@authup/server-core 1.0.0-beta.55 → 1.0.0-beta.57

package/dist/core/authentication/login-throttle/service.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import "../../entities/event/constants.mjs";
 import { EventName } from "@authup/core-kit";
 import { LoginThrottledError } from "@authup/errors";
 //#region src/core/authentication/login-throttle/service.ts
@@ -20,7 +21,7 @@ var LoginThrottleService = class {
 		const windowSeconds = this.options.windowSeconds ?? DEFAULT_WINDOW_SECONDS;
 		if (await this.repository.countRecent({
 			name: EventName.LOGIN_FAILED,
-			actorName: ctx.identifier,
+			actorName: ctx.identifier.slice(0, 128),
 			requestIpAddress: ctx.ipAddress,
 			realmId: ctx.realmId,
 			since: (/* @__PURE__ */ new Date(Date.now() - windowSeconds * 1e3)).toISOString()

package/dist/core/authentication/login-throttle/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["EventName","LoginThrottledError","DEFAULT_THRESHOLD","DEFAULT_WINDOW_SECONDS","LoginThrottleService","repository","options","ctx","assertNotThrottled","enabled","ipAddress","threshold","windowSeconds","count","countRecent","name","LOGIN_FAILED","actorName","identifier","requestIpAddress","realmId","since","Date","now","toISOString","retryAfter"],"sources":["../../../../src/core/authentication/login-throttle/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { EventName } from '@authup/core-kit';\nimport { LoginThrottledError } from '@authup/errors';\nimport type { IEventRepository } from '../../entities/index.ts';\nimport type { ILoginThrottleService, LoginThrottleServiceContext, LoginThrottleServiceOptions } from './types.ts';\n\nconst DEFAULT_THRESHOLD = 5;\nconst DEFAULT_WINDOW_SECONDS = 900;\n\nexport class LoginThrottleService implements ILoginThrottleService {\n    protected repository: IEventRepository;\n\n    protected options: LoginThrottleServiceOptions;\n\n    constructor(ctx: LoginThrottleServiceContext) {\n        this.repository = ctx.repository;\n        this.options = ctx.options ?? {};\n    }\n\n    async assertNotThrottled(\n        ctx: {\n            identifier: string, \n            ipAddress?: string, \n            realmId?: string | null \n        },\n    ): Promise<void> {\n        if (!this.options.enabled) {\n            return;\n        }\n\n        // The (identifier, ip) pair is the account-lockout-DoS mitigation: an\n        // attacker on one IP can never lock the victim's other IPs. Without a\n        // derivable IP the pair does not exist, so the throttle fails open\n        // instead of degrading to a lockable per-identifier key.\n        if (!ctx.ipAddress) {\n            return;\n        }\n\n        const threshold = this.options.threshold ?? DEFAULT_THRESHOLD;\n        const windowSeconds = this.options.windowSeconds ?? DEFAULT_WINDOW_SECONDS;\n\n        const count = await this.repository.countRecent({\n            name: EventName.LOGIN_FAILED,\n            actorName: ctx.identifier,\n            requestIpAddress: ctx.ipAddress,\n            realmId: ctx.realmId,\n            since: new Date(Date.now() - (windowSeconds * 1_000)).toISOString(),\n        });\n\n        if (count >= threshold) {\n            throw new LoginThrottledError({ retryAfter: windowSeconds });\n        }\n    }\n}\n"],"mappings":";;;;;;AAYA,MAAME,oBAAoB;AAC1B,MAAMC,yBAAyB;AAE/B,IAAaC,uBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,mBACFD,KAKa;EACb,IAAI,CAAC,KAAKD,QAAQG,SACd;EAOJ,IAAI,CAACF,IAAIG,WACL;EAGJ,MAAMC,YAAY,KAAKL,QAAQK,aAAaT;EAC5C,MAAMU,gBAAgB,KAAKN,QAAQM,iBAAiBT;EAUpD,IAAIU,MARgB,KAAKR,WAAWS,YAAY;GAC5CC,MAAMf,UAAUgB;GAChBC,WAAWV,IAAIW;GACfC,kBAAkBZ,IAAIG;GACtBU,SAASb,IAAIa;GACbC,wBAAO,IAAIC,KAAKA,KAAKC,IAAG,IAAMX,gBAAgB,GAAA,EAAA,CAAQY,YAAW;EACrE,CAAA,KAEab,WACT,MAAM,IAAIV,oBAAoB,EAAEwB,YAAYb,cAAc,CAAA;CAElE;AACJ"}
+{"version":3,"file":"service.mjs","names":["EventName","LoginThrottledError","EVENT_ACTOR_NAME_MAX_LENGTH","DEFAULT_THRESHOLD","DEFAULT_WINDOW_SECONDS","LoginThrottleService","repository","options","ctx","assertNotThrottled","enabled","ipAddress","threshold","windowSeconds","count","countRecent","name","LOGIN_FAILED","actorName","identifier","slice","requestIpAddress","realmId","since","Date","now","toISOString","retryAfter"],"sources":["../../../../src/core/authentication/login-throttle/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { EventName } from '@authup/core-kit';\nimport { LoginThrottledError } from '@authup/errors';\n// direct file import — the entities barrel reaches every entity service, and a\n// value import of it from here would pull that graph in at module init.\nimport { EVENT_ACTOR_NAME_MAX_LENGTH } from '../../entities/event/constants.ts';\nimport type { IEventRepository } from '../../entities/index.ts';\nimport type { ILoginThrottleService, LoginThrottleServiceContext, LoginThrottleServiceOptions } from './types.ts';\n\nconst DEFAULT_THRESHOLD = 5;\nconst DEFAULT_WINDOW_SECONDS = 900;\n\nexport class LoginThrottleService implements ILoginThrottleService {\n    protected repository: IEventRepository;\n\n    protected options: LoginThrottleServiceOptions;\n\n    constructor(ctx: LoginThrottleServiceContext) {\n        this.repository = ctx.repository;\n        this.options = ctx.options ?? {};\n    }\n\n    async assertNotThrottled(\n        ctx: {\n            identifier: string, \n            ipAddress?: string, \n            realmId?: string | null \n        },\n    ): Promise<void> {\n        if (!this.options.enabled) {\n            return;\n        }\n\n        // The (identifier, ip) pair is the account-lockout-DoS mitigation: an\n        // attacker on one IP can never lock the victim's other IPs. Without a\n        // derivable IP the pair does not exist, so the throttle fails open\n        // instead of degrading to a lockable per-identifier key.\n        if (!ctx.ipAddress) {\n            return;\n        }\n\n        const threshold = this.options.threshold ?? DEFAULT_THRESHOLD;\n        const windowSeconds = this.options.windowSeconds ?? DEFAULT_WINDOW_SECONDS;\n\n        const count = await this.repository.countRecent({\n            name: EventName.LOGIN_FAILED,\n            // the loginFailed rows are persisted with the actor name truncated\n            // to the column bound — an untruncated key would never match its\n            // own rows, silently failing open for over-long identifiers.\n            actorName: ctx.identifier.slice(0, EVENT_ACTOR_NAME_MAX_LENGTH),\n            requestIpAddress: ctx.ipAddress,\n            realmId: ctx.realmId,\n            since: new Date(Date.now() - (windowSeconds * 1_000)).toISOString(),\n        });\n\n        if (count >= threshold) {\n            throw new LoginThrottledError({ retryAfter: windowSeconds });\n        }\n    }\n}\n"],"mappings":";;;;;;;AAeA,MAAMG,oBAAoB;AAC1B,MAAMC,yBAAyB;AAE/B,IAAaC,uBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,mBACFD,KAKa;EACb,IAAI,CAAC,KAAKD,QAAQG,SACd;EAOJ,IAAI,CAACF,IAAIG,WACL;EAGJ,MAAMC,YAAY,KAAKL,QAAQK,aAAaT;EAC5C,MAAMU,gBAAgB,KAAKN,QAAQM,iBAAiBT;EAapD,IAAIU,MAXgB,KAAKR,WAAWS,YAAY;GAC5CC,MAAMhB,UAAUiB;GAIhBC,WAAWV,IAAIW,WAAWC,MAAM,GAAA,GAAGlB;GACnCmB,kBAAkBb,IAAIG;GACtBW,SAASd,IAAIc;GACbC,wBAAO,IAAIC,KAAKA,KAAKC,IAAG,IAAMZ,gBAAgB,GAAA,EAAA,CAAQa,YAAW;EACrE,CAAA,KAEad,WACT,MAAM,IAAIX,oBAAoB,EAAE0B,YAAYd,cAAc,CAAA;CAElE;AACJ"}

package/dist/core/entities/client/constants.d.ts

@@ -0,0 +1,10 @@
+import { PermissionName } from '@authup/core-kit';
+/**
+ * The client read-permission disjunction: holding ANY of these grants
+ * read access to client rows. Shared between `ClientService`'s
+ * getMany/getOne pre-gates and the schema-level `secret` visibility
+ * gate (issue #3322) — the two MUST evaluate the same disjunction, or
+ * listability and secret visibility silently diverge.
+ */
+export declare const CLIENT_READ_PERMISSIONS: PermissionName[];
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/entities/client/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAG,cAAc,EAIpD,CAAC"}

package/dist/core/entities/client/constants.mjs

@@ -0,0 +1,20 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PermissionName } from "@authup/core-kit";
+//#region src/core/entities/client/constants.ts
+/**
+* The client read-permission disjunction: holding ANY of these grants
+* read access to client rows. Shared between `ClientService`'s
+* getMany/getOne pre-gates and the schema-level `secret` visibility
+* gate (issue #3322) — the two MUST evaluate the same disjunction, or
+* listability and secret visibility silently diverge.
+*/ const CLIENT_READ_PERMISSIONS = [
+	PermissionName.CLIENT_READ,
+	PermissionName.CLIENT_UPDATE,
+	PermissionName.CLIENT_DELETE
+];
+//#endregion
+export { CLIENT_READ_PERMISSIONS };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/entities/client/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["PermissionName","CLIENT_READ_PERMISSIONS","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE"],"sources":["../../../../src/core/entities/client/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { PermissionName } from '@authup/core-kit';\n\n/**\n * The client read-permission disjunction: holding ANY of these grants\n * read access to client rows. Shared between `ClientService`'s\n * getMany/getOne pre-gates and the schema-level `secret` visibility\n * gate (issue #3322) — the two MUST evaluate the same disjunction, or\n * listability and secret visibility silently diverge.\n */\nexport const CLIENT_READ_PERMISSIONS : PermissionName[] = [\n    PermissionName.CLIENT_READ,\n    PermissionName.CLIENT_UPDATE,\n    PermissionName.CLIENT_DELETE,\n];\n"],"mappings":";;;;;;;;;;;GAgBA,MAAaC,0BAA6C;CACtDD,eAAeE;CACfF,eAAeG;CACfH,eAAeI;AAClB"}

package/dist/core/entities/client/index.d.ts

@@ -1,3 +1,4 @@
+export * from './constants.ts';
 export * from './service.ts';
 export * from './types.ts';
 export * from './web-client.ts';

package/dist/core/entities/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}

package/dist/core/entities/client/index.mjs

@@ -1,7 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { CLIENT_READ_PERMISSIONS } from "./constants.mjs";
 import { clientSchema } from "./schema.mjs";
 import { ClientService } from "./service.mjs";
-import { WebClientProvisioner, buildWebClientAttributes } from "./web-client.mjs";
-export { ClientService, WebClientProvisioner, buildWebClientAttributes, clientSchema };
+import { WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes } from "./web-client.mjs";
+export { CLIENT_READ_PERMISSIONS, ClientService, WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes, clientSchema };

package/dist/core/entities/client/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM/C,eAAO,MAAM,YAAY,2CAgCvB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/schema.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA2D/C,eAAO,MAAM,YAAY,2CAiCvB,CAAC"}

package/dist/core/entities/client/schema.mjs

@@ -1,14 +1,50 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { CLIENT_READ_PERMISSIONS } from "./constants.mjs";
+import { createFieldsReadGate } from "../../query/fields.mjs";
 import { createRelationsReadGate } from "../../query/relations.mjs";
-import { EntityType } from "@authup/core-kit";
-import { defineSchema } from "@rapiq/core";
+import { EntityType, IdentityType } from "@authup/core-kit";
+import { and, defineSchema, eq, ne, or } from "@rapiq/core";
 //#region src/core/entities/client/schema.ts
 const schemaMapping = {
 	realm: EntityType.REALM,
 	accessPolicy: EntityType.POLICY
 };
+/**
+* Per-row visibility gate for the `secret` column (issue #3322) —
+* schema-level, so it applies wherever the client schema governs a
+* projection: the `/clients` root AND the `include=client` paths of
+* client-permission / client-role / client-scope, which never run
+* `ClientService`'s read path.
+*
+* Only rows exposing a PLAINTEXT secret are guarded: `null`, hashed
+* and encrypted values stay visible to any actor that passed the read
+* pre-gate (the historical service semantics). A plaintext value is
+* additionally visible on the actor's OWN client row (the `getOne`
+* isMe bypass, list-shaped) and on rows the compiled permission
+* condition covers. A non-expressible (`post`) or settled-deny compile
+* yields no permission leg — fail closed for plaintext rows rather
+* than falling back to per-row evaluation.
+*
+* The outer `ne('realmId', null)` guard is semantically inert (clients
+* are realm-bound) but makes the condition fail closed on rows whose
+* gate columns were not fetched — an `ownOrNull` reach compiles to a
+* null-inclusive realm leg that would otherwise MATCH a missing
+* column. The SQL adapter force-selects every column the condition
+* reads (rapiq#830's operand projection), so this is defense in depth.
+*/ async function secretReadGate(actor) {
+	const compiled = await actor.permissionEvaluator.compile({ name: CLIENT_READ_PERMISSIONS });
+	if (compiled.verdict === "allow") return true;
+	const visible = [
+		eq("secret", null),
+		eq("secretHashed", true),
+		eq("secretEncrypted", true)
+	];
+	if (compiled.verdict === "conditional") visible.push(compiled.condition);
+	if (actor.identity && actor.identity.type === IdentityType.CLIENT && actor.identity.data.id) visible.push(eq("id", actor.identity.data.id));
+	return and(ne("realmId", null), or(...visible));
+}
 const clientSchema = defineSchema({
 	name: EntityType.CLIENT,
 	fields: {
@@ -34,7 +70,8 @@ const clientSchema = defineSchema({
 			"updatedAt",
 			"createdAt"
 		],
-		allowed: ["secret"]
+		allowed: ["secret"],
+		validateMany: createFieldsReadGate({ secret: secretReadGate })
 	},
 	filters: { allowed: [
 		"id",

package/dist/core/entities/client/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","accessPolicy","POLICY","clientSchema","name","CLIENT","fields","default","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Client } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM, accessPolicy: EntityType.POLICY };\n\nexport const clientSchema = defineSchema<Client>({\n    name: EntityType.CLIENT,\n    fields: {\n        default: [\n            'id',\n            'active',\n            'builtIn',\n            'name',\n            'displayName',\n            'description',\n            'secretHashed',\n            'secretEncrypted',\n            'baseUrl',\n            'rootUrl',\n            'redirectUri',\n            'postLogoutRedirectUri',\n            'grantTypes',\n            'scope',\n            'authMethod',\n            'tokenBindingMethod',\n            'accessPolicyId',\n            'realmId',\n            'updatedAt',\n            'createdAt',\n        ],\n        allowed: ['secret'],\n    },\n    filters: { allowed: ['id', 'name', 'realmId'] },\n    relations: { allowed: ['realm', 'accessPolicy'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,OAAOH,WAAWI;CAAOC,cAAcL,WAAWM;AAAO;AAEjF,MAAaC,eAAeR,aAAqB;CAC7CS,MAAMR,WAAWS;CACjBC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,QAAS;CACvB;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;CAAU,EAAC;CAC9CE,WAAW;EAAEF,SAAS,CAAC,SAAS,cAAe;EAAEG,UAAUd,wBAAwBC,aAAAA;CAAe;CAClGc,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDK,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["and","defineSchema","eq","ne","or","EntityType","IdentityType","createFieldsReadGate","createRelationsReadGate","CLIENT_READ_PERMISSIONS","schemaMapping","realm","REALM","accessPolicy","POLICY","secretReadGate","actor","compiled","permissionEvaluator","compile","name","verdict","visible","push","condition","identity","type","CLIENT","data","id","clientSchema","fields","default","allowed","validateMany","secret","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICondition, KeyValidationVerdict } from '@rapiq/core';\nimport {\n    and,\n    defineSchema,\n    eq,\n    ne,\n    or,\n} from '@rapiq/core';\nimport type { Client } from '@authup/core-kit';\nimport { EntityType, IdentityType } from '@authup/core-kit';\nimport type { ActorContext } from '@authup/server-kit';\nimport { createFieldsReadGate } from '../../query/fields.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\n\nconst schemaMapping = { realm: EntityType.REALM, accessPolicy: EntityType.POLICY };\n\n/**\n * Per-row visibility gate for the `secret` column (issue #3322) —\n * schema-level, so it applies wherever the client schema governs a\n * projection: the `/clients` root AND the `include=client` paths of\n * client-permission / client-role / client-scope, which never run\n * `ClientService`'s read path.\n *\n * Only rows exposing a PLAINTEXT secret are guarded: `null`, hashed\n * and encrypted values stay visible to any actor that passed the read\n * pre-gate (the historical service semantics). A plaintext value is\n * additionally visible on the actor's OWN client row (the `getOne`\n * isMe bypass, list-shaped) and on rows the compiled permission\n * condition covers. A non-expressible (`post`) or settled-deny compile\n * yields no permission leg — fail closed for plaintext rows rather\n * than falling back to per-row evaluation.\n *\n * The outer `ne('realmId', null)` guard is semantically inert (clients\n * are realm-bound) but makes the condition fail closed on rows whose\n * gate columns were not fetched — an `ownOrNull` reach compiles to a\n * null-inclusive realm leg that would otherwise MATCH a missing\n * column. The SQL adapter force-selects every column the condition\n * reads (rapiq#830's operand projection), so this is defense in depth.\n */\nasync function secretReadGate(actor: ActorContext) : Promise<KeyValidationVerdict> {\n    const compiled = await actor.permissionEvaluator.compile({ name: CLIENT_READ_PERMISSIONS });\n    if (compiled.verdict === 'allow') {\n        return true;\n    }\n\n    const visible : ICondition[] = [\n        eq('secret', null),\n        eq('secretHashed', true),\n        eq('secretEncrypted', true),\n    ];\n\n    if (compiled.verdict === 'conditional') {\n        visible.push(compiled.condition);\n    }\n\n    if (\n        actor.identity &&\n        actor.identity.type === IdentityType.CLIENT &&\n        actor.identity.data.id\n    ) {\n        visible.push(eq('id', actor.identity.data.id));\n    }\n\n    return and(ne('realmId', null), or(...visible));\n}\n\nexport const clientSchema = defineSchema<Client>({\n    name: EntityType.CLIENT,\n    fields: {\n        default: [\n            'id',\n            'active',\n            'builtIn',\n            'name',\n            'displayName',\n            'description',\n            'secretHashed',\n            'secretEncrypted',\n            'baseUrl',\n            'rootUrl',\n            'redirectUri',\n            'postLogoutRedirectUri',\n            'grantTypes',\n            'scope',\n            'authMethod',\n            'tokenBindingMethod',\n            'accessPolicyId',\n            'realmId',\n            'updatedAt',\n            'createdAt',\n        ],\n        allowed: ['secret'],\n        validateMany: createFieldsReadGate({ secret: secretReadGate }),\n    },\n    filters: { allowed: ['id', 'name', 'realmId'] },\n    relations: { allowed: ['realm', 'accessPolicy'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;;AAsBA,MAAMU,gBAAgB;CAAEC,OAAON,WAAWO;CAAOC,cAAcR,WAAWS;AAAO;;;;;;;;;;;;;;;;;;;;;;;GAyBjF,eAAeC,eAAeC,OAAmB;CAC7C,MAAMC,WAAW,MAAMD,MAAME,oBAAoBC,QAAQ,EAAEC,MAAMX,wBAAwB,CAAA;CACzF,IAAIQ,SAASI,YAAY,SACrB,OAAO;CAGX,MAAMC,UAAyB;EAC3BpB,GAAG,UAAU,IAAA;EACbA,GAAG,gBAAgB,IAAA;EACnBA,GAAG,mBAAmB,IAAA;CACzB;CAED,IAAIe,SAASI,YAAY,eACrBC,QAAQC,KAAKN,SAASO,SAAS;CAGnC,IACIR,MAAMS,YACNT,MAAMS,SAASC,SAASpB,aAAaqB,UACrCX,MAAMS,SAASG,KAAKC,IAEpBP,QAAQC,KAAKrB,GAAG,MAAMc,MAAMS,SAASG,KAAKC,EAAE,CAAA;CAGhD,OAAO7B,IAAIG,GAAG,WAAW,IAAA,GAAOC,GAAAA,GAAMkB,OAAAA,CAAAA;AAC1C;AAEA,MAAaQ,eAAe7B,aAAqB;CAC7CmB,MAAMf,WAAWsB;CACjBI,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,QAAS;EACnBC,cAAc3B,qBAAqB,EAAE4B,QAAQpB,eAAe,CAAA;CAChE;CACAqB,SAAS,EAAEH,SAAS;EAAC;EAAM;EAAQ;CAAU,EAAC;CAC9CI,WAAW;EAAEJ,SAAS,CAAC,SAAS,cAAe;EAAEK,UAAU9B,wBAAwBE,aAAAA;CAAe;CAClG6B,MAAM,EAAEN,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDO,YAAY,EAAEC,UAAU,GAAG;CAC3B/B;AACJ,CAAA"}

package/dist/core/entities/client/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAiBA,OAAO,EAGH,eAAe,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAmF5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IAmDZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IA2JI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,eAAe,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAY5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IA6CZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IA2JI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}

package/dist/core/entities/client/service.mjs

@@ -2,15 +2,15 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "../../authentication/credential/entities/client/module.mjs";
+import { CLIENT_READ_PERMISSIONS } from "./constants.mjs";
 import { clientSchema } from "./schema.mjs";
-import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
+import { decodeQuery } from "../../query/module.mjs";
 import "../../query/index.mjs";
 import { ValidatorGroup, isUUID } from "@authup/kit";
 import { CLIENT_RESERVED_NAMES, ClientAuthMethod, ClientValidator, PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { EntityNotFoundError, ValidationError } from "@authup/errors";
-import { and, eq, ne, not, or } from "@rapiq/core";
 //#region src/core/entities/client/service.ts
 var ClientService = class extends AbstractEntityService {
 	repository;
@@ -23,67 +23,15 @@ var ClientService = class extends AbstractEntityService {
 		this.validator = new ClientValidator();
 	}
 	async getMany(query, actor) {
-		const permissionNames = [
-			PermissionName.CLIENT_READ,
-			PermissionName.CLIENT_UPDATE,
-			PermissionName.CLIENT_DELETE
-		];
-		await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });
-		const parsed = await decodeQuery(query, {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });
+		return this.repository.findMany(await decodeQuery(query, {
 			schema: clientSchema,
 			actor
-		});
-		const secretSelected = parsed.fields.value.some((field) => field.name === "secret" && field.operator !== "-");
-		const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });
-		if (compiled.verdict !== "post") {
-			let scoped = parsed;
-			if (secretSelected && compiled.verdict !== "allow") {
-				const plaintextSecret = and(ne("secret", null), eq("secretHashed", false), eq("secretEncrypted", false));
-				scoped = appendQueryConditions(parsed, compiled.verdict === "conditional" ? or(not(plaintextSecret), compiled.condition) : not(plaintextSecret));
-			}
-			return this.repository.findMany(scoped);
-		}
-		const { data: entities, meta } = await this.repository.findMany(parsed);
-		let { total } = meta;
-		const data = [];
-		for (const entity of entities) {
-			if (entity.secret && !entity.secretEncrypted && !entity.secretHashed) {
-				try {
-					await actor.permissionEvaluator.evaluateOneOf({
-						name: [
-							PermissionName.CLIENT_READ,
-							PermissionName.CLIENT_UPDATE,
-							PermissionName.CLIENT_DELETE
-						],
-						data: definePolicyData({
-							[BuiltInPolicyType.ATTRIBUTES]: entity,
-							...this.resourceRealmMatch(entity)
-						})
-					});
-					data.push(entity);
-				} catch {
-					total -= 1;
-				}
-				continue;
-			}
-			data.push(entity);
-		}
-		return {
-			data,
-			meta: {
-				...meta,
-				total
-			}
-		};
+		}));
 	}
 	async getOne(idOrName, actor, query, realmId) {
-		const permissionNames = [
-			PermissionName.CLIENT_READ,
-			PermissionName.CLIENT_UPDATE,
-			PermissionName.CLIENT_DELETE
-		];
 		let isMe = !!actor.identity && actor.identity.type === "client" && (actor.identity.data.id === idOrName || actor.identity.data.name === idOrName);
-		if (!isMe) await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });
+		if (!isMe) await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });
 		const entity = await this.repository.findOne(idOrName, await decodeQuery(query, {
 			schema: clientSchema,
 			parameters: ["fields", "relations"],
@@ -92,10 +40,10 @@ var ClientService = class extends AbstractEntityService {
 		if (!entity) throw new EntityNotFoundError();
 		if (isMe && actor.identity.data.id !== entity.id) {
 			isMe = false;
-			await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });
+			await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });
 		}
 		if (!isMe && entity.secret && !entity.secretEncrypted && !entity.secretHashed) await actor.permissionEvaluator.evaluateOneOf({
-			name: permissionNames,
+			name: CLIENT_READ_PERMISSIONS,
 			data: definePolicyData({
 				[BuiltInPolicyType.ATTRIBUTES]: entity,
 				...this.resourceRealmMatch(entity)

package/dist/core/entities/client/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","and","eq","ne","not","or","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","appendQueryConditions","decodeQuery","clientSchema","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionNames","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","secretSelected","fields","value","some","field","operator","compiled","compile","verdict","scoped","plaintextSecret","condition","findMany","data","entities","meta","total","entity","secret","secretEncrypted","secretHashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","realmId","isMe","identity","type","id","findOne","parameters","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","builtIn","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","authMethod","SECRET","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    and, \n    eq, \n    ne, \n    not, \n    or,\n} from '@rapiq/core';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    CLIENT_RESERVED_NAMES,\n    ClientAuthMethod,\n    ClientValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { clientSchema } from './schema.ts';\n\nexport type ClientServiceContext = {\n    repository: IClientRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n    protected repository: IClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ClientValidator;\n\n    constructor(ctx: ClientServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ClientValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Client>> {\n        const permissionNames = [\n            PermissionName.CLIENT_READ,\n            PermissionName.CLIENT_UPDATE,\n            PermissionName.CLIENT_DELETE,\n        ];\n\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n\n        const parsed = await decodeQuery(query, { schema: clientSchema, actor });\n\n        // The per-row gate below only fires for rows exposing a PLAINTEXT secret,\n        // and only when the projection actually selects the (non-default) `secret`\n        // field — everything else lists freely. Compile the gate into WHERE\n        // (#3286 phase 3): a plaintext-secret row is visible iff the compiled\n        // permission condition covers it; rows without a plaintext secret always\n        // are. A non-expressible policy falls back to the per-row loop below.\n        const secretSelected = parsed.fields.value.some(\n            (field) => field.name === 'secret' && field.operator !== '-',\n        );\n        const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });\n        if (compiled.verdict !== 'post') {\n            let scoped = parsed;\n            if (secretSelected && compiled.verdict !== 'allow') {\n                const plaintextSecret = and(\n                    ne('secret', null),\n                    eq('secretHashed', false),\n                    eq('secretEncrypted', false),\n                );\n\n                scoped = appendQueryConditions(\n                    parsed,\n                    compiled.verdict === 'conditional' ?\n                        or(not(plaintextSecret), compiled.condition) :\n                        not(plaintextSecret),\n                );\n            }\n\n            return this.repository.findMany(scoped);\n        }\n\n        const {\n            data: entities,\n            meta,\n        } = await this.repository.findMany(parsed);\n        let { total } = meta;\n\n        const data: Client[] = [];\n        for (const entity of entities) {\n            if (\n                entity.secret &&\n                !entity.secretEncrypted &&\n                !entity.secretHashed\n            ) {\n                try {\n                    await actor.permissionEvaluator.evaluateOneOf({\n                        name: [\n                            PermissionName.CLIENT_READ,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                        ],\n                        data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                    });\n                    data.push(entity);\n                } catch {\n                    total -= 1;\n                }\n\n                continue;\n            }\n\n            data.push(entity);\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<Client> {\n        const permissionNames = [\n            PermissionName.CLIENT_READ,\n            PermissionName.CLIENT_UPDATE,\n            PermissionName.CLIENT_DELETE,\n        ];\n\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'client' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        const entity = await this.repository.findOne(\n            idOrName,\n            await decodeQuery(query, {\n                schema: clientSchema, \n                parameters: ['fields', 'relations'], \n                actor, \n            }),\n            realmId,\n        );\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        if (\n            !isMe &&\n            entity.secret &&\n            !entity.secretEncrypted &&\n            !entity.secretHashed\n        ) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: permissionNames,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Client,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Client | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneWithSecret(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'client' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n            }\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        // Reserve the system-provisioned client names (`system`, `web`) so an\n        // API caller can't create or rename a client onto them — that would\n        // collide on unique(name, realmId) or shadow the builtIn client.\n        // Provisioning and runtime hooks bypass this service, so they remain\n        // free to manage the reserved clients. builtIn clients are exempt\n        // (they ARE the provisioned ones) but API callers can never produce a\n        // builtIn client since the validator strips the flag.\n        if (\n            typeof validated.name === 'string' &&\n            CLIENT_RESERVED_NAMES.includes(validated.name) &&\n            !(entity && entity.builtIn && entity.name === validated.name)\n        ) {\n            throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n        }\n\n        await this.repository.validateJoinColumns(validated);\n        await this.repository.checkUniqueness(validated, entity || undefined);\n\n        const credentialsService = new ClientCredentialsService();\n\n        if (entity) {\n            if (\n                !isSelfEdit &&\n                !validated.realmId &&\n                !entity.realmId\n            ) {\n                const actorRealmId = this.getActorRealmId(actor);\n                if (actorRealmId) {\n                    validated.realmId = actorRealmId;\n                }\n            }\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_UPDATE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n            }\n\n            if (entity.authMethod === ClientAuthMethod.SECRET) {\n                if (!validated.secret && !entity.secret) {\n                    validated.secret = credentialsService.generateSecret();\n                }\n\n                if (validated.secret) {\n                    entity.secret = await credentialsService.protect(validated.secret, entity);\n                }\n            } else {\n                entity.secret = null;\n                entity.secretHashed = false;\n                entity.secretEncrypted = false;\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realmId) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        entity = this.repository.create(validated);\n\n        if (entity.authMethod === ClientAuthMethod.SECRET) {\n            if (!validated.secret) {\n                validated.secret = credentialsService.generateSecret();\n            }\n\n            entity.secret = await credentialsService.protect(validated.secret, validated);\n        } else {\n            entity.secret = null;\n            entity.secretHashed = false;\n            entity.secretEncrypted = false;\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AAqCA,IAAaoB,gBAAb,cAAmCL,sBAAAA;CACrBM;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIV,gBAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OAC+C;EAC/C,MAAMC,kBAAkB;GACpBd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;EAClB;EAED,MAAMJ,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAEzE,MAAMO,SAAS,MAAMjB,YAAYQ,OAAO;GAAEU,QAAQjB;GAAcQ;EAAM,CAAA;EAQtE,MAAMU,iBAAiBF,OAAOG,OAAOC,MAAMC,MACtCC,UAAUA,MAAMP,SAAS,YAAYO,MAAMC,aAAa,GAAA;EAE7D,MAAMC,WAAW,MAAMhB,MAAMK,oBAAoBY,QAAQ,EAAEV,MAAMN,gBAAgB,CAAA;EACjF,IAAIe,SAASE,YAAY,QAAQ;GAC7B,IAAIC,SAASX;GACb,IAAIE,kBAAkBM,SAASE,YAAY,SAAS;IAChD,MAAME,kBAAkB7C,IACpBE,GAAG,UAAU,IAAA,GACbD,GAAG,gBAAgB,KAAA,GACnBA,GAAG,mBAAmB,KAAA,CAAA;IAG1B2C,SAAS7B,sBACLkB,QACAQ,SAASE,YAAY,gBACjBvC,GAAGD,IAAI0C,eAAAA,GAAkBJ,SAASK,SAAS,IAC3C3C,IAAI0C,eAAAA,CAAAA;GAEhB;GAEA,OAAO,KAAK1B,WAAW4B,SAASH,MAAAA;EACpC;EAEA,MAAM,EACFI,MAAMC,UACNC,SACA,MAAM,KAAK/B,WAAW4B,SAASd,MAAAA;EACnC,IAAI,EAAEkB,UAAUD;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMI,UAAUH,UAAU;GAC3B,IACIG,OAAOC,UACP,CAACD,OAAOE,mBACR,CAACF,OAAOG,cACV;IACE,IAAI;KACA,MAAM9B,MAAMK,oBAAoB0B,cAAc;MAC1CxB,MAAM;OACFpB,eAAee;OACff,eAAegB;OACfhB,eAAeiB;MAClB;MACDmB,MAAMjD,iBAAiB;QAAGD,kBAAkB2D,aAAaL;OAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;MAAQ,CAAA;KACxG,CAAA;KACAJ,KAAKW,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAH,KAAKW,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACApC,OACAD,OACAsC,SACe;EACf,MAAMpC,kBAAkB;GACpBd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;EAClB;EAED,IAAIkC,OAAO,CAAC,CAACtC,MAAMuC,YACfvC,MAAMuC,SAASC,SAAS,aAEpBxC,MAAMuC,SAAShB,KAAKkB,OAAOL,YAC3BpC,MAAMuC,SAAShB,KAAKhB,SAAS6B;EAGrC,IAAI,CAACE,MACD,MAAMtC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAG7E,MAAM0B,SAAS,MAAM,KAAKjC,WAAWgD,QACjCN,UACA,MAAM7C,YAAYQ,OAAO;GACrBU,QAAQjB;GACRmD,YAAY,CAAC,UAAU,WAAY;GACnC3C;EACJ,CAAA,GACAqC,OAAAA;EAEJ,IAAI,CAACV,QACD,MAAM,IAAI7C,oBAAAA;EAGd,IAAIwD,QAAQtC,MAAMuC,SAAUhB,KAAKkB,OAAOd,OAAOc,IAAI;GAC/CH,OAAO;GACP,MAAMtC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACqC,QACDX,OAAOC,UACP,CAACD,OAAOE,mBACR,CAACF,OAAOG,cAER,MAAM9B,MAAMK,oBAAoB0B,cAAc;GAC1CxB,MAAMN;GACNsB,MAAMjD,iBAAiB;KAAGD,kBAAkB2D,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFrB,MACAvB,OACe;EACf,MAAM,EAAE2B,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWvB,MAAMvB,KAAAA;EACpD,OAAO2B;CACX;CAEA,MAAMoB,OACFX,UACAb,MACAvB,OACe;EACf,MAAM,EAAE2B,WAAW,MAAM,KAAKkB,KAAKT,UAAUb,MAAMvB,OAAO,EAAEgD,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAb,MACAvB,OACAiD,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO5B,KAAKc,YAAY,WAClC,MAAM,KAAK1C,gBAAgByD,QAAQ7B,KAAKc,OAAO,IAC/CS,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMiB,QAA6B,CAAC;GACpC,IAAIxE,OAAOuD,QAAAA,GACPiB,MAAMZ,KAAKL;QAEXiB,MAAM9C,OAAO6B;GAGjB,IAAIe,OACAE,MAAMhB,UAAUc,MAAMV;GAG1Bd,SAAS,MAAM,KAAKjC,WAAW4D,kBAAkBD,KAAAA;GACjD,IAAI,CAAC1B,UAAUsB,QAAQD,YACnB,MAAM,IAAIlE,oBAAAA;EAElB,OAAO,IAAImE,QAAQD,YACf,MAAM,IAAIlE,oBAAAA;EAGd,IAAIyE,aAAa;EACjB,IAAI5B,QAAQ;GACR,IAAI;IACA,MAAM3B,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAegB,cAAc,CAAA;GACrF,SAASsD,GAAG;IACR,IACI,CAACzD,MAAMuC,YACPvC,MAAMuC,SAASC,SAAS,YACxBxC,MAAMuC,SAAShB,KAAKkB,OAAOd,OAAOc,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMvD,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAeuE,mBAAmB,CAAA;GAC1F;GACAR,QAAQtE,eAAe+E;EAC3B,OAAO;GACH,MAAM3D,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAeyE,cAAc,CAAA;GACjFV,QAAQtE,eAAeiF;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKlE,UAAUmE,IAAIxC,MAAM,EAAE2B,MAAM,CAAA;EASzD,IACI,OAAOY,UAAUvD,SAAS,YAC1BvB,sBAAsBgF,SAASF,UAAUvD,IAAI,KAC7C,EAAEoB,UAAUA,OAAOsC,WAAWtC,OAAOpB,SAASuD,UAAUvD,OAExD,MAAM,IAAIxB,gBAAgB,oBAAoB+E,UAAUvD,KAAK,eAAe;EAGhF,MAAM,KAAKb,WAAWwE,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKpE,WAAWyE,gBAAgBL,WAAWnC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMsB,qBAAqB,IAAI/E,yBAAAA;EAE/B,IAAIsC,QAAQ;GACR,IACI,CAAC4B,cACD,CAACO,UAAUzB,WACX,CAACV,OAAOU,SACV;IACE,MAAMgC,eAAe,KAAKC,gBAAgBtE,KAAAA;IAC1C,IAAIqE,cACAP,UAAUzB,UAAUgC;GAE5B;GAEA,IAAId,YACA,MAAMvD,MAAMK,oBAAoBkE,SAAS;IACrChE,MAAMpB,eAAeuE;IACrBnC,MAAMjD,iBAAiB;MAAGD,kBAAkB2D,aAAa8B;KAAW,GAAG,KAAK7B,mBAAmB6B,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJnC,SAAS,KAAKjC,WAAW8E,MAAM7C,QAAQmC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMvD,MAAMK,oBAAoBkE,SAAS;IACrChE,MAAMpB,eAAegB;IACrBoB,MAAMjD,iBAAiB;MAAGD,kBAAkB2D,aAAaL;KAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAO8C,eAAexF,iBAAiByF,QAAQ;IAC/C,IAAI,CAACZ,UAAUlC,UAAU,CAACD,OAAOC,QAC7BkC,UAAUlC,SAASwC,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUlC,QACVD,OAAOC,SAAS,MAAMwC,mBAAmBQ,QAAQd,UAAUlC,QAAQD,MAAAA;GAE3E,OAAO;IACHA,OAAOC,SAAS;IAChBD,OAAOG,eAAe;IACtBH,OAAOE,kBAAkB;GAC7B;GAEA,MAAM,KAAKnC,WAAWmD,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAkD,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUzB,SAAS;GACpB,MAAMgC,eAAe,KAAKC,gBAAgBtE,KAAAA;GAC1C,IAAIqE,cACAP,UAAUzB,UAAUgC;EAE5B;EAEA,MAAMrE,MAAMK,oBAAoBkE,SAAS;GACrChE,MAAMpB,eAAeyE;GACrBrC,MAAMjD,iBAAiB;KAAGD,kBAAkB2D,aAAa8B;IAAW,GAAG,KAAK7B,mBAAmB6B,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEAnC,SAAS,KAAKjC,WAAWkD,OAAOkB,SAAAA;EAEhC,IAAInC,OAAO8C,eAAexF,iBAAiByF,QAAQ;GAC/C,IAAI,CAACZ,UAAUlC,QACXkC,UAAUlC,SAASwC,mBAAmBO,eAAc;GAGxDhD,OAAOC,SAAS,MAAMwC,mBAAmBQ,QAAQd,UAAUlC,QAAQkC,SAAAA;EACvE,OAAO;GACHnC,OAAOC,SAAS;GAChBD,OAAOG,eAAe;GACtBH,OAAOE,kBAAkB;EAC7B;EAEA,MAAM,KAAKnC,WAAWmD,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAkD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFrC,IACAzC,OACe;EACf,MAAMA,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAeiB,cAAc,CAAA;EAEjF,MAAMuB,SAAS,MAAM,KAAKjC,WAAWqF,UAAU,EAAEtC,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAI7C,oBAAAA;EAGd,MAAMkB,MAAMK,oBAAoBkE,SAAS;GACrChE,MAAMpB,eAAeiB;GACrBmB,MAAMjD,iBAAiB;KAAGD,kBAAkB2D,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAIuC,aAAarD;EACzB,MAAM,KAAKjC,WAAWuF,OAAOtD,MAAAA;EAC7BA,OAAOc,KAAKuC;EAEZ,OAAOrD;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","CLIENT_READ_PERMISSIONS","decodeQuery","clientSchema","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","findMany","schema","getOne","idOrName","realmId","isMe","identity","type","data","id","entity","findOne","parameters","secret","secretEncrypted","secretHashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","CLIENT_UPDATE","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","builtIn","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","authMethod","SECRET","generateSecret","protect","created","delete","CLIENT_DELETE","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    CLIENT_RESERVED_NAMES,\n    ClientAuthMethod,\n    ClientValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientSchema } from './schema.ts';\n\nexport type ClientServiceContext = {\n    repository: IClientRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n    protected repository: IClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ClientValidator;\n\n    constructor(ctx: ClientServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ClientValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Client>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n\n        // The per-row `secret` visibility gate lives on the client SCHEMA\n        // (`fields.validateMany`, issue #3322), so it also covers the\n        // `include=client` paths served by other services; the repository\n        // layer redacts unauthorized values without dropping rows.\n        return this.repository.findMany(\n            await decodeQuery(query, { schema: clientSchema, actor }),\n        );\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<Client> {\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'client' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n        }\n\n        const entity = await this.repository.findOne(\n            idOrName,\n            await decodeQuery(query, {\n                schema: clientSchema, \n                parameters: ['fields', 'relations'], \n                actor, \n            }),\n            realmId,\n        );\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n        }\n\n        if (\n            !isMe &&\n            entity.secret &&\n            !entity.secretEncrypted &&\n            !entity.secretHashed\n        ) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: CLIENT_READ_PERMISSIONS,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Client,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Client | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneWithSecret(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'client' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n            }\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        // Reserve the system-provisioned client names (`system`, `web`) so an\n        // API caller can't create or rename a client onto them — that would\n        // collide on unique(name, realmId) or shadow the builtIn client.\n        // Provisioning and runtime hooks bypass this service, so they remain\n        // free to manage the reserved clients. builtIn clients are exempt\n        // (they ARE the provisioned ones) but API callers can never produce a\n        // builtIn client since the validator strips the flag.\n        if (\n            typeof validated.name === 'string' &&\n            CLIENT_RESERVED_NAMES.includes(validated.name) &&\n            !(entity && entity.builtIn && entity.name === validated.name)\n        ) {\n            throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n        }\n\n        await this.repository.validateJoinColumns(validated);\n        await this.repository.checkUniqueness(validated, entity || undefined);\n\n        const credentialsService = new ClientCredentialsService();\n\n        if (entity) {\n            if (\n                !isSelfEdit &&\n                !validated.realmId &&\n                !entity.realmId\n            ) {\n                const actorRealmId = this.getActorRealmId(actor);\n                if (actorRealmId) {\n                    validated.realmId = actorRealmId;\n                }\n            }\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_UPDATE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n            }\n\n            if (entity.authMethod === ClientAuthMethod.SECRET) {\n                if (!validated.secret && !entity.secret) {\n                    validated.secret = credentialsService.generateSecret();\n                }\n\n                if (validated.secret) {\n                    entity.secret = await credentialsService.protect(validated.secret, entity);\n                }\n            } else {\n                entity.secret = null;\n                entity.secretHashed = false;\n                entity.secretEncrypted = false;\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realmId) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        entity = this.repository.create(validated);\n\n        if (entity.authMethod === ClientAuthMethod.SECRET) {\n            if (!validated.secret) {\n                validated.secret = credentialsService.generateSecret();\n            }\n\n            entity.secret = await credentialsService.protect(validated.secret, validated);\n        } else {\n            entity.secret = null;\n            entity.secretHashed = false;\n            entity.secretEncrypted = false;\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,IAAae,gBAAb,cAAmCL,sBAAAA;CACrBM;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIV,gBAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAMjF,OAAO,KAAKI,WAAWU,SACnB,MAAMb,YAAYQ,OAAO;GAAEM,QAAQb;GAAcQ;EAAM,CAAA,CAAA;CAE/D;CAEA,MAAMM,OACFC,UACAP,OACAD,OACAS,SACe;EACf,IAAIC,OAAO,CAAC,CAACT,MAAMU,YACfV,MAAMU,SAASC,SAAS,aAEpBX,MAAMU,SAASE,KAAKC,OAAON,YAC3BP,MAAMU,SAASE,KAAKT,SAASI;EAGrC,IAAI,CAACE,MACD,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAGrF,MAAMwB,SAAS,MAAM,KAAKpB,WAAWqB,QACjCR,UACA,MAAMhB,YAAYQ,OAAO;GACrBM,QAAQb;GACRwB,YAAY,CAAC,UAAU,WAAY;GACnChB;EACJ,CAAA,GACAQ,OAAAA;EAEJ,IAAI,CAACM,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI2B,QAAQT,MAAMU,SAAUE,KAAKC,OAAOC,OAAOD,IAAI;GAC/CJ,OAAO;GACP,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EACrF;EAEA,IACI,CAACmB,QACDK,OAAOG,UACP,CAACH,OAAOI,mBACR,CAACJ,OAAOK,cAER,MAAMnB,MAAMC,oBAAoBmB,cAAc;GAC1CjB,MAAMb;GACNsB,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMS,OACFX,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKC,KAAAA,GAAWb,MAAMZ,KAAAA;EACpD,OAAOc;CACX;CAEA,MAAMY,OACFnB,UACAK,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKjB,UAAUK,MAAMZ,OAAO,EAAE2B,YAAY,KAAK,CAAA;EAC7E,OAAOb;CACX;CAEA,MAAMU,KACFjB,UACAK,MACAZ,OACA4B,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOlB,KAAKJ,YAAY,WAClC,MAAM,KAAKb,gBAAgBoC,QAAQnB,KAAKJ,OAAO,IAC/CiB,KAAAA;EAEJ,IAAIX;EACJ,IAAIP,UAAU;GACV,MAAMyB,QAA6B,CAAC;GACpC,IAAInD,OAAO0B,QAAAA,GACPyB,MAAMnB,KAAKN;QAEXyB,MAAM7B,OAAOI;GAGjB,IAAIuB,OACAE,MAAMxB,UAAUsB,MAAMjB;GAG1BC,SAAS,MAAM,KAAKpB,WAAWuC,kBAAkBD,KAAAA;GACjD,IAAI,CAAClB,UAAUc,QAAQD,YACnB,MAAM,IAAI7C,oBAAAA;EAElB,OAAO,IAAI8C,QAAQD,YACf,MAAM,IAAI7C,oBAAAA;EAGd,IAAIoD,aAAa;EACjB,IAAIpB,QAAQ;GACR,IAAI;IACA,MAAMd,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeiD,cAAc,CAAA;GACrF,SAASC,GAAG;IACR,IACI,CAACrC,MAAMU,YACPV,MAAMU,SAASC,SAAS,YACxBX,MAAMU,SAASE,KAAKC,OAAOC,OAAOD,IAElC,MAAMwB;IAEVH,aAAa;IACb,MAAMlC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAemD,mBAAmB,CAAA;GAC1F;GACAT,QAAQjD,eAAe2D;EAC3B,OAAO;GACH,MAAMvC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeqD,cAAc,CAAA;GACjFX,QAAQjD,eAAe6D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK9C,UAAU+C,IAAI/B,MAAM,EAAEiB,MAAM,CAAA;EASzD,IACI,OAAOa,UAAUvC,SAAS,YAC1BnB,sBAAsB4D,SAASF,UAAUvC,IAAI,KAC7C,EAAEW,UAAUA,OAAO+B,WAAW/B,OAAOX,SAASuC,UAAUvC,OAExD,MAAM,IAAIpB,gBAAgB,oBAAoB2D,UAAUvC,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAWoD,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKhD,WAAWqD,gBAAgBL,WAAW5B,UAAUW,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI3D,yBAAAA;EAE/B,IAAIyB,QAAQ;GACR,IACI,CAACoB,cACD,CAACQ,UAAUlC,WACX,CAACM,OAAON,SACV;IACE,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;IAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;GAE5B;GAEA,IAAIf,YACA,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAemD;IACrB1B,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaqB;KAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJ5B,SAAS,KAAKpB,WAAW0D,MAAMtC,QAAQ4B,SAAAA;GAEvC,IAAI,CAACR,YACD,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAeiD;IACrBxB,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaP;KAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAOuC,eAAepE,iBAAiBqE,QAAQ;IAC/C,IAAI,CAACZ,UAAUzB,UAAU,CAACH,OAAOG,QAC7ByB,UAAUzB,SAAS+B,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUzB,QACVH,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQH,MAAAA;GAE3E,OAAO;IACHA,OAAOG,SAAS;IAChBH,OAAOK,eAAe;IACtBL,OAAOI,kBAAkB;GAC7B;GAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;GAE3B,OAAO;IACHA;IACA2C,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUlC,SAAS;GACpB,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;GAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;EAE5B;EAEA,MAAMjD,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAeqD;GACrB5B,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaqB;IAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA5B,SAAS,KAAKpB,WAAW6B,OAAOmB,SAAAA;EAEhC,IAAI5B,OAAOuC,eAAepE,iBAAiBqE,QAAQ;GAC/C,IAAI,CAACZ,UAAUzB,QACXyB,UAAUzB,SAAS+B,mBAAmBO,eAAc;GAGxDzC,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQyB,SAAAA;EACvE,OAAO;GACH5B,OAAOG,SAAS;GAChBH,OAAOK,eAAe;GACtBL,OAAOI,kBAAkB;EAC7B;EAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;EAE3B,OAAO;GACHA;GACA2C,SAAS;EACb;CACJ;CAEA,MAAMC,OACF7C,IACAb,OACe;EACf,MAAMA,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAewE,cAAc,CAAA;EAEjF,MAAM7C,SAAS,MAAM,KAAKpB,WAAWkE,UAAU,EAAE/C,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAewE;GACrB/C,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAED,IAAIgD,aAAa/C;EACzB,MAAM,KAAKpB,WAAWoE,OAAOhD,MAAAA;EAC7BA,OAAOD,KAAKgD;EAEZ,OAAO/C;CACX;AACJ"}

package/dist/core/entities/client/web-client.d.ts

@@ -1,36 +1,72 @@
 import type { Client, Realm } from '@authup/core-kit';
 import type { Logger } from '@authup/server-kit';
+import type { IClientScopeRepository } from '../client-scope/types.ts';
+import type { IScopeRepository } from '../scope/types.ts';
 import type { IClientRepository, IWebClientProvisioner } from './types.ts';
 export type WebClientProvisionerContext = {
     clientRepository: IClientRepository;
+    scopeRepository: IScopeRepository;
+    clientScopeRepository: IClientScopeRepository;
     appOrigins: string[];
     logger?: Logger;
 };
+/**
+ * The scopes a realm's public `web` client is granted.
+ *
+ * `global` lets the issued token drive the management API (parity with the
+ * legacy password-grant admin login); `openid` yields the id-token.
+ */
+export declare const WEB_CLIENT_SCOPE_NAMES: string[];
 /**
  * Build the attribute set for a realm's public `web` client.
  *
  * Public (PKCE) client used by authup's own client-web and any downstream
  * UI embedding client-web-kit. `builtIn` makes it auto-consent in the
- * /authorize flow and protects it from the API reserved-name guard. The
- * `global` scope lets the issued token drive the management API (parity
- * with the legacy password-grant admin login); `openid` for the id-token.
+ * /authorize flow and protects it from the API reserved-name guard.
  *
  * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the
  * /token grants and the /authorize code-request verifier; null = allow-all),
  * so it must list every flow the client uses. `redirectUri` and
  * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted
  * origin (matched by isSimpleMatch).
+ *
+ * The `scope` column is descriptive only. Scope authorization resolves
+ * through the `auth_client_scopes` junction, which
+ * `WebClientProvisioner.ensureForRealm` fills from
+ * {@see WEB_CLIENT_SCOPE_NAMES}.
  */
 export declare function buildWebClientAttributes(realm: Realm | {
     id: string;
 }, appOrigins: string[]): Partial<Client>;
 export declare class WebClientProvisioner implements IWebClientProvisioner {
     protected clientRepository: IClientRepository;
+    protected scopeRepository: IScopeRepository;
+    protected clientScopeRepository: IClientScopeRepository;
     protected appOrigins: string[];
     protected logger?: Logger;
     constructor(ctx: WebClientProvisionerContext);
     ensureForRealm(realm: Realm | {
         id: string;
     }): Promise<void>;
+    /**
+     * Upsert the client row itself.
+     *
+     * `web` is a reserved client name (`CLIENT_RESERVED_NAMES`), so the row
+     * belongs to the system whatever state it is in. A non-built-in one
+     * predates the reservation and is taken over rather than left to shadow
+     * the realm's login client.
+     */
+    protected ensureClient(realm: Realm | {
+        id: string;
+    }): Promise<Client>;
+    /**
+     * Bind the built-in global scopes through `auth_client_scopes`. That
+     * junction is the only source the /authorize code-request verifier reads
+     * scopes from.
+     *
+     * Additive like the attribute MERGE above: an extra scope an admin bound
+     * by hand is left in place.
+     */
+    protected ensureScopes(client: Client): Promise<void>;
 }
 //# sourceMappingURL=web-client.d.ts.map

package/dist/core/entities/client/web-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAMtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAsCrE"}
+{"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,eAAe,EAAE,gBAAgB,CAAC;IAClC,qBAAqB,EAAE,sBAAsB,CAAC;IAC9C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,EAG1C,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;IAExD,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAQtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASlE;;;;;;;OAOG;cACa,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAsD5E;;;;;;;OAOG;cACa,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAiC9D"}

package/dist/core/entities/client/web-client.mjs

@@ -4,19 +4,28 @@ import.meta.url;
 import { CLIENT_WEB_NAME, ClientAuthMethod, ClientTokenBindingMethod, ScopeName } from "@authup/core-kit";
 //#region src/core/entities/client/web-client.ts
 /**
+* The scopes a realm's public `web` client is granted.
+*
+* `global` lets the issued token drive the management API (parity with the
+* legacy password-grant admin login); `openid` yields the id-token.
+*/ const WEB_CLIENT_SCOPE_NAMES = [ScopeName.GLOBAL, ScopeName.OPEN_ID];
+/**
 * Build the attribute set for a realm's public `web` client.
 *
 * Public (PKCE) client used by authup's own client-web and any downstream
 * UI embedding client-web-kit. `builtIn` makes it auto-consent in the
-* /authorize flow and protects it from the API reserved-name guard. The
-* `global` scope lets the issued token drive the management API (parity
-* with the legacy password-grant admin login); `openid` for the id-token.
+* /authorize flow and protects it from the API reserved-name guard.
 *
 * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the
 * /token grants and the /authorize code-request verifier; null = allow-all),
 * so it must list every flow the client uses. `redirectUri` and
 * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted
 * origin (matched by isSimpleMatch).
+*
+* The `scope` column is descriptive only. Scope authorization resolves
+* through the `auth_client_scopes` junction, which
+* `WebClientProvisioner.ensureForRealm` fills from
+* {@see WEB_CLIENT_SCOPE_NAMES}.
 */ function buildWebClientAttributes(realm, appOrigins) {
 	const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(",");
 	return {
@@ -27,41 +36,88 @@ import { CLIENT_WEB_NAME, ClientAuthMethod, ClientTokenBindingMethod, ScopeName
 		builtIn: true,
 		active: true,
 		grantTypes: "authorization_code refresh_token",
-		scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,
+		scope: WEB_CLIENT_SCOPE_NAMES.join(" "),
 		redirectUri: originPatterns,
 		postLogoutRedirectUri: originPatterns
 	};
 }
 var WebClientProvisioner = class {
 	clientRepository;
+	scopeRepository;
+	clientScopeRepository;
 	appOrigins;
 	logger;
 	constructor(ctx) {
 		this.clientRepository = ctx.clientRepository;
+		this.scopeRepository = ctx.scopeRepository;
+		this.clientScopeRepository = ctx.clientScopeRepository;
 		this.appOrigins = ctx.appOrigins;
 		this.logger = ctx.logger;
 	}
 	async ensureForRealm(realm) {
+		const client = await this.ensureClient(realm);
+		await this.ensureScopes(client);
+	}
+	/**
+	* Upsert the client row itself.
+	*
+	* `web` is a reserved client name (`CLIENT_RESERVED_NAMES`), so the row
+	* belongs to the system whatever state it is in. A non-built-in one
+	* predates the reservation and is taken over rather than left to shadow
+	* the realm's login client.
+	*/ async ensureClient(realm) {
 		const attributes = buildWebClientAttributes(realm, this.appOrigins);
 		const existing = await this.clientRepository.findOneBy({
 			name: CLIENT_WEB_NAME,
 			realmId: realm.id
 		});
 		if (existing) {
+			if (!Object.keys(attributes).some((key) => existing[key] !== attributes[key])) return existing;
+			let target = existing;
 			if (!existing.builtIn) {
-				if (this.logger) this.logger.warn(`Skipping web client provisioning for realm ${realm.id}: a non-built-in client named '${CLIENT_WEB_NAME}' already exists.`);
-				return;
+				if (this.logger) this.logger.warn(`Taking over the non-built-in client named '${CLIENT_WEB_NAME}' in realm ${realm.id}: the name is reserved for the built-in web client.`);
+				target = await this.clientRepository.findOneWithSecret({ id: existing.id }) || existing;
+				target.secret = null;
+				target.secretHashed = false;
+				target.secretEncrypted = false;
 			}
-			if (!Object.keys(attributes).some((key) => existing[key] !== attributes[key])) return;
-			const merged = this.clientRepository.merge(existing, attributes);
-			await this.clientRepository.save(merged);
-			return;
+			const merged = this.clientRepository.merge(target, attributes);
+			return this.clientRepository.save(merged);
 		}
 		const entity = this.clientRepository.create(attributes);
-		await this.clientRepository.save(entity);
+		return this.clientRepository.save(entity);
+	}
+	/**
+	* Bind the built-in global scopes through `auth_client_scopes`. That
+	* junction is the only source the /authorize code-request verifier reads
+	* scopes from.
+	*
+	* Additive like the attribute MERGE above: an extra scope an admin bound
+	* by hand is left in place.
+	*/ async ensureScopes(client) {
+		for (const name of WEB_CLIENT_SCOPE_NAMES) {
+			const scope = await this.scopeRepository.findOneBy({
+				name,
+				realmId: null
+			});
+			if (!scope) {
+				if (this.logger) this.logger.warn(`Skipping scope '${name}' for the web client of realm ${client.realmId}: the scope is not provisioned.`);
+				continue;
+			}
+			if (await this.clientScopeRepository.findOneBy({
+				clientId: client.id,
+				scopeId: scope.id
+			})) continue;
+			await this.clientScopeRepository.save(this.clientScopeRepository.create({
+				clientId: client.id,
+				clientRealmId: client.realmId,
+				scopeId: scope.id,
+				scopeRealmId: scope.realmId
+			}));
+		}
 	}
 };
 //#endregion
-export { WebClientProvisioner, buildWebClientAttributes };
+export { WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes };
 
 //# sourceMappingURL=web-client.mjs.map