n        name: `${EventName}`,\n        entity: TrustAnchor,\n        actor: ActorContext,\n        data: Record<string, any> = {},\n    ): Promise<void> {\n        const requestContext = this.requestContext ?\n            this.requestContext() :\n            undefined;\n\n        await this.eventService?.record({\n            scope: EventScope.ENTITY,\n            name,\n            refType: EntityType.TRUST_ANCHOR,\n            refId: entity.id,\n            realmId: entity.realmId ?? null,\n            actorType: actor.identity?.type ?? null,\n            actorId: actor.identity?.data.id ?? null,\n            actorName: actor.identity?.data.name ?? null,\n            requestPath: requestContext?.requestPath ?? null,\n            requestMethod: requestContext?.requestMethod ?? null,\n            requestIpAddress: requestContext?.requestIpAddress ?? null,\n            requestUserAgent: requestContext?.requestUserAgent ?? null,\n            data: {\n                name: entity.name,\n                enabled: entity.enabled,\n                ...data,\n            },\n        });\n    }\n\n    protected pickAuditFields(entity: TrustAnchor): Record<string, any> {\n        return {\n            name: entity.name,\n            enabled: entity.enabled,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,MAAMkB,mBAAmB;CACrBX,eAAeY;CACfZ,eAAea;CACfb,eAAec;AAClB;AAED,IAAaC,qBAAb,cAAwCV,sBAAAA;CAC1BW;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,YAAY,IAAIhB,qBAAAA;EACrB,KAAKiB,eAAeE,IAAIF;EACxB,KAAKC,iBAAiBC,IAAID;CAC9B;CAEA,MAAME,QACFC,OACAC,OACAC,UAAyC,CAAC,GACU;EACpD,MAAMD,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,IAAIiB,SAAS,MAAMnB,YAAYa,OAAO;GAAEO,QAAQnB;GAAmBa;EAAM,CAAA;EACzE,IAAIC,QAAQM,SACRF,SAASpB,sBAAsBoB,QAAQjC,GAAG,WAAW6B,QAAQM,OAAO,CAAA;EAOxE,MAAMC,WAAW,MAAMR,MAAME,oBAAoBO,QAAQ,EAAEL,MAAMhB,iBAAiB,CAAA;EAClF,IAAIoB,SAASE,YAAY,QAErBL,SAASpB,sBAAsBoB,QAAQhC,QAAQ,MAAM,CAAA,CAAE,CAAA;OACpD,IAAImC,SAASE,YAAY,eAC5BL,SAASpB,sBAAsBoB,QAAQG,SAASG,SAAS;EAG7D,MAAM,EAAEC,MAAMC,UAAUC,SAAS,MAAM,KAAKrB,WAAWsB,SAASV,MAAAA;EAEhE,IAAIG,SAASE,YAAY,QACrB,OAAO;GAAEE,MAAMC;GAAUC;EAAK;EAGlC,MAAMF,OAAsB,CAAA;EAC5B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UACjB,IAAI;GACA,MAAMb,MAAME,oBAAoBgB,cAAc;IAC1Cd,MAAMhB;IACNwB,MAAMzC,iBAAiB;MAClBD,kBAAkBiD,aAAaF;KAChC,GAAG,KAAKG,mBAAmBH,MAAAA;IAC/B,CAAA;GACJ,CAAA;GACAL,KAAKS,KAAKJ,MAAAA;EACd,QAAQ;GACJD,SAAS;EACb;EAGJ,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,UACAvB,OACAO,SACoB;EACpB,MAAMP,MAAME,oBAAoBC,iBAAiB,EAAEC,MAAMhB,iBAAiB,CAAA;EAE1E,MAAM6B,SAAS,MAAM,KAAKxB,WAAW+B,kBAAkBD,UAAUhB,OAAAA;EACjE,IAAI,CAACU,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMqB,MAAME,oBAAoBgB,cAAc;GAC1Cd,MAAMhB;GACNwB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,OAAOA;CACX;CAEA,MAAMQ,OACFb,MACAZ,OACoB;EACpB,MAAMA,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAekD,WAAW,CAAA;EAE9E,MAAMC,YAAY,MAAM,KAAKlC,UAAUmC,IAAIjB,MAAM,EAAEkB,OAAOjD,eAAekD,OAAO,CAAA;EAEhF,IAAI,CAACH,UAAUrB,WAAWP,MAAMgC,UAAU;GACtC,MAAMC,eAAe,KAAKC,gBAAgBlC,KAAAA;GAC1C,IAAIiC,cACAL,UAAUrB,UAAU0B;EAE5B;EAEA,IAAI,CAACL,UAAUrB,SACX,MAAM,IAAI3B,gBAAgB,4BAAA;EAG9B,MAAM,KAAKa,WAAW0C,oBAAoBP,SAAAA;EAE1C,MAAM5B,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAekD;GACrBf,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaS;IAChC,GAAG,KAAKR,mBAAmBQ,SAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,KAAKnC,WAAW4C,gBAAgBT,SAAAA;EAEtC,MAAMU,QAAQtD,sBAAsB4C,UAAUW,WAAW;EACzD,IAAI,CAACD,MAAM,MAAM,CAACA,MAAM,EAAE,CAACE,IACvB,MAAM,IAAI5D,gBAAgB,+CAAA;EAG9B,IAAI,OAAOgD,UAAUa,YAAY,WAC7Bb,UAAUa,UAAU;EAGxB,IAAIxB,SAAS,KAAKxB,WAAWgC,OAAOG,SAAAA;EACpCX,SAAS,MAAM,KAAKxB,WAAWiD,KAAKzB,MAAAA;EAEpC,MAAM,KAAK0B,YAAYpE,UAAUqE,SAAS3B,QAAQjB,KAAAA;EAElD,OAAOiB;CACX;CAEA,MAAM4B,OACFtB,UACAX,MACAZ,OACAO,SACoB;EACpB,MAAMP,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAea,WAAW,CAAA;EAE9E,IAAI2B,SAAS,MAAM,KAAKxB,WAAW+B,kBAAkBD,UAAUhB,OAAAA;EAC/D,IAAI,CAACU,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMiD,YAAY,MAAM,KAAKlC,UAAUmC,IAAIjB,MAAM,EAAEkB,OAAOjD,eAAeiE,OAAO,CAAA;EAEhF,MAAM9C,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAea;GACrBsB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAa;KAC5B,GAAGF;KACH,GAAGW;IACP;IACA,GAAG,KAAKR,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,IAAIW,UAAUxB,QAAQwB,UAAUxB,SAASa,OAAOb,MAC5C,MAAM,KAAKX,WAAW4C,gBAAgB;GAClCjC,MAAMwB,UAAUxB;GAChBG,SAASU,OAAOV;EACpB,GAAGU,MAAAA;EAGP,MAAM8B,WAAW,KAAKC,gBAAgB/B,MAAAA;EAEtCA,SAAS,KAAKxB,WAAWwD,MAAMhC,QAAQW,SAAAA;EACvCX,SAAS,MAAM,KAAKxB,WAAWiD,KAAKzB,MAAAA;EAEpC,MAAMiC,OAAOnE,gBAAgB,KAAKiE,gBAAgB/B,MAAAA,GAAS8B,QAAAA;EAC3D,MAAM,KAAKJ,YAAYpE,UAAU4E,SAASlC,QAAQjB,OAAO,EAAE,GAAIoD,OAAOC,KAAKH,IAAAA,CAAAA,CAAMI,SAAS,IAAI,EAAEJ,KAAK,IAAI,CAAC,EAAG,CAAA;EAE7G,OAAOjC;CACX;CAEA,MAAMsC,OACFC,IACAxD,OACoB;EACpB,MAAMA,MAAME,oBAAoBwB,YAAY,EAAEtB,MAAM3B,eAAec,WAAW,CAAA;EAE9E,MAAM0B,SAAS,MAAM,KAAKxB,WAAWgE,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACvC,QACD,MAAM,IAAItC,oBAAAA;EAGd,MAAMqB,MAAME,oBAAoBkC,SAAS;GACrChC,MAAM3B,eAAec;GACrBqB,MAAMzC,iBAAiB;KAClBD,kBAAkBiD,aAAaF;IAChC,GAAG,KAAKG,mBAAmBH,MAAAA;GAC/B,CAAA;EACJ,CAAA;EAEA,MAAM,EAAEuC,IAAIE,aAAazC;EACzB,MAAM,KAAKxB,WAAWkE,OAAO1C,MAAAA;EAC7BA,OAAOuC,KAAKE;EAEZ,MAAM,KAAKf,YAAYpE,UAAUqF,SAAS3C,QAAQjB,KAAAA;EAElD,OAAOiB;CACX;;;;;;;IAWA,MAAgB0B,YACZvC,MACAa,QACAjB,OACAY,OAA4B,CAAC,GAChB;EACb,MAAMhB,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBiE,KAAAA;EAEJ,MAAM,KAAKlE,cAAcmE,OAAO;GAC5BC,OAAOvF,WAAWwF;GAClB5D;GACA6D,SAAS3F,WAAW4F;GACpBC,OAAOlD,OAAOuC;GACdjD,SAASU,OAAOV,WAAW;GAC3B6D,WAAWpE,MAAMgC,UAAUqC,QAAQ;GACnCC,SAAStE,MAAMgC,UAAUpB,KAAK4C,MAAM;GACpCe,WAAWvE,MAAMgC,UAAUpB,KAAKR,QAAQ;GACxCoE,aAAa5E,gBAAgB4E,eAAe;GAC5CC,eAAe7E,gBAAgB6E,iBAAiB;GAChDC,kBAAkB9E,gBAAgB8E,oBAAoB;GACtDC,kBAAkB/E,gBAAgB+E,oBAAoB;GACtD/D,MAAM;IACFR,MAAMa,OAAOb;IACbqC,SAASxB,OAAOwB;IAChB,GAAG7B;GACP;EACJ,CAAA;CACJ;CAEUoC,gBAAgB/B,QAA0C;EAChE,OAAO;GACHb,MAAMa,OAAOb;GACbqC,SAASxB,OAAOwB;EACpB;CACJ;AACJ"}

package/dist/core/entities/user/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","userSchema","name","USER","fields","default","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { User } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const userSchema = defineSchema<User>({\n    name: EntityType.USER,\n    fields: {\n        default: [\n            'id',\n            'name',\n            'nameLocked',\n            'firstName',\n            'lastName',\n            'displayName',\n            'avatar',\n            'cover',\n            'active',\n            'createdAt',\n            'updatedAt',\n            'realmId',\n        ],\n        allowed: ['email'],\n    },\n    filters: { allowed: ['id', 'name', 'realmId'] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'name', 'displayName', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,aAAaN,aAAmB;CACzCO,MAAMN,WAAWO;CACjBC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;;EAEJC,SAAS,CAAC,OAAA;CACd;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;GAAW;CAC9CE,WAAW;EAAEF,SAAS,CAAC,OAAA;EAAUG,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAe;EAAa;GAAa;CACzEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","userSchema","name","USER","fields","default","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { User } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const userSchema = defineSchema<User>({\n    name: EntityType.USER,\n    fields: {\n        default: [\n            'id',\n            'name',\n            'nameLocked',\n            'firstName',\n            'lastName',\n            'displayName',\n            'avatar',\n            'cover',\n            'active',\n            'createdAt',\n            'updatedAt',\n            'realmId',\n        ],\n        allowed: ['email'],\n    },\n    filters: { allowed: ['id', 'name', 'realmId'] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'name', 'displayName', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,aAAaN,aAAmB;CACzCO,MAAMN,WAAWO;CACjBC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,OAAQ;CACtB;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;CAAU,EAAC;CAC9CE,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAe;EAAa;CAAY,EAAC;CACzEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}

package/dist/core/entities/user/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","eq","inArray","or","PermissionName","UserValidator","AbstractEntityService","UserCredentialsService","appendQueryConditions","decodeQuery","userSchema","UserService","repository","realmRepository","validator","ctx","passwordMinLength","getMany","query","actor","permissionNames","USER_READ","USER_UPDATE","USER_DELETE","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","compiled","compile","verdict","self","identity","type","data","id","scoped","condition","findMany","entities","meta","total","entity","push","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","getOne","idOrName","realmId","isMe","findOne","parameters","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneBy","isSelfEdit","preEvaluate","e","USER_SELF_MANAGE","UPDATE","USER_CREATE","CREATE","validated","run","validateJoinColumns","credentialsService","originalName","originalNameLocked","nameLocked","evaluate","merge","REALM_MATCH","password","protect","created","actorRealmId","getActorRealmId","delete","entityId","remove"],"sources":["../../../../src/core/entities/user/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { eq, inArray, or } from '@rapiq/core';\nimport {\n    PermissionName,\n    UserValidator,\n} from '@authup/core-kit';\nimport type { User } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type { IUserRepository, IUserService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { userSchema } from './schema.ts';\n\nexport type UserServiceContext = {\n    repository: IUserRepository;\n    realmRepository: IRealmRepository;\n    passwordMinLength?: number;\n};\n\nexport class UserService extends AbstractEntityService implements IUserService {\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: UserValidator;\n\n    constructor(ctx: UserServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new UserValidator({ passwordMinLength: ctx.passwordMinLength });\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<User>> {\n        const permissionNames = [\n            PermissionName.USER_READ,\n            PermissionName.USER_UPDATE,\n            PermissionName.USER_DELETE,\n        ];\n\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n\n        const parsed = await decodeQuery(query, { schema: userSchema, actor });\n\n        // Compile the read permissions into a row condition (#3286 phase 3). The\n        // own row is always readable, so the self short-circuit composes as an\n        // OR-alternative — the whole gate runs as WHERE and pagination/totals\n        // stay exact. A non-expressible policy falls back to the per-row loop\n        // below.\n        const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });\n        if (compiled.verdict !== 'post') {\n            const self = actor.identity && actor.identity.type === 'user' ?\n                eq('id', actor.identity.data.id) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, self ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    self ? or(self, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped);\n        }\n\n        const {\n            data: entities,\n            meta,\n        } = await this.repository.findMany(parsed);\n\n        const data: User[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (\n                actor.identity &&\n                actor.identity.type === 'user' &&\n                actor.identity.data.id === entity.id\n            ) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: [\n                        PermissionName.USER_READ,\n                        PermissionName.USER_UPDATE,\n                        PermissionName.USER_DELETE,\n                    ],\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<User> {\n        const permissionNames = [\n            PermissionName.USER_READ,\n            PermissionName.USER_UPDATE,\n            PermissionName.USER_DELETE,\n        ];\n\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        const entity = await this.repository.findOne(\n            idOrName,\n            await decodeQuery(query, {\n                schema: userSchema, \n                parameters: ['fields', 'relations'], \n                actor, \n            }),\n            realmId,\n        );\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        if (!isMe) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: permissionNames,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: User,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: User | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'user' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n            }\n\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_CREATE });\n\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const credentialsService = new UserCredentialsService();\n\n        if (entity) {\n            const originalName = entity.name;\n            const originalNameLocked = entity.nameLocked;\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (\n                validated.name &&\n                validated.name !== originalName\n            ) {\n                if (validated.nameLocked) {\n                    entity.nameLocked = validated.nameLocked;\n                }\n\n                if (originalNameLocked && validated.nameLocked !== false) {\n                    entity.name = originalName;\n                }\n            }\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_UPDATE,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: {\n                            ...entity,\n                            ...validated,\n                        },\n                        [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n                    }),\n                });\n            }\n\n            if (validated.password) {\n                entity.password = await credentialsService.protect(validated.password);\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realmId) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        entity = this.repository.create(validated);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        if (validated.password) {\n            entity.password = await credentialsService.protect(validated.password);\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<User> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });\n\n        if (\n            actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === id\n        ) {\n            throw new ValidationError('The own user can not be deleted.');\n        }\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA8BA,IAAagB,cAAb,cAAiCL,sBAAAA;CACnBM;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIT,cAAc,EAAEW,mBAAmBD,IAAIC,kBAAkB,CAAA;CAClF;CAEA,MAAMC,QACFC,OACAC,OAC6C;EAC7C,MAAMC,kBAAkB;GACpBhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;;EAGnB,MAAMJ,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAEzE,MAAMO,SAAS,MAAMlB,YAAYS,OAAO;GAAEU,QAAQlB;GAAYS;EAAM,CAAA;EAOpE,MAAMU,WAAW,MAAMV,MAAMK,oBAAoBM,QAAQ,EAAEJ,MAAMN,gBAAgB,CAAA;EACjF,IAAIS,SAASE,YAAY,QAAQ;GAC7B,MAAMC,OAAOb,MAAMc,YAAYd,MAAMc,SAASC,SAAS,SACnDjC,GAAG,MAAMkB,MAAMc,SAASE,KAAKC,EAAE,IAC/B;GAEJ,IAAIC,SAASV;GACb,IAAIE,SAASE,YAAY,QACrBM,SAAS7B,sBAAsBmB,QAAQK,QAAQ9B,QAAQ,MAAM,CAAA,CAAE,CAAA;QAC5D,IAAI2B,SAASE,YAAY,eAC5BM,SAAS7B,sBACLmB,QACAK,OAAO7B,GAAG6B,MAAMH,SAASS,SAAS,IAAIT,SAASS,SAAS;GAIhE,OAAO,KAAK1B,WAAW2B,SAASF,MAAAA;EACpC;EAEA,MAAM,EACFF,MAAMK,UACNC,SACA,MAAM,KAAK7B,WAAW2B,SAASZ,MAAAA;EAEnC,MAAMQ,OAAe,CAAA;EACrB,IAAI,EAAEO,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IACIrB,MAAMc,YACNd,MAAMc,SAASC,SAAS,UACxBf,MAAMc,SAASE,KAAKC,OAAOO,OAAOP,IACpC;IACED,KAAKS,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMxB,MAAMK,oBAAoBqB,cAAc;KAC1CnB,MAAM;MACFtB,eAAeiB;MACfjB,eAAekB;MACflB,eAAemB;;KAEnBY,MAAMvC,iBAAiB;OAAGD,kBAAkBmD,aAAaH;MAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;KAAQ,CAAA;IACxG,CAAA;IAEAR,KAAKS,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHP;GACAM,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,UACA9B,OACAD,OACAgC,SACa;EACb,MAAM9B,kBAAkB;GACpBhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;;EAGnB,IAAI4B,OAAO,CAAC,CAAChC,MAAMc,YACfd,MAAMc,SAASC,SAAS,WAEpBf,MAAMc,SAASE,KAAKC,OAAOa,YAC3B9B,MAAMc,SAASE,KAAKT,SAASuB;EAGrC,IAAI,CAACE,MACD,MAAMhC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAG7E,MAAMuB,SAAS,MAAM,KAAK/B,WAAWwC,QACjCH,UACA,MAAMxC,YAAYS,OAAO;GACrBU,QAAQlB;GACR2C,YAAY,CAAC,UAAU,WAAA;GACvBlC;EACJ,CAAA,GACA+B,OAAAA;EAEJ,IAAI,CAACP,QACD,MAAM,IAAI5C,oBAAAA;EAGd,IAAIoD,QAAQhC,MAAMc,SAAUE,KAAKC,OAAOO,OAAOP,IAAI;GAC/Ce,OAAO;GACP,MAAMhC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAC7E;EAEA,IAAI,CAAC+B,MACD,MAAMhC,MAAMK,oBAAoBqB,cAAc;GAC1CnB,MAAMN;GACNe,MAAMvC,iBAAiB;KAAGD,kBAAkBmD,aAAaH;IAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMW,OACFnB,MACAhB,OACa;EACb,MAAM,EAAEwB,WAAW,MAAM,KAAKY,KAAKC,KAAAA,GAAWrB,MAAMhB,KAAAA;EACpD,OAAOwB;CACX;CAEA,MAAMc,OACFR,UACAd,MACAhB,OACa;EACb,MAAM,EAAEwB,WAAW,MAAM,KAAKY,KAAKN,UAAUd,MAAMhB,OAAO,EAAEuC,YAAY,KAAK,CAAA;EAC7E,OAAOf;CACX;CAEA,MAAMY,KACFN,UACAd,MACAhB,OACAwC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO1B,KAAKe,YAAY,WAClC,MAAM,KAAKrC,gBAAgBiD,QAAQ3B,KAAKe,OAAO,IAC/CM,KAAAA;EAEJ,IAAIb;EACJ,IAAIM,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAIjE,OAAOmD,QAAAA,GACPc,MAAM3B,KAAKa;QAEXc,MAAMrC,OAAOuB;GAGjB,IAAIY,OACAE,MAAMb,UAAUW,MAAMzB;GAG1BO,SAAS,MAAM,KAAK/B,WAAWoD,UAAUD,KAAAA;GACzC,IAAI,CAACpB,UAAUgB,QAAQD,YACnB,MAAM,IAAI3D,oBAAAA;EAElB,OAAO,IAAI4D,QAAQD,YACf,MAAM,IAAI3D,oBAAAA;EAGd,IAAIkE,aAAa;EACjB,IAAItB,QAAQ;GACR,IAAI;IACA,MAAMxB,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAekB,YAAY,CAAA;GACnF,SAAS6C,GAAG;IACR,IACI,CAAChD,MAAMc,YACPd,MAAMc,SAASC,SAAS,UACxBf,MAAMc,SAASE,KAAKC,OAAOO,OAAOP,IAElC,MAAM+B;IAEVF,aAAa;IACb,MAAM9C,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAegE,iBAAiB,CAAA;GACxF;GAEAR,QAAQ/D,eAAewE;EAC3B,OAAO;GACH,MAAMlD,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAekE,YAAY,CAAA;GAE/EV,QAAQ/D,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK1D,UAAU2D,IAAItC,MAAM,EAAEyB,MAAM,CAAA;EAEzD,MAAM,KAAKhD,WAAW8D,oBAAoBF,SAAAA;EAE1C,MAAMG,qBAAqB,IAAIpE,uBAAAA;EAE/B,IAAIoC,QAAQ;GACR,MAAMiC,eAAejC,OAAOjB;GAC5B,MAAMmD,qBAAqBlC,OAAOmC;GAElC,IAAIb,YACA,MAAM9C,MAAMK,oBAAoBuD,SAAS;IACrCrD,MAAMtB,eAAegE;IACrBjC,MAAMvC,iBAAiB;MAAGD,kBAAkBmD,aAAa0B;KAAW,GAAG,KAAKzB,mBAAmByB,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJ7B,SAAS,KAAK/B,WAAWoE,MAAMrC,QAAQ6B,SAAAA;GAEvC,IACIA,UAAU9C,QACV8C,UAAU9C,SAASkD,cACrB;IACE,IAAIJ,UAAUM,YACVnC,OAAOmC,aAAaN,UAAUM;IAGlC,IAAID,sBAAsBL,UAAUM,eAAe,OAC/CnC,OAAOjB,OAAOkD;GAEtB;GAEA,IAAI,CAACX,YACD,MAAM9C,MAAMK,oBAAoBuD,SAAS;IACrCrD,MAAMtB,eAAekB;IACrBa,MAAMvC,iBAAiB;MAClBD,kBAAkBmD,aAAa;MAC5B,GAAGH;MACH,GAAG6B;KACP;MACC7E,kBAAkBsF,cAAcT,UAAUtB,WAAWP,OAAOO,WAAW;IAC5E,CAAA;GACJ,CAAA;GAGJ,IAAIsB,UAAUU,UACVvC,OAAOuC,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;GAGzE,MAAM,KAAKtE,WAAW2C,KAAKZ,MAAAA;GAE3B,OAAO;IACHA;IACAyC,SAAS;GACb;EACJ;EAEA,IAAI,CAACZ,UAAUtB,SAAS;GACpB,MAAMmC,eAAe,KAAKC,gBAAgBnE,KAAAA;GAC1C,IAAIkE,cACAb,UAAUtB,UAAUmC;EAE5B;EAEA1C,SAAS,KAAK/B,WAAW0C,OAAOkB,SAAAA;EAEhC,MAAMrD,MAAMK,oBAAoBuD,SAAS;GACrCrD,MAAMtB,eAAekE;GACrBnC,MAAMvC,iBAAiB;KAAGD,kBAAkBmD,aAAaH;IAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,IAAI6B,UAAUU,UACVvC,OAAOuC,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;EAGzE,MAAM,KAAKtE,WAAW2C,KAAKZ,MAAAA;EAE3B,OAAO;GACHA;GACAyC,SAAS;EACb;CACJ;CAEA,MAAMG,OACFnD,IACAjB,OACa;EACb,MAAMA,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAemB,YAAY,CAAA;EAE/E,IACIJ,MAAMc,YACNd,MAAMc,SAASC,SAAS,UACxBf,MAAMc,SAASE,KAAKC,OAAOA,IAE3B,MAAM,IAAIpC,gBAAgB,kCAAA;EAG9B,MAAM2C,SAAS,MAAM,KAAK/B,WAAWoD,UAAU,EAAE5B,GAAG,CAAA;EACpD,IAAI,CAACO,QACD,MAAM,IAAI5C,oBAAAA;EAGd,MAAMoB,MAAMK,oBAAoBuD,SAAS;GACrCrD,MAAMtB,eAAemB;GACrBY,MAAMvC,iBAAiB;KAAGD,kBAAkBmD,aAAaH;IAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEP,IAAIoD,aAAa7C;EACzB,MAAM,KAAK/B,WAAW6E,OAAO9C,MAAAA;EAC7BA,OAAOP,KAAKoD;EAEZ,OAAO7C;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","eq","inArray","or","PermissionName","UserValidator","AbstractEntityService","UserCredentialsService","appendQueryConditions","decodeQuery","userSchema","UserService","repository","realmRepository","validator","ctx","passwordMinLength","getMany","query","actor","permissionNames","USER_READ","USER_UPDATE","USER_DELETE","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","compiled","compile","verdict","self","identity","type","data","id","scoped","condition","findMany","entities","meta","total","entity","push","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","getOne","idOrName","realmId","isMe","findOne","parameters","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneBy","isSelfEdit","preEvaluate","e","USER_SELF_MANAGE","UPDATE","USER_CREATE","CREATE","validated","run","validateJoinColumns","credentialsService","originalName","originalNameLocked","nameLocked","evaluate","merge","REALM_MATCH","password","protect","created","actorRealmId","getActorRealmId","delete","entityId","remove"],"sources":["../../../../src/core/entities/user/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { eq, inArray, or } from '@rapiq/core';\nimport {\n    PermissionName,\n    UserValidator,\n} from '@authup/core-kit';\nimport type { User } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type { IUserRepository, IUserService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { userSchema } from './schema.ts';\n\nexport type UserServiceContext = {\n    repository: IUserRepository;\n    realmRepository: IRealmRepository;\n    passwordMinLength?: number;\n};\n\nexport class UserService extends AbstractEntityService implements IUserService {\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: UserValidator;\n\n    constructor(ctx: UserServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new UserValidator({ passwordMinLength: ctx.passwordMinLength });\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<User>> {\n        const permissionNames = [\n            PermissionName.USER_READ,\n            PermissionName.USER_UPDATE,\n            PermissionName.USER_DELETE,\n        ];\n\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n\n        const parsed = await decodeQuery(query, { schema: userSchema, actor });\n\n        // Compile the read permissions into a row condition (#3286 phase 3). The\n        // own row is always readable, so the self short-circuit composes as an\n        // OR-alternative — the whole gate runs as WHERE and pagination/totals\n        // stay exact. A non-expressible policy falls back to the per-row loop\n        // below.\n        const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });\n        if (compiled.verdict !== 'post') {\n            const self = actor.identity && actor.identity.type === 'user' ?\n                eq('id', actor.identity.data.id) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, self ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    self ? or(self, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped);\n        }\n\n        const {\n            data: entities,\n            meta,\n        } = await this.repository.findMany(parsed);\n\n        const data: User[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (\n                actor.identity &&\n                actor.identity.type === 'user' &&\n                actor.identity.data.id === entity.id\n            ) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: [\n                        PermissionName.USER_READ,\n                        PermissionName.USER_UPDATE,\n                        PermissionName.USER_DELETE,\n                    ],\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<User> {\n        const permissionNames = [\n            PermissionName.USER_READ,\n            PermissionName.USER_UPDATE,\n            PermissionName.USER_DELETE,\n        ];\n\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        const entity = await this.repository.findOne(\n            idOrName,\n            await decodeQuery(query, {\n                schema: userSchema, \n                parameters: ['fields', 'relations'], \n                actor, \n            }),\n            realmId,\n        );\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        if (!isMe) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: permissionNames,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: User,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: User | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'user' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n            }\n\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_CREATE });\n\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const credentialsService = new UserCredentialsService();\n\n        if (entity) {\n            const originalName = entity.name;\n            const originalNameLocked = entity.nameLocked;\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (\n                validated.name &&\n                validated.name !== originalName\n            ) {\n                if (validated.nameLocked) {\n                    entity.nameLocked = validated.nameLocked;\n                }\n\n                if (originalNameLocked && validated.nameLocked !== false) {\n                    entity.name = originalName;\n                }\n            }\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_UPDATE,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: {\n                            ...entity,\n                            ...validated,\n                        },\n                        [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n                    }),\n                });\n            }\n\n            if (validated.password) {\n                entity.password = await credentialsService.protect(validated.password);\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realmId) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        entity = this.repository.create(validated);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        if (validated.password) {\n            entity.password = await credentialsService.protect(validated.password);\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<User> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });\n\n        if (\n            actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === id\n        ) {\n            throw new ValidationError('The own user can not be deleted.');\n        }\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA8BA,IAAagB,cAAb,cAAiCL,sBAAAA;CACnBM;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIT,cAAc,EAAEW,mBAAmBD,IAAIC,kBAAkB,CAAA;CAClF;CAEA,MAAMC,QACFC,OACAC,OAC6C;EAC7C,MAAMC,kBAAkB;GACpBhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;EAClB;EAED,MAAMJ,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAEzE,MAAMO,SAAS,MAAMlB,YAAYS,OAAO;GAAEU,QAAQlB;GAAYS;EAAM,CAAA;EAOpE,MAAMU,WAAW,MAAMV,MAAMK,oBAAoBM,QAAQ,EAAEJ,MAAMN,gBAAgB,CAAA;EACjF,IAAIS,SAASE,YAAY,QAAQ;GAC7B,MAAMC,OAAOb,MAAMc,YAAYd,MAAMc,SAASC,SAAS,SACnDjC,GAAG,MAAMkB,MAAMc,SAASE,KAAKC,EAAE,IAC/B;GAEJ,IAAIC,SAASV;GACb,IAAIE,SAASE,YAAY,QACrBM,SAAS7B,sBAAsBmB,QAAQK,QAAQ9B,QAAQ,MAAM,CAAA,CAAE,CAAA;QAC5D,IAAI2B,SAASE,YAAY,eAC5BM,SAAS7B,sBACLmB,QACAK,OAAO7B,GAAG6B,MAAMH,SAASS,SAAS,IAAIT,SAASS,SAAS;GAIhE,OAAO,KAAK1B,WAAW2B,SAASF,MAAAA;EACpC;EAEA,MAAM,EACFF,MAAMK,UACNC,SACA,MAAM,KAAK7B,WAAW2B,SAASZ,MAAAA;EAEnC,MAAMQ,OAAe,CAAA;EACrB,IAAI,EAAEO,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IACIrB,MAAMc,YACNd,MAAMc,SAASC,SAAS,UACxBf,MAAMc,SAASE,KAAKC,OAAOO,OAAOP,IACpC;IACED,KAAKS,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMxB,MAAMK,oBAAoBqB,cAAc;KAC1CnB,MAAM;MACFtB,eAAeiB;MACfjB,eAAekB;MACflB,eAAemB;KAClB;KACDY,MAAMvC,iBAAiB;OAAGD,kBAAkBmD,aAAaH;MAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;KAAQ,CAAA;IACxG,CAAA;IAEAR,KAAKS,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHP;GACAM,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,UACA9B,OACAD,OACAgC,SACa;EACb,MAAM9B,kBAAkB;GACpBhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;EAClB;EAED,IAAI4B,OAAO,CAAC,CAAChC,MAAMc,YACfd,MAAMc,SAASC,SAAS,WAEpBf,MAAMc,SAASE,KAAKC,OAAOa,YAC3B9B,MAAMc,SAASE,KAAKT,SAASuB;EAGrC,IAAI,CAACE,MACD,MAAMhC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAG7E,MAAMuB,SAAS,MAAM,KAAK/B,WAAWwC,QACjCH,UACA,MAAMxC,YAAYS,OAAO;GACrBU,QAAQlB;GACR2C,YAAY,CAAC,UAAU,WAAY;GACnClC;EACJ,CAAA,GACA+B,OAAAA;EAEJ,IAAI,CAACP,QACD,MAAM,IAAI5C,oBAAAA;EAGd,IAAIoD,QAAQhC,MAAMc,SAAUE,KAAKC,OAAOO,OAAOP,IAAI;GAC/Ce,OAAO;GACP,MAAMhC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAC7E;EAEA,IAAI,CAAC+B,MACD,MAAMhC,MAAMK,oBAAoBqB,cAAc;GAC1CnB,MAAMN;GACNe,MAAMvC,iBAAiB;KAAGD,kBAAkBmD,aAAaH;IAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMW,OACFnB,MACAhB,OACa;EACb,MAAM,EAAEwB,WAAW,MAAM,KAAKY,KAAKC,KAAAA,GAAWrB,MAAMhB,KAAAA;EACpD,OAAOwB;CACX;CAEA,MAAMc,OACFR,UACAd,MACAhB,OACa;EACb,MAAM,EAAEwB,WAAW,MAAM,KAAKY,KAAKN,UAAUd,MAAMhB,OAAO,EAAEuC,YAAY,KAAK,CAAA;EAC7E,OAAOf;CACX;CAEA,MAAMY,KACFN,UACAd,MACAhB,OACAwC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO1B,KAAKe,YAAY,WAClC,MAAM,KAAKrC,gBAAgBiD,QAAQ3B,KAAKe,OAAO,IAC/CM,KAAAA;EAEJ,IAAIb;EACJ,IAAIM,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAIjE,OAAOmD,QAAAA,GACPc,MAAM3B,KAAKa;QAEXc,MAAMrC,OAAOuB;GAGjB,IAAIY,OACAE,MAAMb,UAAUW,MAAMzB;GAG1BO,SAAS,MAAM,KAAK/B,WAAWoD,UAAUD,KAAAA;GACzC,IAAI,CAACpB,UAAUgB,QAAQD,YACnB,MAAM,IAAI3D,oBAAAA;EAElB,OAAO,IAAI4D,QAAQD,YACf,MAAM,IAAI3D,oBAAAA;EAGd,IAAIkE,aAAa;EACjB,IAAItB,QAAQ;GACR,IAAI;IACA,MAAMxB,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAekB,YAAY,CAAA;GACnF,SAAS6C,GAAG;IACR,IACI,CAAChD,MAAMc,YACPd,MAAMc,SAASC,SAAS,UACxBf,MAAMc,SAASE,KAAKC,OAAOO,OAAOP,IAElC,MAAM+B;IAEVF,aAAa;IACb,MAAM9C,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAegE,iBAAiB,CAAA;GACxF;GAEAR,QAAQ/D,eAAewE;EAC3B,OAAO;GACH,MAAMlD,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAekE,YAAY,CAAA;GAE/EV,QAAQ/D,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK1D,UAAU2D,IAAItC,MAAM,EAAEyB,MAAM,CAAA;EAEzD,MAAM,KAAKhD,WAAW8D,oBAAoBF,SAAAA;EAE1C,MAAMG,qBAAqB,IAAIpE,uBAAAA;EAE/B,IAAIoC,QAAQ;GACR,MAAMiC,eAAejC,OAAOjB;GAC5B,MAAMmD,qBAAqBlC,OAAOmC;GAElC,IAAIb,YACA,MAAM9C,MAAMK,oBAAoBuD,SAAS;IACrCrD,MAAMtB,eAAegE;IACrBjC,MAAMvC,iBAAiB;MAAGD,kBAAkBmD,aAAa0B;KAAW,GAAG,KAAKzB,mBAAmByB,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJ7B,SAAS,KAAK/B,WAAWoE,MAAMrC,QAAQ6B,SAAAA;GAEvC,IACIA,UAAU9C,QACV8C,UAAU9C,SAASkD,cACrB;IACE,IAAIJ,UAAUM,YACVnC,OAAOmC,aAAaN,UAAUM;IAGlC,IAAID,sBAAsBL,UAAUM,eAAe,OAC/CnC,OAAOjB,OAAOkD;GAEtB;GAEA,IAAI,CAACX,YACD,MAAM9C,MAAMK,oBAAoBuD,SAAS;IACrCrD,MAAMtB,eAAekB;IACrBa,MAAMvC,iBAAiB;MAClBD,kBAAkBmD,aAAa;MAC5B,GAAGH;MACH,GAAG6B;KACP;MACC7E,kBAAkBsF,cAAcT,UAAUtB,WAAWP,OAAOO,WAAW;IAC5E,CAAA;GACJ,CAAA;GAGJ,IAAIsB,UAAUU,UACVvC,OAAOuC,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;GAGzE,MAAM,KAAKtE,WAAW2C,KAAKZ,MAAAA;GAE3B,OAAO;IACHA;IACAyC,SAAS;GACb;EACJ;EAEA,IAAI,CAACZ,UAAUtB,SAAS;GACpB,MAAMmC,eAAe,KAAKC,gBAAgBnE,KAAAA;GAC1C,IAAIkE,cACAb,UAAUtB,UAAUmC;EAE5B;EAEA1C,SAAS,KAAK/B,WAAW0C,OAAOkB,SAAAA;EAEhC,MAAMrD,MAAMK,oBAAoBuD,SAAS;GACrCrD,MAAMtB,eAAekE;GACrBnC,MAAMvC,iBAAiB;KAAGD,kBAAkBmD,aAAaH;IAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,IAAI6B,UAAUU,UACVvC,OAAOuC,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;EAGzE,MAAM,KAAKtE,WAAW2C,KAAKZ,MAAAA;EAE3B,OAAO;GACHA;GACAyC,SAAS;EACb;CACJ;CAEA,MAAMG,OACFnD,IACAjB,OACa;EACb,MAAMA,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAemB,YAAY,CAAA;EAE/E,IACIJ,MAAMc,YACNd,MAAMc,SAASC,SAAS,UACxBf,MAAMc,SAASE,KAAKC,OAAOA,IAE3B,MAAM,IAAIpC,gBAAgB,kCAAA;EAG9B,MAAM2C,SAAS,MAAM,KAAK/B,WAAWoD,UAAU,EAAE5B,GAAG,CAAA;EACpD,IAAI,CAACO,QACD,MAAM,IAAI5C,oBAAAA;EAGd,MAAMoB,MAAMK,oBAAoBuD,SAAS;GACrCrD,MAAMtB,eAAemB;GACrBY,MAAMvC,iBAAiB;KAAGD,kBAAkBmD,aAAaH;IAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEP,IAAIoD,aAAa7C;EACzB,MAAM,KAAK/B,WAAW6E,OAAO9C,MAAAA;EAC7BA,OAAOP,KAAKoD;EAEZ,OAAO7C;CACX;AACJ"}

package/dist/core/entities/user-attribute/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","user","USER","realm","REALM","userAttributeSchema","name","USER_ATTRIBUTE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user-attribute/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { user: EntityType.USER, realm: EntityType.REALM };\n\nexport const userAttributeSchema = defineSchema<UserAttribute>({\n    name: EntityType.USER_ATTRIBUTE,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'name',\n            'value',\n            'userId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'name', 'userId', 'realmId'] },\n    relations: { allowed: ['user', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: {\n        allowed: [\n            'id',\n            'name',\n            'userId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,sBAAsBR,aAA4B;CAC3DS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAM;EAAQ;EAAU;GAAW;CACxDC,WAAW;EAAED,SAAS,CAAC,QAAQ,OAAA;EAAUE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC1Fc,MAAM,EACFH,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;GAER;CACAI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","user","USER","realm","REALM","userAttributeSchema","name","USER_ATTRIBUTE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user-attribute/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { user: EntityType.USER, realm: EntityType.REALM };\n\nexport const userAttributeSchema = defineSchema<UserAttribute>({\n    name: EntityType.USER_ATTRIBUTE,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'name',\n            'value',\n            'userId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'name', 'userId', 'realmId'] },\n    relations: { allowed: ['user', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: {\n        allowed: [\n            'id',\n            'name',\n            'userId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,sBAAsBR,aAA4B;CAC3DS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAM;EAAQ;EAAU;CAAU,EAAC;CACxDC,WAAW;EAAED,SAAS,CAAC,QAAQ,OAAQ;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC1Fc,MAAM,EACFH,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/user-attribute/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","EntityNotFoundError","ValidationError","eq","inArray","or","PermissionName","buildErrorMessageForAttribute","AbstractEntityService","appendQueryConditions","decodeQuery","userAttributeSchema","UserAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_UPDATE","USER_SELF_MANAGE","parsed","schema","compiled","compile","verdict","self","identity","type","data","id","scoped","condition","findMany","entities","meta","total","entity","canRead","canReadUserAttribute","push","getOne","findOneBy","create","targetUserId","userId","user","isSelfTarget","isSelfFallback","preEvaluate","e","validateJoinColumns","has","realmId","evaluate","ATTRIBUTES","value","resourceRealmMatch","save","update","merge","delete","entityId","remove","isMe"],"sources":["../../../../src/core/entities/user-attribute/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { eq, inArray, or } from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { buildErrorMessageForAttribute } from 'validup';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IUserAttributeRepository, IUserAttributeService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { userAttributeSchema } from './schema.ts';\n\nexport type UserAttributeServiceContext = {\n    repository: IUserAttributeRepository;\n    reservedNames?: ReadonlySet<string>;\n};\n\nexport class UserAttributeService extends AbstractEntityService implements IUserAttributeService {\n    protected repository: IUserAttributeRepository;\n\n    protected reservedNames: ReadonlySet<string>;\n\n    constructor(ctx: UserAttributeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.reservedNames = ctx.reservedNames ?? new Set();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserAttribute>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const parsed = await decodeQuery(query, { schema: userAttributeSchema, actor });\n\n        // Compile the foreign-row gate into a row condition (#3286 phase 3),\n        // mirroring canReadUserAttribute: own rows (the actor's userId) are\n        // always readable, foreign rows require USER_UPDATE. USER_SELF_MANAGE\n        // is deliberately not compiled — its ATTRIBUTE_NAMES denylist policy is\n        // non-lowerable, and the self leg is the ownership term anyway. A\n        // non-expressible USER_UPDATE policy falls back to the per-row loop.\n        const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.USER_UPDATE });\n        if (compiled.verdict !== 'post') {\n            const self = actor.identity && actor.identity.type === 'user' ?\n                eq('userId', actor.identity.data.id) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, self ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    self ? or(self, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped);\n        }\n\n        const {\n            data: entities,\n            meta,\n        } = await this.repository.findMany(parsed);\n\n        const data: UserAttribute[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            const canRead = await this.canReadUserAttribute(actor, entity);\n            if (canRead) {\n                data.push(entity);\n            } else {\n                total--;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const canRead = await this.canReadUserAttribute(actor, entity);\n        if (!canRead) {\n            throw new PermissionError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        const targetUserId: string | undefined = data.userId ||\n            (data.user && data.user.id);\n\n        const isSelfTarget = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            (!targetUserId || targetUserId === actor.identity.data.id);\n\n        let isSelfFallback = false;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n        } catch (e) {\n            if (!isSelfTarget) {\n                throw e;\n            }\n            isSelfFallback = true;\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n        }\n\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new ValidationError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n        }\n\n        if (data.user) {\n            data.realmId = data.user.realmId;\n        } else if (\n            actor.identity &&\n            actor.identity.type === 'user'\n        ) {\n            data.userId = actor.identity.data.id;\n            data.realmId = actor.identity.data.realmId;\n        } else {\n            throw new ValidationError(buildErrorMessageForAttribute('userId'));\n        }\n\n        const entity = this.repository.create(data);\n\n        if (isSelfFallback) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_SELF_MANAGE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } }),\n            });\n        } else {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new ValidationError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n        }\n\n        let entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const isSelfTarget = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.userId;\n\n        let isSelfFallback = false;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n        } catch (e) {\n            if (!isSelfTarget) {\n                throw e;\n            }\n            isSelfFallback = true;\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n        }\n\n        // An attribute belongs to a fixed user; its owner (and the user-derived realmId) is\n        // IMMUTABLE on update — strip both from the body. This blocks a self-manage or admin\n        // caller from reassigning the attribute to another user (isSelfTarget was decided from\n        // the ORIGINAL owner), and blocks a caller-supplied realmId that would gate USER_UPDATE\n        // against a realm of their choosing. To move an attribute, delete + recreate.\n        delete data.userId;\n        delete data.user;\n        delete data.realmId;\n\n        entity = this.repository.merge(entity, data);\n\n        if (isSelfFallback) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_SELF_MANAGE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } }),\n            });\n        } else {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const canRead = await this.canReadUserAttribute(actor, entity);\n        if (!canRead) {\n            throw new PermissionError();\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    private async canReadUserAttribute(\n        actor: ActorContext,\n        entity: UserAttribute,\n    ): Promise<boolean> {\n        const isMe = actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.userId;\n\n        if (isMe) {\n            return true;\n        }\n\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n\n            return true;\n        } catch {\n            return false;\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAwBA,IAAac,uBAAb,cAA0CJ,sBAAAA;CAC5BK;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFhB,eAAeiB,aACfjB,eAAekB,gBAAAA,EAEvB,CAAA;EAEA,MAAMC,SAAS,MAAMf,YAAYQ,OAAO;GAAEQ,QAAQf;GAAqBQ;EAAM,CAAA;EAQ7E,MAAMQ,WAAW,MAAMR,MAAMC,oBAAoBQ,QAAQ,EAAEN,MAAMhB,eAAeiB,YAAY,CAAA;EAC5F,IAAII,SAASE,YAAY,QAAQ;GAC7B,MAAMC,OAAOX,MAAMY,YAAYZ,MAAMY,SAASC,SAAS,SACnD7B,GAAG,UAAUgB,MAAMY,SAASE,KAAKC,EAAE,IACnC;GAEJ,IAAIC,SAASV;GACb,IAAIE,SAASE,YAAY,QACrBM,SAAS1B,sBAAsBgB,QAAQK,QAAQ1B,QAAQ,MAAM,CAAA,CAAE,CAAA;QAC5D,IAAIuB,SAASE,YAAY,eAC5BM,SAAS1B,sBACLgB,QACAK,OAAOzB,GAAGyB,MAAMH,SAASS,SAAS,IAAIT,SAASS,SAAS;GAIhE,OAAO,KAAKvB,WAAWwB,SAASF,MAAAA;EACpC;EAEA,MAAM,EACFF,MAAMK,UACNC,SACA,MAAM,KAAK1B,WAAWwB,SAASZ,MAAAA;EAEnC,MAAMQ,OAAwB,CAAA;EAC9B,IAAI,EAAEO,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAEjB,IAAII,MADkB,KAAKC,qBAAqBxB,OAAOsB,MAAAA,GAEnDR,KAAKW,KAAKH,MAAAA;OAEVD;EAIR,OAAO;GACHP;GACAM,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMK,OACFX,IACAf,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFhB,eAAeiB,aACfjB,eAAekB,gBAAAA,EAEvB,CAAA;EAEA,MAAMiB,SAAS,MAAM,KAAK5B,WAAWiC,UAAU,EAAEZ,GAAG,CAAA;EACpD,IAAI,CAACO,QACD,MAAM,IAAIxC,oBAAAA;EAId,IAAI,CAACyC,MADiB,KAAKC,qBAAqBxB,OAAOsB,MAAAA,GAEnD,MAAM,IAAI1C,gBAAAA;EAGd,OAAO0C;CACX;CAEA,MAAMM,OACFd,MACAd,OACsB;EACtB,MAAM6B,eAAmCf,KAAKgB,UACzChB,KAAKiB,QAAQjB,KAAKiB,KAAKhB;EAE5B,MAAMiB,eAAe,CAAC,CAAChC,MAAMY,YACzBZ,MAAMY,SAASC,SAAS,WACvB,CAACgB,gBAAgBA,iBAAiB7B,MAAMY,SAASE,KAAKC;EAE3D,IAAIkB,iBAAiB;EACrB,IAAI;GACA,MAAMjC,MAAMC,oBAAoBiC,YAAY,EAAE/B,MAAMhB,eAAeiB,YAAY,CAAA;EACnF,SAAS+B,GAAG;GACR,IAAI,CAACH,cACD,MAAMG;GAEVF,iBAAiB;GACjB,MAAMjC,MAAMC,oBAAoBiC,YAAY,EAAE/B,MAAMhB,eAAekB,iBAAiB,CAAA;EACxF;EAEA,MAAM,KAAKX,WAAW0C,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKX,SAAS,YAAY,KAAKR,cAAc0C,IAAIvB,KAAKX,IAAI,GACjE,MAAM,IAAIpB,gBAAgB,4BAA4B+B,KAAKX,KAAK,sCAAsC;EAG1G,IAAIW,KAAKiB,MACLjB,KAAKwB,UAAUxB,KAAKiB,KAAKO;OACtB,IACHtC,MAAMY,YACNZ,MAAMY,SAASC,SAAS,QAC1B;GACEC,KAAKgB,SAAS9B,MAAMY,SAASE,KAAKC;GAClCD,KAAKwB,UAAUtC,MAAMY,SAASE,KAAKwB;EACvC,OACI,MAAM,IAAIvD,gBAAgBK,8BAA8B,QAAA,CAAA;EAG5D,MAAMkC,SAAS,KAAK5B,WAAWkC,OAAOd,IAAAA;EAEtC,IAAImB,gBACA,MAAMjC,MAAMC,oBAAoBsC,SAAS;GACrCpC,MAAMhB,eAAekB;GACrBS,MAAMjC,iBAAiB,GAAGF,kBAAkB6D,aAAa,GAAG1B,KAAKX,OAAOW,KAAK2B,MAAM,EAAE,CAAA;EACzF,CAAA;OAEA,MAAMzC,MAAMC,oBAAoBsC,SAAS;GACrCpC,MAAMhB,eAAeiB;GACrBU,MAAMjC,iBAAiB;KAAGF,kBAAkB6D,aAAalB;IAAQ,GAAG,KAAKoB,mBAAmBpB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAK5B,WAAWiD,KAAKrB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMsB,OACF7B,IACAD,MACAd,OACsB;EACtB,MAAM,KAAKN,WAAW0C,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKX,SAAS,YAAY,KAAKR,cAAc0C,IAAIvB,KAAKX,IAAI,GACjE,MAAM,IAAIpB,gBAAgB,4BAA4B+B,KAAKX,KAAK,sCAAsC;EAG1G,IAAImB,SAAS,MAAM,KAAK5B,WAAWiC,UAAU,EAAEZ,GAAG,CAAA;EAClD,IAAI,CAACO,QACD,MAAM,IAAIxC,oBAAAA;EAGd,MAAMkD,eAAe,CAAC,CAAChC,MAAMY,YACzBZ,MAAMY,SAASC,SAAS,UACxBb,MAAMY,SAASE,KAAKC,OAAOO,OAAOQ;EAEtC,IAAIG,iBAAiB;EACrB,IAAI;GACA,MAAMjC,MAAMC,oBAAoBiC,YAAY,EAAE/B,MAAMhB,eAAeiB,YAAY,CAAA;EACnF,SAAS+B,GAAG;GACR,IAAI,CAACH,cACD,MAAMG;GAEVF,iBAAiB;GACjB,MAAMjC,MAAMC,oBAAoBiC,YAAY,EAAE/B,MAAMhB,eAAekB,iBAAiB,CAAA;EACxF;EAOA,OAAOS,KAAKgB;EACZ,OAAOhB,KAAKiB;EACZ,OAAOjB,KAAKwB;EAEZhB,SAAS,KAAK5B,WAAWmD,MAAMvB,QAAQR,IAAAA;EAEvC,IAAImB,gBACA,MAAMjC,MAAMC,oBAAoBsC,SAAS;GACrCpC,MAAMhB,eAAekB;GACrBS,MAAMjC,iBAAiB,GAAGF,kBAAkB6D,aAAa,GAAGlB,OAAOnB,OAAOmB,OAAOmB,MAAM,EAAE,CAAA;EAC7F,CAAA;OAEA,MAAMzC,MAAMC,oBAAoBsC,SAAS;GACrCpC,MAAMhB,eAAeiB;GACrBU,MAAMjC,iBAAiB;KAAGF,kBAAkB6D,aAAalB;IAAQ,GAAG,KAAKoB,mBAAmBpB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAK5B,WAAWiD,KAAKrB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMwB,OACF/B,IACAf,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFhB,eAAeiB,aACfjB,eAAekB,gBAAAA,EAEvB,CAAA;EAEA,MAAMiB,SAAS,MAAM,KAAK5B,WAAWiC,UAAU,EAAEZ,GAAG,CAAA;EACpD,IAAI,CAACO,QACD,MAAM,IAAIxC,oBAAAA;EAId,IAAI,CAACyC,MADiB,KAAKC,qBAAqBxB,OAAOsB,MAAAA,GAEnD,MAAM,IAAI1C,gBAAAA;EAGd,MAAM,EAAEmC,IAAIgC,aAAazB;EACzB,MAAM,KAAK5B,WAAWsD,OAAO1B,MAAAA;EAC7BA,OAAOP,KAAKgC;EAEZ,OAAOzB;CACX;CAEA,MAAcE,qBACVxB,OACAsB,QACgB;EAKhB,IAJatB,MAAMY,YACfZ,MAAMY,SAASC,SAAS,UACxBb,MAAMY,SAASE,KAAKC,OAAOO,OAAOQ,QAGlC,OAAO;EAGX,IAAI;GACA,MAAM9B,MAAMC,oBAAoBsC,SAAS;IACrCpC,MAAMhB,eAAeiB;IACrBU,MAAMjC,iBAAiB;MAAGF,kBAAkB6D,aAAalB;KAAQ,GAAG,KAAKoB,mBAAmBpB,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAEA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","EntityNotFoundError","ValidationError","eq","inArray","or","PermissionName","buildErrorMessageForAttribute","AbstractEntityService","appendQueryConditions","decodeQuery","userAttributeSchema","UserAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_UPDATE","USER_SELF_MANAGE","parsed","schema","compiled","compile","verdict","self","identity","type","data","id","scoped","condition","findMany","entities","meta","total","entity","canRead","canReadUserAttribute","push","getOne","findOneBy","create","targetUserId","userId","user","isSelfTarget","isSelfFallback","preEvaluate","e","validateJoinColumns","has","realmId","evaluate","ATTRIBUTES","value","resourceRealmMatch","save","update","merge","delete","entityId","remove","isMe"],"sources":["../../../../src/core/entities/user-attribute/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { eq, inArray, or } from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { buildErrorMessageForAttribute } from 'validup';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IUserAttributeRepository, IUserAttributeService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { userAttributeSchema } from './schema.ts';\n\nexport type UserAttributeServiceContext = {\n    repository: IUserAttributeRepository;\n    reservedNames?: ReadonlySet<string>;\n};\n\nexport class UserAttributeService extends AbstractEntityService implements IUserAttributeService {\n    protected repository: IUserAttributeRepository;\n\n    protected reservedNames: ReadonlySet<string>;\n\n    constructor(ctx: UserAttributeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.reservedNames = ctx.reservedNames ?? new Set();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserAttribute>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const parsed = await decodeQuery(query, { schema: userAttributeSchema, actor });\n\n        // Compile the foreign-row gate into a row condition (#3286 phase 3),\n        // mirroring canReadUserAttribute: own rows (the actor's userId) are\n        // always readable, foreign rows require USER_UPDATE. USER_SELF_MANAGE\n        // is deliberately not compiled — its ATTRIBUTE_NAMES denylist policy is\n        // non-lowerable, and the self leg is the ownership term anyway. A\n        // non-expressible USER_UPDATE policy falls back to the per-row loop.\n        const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.USER_UPDATE });\n        if (compiled.verdict !== 'post') {\n            const self = actor.identity && actor.identity.type === 'user' ?\n                eq('userId', actor.identity.data.id) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, self ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    self ? or(self, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped);\n        }\n\n        const {\n            data: entities,\n            meta,\n        } = await this.repository.findMany(parsed);\n\n        const data: UserAttribute[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            const canRead = await this.canReadUserAttribute(actor, entity);\n            if (canRead) {\n                data.push(entity);\n            } else {\n                total--;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const canRead = await this.canReadUserAttribute(actor, entity);\n        if (!canRead) {\n            throw new PermissionError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        const targetUserId: string | undefined = data.userId ||\n            (data.user && data.user.id);\n\n        const isSelfTarget = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            (!targetUserId || targetUserId === actor.identity.data.id);\n\n        let isSelfFallback = false;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n        } catch (e) {\n            if (!isSelfTarget) {\n                throw e;\n            }\n            isSelfFallback = true;\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n        }\n\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new ValidationError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n        }\n\n        if (data.user) {\n            data.realmId = data.user.realmId;\n        } else if (\n            actor.identity &&\n            actor.identity.type === 'user'\n        ) {\n            data.userId = actor.identity.data.id;\n            data.realmId = actor.identity.data.realmId;\n        } else {\n            throw new ValidationError(buildErrorMessageForAttribute('userId'));\n        }\n\n        const entity = this.repository.create(data);\n\n        if (isSelfFallback) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_SELF_MANAGE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } }),\n            });\n        } else {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new ValidationError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n        }\n\n        let entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const isSelfTarget = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.userId;\n\n        let isSelfFallback = false;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n        } catch (e) {\n            if (!isSelfTarget) {\n                throw e;\n            }\n            isSelfFallback = true;\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n        }\n\n        // An attribute belongs to a fixed user; its owner (and the user-derived realmId) is\n        // IMMUTABLE on update — strip both from the body. This blocks a self-manage or admin\n        // caller from reassigning the attribute to another user (isSelfTarget was decided from\n        // the ORIGINAL owner), and blocks a caller-supplied realmId that would gate USER_UPDATE\n        // against a realm of their choosing. To move an attribute, delete + recreate.\n        delete data.userId;\n        delete data.user;\n        delete data.realmId;\n\n        entity = this.repository.merge(entity, data);\n\n        if (isSelfFallback) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_SELF_MANAGE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } }),\n            });\n        } else {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const canRead = await this.canReadUserAttribute(actor, entity);\n        if (!canRead) {\n            throw new PermissionError();\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    private async canReadUserAttribute(\n        actor: ActorContext,\n        entity: UserAttribute,\n    ): Promise<boolean> {\n        const isMe = actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.userId;\n\n        if (isMe) {\n            return true;\n        }\n\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n\n            return true;\n        } catch {\n            return false;\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAwBA,IAAac,uBAAb,cAA0CJ,sBAAAA;CAC5BK;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFhB,eAAeiB,aACfjB,eAAekB,gBAClB,EACL,CAAA;EAEA,MAAMC,SAAS,MAAMf,YAAYQ,OAAO;GAAEQ,QAAQf;GAAqBQ;EAAM,CAAA;EAQ7E,MAAMQ,WAAW,MAAMR,MAAMC,oBAAoBQ,QAAQ,EAAEN,MAAMhB,eAAeiB,YAAY,CAAA;EAC5F,IAAII,SAASE,YAAY,QAAQ;GAC7B,MAAMC,OAAOX,MAAMY,YAAYZ,MAAMY,SAASC,SAAS,SACnD7B,GAAG,UAAUgB,MAAMY,SAASE,KAAKC,EAAE,IACnC;GAEJ,IAAIC,SAASV;GACb,IAAIE,SAASE,YAAY,QACrBM,SAAS1B,sBAAsBgB,QAAQK,QAAQ1B,QAAQ,MAAM,CAAA,CAAE,CAAA;QAC5D,IAAIuB,SAASE,YAAY,eAC5BM,SAAS1B,sBACLgB,QACAK,OAAOzB,GAAGyB,MAAMH,SAASS,SAAS,IAAIT,SAASS,SAAS;GAIhE,OAAO,KAAKvB,WAAWwB,SAASF,MAAAA;EACpC;EAEA,MAAM,EACFF,MAAMK,UACNC,SACA,MAAM,KAAK1B,WAAWwB,SAASZ,MAAAA;EAEnC,MAAMQ,OAAwB,CAAA;EAC9B,IAAI,EAAEO,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAEjB,IAAII,MADkB,KAAKC,qBAAqBxB,OAAOsB,MAAAA,GAEnDR,KAAKW,KAAKH,MAAAA;OAEVD;EAIR,OAAO;GACHP;GACAM,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMK,OACFX,IACAf,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFhB,eAAeiB,aACfjB,eAAekB,gBAClB,EACL,CAAA;EAEA,MAAMiB,SAAS,MAAM,KAAK5B,WAAWiC,UAAU,EAAEZ,GAAG,CAAA;EACpD,IAAI,CAACO,QACD,MAAM,IAAIxC,oBAAAA;EAId,IAAI,CAACyC,MADiB,KAAKC,qBAAqBxB,OAAOsB,MAAAA,GAEnD,MAAM,IAAI1C,gBAAAA;EAGd,OAAO0C;CACX;CAEA,MAAMM,OACFd,MACAd,OACsB;EACtB,MAAM6B,eAAmCf,KAAKgB,UACzChB,KAAKiB,QAAQjB,KAAKiB,KAAKhB;EAE5B,MAAMiB,eAAe,CAAC,CAAChC,MAAMY,YACzBZ,MAAMY,SAASC,SAAS,WACvB,CAACgB,gBAAgBA,iBAAiB7B,MAAMY,SAASE,KAAKC;EAE3D,IAAIkB,iBAAiB;EACrB,IAAI;GACA,MAAMjC,MAAMC,oBAAoBiC,YAAY,EAAE/B,MAAMhB,eAAeiB,YAAY,CAAA;EACnF,SAAS+B,GAAG;GACR,IAAI,CAACH,cACD,MAAMG;GAEVF,iBAAiB;GACjB,MAAMjC,MAAMC,oBAAoBiC,YAAY,EAAE/B,MAAMhB,eAAekB,iBAAiB,CAAA;EACxF;EAEA,MAAM,KAAKX,WAAW0C,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKX,SAAS,YAAY,KAAKR,cAAc0C,IAAIvB,KAAKX,IAAI,GACjE,MAAM,IAAIpB,gBAAgB,4BAA4B+B,KAAKX,KAAK,sCAAsC;EAG1G,IAAIW,KAAKiB,MACLjB,KAAKwB,UAAUxB,KAAKiB,KAAKO;OACtB,IACHtC,MAAMY,YACNZ,MAAMY,SAASC,SAAS,QAC1B;GACEC,KAAKgB,SAAS9B,MAAMY,SAASE,KAAKC;GAClCD,KAAKwB,UAAUtC,MAAMY,SAASE,KAAKwB;EACvC,OACI,MAAM,IAAIvD,gBAAgBK,8BAA8B,QAAA,CAAA;EAG5D,MAAMkC,SAAS,KAAK5B,WAAWkC,OAAOd,IAAAA;EAEtC,IAAImB,gBACA,MAAMjC,MAAMC,oBAAoBsC,SAAS;GACrCpC,MAAMhB,eAAekB;GACrBS,MAAMjC,iBAAiB,GAAGF,kBAAkB6D,aAAa,GAAG1B,KAAKX,OAAOW,KAAK2B,MAAM,EAAE,CAAA;EACzF,CAAA;OAEA,MAAMzC,MAAMC,oBAAoBsC,SAAS;GACrCpC,MAAMhB,eAAeiB;GACrBU,MAAMjC,iBAAiB;KAAGF,kBAAkB6D,aAAalB;IAAQ,GAAG,KAAKoB,mBAAmBpB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAK5B,WAAWiD,KAAKrB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMsB,OACF7B,IACAD,MACAd,OACsB;EACtB,MAAM,KAAKN,WAAW0C,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKX,SAAS,YAAY,KAAKR,cAAc0C,IAAIvB,KAAKX,IAAI,GACjE,MAAM,IAAIpB,gBAAgB,4BAA4B+B,KAAKX,KAAK,sCAAsC;EAG1G,IAAImB,SAAS,MAAM,KAAK5B,WAAWiC,UAAU,EAAEZ,GAAG,CAAA;EAClD,IAAI,CAACO,QACD,MAAM,IAAIxC,oBAAAA;EAGd,MAAMkD,eAAe,CAAC,CAAChC,MAAMY,YACzBZ,MAAMY,SAASC,SAAS,UACxBb,MAAMY,SAASE,KAAKC,OAAOO,OAAOQ;EAEtC,IAAIG,iBAAiB;EACrB,IAAI;GACA,MAAMjC,MAAMC,oBAAoBiC,YAAY,EAAE/B,MAAMhB,eAAeiB,YAAY,CAAA;EACnF,SAAS+B,GAAG;GACR,IAAI,CAACH,cACD,MAAMG;GAEVF,iBAAiB;GACjB,MAAMjC,MAAMC,oBAAoBiC,YAAY,EAAE/B,MAAMhB,eAAekB,iBAAiB,CAAA;EACxF;EAOA,OAAOS,KAAKgB;EACZ,OAAOhB,KAAKiB;EACZ,OAAOjB,KAAKwB;EAEZhB,SAAS,KAAK5B,WAAWmD,MAAMvB,QAAQR,IAAAA;EAEvC,IAAImB,gBACA,MAAMjC,MAAMC,oBAAoBsC,SAAS;GACrCpC,MAAMhB,eAAekB;GACrBS,MAAMjC,iBAAiB,GAAGF,kBAAkB6D,aAAa,GAAGlB,OAAOnB,OAAOmB,OAAOmB,MAAM,EAAE,CAAA;EAC7F,CAAA;OAEA,MAAMzC,MAAMC,oBAAoBsC,SAAS;GACrCpC,MAAMhB,eAAeiB;GACrBU,MAAMjC,iBAAiB;KAAGF,kBAAkB6D,aAAalB;IAAQ,GAAG,KAAKoB,mBAAmBpB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAK5B,WAAWiD,KAAKrB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMwB,OACF/B,IACAf,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFhB,eAAeiB,aACfjB,eAAekB,gBAClB,EACL,CAAA;EAEA,MAAMiB,SAAS,MAAM,KAAK5B,WAAWiC,UAAU,EAAEZ,GAAG,CAAA;EACpD,IAAI,CAACO,QACD,MAAM,IAAIxC,oBAAAA;EAId,IAAI,CAACyC,MADiB,KAAKC,qBAAqBxB,OAAOsB,MAAAA,GAEnD,MAAM,IAAI1C,gBAAAA;EAGd,MAAM,EAAEmC,IAAIgC,aAAazB;EACzB,MAAM,KAAK5B,WAAWsD,OAAO1B,MAAAA;EAC7BA,OAAOP,KAAKgC;EAEZ,OAAOzB;CACX;CAEA,MAAcE,qBACVxB,OACAsB,QACgB;EAKhB,IAJatB,MAAMY,YACfZ,MAAMY,SAASC,SAAS,UACxBb,MAAMY,SAASE,KAAKC,OAAOO,OAAOQ,QAGlC,OAAO;EAGX,IAAI;GACA,MAAM9B,MAAMC,oBAAoBsC,SAAS;IACrCpC,MAAMhB,eAAeiB;IACrBU,MAAMjC,iBAAiB;MAAGF,kBAAkB6D,aAAalB;KAAQ,GAAG,KAAKoB,mBAAmBpB,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAEA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ"}

package/dist/core/entities/user-authenticator/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","user","USER","realm","REALM","userAuthenticatorSchema","name","USER_AUTHENTICATOR","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user-authenticator/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { UserAuthenticator } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { user: EntityType.USER, realm: EntityType.REALM };\n\nexport const userAuthenticatorSchema = defineSchema<UserAuthenticator>({\n    name: EntityType.USER_AUTHENTICATOR,\n    fields: {\n        allowed: [\n            'id',\n            'kind',\n            'name',\n            'confirmed',\n            'lastUsedAt',\n            'createdAt',\n            'updatedAt',\n            'userId',\n            'realmId',\n        ],\n    },\n    filters: { allowed: ['id', 'kind', 'confirmed', 'userId', 'realmId'] },\n    relations: { allowed: ['user', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['createdAt', 'updatedAt', 'lastUsedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,0BAA0BR,aAAgC;CACnES,MAAMR,WAAWS;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;EAAa;EAAU;GAAW;CACrEE,WAAW;EAAEF,SAAS,CAAC,QAAQ,OAAA;EAAUG,UAAUb,wBAAwBC,aAAAA;CAAe;CAC1Fa,MAAM,EAAEJ,SAAS;EAAC;EAAa;EAAa;GAAc;CAC1DK,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","user","USER","realm","REALM","userAuthenticatorSchema","name","USER_AUTHENTICATOR","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user-authenticator/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { UserAuthenticator } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { user: EntityType.USER, realm: EntityType.REALM };\n\nexport const userAuthenticatorSchema = defineSchema<UserAuthenticator>({\n    name: EntityType.USER_AUTHENTICATOR,\n    fields: {\n        allowed: [\n            'id',\n            'kind',\n            'name',\n            'confirmed',\n            'lastUsedAt',\n            'createdAt',\n            'updatedAt',\n            'userId',\n            'realmId',\n        ],\n    },\n    filters: { allowed: ['id', 'kind', 'confirmed', 'userId', 'realmId'] },\n    relations: { allowed: ['user', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['createdAt', 'updatedAt', 'lastUsedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,0BAA0BR,aAAgC;CACnES,MAAMR,WAAWS;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;EAAa;EAAU;CAAU,EAAC;CACrEE,WAAW;EAAEF,SAAS,CAAC,QAAQ,OAAQ;EAAEG,UAAUb,wBAAwBC,aAAAA;CAAe;CAC1Fa,MAAM,EAAEJ,SAAS;EAAC;EAAa;EAAa;CAAa,EAAC;CAC1DK,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}