@authup/server-core 1.0.0-beta.56 → 1.0.0-beta.57

package/dist/app/modules/database/repositories/query.d.ts

@@ -11,8 +11,28 @@ import type { EntityRepositoryPaginationMeta } from '@authup/server-kit';
  * Joins triggered by the parsed relations replicate the DISTINCT-id
  * pattern: when the builder already groups by the root id, every join
  * contributes its own `GROUP BY <alias>.id`.
+ *
+ * Field visibility conditions (`IField.condition`, attached by a
+ * schema `fields.validateMany` gate) cannot go into the statement — a
+ * TypeORM selection must stay a bare column for entity hydration.
+ * The adapter projects the gated column unconditionally and
+ * force-selects every column its condition reads (rapiq#830's operand
+ * projection — the SQL counterpart of the plan-039 force-select
+ * discipline, so a sparse replace-projection can neither over-redact
+ * nor fail open on missing operands); the fetching adapter MUST then
+ * run the rows through `redactFieldConditions` before returning them.
  */
 export declare function applyQuery(queryBuilder: SelectQueryBuilder<any>, query?: IQuery): {
     pagination: EntityRepositoryPaginationMeta;
 };
+/**
+ * Enforce the field visibility conditions of a decoded query on
+ * already-fetched rows: a gated column is dropped from every row that
+ * fails its condition; no row is ever removed. The SQL execution path
+ * projects gated columns unconditionally, so EVERY `findMany` adapter
+ * must pass its fetched entities through this before returning them —
+ * enforcement is fail-open by construction (a skipped call ships the
+ * value). Condition-less queries pass through untouched.
+ */
+export declare function redactFieldConditions<T>(query: IQuery | undefined, data: T[]): T[];
 //# sourceMappingURL=query.d.ts.map

package/dist/app/modules/database/repositories/query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/query.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACtB,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC,EACrC,KAAK,CAAC,EAAE,MAAM,GACd;IAAE,UAAU,EAAE,8BAA8B,CAAA;CAAE,CAejD"}
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/query.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,UAAU,CACtB,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC,EACrC,KAAK,CAAC,EAAE,MAAM,GACd;IAAE,UAAU,EAAE,8BAA8B,CAAA;CAAE,CAejD;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,GAAI,CAAC,EAAE,CAMnF"}

package/dist/app/modules/database/repositories/query.mjs

@@ -1,8 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { Query } from "@rapiq/core";
-import { TypeormAdapter } from "@rapiq/typeorm";
+import { Query, hasFieldConditions } from "@rapiq/core";
+import { applyFieldConditions } from "@rapiq/adapter-memory";
+import { TypeormAdapter } from "@rapiq/adapter-typeorm";
 //#region src/app/modules/database/repositories/query.ts
 /**
 * Apply a decoded rapiq query (IR) to the given TypeORM query builder.
@@ -14,6 +15,16 @@ import { TypeormAdapter } from "@rapiq/typeorm";
 * Joins triggered by the parsed relations replicate the DISTINCT-id
 * pattern: when the builder already groups by the root id, every join
 * contributes its own `GROUP BY <alias>.id`.
+*
+* Field visibility conditions (`IField.condition`, attached by a
+* schema `fields.validateMany` gate) cannot go into the statement — a
+* TypeORM selection must stay a bare column for entity hydration.
+* The adapter projects the gated column unconditionally and
+* force-selects every column its condition reads (rapiq#830's operand
+* projection — the SQL counterpart of the plan-039 force-select
+* discipline, so a sparse replace-projection can neither over-redact
+* nor fail open on missing operands); the fetching adapter MUST then
+* run the rows through `redactFieldConditions` before returning them.
 */ function applyQuery(queryBuilder, query) {
 	const { pagination } = new TypeormAdapter({
 		queryBuilder,
@@ -23,7 +34,19 @@ import { TypeormAdapter } from "@rapiq/typeorm";
 	}).execute(query ?? new Query({}));
 	return { pagination };
 }
+/**
+* Enforce the field visibility conditions of a decoded query on
+* already-fetched rows: a gated column is dropped from every row that
+* fails its condition; no row is ever removed. The SQL execution path
+* projects gated columns unconditionally, so EVERY `findMany` adapter
+* must pass its fetched entities through this before returning them —
+* enforcement is fail-open by construction (a skipped call ships the
+* value). Condition-less queries pass through untouched.
+*/ function redactFieldConditions(query, data) {
+	if (!query || !hasFieldConditions(query.fields)) return data;
+	return applyFieldConditions(query.fields, data);
+}
 //#endregion
-export { applyQuery };
+export { applyQuery, redactFieldConditions };
 
 //# sourceMappingURL=query.mjs.map

package/dist/app/modules/database/repositories/query.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"query.mjs","names":["Query","TypeormAdapter","applyQuery","queryBuilder","query","adapter","relations","onJoin","_path","alias","qb","expressionMap","groupBys","length","addGroupBy","pagination","execute"],"sources":["../../../../../src/app/modules/database/repositories/query.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IQuery } from '@rapiq/core';\nimport { Query } from '@rapiq/core';\nimport { TypeormAdapter } from '@rapiq/typeorm';\nimport type { SelectQueryBuilder } from 'typeorm';\nimport type { EntityRepositoryPaginationMeta } from '@authup/server-kit';\n\n/**\n * Apply a decoded rapiq query (IR) to the given TypeORM query builder.\n * Schema allow-lists, defaults and pagination bounds were already\n * applied at decode time (`decodeQuery` in core/query) — this helper\n * only executes the IR. Returns the applied pagination for the\n * response meta block.\n *\n * Joins triggered by the parsed relations replicate the DISTINCT-id\n * pattern: when the builder already groups by the root id, every join\n * contributes its own `GROUP BY <alias>.id`.\n */\nexport function applyQuery(\n    queryBuilder: SelectQueryBuilder<any>,\n    query?: IQuery,\n) : { pagination: EntityRepositoryPaginationMeta } {\n    const adapter = new TypeormAdapter({\n        queryBuilder,\n        relations: {\n            onJoin: (_path, alias, qb) => {\n                if (qb.expressionMap.groupBys.length > 0) {\n                    qb.addGroupBy(`${alias}.id`);\n                }\n            },\n        },\n    });\n\n    const { pagination } = adapter.execute(query ?? new Query({}));\n\n    return { pagination };\n}\n"],"mappings":";;;;;;;;;;;;;;;;GAwBA,SAAgBE,WACZC,cACAC,OAAc;CAad,MAAM,EAAEW,eAAeV,IAXHJ,eAAe;EAC/BE;EACAG,WAAW,EACPC,SAASC,OAAOC,OAAOC,OAAAA;GACnB,IAAIA,GAAGC,cAAcC,SAASC,SAAS,GACnCH,GAAGI,WAAW,GAAGL,MAAM,IAAI;EAEnC,EACJ;CACJ,CAEuBJ,CAAAA,CAAQW,QAAQZ,SAAS,IAAIJ,MAAM,CAAC,CAAA,CAAA;CAE3D,OAAO,EAAEe,WAAW;AACxB"}
+{"version":3,"file":"query.mjs","names":["Query","hasFieldConditions","applyFieldConditions","TypeormAdapter","applyQuery","queryBuilder","query","adapter","relations","onJoin","_path","alias","qb","expressionMap","groupBys","length","addGroupBy","pagination","execute","redactFieldConditions","data","fields"],"sources":["../../../../../src/app/modules/database/repositories/query.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IQuery } from '@rapiq/core';\nimport { Query, hasFieldConditions } from '@rapiq/core';\nimport { applyFieldConditions } from '@rapiq/adapter-memory';\nimport { TypeormAdapter } from '@rapiq/adapter-typeorm';\nimport type { SelectQueryBuilder } from 'typeorm';\nimport type { EntityRepositoryPaginationMeta } from '@authup/server-kit';\n\n/**\n * Apply a decoded rapiq query (IR) to the given TypeORM query builder.\n * Schema allow-lists, defaults and pagination bounds were already\n * applied at decode time (`decodeQuery` in core/query) — this helper\n * only executes the IR. Returns the applied pagination for the\n * response meta block.\n *\n * Joins triggered by the parsed relations replicate the DISTINCT-id\n * pattern: when the builder already groups by the root id, every join\n * contributes its own `GROUP BY <alias>.id`.\n *\n * Field visibility conditions (`IField.condition`, attached by a\n * schema `fields.validateMany` gate) cannot go into the statement — a\n * TypeORM selection must stay a bare column for entity hydration.\n * The adapter projects the gated column unconditionally and\n * force-selects every column its condition reads (rapiq#830's operand\n * projection — the SQL counterpart of the plan-039 force-select\n * discipline, so a sparse replace-projection can neither over-redact\n * nor fail open on missing operands); the fetching adapter MUST then\n * run the rows through `redactFieldConditions` before returning them.\n */\nexport function applyQuery(\n    queryBuilder: SelectQueryBuilder<any>,\n    query?: IQuery,\n) : { pagination: EntityRepositoryPaginationMeta } {\n    const adapter = new TypeormAdapter({\n        queryBuilder,\n        relations: {\n            onJoin: (_path, alias, qb) => {\n                if (qb.expressionMap.groupBys.length > 0) {\n                    qb.addGroupBy(`${alias}.id`);\n                }\n            },\n        },\n    });\n\n    const { pagination } = adapter.execute(query ?? new Query({}));\n\n    return { pagination };\n}\n\n/**\n * Enforce the field visibility conditions of a decoded query on\n * already-fetched rows: a gated column is dropped from every row that\n * fails its condition; no row is ever removed. The SQL execution path\n * projects gated columns unconditionally, so EVERY `findMany` adapter\n * must pass its fetched entities through this before returning them —\n * enforcement is fail-open by construction (a skipped call ships the\n * value). Condition-less queries pass through untouched.\n */\nexport function redactFieldConditions<T>(query: IQuery | undefined, data: T[]) : T[] {\n    if (!query || !hasFieldConditions(query.fields)) {\n        return data;\n    }\n\n    return applyFieldConditions(query.fields, data);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCA,SAAgBI,WACZC,cACAC,OAAc;CAad,MAAM,EAAEW,eAAeV,IAXHJ,eAAe;EAC/BE;EACAG,WAAW,EACPC,SAASC,OAAOC,OAAOC,OAAAA;GACnB,IAAIA,GAAGC,cAAcC,SAASC,SAAS,GACnCH,GAAGI,WAAW,GAAGL,MAAM,IAAI;EAEnC,EACJ;CACJ,CAEuBJ,CAAAA,CAAQW,QAAQZ,SAAS,IAAIN,MAAM,CAAC,CAAA,CAAA;CAE3D,OAAO,EAAEiB,WAAW;AACxB;;;;;;;;;GAWA,SAAgBE,sBAAyBb,OAA2Bc,MAAS;CACzE,IAAI,CAACd,SAAS,CAACL,mBAAmBK,MAAMe,MAAM,GAC1C,OAAOD;CAGX,OAAOlB,qBAAqBI,MAAMe,QAAQD,IAAAA;AAC9C"}

package/dist/app/modules/database/repositories/realm/repository.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { RealmEntity } from "../../../../../adapters/database/domains/realm/entity.mjs";
 import { CachePrefix } from "../../../../../adapters/database/domains/constants.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { translateWhereConditions } from "../helpers.mjs";
 import { isUUID } from "@authup/kit";
 import { REALM_MASTER_NAME } from "@authup/core-kit";
@@ -37,7 +37,7 @@ var RealmRepositoryAdapter = class {
 		const { pagination } = applyQuery(qb, query);
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/database/repositories/realm/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["REALM_MASTER_NAME","InternalError","isUUID","validateEntityJoinColumns","applyQuery","buildRedisKeyPath","CachePrefix","RealmEntity","translateWhereConditions","RealmRepositoryAdapter","repository","findOneById","id","qb","createQueryBuilder","where","cache","prefix","REALM","key","getOne","findOneByName","name","trim","toLowerCase","findMany","query","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneByIdOrName","idOrName","findManyBy","findBy","findOneBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","resolveId","resolve","withFallback"],"sources":["../../../../../../src/app/modules/database/repositories/realm/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { REALM_MASTER_NAME  } from '@authup/core-kit';\nimport { InternalError } from '@authup/errors';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { IRealmRepository } from '../../../../../core/index.ts';\nimport { CachePrefix, RealmEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { translateWhereConditions } from '../helpers.ts';\n\nexport class RealmRepositoryAdapter implements IRealmRepository {\n    private readonly repository: Repository<Realm>;\n\n    constructor(repository: Repository<Realm>) {\n        this.repository = repository;\n    }\n\n    findOneById(id: string): Promise<Realm | null> {\n        const qb = this.repository.createQueryBuilder('realm');\n        qb.where('realm.id = :id', { id });\n        qb.cache(\n            buildRedisKeyPath({\n                prefix: CachePrefix.REALM,\n                key: id,\n            }),\n            60_000,\n        );\n\n        return qb.getOne();\n    }\n\n    findOneByName(name: string): Promise<Realm | null> {\n        const qb = this.repository.createQueryBuilder('realm');\n        qb.where('realm.name = :name', { name: name.trim().toLowerCase() });\n\n        return qb.getOne();\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Realm>> {\n        const qb = this.repository.createQueryBuilder('realm');\n        qb.groupBy('realm.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneByIdOrName(idOrName: string): Promise<Realm | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<Realm[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<Realm | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<Realm>): Realm {\n        return this.repository.create(data);\n    }\n\n    merge(entity: Realm, data: Partial<Realm>): Realm {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: Realm): Promise<Realm> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: Realm): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<Realm>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: RealmEntity,\n        });\n    }\n\n    async resolveId(key: string): Promise<string | null> {\n        if (isUUID(key)) {\n            return key;\n        }\n\n        const entity = await this.findOneByName(key);\n        return entity ? entity.id : null;\n    }\n\n    async resolve(id: string | undefined, withFallback: true): Promise<Realm>;\n\n    async resolve(id: string | undefined, withFallback?: boolean): Promise<Realm | null>;\n\n    async resolve(id: string | undefined, withFallback?: boolean): Promise<Realm | null> {\n        let entity: Realm | null = null;\n\n        if (id) {\n            entity = await this.findOneByIdOrName(id);\n        }\n\n        if (!entity && withFallback) {\n            entity = await this.findOneBy({ name: REALM_MASTER_NAME });\n            if (!entity) {\n                throw new InternalError('The master realm could not be resolved.');\n            }\n        }\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AAqBA,IAAaS,yBAAb,MAAaA;CACQC;CAEjB,YAAYA,YAA+B;EACvC,KAAKA,aAAaA;CACtB;CAEAC,YAAYC,IAAmC;EAC3C,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,OAAA;EAC9CD,GAAGE,MAAM,kBAAkB,EAAEH,GAAG,CAAA;EAChCC,GAAGG,MACCX,kBAAkB;GACdY,QAAQX,YAAYY;GACpBC,KAAKP;EACT,CAAA,GACA,GAAA;EAGJ,OAAOC,GAAGO,OAAM;CACpB;CAEAC,cAAcC,MAAqC;EAC/C,MAAMT,KAAK,KAAKH,WAAWI,mBAAmB,OAAA;EAC9CD,GAAGE,MAAM,sBAAsB,EAAEO,MAAMA,KAAKC,KAAI,CAAA,CAAGC,YAAW,EAAG,CAAA;EAEjE,OAAOX,GAAGO,OAAM;CACpB;CAEA,MAAMK,SAASC,OAA+D;EAC1E,MAAMb,KAAK,KAAKH,WAAWI,mBAAmB,OAAA;EAC9CD,GAAGc,QAAQ,UAAA;EAEX,MAAM,EAAEC,eAAexB,WAAWS,IAAIa,KAAAA;EAEtC,MAAM,CAACG,UAAUC,SAAS,MAAMjB,GAAGkB,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMM,kBAAkBC,UAAyC;EAC7D,OAAOjC,OAAOiC,QAAAA,IACV,KAAKxB,YAAYwB,QAAAA,IACjB,KAAKd,cAAcc,QAAAA;CAC3B;CAEA,MAAMC,WAAWrB,OAA8C;EAC3D,OAAO,KAAKL,WAAW2B,OAAO7B,yBAAyBO,KAAAA,CAAAA;CAC3D;CAEA,MAAMuB,UAAUvB,OAAmD;EAC/D,OAAO,KAAKL,WAAW4B,UAAU9B,yBAAyBO,KAAAA,CAAAA;CAC9D;CAEAwB,OAAOP,MAA6B;EAChC,OAAO,KAAKtB,WAAW6B,OAAOP,IAAAA;CAClC;CAEAQ,MAAMC,QAAeT,MAA6B;EAC9C,OAAO,KAAKtB,WAAW8B,MAAMC,QAAQT,IAAAA;CACzC;CAEA,MAAMU,KAAKD,QAA+B;EACtC,OAAO,KAAK/B,WAAWgC,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAA8B;EACvC,MAAM,KAAK/B,WAAWiC,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBZ,MAAqC;EAC3D,MAAM7B,0BAA0B6B,MAAM;GAClCa,YAAY,KAAKnC,WAAWoC,QAAQC;GACpCC,cAAczC;EAClB,CAAA;CACJ;CAEA,MAAM0C,UAAU9B,KAAqC;EACjD,IAAIjB,OAAOiB,GAAAA,GACP,OAAOA;EAGX,MAAMsB,SAAS,MAAM,KAAKpB,cAAcF,GAAAA;EACxC,OAAOsB,SAASA,OAAO7B,KAAK;CAChC;CAMA,MAAMsC,QAAQtC,IAAwBuC,cAA+C;EACjF,IAAIV,SAAuB;EAE3B,IAAI7B,IACA6B,SAAS,MAAM,KAAKP,kBAAkBtB,EAAAA;EAG1C,IAAI,CAAC6B,UAAUU,cAAc;GACzBV,SAAS,MAAM,KAAKH,UAAU,EAAEhB,MAAMtB,kBAAkB,CAAA;GACxD,IAAI,CAACyC,QACD,MAAM,IAAIxC,cAAc,yCAAA;EAEhC;EAEA,OAAOwC;CACX;AACJ"}
+{"version":3,"file":"repository.mjs","names":["REALM_MASTER_NAME","InternalError","isUUID","validateEntityJoinColumns","applyQuery","redactFieldConditions","buildRedisKeyPath","CachePrefix","RealmEntity","translateWhereConditions","RealmRepositoryAdapter","repository","findOneById","id","qb","createQueryBuilder","where","cache","prefix","REALM","key","getOne","findOneByName","name","trim","toLowerCase","findMany","query","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneByIdOrName","idOrName","findManyBy","findBy","findOneBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","resolveId","resolve","withFallback"],"sources":["../../../../../../src/app/modules/database/repositories/realm/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { REALM_MASTER_NAME  } from '@authup/core-kit';\nimport { InternalError } from '@authup/errors';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { IRealmRepository } from '../../../../../core/index.ts';\nimport { CachePrefix, RealmEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { translateWhereConditions } from '../helpers.ts';\n\nexport class RealmRepositoryAdapter implements IRealmRepository {\n    private readonly repository: Repository<Realm>;\n\n    constructor(repository: Repository<Realm>) {\n        this.repository = repository;\n    }\n\n    findOneById(id: string): Promise<Realm | null> {\n        const qb = this.repository.createQueryBuilder('realm');\n        qb.where('realm.id = :id', { id });\n        qb.cache(\n            buildRedisKeyPath({\n                prefix: CachePrefix.REALM,\n                key: id,\n            }),\n            60_000,\n        );\n\n        return qb.getOne();\n    }\n\n    findOneByName(name: string): Promise<Realm | null> {\n        const qb = this.repository.createQueryBuilder('realm');\n        qb.where('realm.name = :name', { name: name.trim().toLowerCase() });\n\n        return qb.getOne();\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Realm>> {\n        const qb = this.repository.createQueryBuilder('realm');\n        qb.groupBy('realm.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneByIdOrName(idOrName: string): Promise<Realm | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<Realm[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<Realm | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<Realm>): Realm {\n        return this.repository.create(data);\n    }\n\n    merge(entity: Realm, data: Partial<Realm>): Realm {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: Realm): Promise<Realm> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: Realm): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<Realm>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: RealmEntity,\n        });\n    }\n\n    async resolveId(key: string): Promise<string | null> {\n        if (isUUID(key)) {\n            return key;\n        }\n\n        const entity = await this.findOneByName(key);\n        return entity ? entity.id : null;\n    }\n\n    async resolve(id: string | undefined, withFallback: true): Promise<Realm>;\n\n    async resolve(id: string | undefined, withFallback?: boolean): Promise<Realm | null>;\n\n    async resolve(id: string | undefined, withFallback?: boolean): Promise<Realm | null> {\n        let entity: Realm | null = null;\n\n        if (id) {\n            entity = await this.findOneByIdOrName(id);\n        }\n\n        if (!entity && withFallback) {\n            entity = await this.findOneBy({ name: REALM_MASTER_NAME });\n            if (!entity) {\n                throw new InternalError('The master realm could not be resolved.');\n            }\n        }\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AAqBA,IAAaU,yBAAb,MAAaA;CACQC;CAEjB,YAAYA,YAA+B;EACvC,KAAKA,aAAaA;CACtB;CAEAC,YAAYC,IAAmC;EAC3C,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,OAAA;EAC9CD,GAAGE,MAAM,kBAAkB,EAAEH,GAAG,CAAA;EAChCC,GAAGG,MACCX,kBAAkB;GACdY,QAAQX,YAAYY;GACpBC,KAAKP;EACT,CAAA,GACA,GAAA;EAGJ,OAAOC,GAAGO,OAAM;CACpB;CAEAC,cAAcC,MAAqC;EAC/C,MAAMT,KAAK,KAAKH,WAAWI,mBAAmB,OAAA;EAC9CD,GAAGE,MAAM,sBAAsB,EAAEO,MAAMA,KAAKC,KAAI,CAAA,CAAGC,YAAW,EAAG,CAAA;EAEjE,OAAOX,GAAGO,OAAM;CACpB;CAEA,MAAMK,SAASC,OAA+D;EAC1E,MAAMb,KAAK,KAAKH,WAAWI,mBAAmB,OAAA;EAC9CD,GAAGc,QAAQ,UAAA;EAEX,MAAM,EAAEC,eAAezB,WAAWU,IAAIa,KAAAA;EAEtC,MAAM,CAACG,UAAUC,SAAS,MAAMjB,GAAGkB,gBAAe;EAElD,OAAO;GACHC,MAAM5B,sBAAsBsB,OAAOG,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMM,kBAAkBC,UAAyC;EAC7D,OAAOlC,OAAOkC,QAAAA,IACV,KAAKxB,YAAYwB,QAAAA,IACjB,KAAKd,cAAcc,QAAAA;CAC3B;CAEA,MAAMC,WAAWrB,OAA8C;EAC3D,OAAO,KAAKL,WAAW2B,OAAO7B,yBAAyBO,KAAAA,CAAAA;CAC3D;CAEA,MAAMuB,UAAUvB,OAAmD;EAC/D,OAAO,KAAKL,WAAW4B,UAAU9B,yBAAyBO,KAAAA,CAAAA;CAC9D;CAEAwB,OAAOP,MAA6B;EAChC,OAAO,KAAKtB,WAAW6B,OAAOP,IAAAA;CAClC;CAEAQ,MAAMC,QAAeT,MAA6B;EAC9C,OAAO,KAAKtB,WAAW8B,MAAMC,QAAQT,IAAAA;CACzC;CAEA,MAAMU,KAAKD,QAA+B;EACtC,OAAO,KAAK/B,WAAWgC,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAA8B;EACvC,MAAM,KAAK/B,WAAWiC,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBZ,MAAqC;EAC3D,MAAM9B,0BAA0B8B,MAAM;GAClCa,YAAY,KAAKnC,WAAWoC,QAAQC;GACpCC,cAAczC;EAClB,CAAA;CACJ;CAEA,MAAM0C,UAAU9B,KAAqC;EACjD,IAAIlB,OAAOkB,GAAAA,GACP,OAAOA;EAGX,MAAMsB,SAAS,MAAM,KAAKpB,cAAcF,GAAAA;EACxC,OAAOsB,SAASA,OAAO7B,KAAK;CAChC;CAMA,MAAMsC,QAAQtC,IAAwBuC,cAA+C;EACjF,IAAIV,SAAuB;EAE3B,IAAI7B,IACA6B,SAAS,MAAM,KAAKP,kBAAkBtB,EAAAA;EAG1C,IAAI,CAAC6B,UAAUU,cAAc;GACzBV,SAAS,MAAM,KAAKH,UAAU,EAAEhB,MAAMvB,kBAAkB,CAAA;GACxD,IAAI,CAAC0C,QACD,MAAM,IAAIzC,cAAc,yCAAA;EAEhC;EAEA,OAAOyC;CACX;AACJ"}

package/dist/app/modules/database/repositories/role/repository.mjs

@@ -5,7 +5,7 @@ import { CachePrefix } from "../../../../../adapters/database/domains/constants.
 import { RoleEntity } from "../../../../../adapters/database/domains/role/entity.mjs";
 import { RolePermissionEntity } from "../../../../../adapters/database/domains/role-permission/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
 import "../../../../../adapters/database/index.mjs";
@@ -27,7 +27,7 @@ var RoleRepositoryAdapter = class {
 		const { pagination } = applyQuery(qb, query);
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/database/repositories/role/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["isUUID","validateEntityJoinColumns","applyQuery","DatabaseConflictError","isEntityUnique","translateWhereConditions","loadBoundPermissions","CachePrefix","RoleEntity","RolePermissionEntity","RealmRepositoryAdapter","RoleRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOneByIdOrName","idOrName","realm","findManyBy","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting","getBoundPermissions","junctionTarget","roleId","cachePrefix","ROLE_OWNED_PERMISSIONS","cacheKey","getBoundPermissionsForMany","results","Promise","all","map","flat"],"sources":["../../../../../../src/app/modules/database/repositories/role/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm, Role } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { PermissionPolicyBinding } from '@authup/access';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository, IRoleRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport { isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { loadBoundPermissions } from '../bindings.ts';\nimport {\n    CachePrefix,\n    RoleEntity,\n    RolePermissionEntity,\n} from '../../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type RoleRepositoryAdapterContext = {\n    repository: Repository<Role>,\n    realmRepository: Repository<Realm>,\n};\n\nexport class RoleRepositoryAdapter implements IRoleRepository {\n    private readonly repository: Repository<Role>;\n\n    private readonly realmRepository: IRealmRepository;\n\n    constructor(ctx: RoleRepositoryAdapterContext) {\n        this.repository = ctx.repository;\n        this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Role>> {\n        const qb = this.repository.createQueryBuilder('role');\n        qb.groupBy('role.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    findOneById(id: string): Promise<Role | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<Role | null> {\n        const qb = this.repository.createQueryBuilder('role');\n        qb.where('role.name = :name', { name });\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n            qb.andWhere('role.realmId = :realmId', { realmId });\n        }\n\n        return qb.getOne();\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<Role | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<Role[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<Role | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<Role>): Role {\n        return this.repository.create(data);\n    }\n\n    merge(entity: Role, data: Partial<Role>): Role {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: Role): Promise<Role> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: Role): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<Role>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: RoleEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<Role>, existing?: Role): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.repository.manager.connection,\n            entityTarget: RoleEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async getBoundPermissions(entity: string | Role): Promise<PermissionPolicyBinding[]> {\n        const id = typeof entity === 'string' ? entity : entity.id;\n        return loadBoundPermissions({\n            manager: this.repository.manager,\n            junctionTarget: RolePermissionEntity,\n            where: { roleId: id },\n            cachePrefix: CachePrefix.ROLE_OWNED_PERMISSIONS,\n            cacheKey: id,\n        });\n    }\n\n    async getBoundPermissionsForMany(entities: (string | Role)[]): Promise<PermissionPolicyBinding[]> {\n        const results = await Promise.all(entities.map((entity) => this.getBoundPermissions(entity)));\n        return results.flat();\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA+BA,IAAaW,wBAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAAmC;EAC3C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAA8D;EACzE,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,MAAA;EAC9CD,GAAGE,QAAQ,SAAA;EAEX,MAAM,EAAEC,eAAelB,WAAWe,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAAkC;EAC1C,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,cAAcC,MAAcC,UAAyC;EACvE,MAAMd,KAAK,KAAKL,WAAWM,mBAAmB,MAAA;EAC9CD,GAAGe,MAAM,qBAAqB,EAAEF,KAAK,CAAA;EAErC,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKpB,gBAAgBqB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXhB,GAAGkB,SAAS,2BAA2B,EAAEF,QAAQ,CAAA;EACrD;EAEA,OAAOhB,GAAGmB,OAAM;CACpB;CAEA,MAAMC,kBAAkBC,UAAkBC,OAAsC;EAC5E,OAAOvC,OAAOsC,QAAAA,IACV,KAAKZ,YAAYY,QAAAA,IACjB,KAAKT,cAAcS,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWR,OAA6C;EAC1D,OAAO,KAAKpB,WAAW6B,OAAOpC,yBAAyB2B,KAAAA,CAAAA;CAC3D;CAEA,MAAMJ,UAAUI,OAAkD;EAC9D,OAAO,KAAKpB,WAAWgB,UAAUvB,yBAAyB2B,KAAAA,CAAAA;CAC9D;CAEAU,OAAOlB,MAA2B;EAC9B,OAAO,KAAKZ,WAAW8B,OAAOlB,IAAAA;CAClC;CAEAmB,MAAMC,QAAcpB,MAA2B;EAC3C,OAAO,KAAKZ,WAAW+B,MAAMC,QAAQpB,IAAAA;CACzC;CAEA,MAAMqB,KAAKD,QAA6B;EACpC,OAAO,KAAKhC,WAAWiC,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAA6B;EACtC,MAAM,KAAKhC,WAAWkC,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBvB,MAAoC;EAC1D,MAAMvB,0BAA0BuB,MAAM;GAClCwB,YAAY,KAAKpC,WAAWqC,QAAQC;GACpCC,cAAc3C;EAClB,CAAA;CACJ;CAEA,MAAM4C,gBAAgB5B,MAAqB6B,UAAgC;EAQvE,IAAI,CAACC,MAPkBlD,eAAe;GAClC4C,YAAY,KAAKpC,WAAWqC,QAAQC;GACpCC,cAAc3C;GACdoC,QAAQpB;GACR+B,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAIlD,sBAAAA;CAElB;CAEA,MAAMqD,oBAAoBZ,QAA2D;EACjF,MAAMjB,KAAK,OAAOiB,WAAW,WAAWA,SAASA,OAAOjB;EACxD,OAAOrB,qBAAqB;GACxB2C,SAAS,KAAKrC,WAAWqC;GACzBQ,gBAAgBhD;GAChBuB,OAAO,EAAE0B,QAAQ/B,GAAG;GACpBgC,aAAapD,YAAYqD;GACzBC,UAAUlC;EACd,CAAA;CACJ;CAEA,MAAMmC,2BAA2BzC,UAAiE;EAE9F,QAAO0C,MADeC,QAAQC,IAAI5C,SAAS6C,KAAKtB,WAAW,KAAKY,oBAAoBZ,MAAAA,CAAAA,CAAAA,EAAAA,CACrEuB,KAAI;CACvB;AACJ"}
+{"version":3,"file":"repository.mjs","names":["isUUID","validateEntityJoinColumns","applyQuery","redactFieldConditions","DatabaseConflictError","isEntityUnique","translateWhereConditions","loadBoundPermissions","CachePrefix","RoleEntity","RolePermissionEntity","RealmRepositoryAdapter","RoleRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOneByIdOrName","idOrName","realm","findManyBy","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting","getBoundPermissions","junctionTarget","roleId","cachePrefix","ROLE_OWNED_PERMISSIONS","cacheKey","getBoundPermissionsForMany","results","Promise","all","map","flat"],"sources":["../../../../../../src/app/modules/database/repositories/role/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm, Role } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { PermissionPolicyBinding } from '@authup/access';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository, IRoleRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport { isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { loadBoundPermissions } from '../bindings.ts';\nimport {\n    CachePrefix,\n    RoleEntity,\n    RolePermissionEntity,\n} from '../../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type RoleRepositoryAdapterContext = {\n    repository: Repository<Role>,\n    realmRepository: Repository<Realm>,\n};\n\nexport class RoleRepositoryAdapter implements IRoleRepository {\n    private readonly repository: Repository<Role>;\n\n    private readonly realmRepository: IRealmRepository;\n\n    constructor(ctx: RoleRepositoryAdapterContext) {\n        this.repository = ctx.repository;\n        this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Role>> {\n        const qb = this.repository.createQueryBuilder('role');\n        qb.groupBy('role.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    findOneById(id: string): Promise<Role | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<Role | null> {\n        const qb = this.repository.createQueryBuilder('role');\n        qb.where('role.name = :name', { name });\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n            qb.andWhere('role.realmId = :realmId', { realmId });\n        }\n\n        return qb.getOne();\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<Role | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<Role[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<Role | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<Role>): Role {\n        return this.repository.create(data);\n    }\n\n    merge(entity: Role, data: Partial<Role>): Role {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: Role): Promise<Role> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: Role): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<Role>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: RoleEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<Role>, existing?: Role): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.repository.manager.connection,\n            entityTarget: RoleEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async getBoundPermissions(entity: string | Role): Promise<PermissionPolicyBinding[]> {\n        const id = typeof entity === 'string' ? entity : entity.id;\n        return loadBoundPermissions({\n            manager: this.repository.manager,\n            junctionTarget: RolePermissionEntity,\n            where: { roleId: id },\n            cachePrefix: CachePrefix.ROLE_OWNED_PERMISSIONS,\n            cacheKey: id,\n        });\n    }\n\n    async getBoundPermissionsForMany(entities: (string | Role)[]): Promise<PermissionPolicyBinding[]> {\n        const results = await Promise.all(entities.map((entity) => this.getBoundPermissions(entity)));\n        return results.flat();\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA+BA,IAAaY,wBAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAAmC;EAC3C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAA8D;EACzE,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,MAAA;EAC9CD,GAAGE,QAAQ,SAAA;EAEX,MAAM,EAAEC,eAAenB,WAAWgB,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMtB,sBAAsBc,OAAOK,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAAkC;EAC1C,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,cAAcC,MAAcC,UAAyC;EACvE,MAAMd,KAAK,KAAKL,WAAWM,mBAAmB,MAAA;EAC9CD,GAAGe,MAAM,qBAAqB,EAAEF,KAAK,CAAA;EAErC,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKpB,gBAAgBqB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXhB,GAAGkB,SAAS,2BAA2B,EAAEF,QAAQ,CAAA;EACrD;EAEA,OAAOhB,GAAGmB,OAAM;CACpB;CAEA,MAAMC,kBAAkBC,UAAkBC,OAAsC;EAC5E,OAAOxC,OAAOuC,QAAAA,IACV,KAAKZ,YAAYY,QAAAA,IACjB,KAAKT,cAAcS,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWR,OAA6C;EAC1D,OAAO,KAAKpB,WAAW6B,OAAOpC,yBAAyB2B,KAAAA,CAAAA;CAC3D;CAEA,MAAMJ,UAAUI,OAAkD;EAC9D,OAAO,KAAKpB,WAAWgB,UAAUvB,yBAAyB2B,KAAAA,CAAAA;CAC9D;CAEAU,OAAOlB,MAA2B;EAC9B,OAAO,KAAKZ,WAAW8B,OAAOlB,IAAAA;CAClC;CAEAmB,MAAMC,QAAcpB,MAA2B;EAC3C,OAAO,KAAKZ,WAAW+B,MAAMC,QAAQpB,IAAAA;CACzC;CAEA,MAAMqB,KAAKD,QAA6B;EACpC,OAAO,KAAKhC,WAAWiC,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAA6B;EACtC,MAAM,KAAKhC,WAAWkC,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBvB,MAAoC;EAC1D,MAAMxB,0BAA0BwB,MAAM;GAClCwB,YAAY,KAAKpC,WAAWqC,QAAQC;GACpCC,cAAc3C;EAClB,CAAA;CACJ;CAEA,MAAM4C,gBAAgB5B,MAAqB6B,UAAgC;EAQvE,IAAI,CAACC,MAPkBlD,eAAe;GAClC4C,YAAY,KAAKpC,WAAWqC,QAAQC;GACpCC,cAAc3C;GACdoC,QAAQpB;GACR+B,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAIlD,sBAAAA;CAElB;CAEA,MAAMqD,oBAAoBZ,QAA2D;EACjF,MAAMjB,KAAK,OAAOiB,WAAW,WAAWA,SAASA,OAAOjB;EACxD,OAAOrB,qBAAqB;GACxB2C,SAAS,KAAKrC,WAAWqC;GACzBQ,gBAAgBhD;GAChBuB,OAAO,EAAE0B,QAAQ/B,GAAG;GACpBgC,aAAapD,YAAYqD;GACzBC,UAAUlC;EACd,CAAA;CACJ;CAEA,MAAMmC,2BAA2BzC,UAAiE;EAE9F,QAAO0C,MADeC,QAAQC,IAAI5C,SAAS6C,KAAKtB,WAAW,KAAKY,oBAAoBZ,MAAAA,CAAAA,CAAAA,EAAAA,CACrEuB,KAAI;CACvB;AACJ"}

package/dist/app/modules/database/repositories/role-attribute/repository.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { RoleAttributeEntity } from "../../../../../adapters/database/domains/role-attribute/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { applyRealmScopeSelect, translateWhereConditions } from "../helpers.mjs";
 import { validateEntityJoinColumns } from "typeorm-extension";
 //#region src/app/modules/database/repositories/role-attribute/repository.ts
@@ -19,7 +19,7 @@ var RoleAttributeRepositoryAdapter = class {
 		applyRealmScopeSelect(qb, "roleAttribute");
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/database/repositories/role-attribute/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["validateEntityJoinColumns","applyQuery","RoleAttributeEntity","applyRealmScopeSelect","translateWhereConditions","RoleAttributeRepositoryAdapter","repository","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","findOneByIdOrName","idOrName","findManyBy","where","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget"],"sources":["../../../../../../src/app/modules/database/repositories/role-attribute/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RoleAttribute } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRoleAttributeRepository } from '../../../../../core/index.ts';\nimport { RoleAttributeEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { applyRealmScopeSelect, translateWhereConditions } from '../helpers.ts';\n\nexport class RoleAttributeRepositoryAdapter implements IRoleAttributeRepository {\n    private readonly repository: Repository<RoleAttribute>;\n\n    constructor(repository: Repository<RoleAttribute>) {\n        this.repository = repository;\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<RoleAttribute>> {\n        const qb = this.repository.createQueryBuilder('roleAttribute');\n        qb.groupBy('roleAttribute.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'roleAttribute');\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    findOneById(id: string): Promise<RoleAttribute | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(): Promise<RoleAttribute | null> {\n        return null;\n    }\n\n    async findOneByIdOrName(idOrName: string): Promise<RoleAttribute | null> {\n        return this.findOneById(idOrName);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<RoleAttribute[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<RoleAttribute | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<RoleAttribute>): RoleAttribute {\n        return this.repository.create(data);\n    }\n\n    merge(entity: RoleAttribute, data: Partial<RoleAttribute>): RoleAttribute {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: RoleAttribute): Promise<RoleAttribute> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: RoleAttribute): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<RoleAttribute>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: RoleAttributeEntity,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;AAiBA,IAAaK,iCAAb,MAAaA;CACQC;CAEjB,YAAYA,YAAuC;EAC/C,KAAKA,aAAaA;CACtB;CAEA,MAAMC,SAASC,OAAuE;EAClF,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,eAAA;EAC9CD,GAAGE,QAAQ,kBAAA;EAEX,MAAM,EAAEC,eAAeX,WAAWQ,IAAID,KAAAA;EAEtCL,sBAAsBM,IAAI,eAAA;EAE1B,MAAM,CAACI,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAA2C;EACnD,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,gBAA+C;EACjD,OAAO;CACX;CAEA,MAAMC,kBAAkBC,UAAiD;EACrE,OAAO,KAAKL,YAAYK,QAAAA;CAC5B;CAEA,MAAMC,WAAWC,OAAsD;EACnE,OAAO,KAAKnB,WAAWoB,OAAOtB,yBAAyBqB,KAAAA,CAAAA;CAC3D;CAEA,MAAML,UAAUK,OAA2D;EACvE,OAAO,KAAKnB,WAAWc,UAAUhB,yBAAyBqB,KAAAA,CAAAA;CAC9D;CAEAE,OAAOX,MAA6C;EAChD,OAAO,KAAKV,WAAWqB,OAAOX,IAAAA;CAClC;CAEAY,MAAMC,QAAuBb,MAA6C;EACtE,OAAO,KAAKV,WAAWsB,MAAMC,QAAQb,IAAAA;CACzC;CAEA,MAAMc,KAAKD,QAA+C;EACtD,OAAO,KAAKvB,WAAWwB,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAAsC;EAC/C,MAAM,KAAKvB,WAAWyB,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBhB,MAA6C;EACnE,MAAMhB,0BAA0BgB,MAAM;GAClCiB,YAAY,KAAK3B,WAAW4B,QAAQC;GACpCC,cAAclC;EAClB,CAAA;CACJ;AACJ"}
+{"version":3,"file":"repository.mjs","names":["validateEntityJoinColumns","applyQuery","redactFieldConditions","RoleAttributeEntity","applyRealmScopeSelect","translateWhereConditions","RoleAttributeRepositoryAdapter","repository","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","findOneByIdOrName","idOrName","findManyBy","where","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget"],"sources":["../../../../../../src/app/modules/database/repositories/role-attribute/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RoleAttribute } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRoleAttributeRepository } from '../../../../../core/index.ts';\nimport { RoleAttributeEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { applyRealmScopeSelect, translateWhereConditions } from '../helpers.ts';\n\nexport class RoleAttributeRepositoryAdapter implements IRoleAttributeRepository {\n    private readonly repository: Repository<RoleAttribute>;\n\n    constructor(repository: Repository<RoleAttribute>) {\n        this.repository = repository;\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<RoleAttribute>> {\n        const qb = this.repository.createQueryBuilder('roleAttribute');\n        qb.groupBy('roleAttribute.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'roleAttribute');\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    findOneById(id: string): Promise<RoleAttribute | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(): Promise<RoleAttribute | null> {\n        return null;\n    }\n\n    async findOneByIdOrName(idOrName: string): Promise<RoleAttribute | null> {\n        return this.findOneById(idOrName);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<RoleAttribute[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<RoleAttribute | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<RoleAttribute>): RoleAttribute {\n        return this.repository.create(data);\n    }\n\n    merge(entity: RoleAttribute, data: Partial<RoleAttribute>): RoleAttribute {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: RoleAttribute): Promise<RoleAttribute> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: RoleAttribute): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<RoleAttribute>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: RoleAttributeEntity,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;AAiBA,IAAaM,iCAAb,MAAaA;CACQC;CAEjB,YAAYA,YAAuC;EAC/C,KAAKA,aAAaA;CACtB;CAEA,MAAMC,SAASC,OAAuE;EAClF,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,eAAA;EAC9CD,GAAGE,QAAQ,kBAAA;EAEX,MAAM,EAAEC,eAAeZ,WAAWS,IAAID,KAAAA;EAEtCL,sBAAsBM,IAAI,eAAA;EAE1B,MAAM,CAACI,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMf,sBAAsBO,OAAOK,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAA2C;EACnD,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,gBAA+C;EACjD,OAAO;CACX;CAEA,MAAMC,kBAAkBC,UAAiD;EACrE,OAAO,KAAKL,YAAYK,QAAAA;CAC5B;CAEA,MAAMC,WAAWC,OAAsD;EACnE,OAAO,KAAKnB,WAAWoB,OAAOtB,yBAAyBqB,KAAAA,CAAAA;CAC3D;CAEA,MAAML,UAAUK,OAA2D;EACvE,OAAO,KAAKnB,WAAWc,UAAUhB,yBAAyBqB,KAAAA,CAAAA;CAC9D;CAEAE,OAAOX,MAA6C;EAChD,OAAO,KAAKV,WAAWqB,OAAOX,IAAAA;CAClC;CAEAY,MAAMC,QAAuBb,MAA6C;EACtE,OAAO,KAAKV,WAAWsB,MAAMC,QAAQb,IAAAA;CACzC;CAEA,MAAMc,KAAKD,QAA+C;EACtD,OAAO,KAAKvB,WAAWwB,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAAsC;EAC/C,MAAM,KAAKvB,WAAWyB,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBhB,MAA6C;EACnE,MAAMjB,0BAA0BiB,MAAM;GAClCiB,YAAY,KAAK3B,WAAW4B,QAAQC;GACpCC,cAAclC;EAClB,CAAA;CACJ;AACJ"}

package/dist/app/modules/database/repositories/role-permission/repository.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { RolePermissionEntity } from "../../../../../adapters/database/domains/role-permission/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { translateWhereConditions } from "../helpers.mjs";
 import { validateEntityJoinColumns } from "typeorm-extension";
 //#region src/app/modules/database/repositories/role-permission/repository.ts
@@ -18,7 +18,7 @@ var RolePermissionRepositoryAdapter = class {
 		const { pagination } = applyQuery(qb, query);
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/database/repositories/role-permission/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["validateEntityJoinColumns","applyQuery","RolePermissionEntity","translateWhereConditions","RolePermissionRepositoryAdapter","repository","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","_name","Promise","resolve","findOneByIdOrName","idOrName","findManyBy","where","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget"],"sources":["../../../../../../src/app/modules/database/repositories/role-permission/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RolePermission } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRolePermissionRepository } from '../../../../../core/index.ts';\nimport { RolePermissionEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { translateWhereConditions } from '../helpers.ts';\n\nexport class RolePermissionRepositoryAdapter implements IRolePermissionRepository {\n    private readonly repository: Repository<RolePermission>;\n\n    constructor(repository: Repository<RolePermission>) {\n        this.repository = repository;\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<RolePermission>> {\n        const qb = this.repository.createQueryBuilder('rolePermission');\n        qb.groupBy('rolePermission.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    findOneById(id: string): Promise<RolePermission | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(_name: string): Promise<RolePermission | null> {\n        return Promise.resolve(null);\n    }\n\n    findOneByIdOrName(idOrName: string): Promise<RolePermission | null> {\n        return this.findOneById(idOrName);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<RolePermission[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<RolePermission | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<RolePermission>): RolePermission {\n        return this.repository.create(data);\n    }\n\n    merge(entity: RolePermission, data: Partial<RolePermission>): RolePermission {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: RolePermission): Promise<RolePermission> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: RolePermission): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<RolePermission>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: RolePermissionEntity,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;AAiBA,IAAaI,kCAAb,MAAaA;CACQC;CAEjB,YAAYA,YAAwC;EAChD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,SAASC,OAAwE;EACnF,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,gBAAA;EAC9CD,GAAGE,QAAQ,mBAAA;EAEX,MAAM,EAAEC,eAAeV,WAAWO,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAA4C;EACpD,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,cAAcC,OAA+C;EAC/D,OAAOC,QAAQC,QAAQ,IAAA;CAC3B;CAEAC,kBAAkBC,UAAkD;EAChE,OAAO,KAAKR,YAAYQ,QAAAA;CAC5B;CAEA,MAAMC,WAAWC,OAAuD;EACpE,OAAO,KAAKtB,WAAWuB,OAAOzB,yBAAyBwB,KAAAA,CAAAA;CAC3D;CAEA,MAAMR,UAAUQ,OAA4D;EACxE,OAAO,KAAKtB,WAAWc,UAAUhB,yBAAyBwB,KAAAA,CAAAA;CAC9D;CAEAE,OAAOd,MAA+C;EAClD,OAAO,KAAKV,WAAWwB,OAAOd,IAAAA;CAClC;CAEAe,MAAMC,QAAwBhB,MAA+C;EACzE,OAAO,KAAKV,WAAWyB,MAAMC,QAAQhB,IAAAA;CACzC;CAEA,MAAMiB,KAAKD,QAAiD;EACxD,OAAO,KAAK1B,WAAW2B,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAAuC;EAChD,MAAM,KAAK1B,WAAW4B,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBnB,MAA8C;EACpE,MAAMf,0BAA0Be,MAAM;GAClCoB,YAAY,KAAK9B,WAAW+B,QAAQC;GACpCC,cAAcpC;EAClB,CAAA;CACJ;AACJ"}
+{"version":3,"file":"repository.mjs","names":["validateEntityJoinColumns","applyQuery","redactFieldConditions","RolePermissionEntity","translateWhereConditions","RolePermissionRepositoryAdapter","repository","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","_name","Promise","resolve","findOneByIdOrName","idOrName","findManyBy","where","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget"],"sources":["../../../../../../src/app/modules/database/repositories/role-permission/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RolePermission } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRolePermissionRepository } from '../../../../../core/index.ts';\nimport { RolePermissionEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { translateWhereConditions } from '../helpers.ts';\n\nexport class RolePermissionRepositoryAdapter implements IRolePermissionRepository {\n    private readonly repository: Repository<RolePermission>;\n\n    constructor(repository: Repository<RolePermission>) {\n        this.repository = repository;\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<RolePermission>> {\n        const qb = this.repository.createQueryBuilder('rolePermission');\n        qb.groupBy('rolePermission.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    findOneById(id: string): Promise<RolePermission | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(_name: string): Promise<RolePermission | null> {\n        return Promise.resolve(null);\n    }\n\n    findOneByIdOrName(idOrName: string): Promise<RolePermission | null> {\n        return this.findOneById(idOrName);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<RolePermission[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<RolePermission | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<RolePermission>): RolePermission {\n        return this.repository.create(data);\n    }\n\n    merge(entity: RolePermission, data: Partial<RolePermission>): RolePermission {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: RolePermission): Promise<RolePermission> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: RolePermission): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<RolePermission>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: RolePermissionEntity,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;AAiBA,IAAaK,kCAAb,MAAaA;CACQC;CAEjB,YAAYA,YAAwC;EAChD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,SAASC,OAAwE;EACnF,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,gBAAA;EAC9CD,GAAGE,QAAQ,mBAAA;EAEX,MAAM,EAAEC,eAAeX,WAAWQ,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMd,sBAAsBM,OAAOK,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAA4C;EACpD,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,cAAcC,OAA+C;EAC/D,OAAOC,QAAQC,QAAQ,IAAA;CAC3B;CAEAC,kBAAkBC,UAAkD;EAChE,OAAO,KAAKR,YAAYQ,QAAAA;CAC5B;CAEA,MAAMC,WAAWC,OAAuD;EACpE,OAAO,KAAKtB,WAAWuB,OAAOzB,yBAAyBwB,KAAAA,CAAAA;CAC3D;CAEA,MAAMR,UAAUQ,OAA4D;EACxE,OAAO,KAAKtB,WAAWc,UAAUhB,yBAAyBwB,KAAAA,CAAAA;CAC9D;CAEAE,OAAOd,MAA+C;EAClD,OAAO,KAAKV,WAAWwB,OAAOd,IAAAA;CAClC;CAEAe,MAAMC,QAAwBhB,MAA+C;EACzE,OAAO,KAAKV,WAAWyB,MAAMC,QAAQhB,IAAAA;CACzC;CAEA,MAAMiB,KAAKD,QAAiD;EACxD,OAAO,KAAK1B,WAAW2B,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAAuC;EAChD,MAAM,KAAK1B,WAAW4B,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBnB,MAA8C;EACpE,MAAMhB,0BAA0BgB,MAAM;GAClCoB,YAAY,KAAK9B,WAAW+B,QAAQC;GACpCC,cAAcpC;EAClB,CAAA;CACJ;AACJ"}

package/dist/app/modules/database/repositories/schema-validation.d.ts

@@ -1,9 +1,23 @@
-import type { DataSource } from 'typeorm';
+import type { DataSource, EntityMetadata } from 'typeorm';
+/**
+ * Every selectable column must appear in the schema's field allow-list:
+ * rapiq derives the root projection from `fields` (`default` when
+ * present, else `allowed`), so a column missing from BOTH silently
+ * vanishes from every collection response — no error, just an absent
+ * property (`role.builtIn` went missing this way).
+ */
+export declare function assertSchemaFieldsCoverEntity(name: string, schema: {
+    fields?: {
+        default?: string[];
+        allowed?: string[];
+    };
+}, metadata: EntityMetadata): void;
 /**
  * Validate every registered entity schema against its TypeORM
- * metadata (`@rapiq/typeorm`'s `assertSchemaMatchesEntity`: allow-lists,
+ * metadata (`@rapiq/adapter-typeorm`'s `assertSchemaMatchesEntity`: allow-lists,
  * fields/sort defaults and the filters default condition tree must
- * reference existing columns/relations). Called by
+ * reference existing columns/relations) and assert its field allow-list
+ * covers every selectable column. Called by
  * `DatabaseModule.setup` once the DataSource is initialized —
  * schema/entity drift fails the boot, fail-fast.
  */

package/dist/app/modules/database/repositories/schema-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-validation.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/schema-validation.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAgB,MAAM,SAAS,CAAC;AA8DxD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,UAAU,GAAI,IAAI,CAOnE"}
+{"version":3,"file":"schema-validation.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/schema-validation.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAgB,MAAM,SAAS,CAAC;AA2ExE;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;CAAE,EAC/D,QAAQ,EAAE,cAAc,GACxB,IAAI,CAiBP;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,UAAU,GAAI,IAAI,CAQnE"}

package/dist/app/modules/database/repositories/schema-validation.mjs

@@ -29,7 +29,7 @@ import "../../../../adapters/database/domains/index.mjs";
 import { schemaRegistry } from "../../../../core/query/module.mjs";
 import "../../../../core/index.mjs";
 import { EntityType } from "@authup/core-kit";
-import { assertSchemaMatchesEntity } from "@rapiq/typeorm";
+import { assertSchemaMatchesEntity } from "@rapiq/adapter-typeorm";
 //#region src/app/modules/database/repositories/schema-validation.ts
 /**
 * Entity class per registered schema name — the iteration source for
@@ -62,16 +62,40 @@ import { assertSchemaMatchesEntity } from "@rapiq/typeorm";
 	[EntityType.USER_ROLE]: UserRoleEntity
 };
 /**
+* Selectable columns deliberately kept out of a schema's field
+* allow-list. `select: false` columns are skipped automatically (the
+* entity already declares them hidden); everything listed here is a
+* column that IS selectable but must never ride the API projection.
+*/ const SCHEMA_FIELD_EXCLUSIONS = { [EntityType.USER_AUTHENTICATOR]: ["parameters"] };
+/**
+* Every selectable column must appear in the schema's field allow-list:
+* rapiq derives the root projection from `fields` (`default` when
+* present, else `allowed`), so a column missing from BOTH silently
+* vanishes from every collection response — no error, just an absent
+* property (`role.builtIn` went missing this way).
+*/ function assertSchemaFieldsCoverEntity(name, schema, metadata) {
+	const declared = /* @__PURE__ */ new Set([...schema.fields?.default || [], ...schema.fields?.allowed || []]);
+	const excluded = new Set(SCHEMA_FIELD_EXCLUSIONS[name] || []);
+	const missing = metadata.columns.filter((column) => column.isSelect).map((column) => column.propertyName).filter((propertyName) => !declared.has(propertyName) && !excluded.has(propertyName));
+	if (missing.length > 0) throw new Error(`The schema "${name}" does not declare the field(s): ${missing.join(", ")}.`);
+}
+/**
 * Validate every registered entity schema against its TypeORM
-* metadata (`@rapiq/typeorm`'s `assertSchemaMatchesEntity`: allow-lists,
+* metadata (`@rapiq/adapter-typeorm`'s `assertSchemaMatchesEntity`: allow-lists,
 * fields/sort defaults and the filters default condition tree must
-* reference existing columns/relations). Called by
+* reference existing columns/relations) and assert its field allow-list
+* covers every selectable column. Called by
 * `DatabaseModule.setup` once the DataSource is initialized —
 * schema/entity drift fails the boot, fail-fast.
 */ function validateEntitySchemas(dataSource) {
-	for (const [name, target] of Object.entries(SCHEMA_ENTITY_TARGETS)) assertSchemaMatchesEntity(schemaRegistry.getOrFail(name), dataSource.getMetadata(target));
+	for (const [name, target] of Object.entries(SCHEMA_ENTITY_TARGETS)) {
+		const schema = schemaRegistry.getOrFail(name);
+		const metadata = dataSource.getMetadata(target);
+		assertSchemaMatchesEntity(schema, metadata);
+		assertSchemaFieldsCoverEntity(name, schema, metadata);
+	}
 }
 //#endregion
-export { validateEntitySchemas };
+export { assertSchemaFieldsCoverEntity, validateEntitySchemas };
 
 //# sourceMappingURL=schema-validation.mjs.map

package/dist/app/modules/database/repositories/schema-validation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema-validation.mjs","names":["assertSchemaMatchesEntity","EntityType","schemaRegistry","ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","ConsentEntity","EventEntity","IdentityProviderEntity","IdentityProviderRoleMappingEntity","KeyEntity","PermissionEntity","PermissionPolicyEntity","PolicyEntity","RealmEntity","RoleAttributeEntity","RoleEntity","RolePermissionEntity","ScopeEntity","SessionEntity","TrustAnchorEntity","UserAttributeEntity","UserAuthenticatorEntity","UserEntity","UserPermissionEntity","UserRoleEntity","SCHEMA_ENTITY_TARGETS","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","PERMISSION","PERMISSION_POLICY","POLICY","REALM","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","validateEntitySchemas","dataSource","name","target","Object","entries","getOrFail","getMetadata"],"sources":["../../../../../src/app/modules/database/repositories/schema-validation.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@rapiq/core';\nimport { assertSchemaMatchesEntity } from '@rapiq/typeorm';\nimport type { DataSource, EntityTarget } from 'typeorm';\nimport { EntityType } from '@authup/core-kit';\nimport { schemaRegistry } from '../../../../core/index.ts';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    ConsentEntity,\n    EventEntity,\n    IdentityProviderEntity,\n    IdentityProviderRoleMappingEntity,\n    KeyEntity,\n    PermissionEntity,\n    PermissionPolicyEntity,\n    PolicyEntity,\n    RealmEntity,\n    RoleAttributeEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    SessionEntity,\n    TrustAnchorEntity,\n    UserAttributeEntity,\n    UserAuthenticatorEntity,\n    UserEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../../adapters/database/domains/index.ts';\n\n/**\n * Entity class per registered schema name — the iteration source for\n * the boot-time validation. A mapped name missing from the registry\n * fails via `getOrFail`, so a renamed/removed schema surfaces here too.\n */\nconst SCHEMA_ENTITY_TARGETS : Record<string, EntityTarget<ObjectLiteral>> = {\n    [EntityType.CLIENT]: ClientEntity,\n    [EntityType.CLIENT_PERMISSION]: ClientPermissionEntity,\n    [EntityType.CLIENT_ROLE]: ClientRoleEntity,\n    [EntityType.CLIENT_SCOPE]: ClientScopeEntity,\n    [EntityType.CONSENT]: ConsentEntity,\n    [EntityType.EVENT]: EventEntity,\n    [EntityType.IDENTITY_PROVIDER]: IdentityProviderEntity,\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: IdentityProviderRoleMappingEntity,\n    [EntityType.KEY]: KeyEntity,\n    [EntityType.PERMISSION]: PermissionEntity,\n    [EntityType.PERMISSION_POLICY]: PermissionPolicyEntity,\n    [EntityType.POLICY]: PolicyEntity,\n    [EntityType.REALM]: RealmEntity,\n    [EntityType.ROLE]: RoleEntity,\n    [EntityType.ROLE_ATTRIBUTE]: RoleAttributeEntity,\n    [EntityType.ROLE_PERMISSION]: RolePermissionEntity,\n    [EntityType.SCOPE]: ScopeEntity,\n    [EntityType.SESSION]: SessionEntity,\n    [EntityType.TRUST_ANCHOR]: TrustAnchorEntity,\n    [EntityType.USER]: UserEntity,\n    [EntityType.USER_ATTRIBUTE]: UserAttributeEntity,\n    [EntityType.USER_AUTHENTICATOR]: UserAuthenticatorEntity,\n    [EntityType.USER_PERMISSION]: UserPermissionEntity,\n    [EntityType.USER_ROLE]: UserRoleEntity,\n};\n\n/**\n * Validate every registered entity schema against its TypeORM\n * metadata (`@rapiq/typeorm`'s `assertSchemaMatchesEntity`: allow-lists,\n * fields/sort defaults and the filters default condition tree must\n * reference existing columns/relations). Called by\n * `DatabaseModule.setup` once the DataSource is initialized —\n * schema/entity drift fails the boot, fail-fast.\n */\nexport function validateEntitySchemas(dataSource: DataSource) : void {\n    for (const [name, target] of Object.entries(SCHEMA_ENTITY_TARGETS)) {\n        assertSchemaMatchesEntity(\n            schemaRegistry.getOrFail(name),\n            dataSource.getMetadata(target),\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CA,MAAM2B,wBAAsE;EACvE1B,WAAW2B,SAASzB;EACpBF,WAAW4B,oBAAoBzB;EAC/BH,WAAW6B,cAAczB;EACzBJ,WAAW8B,eAAezB;EAC1BL,WAAW+B,UAAUzB;EACrBN,WAAWgC,QAAQzB;EACnBP,WAAWiC,oBAAoBzB;EAC/BR,WAAWkC,iCAAiCzB;EAC5CT,WAAWmC,MAAMzB;EACjBV,WAAWoC,aAAazB;EACxBX,WAAWqC,oBAAoBzB;EAC/BZ,WAAWsC,SAASzB;EACpBb,WAAWuC,QAAQzB;EACnBd,WAAWwC,OAAOxB;EAClBhB,WAAWyC,iBAAiB1B;EAC5Bf,WAAW0C,kBAAkBzB;EAC7BjB,WAAW2C,QAAQzB;EACnBlB,WAAW4C,UAAUzB;EACrBnB,WAAW6C,eAAezB;EAC1BpB,WAAW8C,OAAOvB;EAClBvB,WAAW+C,iBAAiB1B;EAC5BrB,WAAWgD,qBAAqB1B;EAChCtB,WAAWiD,kBAAkBzB;EAC7BxB,WAAWkD,YAAYzB;AAC5B;;;;;;;;GAUA,SAAgB0B,sBAAsBC,YAAsB;CACxD,KAAK,MAAM,CAACC,MAAMC,WAAWC,OAAOC,QAAQ9B,qBAAAA,GACxC3B,0BACIE,eAAewD,UAAUJ,IAAAA,GACzBD,WAAWM,YAAYJ,MAAAA,CAAAA;AAGnC"}
+{"version":3,"file":"schema-validation.mjs","names":["assertSchemaMatchesEntity","EntityType","schemaRegistry","ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","ConsentEntity","EventEntity","IdentityProviderEntity","IdentityProviderRoleMappingEntity","KeyEntity","PermissionEntity","PermissionPolicyEntity","PolicyEntity","RealmEntity","RoleAttributeEntity","RoleEntity","RolePermissionEntity","ScopeEntity","SessionEntity","TrustAnchorEntity","UserAttributeEntity","UserAuthenticatorEntity","UserEntity","UserPermissionEntity","UserRoleEntity","SCHEMA_ENTITY_TARGETS","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","PERMISSION","PERMISSION_POLICY","POLICY","REALM","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","SCHEMA_FIELD_EXCLUSIONS","assertSchemaFieldsCoverEntity","name","schema","metadata","declared","Set","fields","default","allowed","excluded","missing","columns","filter","column","isSelect","map","propertyName","has","length","Error","join","validateEntitySchemas","dataSource","target","Object","entries","getOrFail","getMetadata"],"sources":["../../../../../src/app/modules/database/repositories/schema-validation.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@rapiq/core';\nimport { assertSchemaMatchesEntity } from '@rapiq/adapter-typeorm';\nimport type { DataSource, EntityMetadata, EntityTarget } from 'typeorm';\nimport { EntityType } from '@authup/core-kit';\nimport { schemaRegistry } from '../../../../core/index.ts';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    ConsentEntity,\n    EventEntity,\n    IdentityProviderEntity,\n    IdentityProviderRoleMappingEntity,\n    KeyEntity,\n    PermissionEntity,\n    PermissionPolicyEntity,\n    PolicyEntity,\n    RealmEntity,\n    RoleAttributeEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    SessionEntity,\n    TrustAnchorEntity,\n    UserAttributeEntity,\n    UserAuthenticatorEntity,\n    UserEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../../adapters/database/domains/index.ts';\n\n/**\n * Entity class per registered schema name — the iteration source for\n * the boot-time validation. A mapped name missing from the registry\n * fails via `getOrFail`, so a renamed/removed schema surfaces here too.\n */\nconst SCHEMA_ENTITY_TARGETS : Record<string, EntityTarget<ObjectLiteral>> = {\n    [EntityType.CLIENT]: ClientEntity,\n    [EntityType.CLIENT_PERMISSION]: ClientPermissionEntity,\n    [EntityType.CLIENT_ROLE]: ClientRoleEntity,\n    [EntityType.CLIENT_SCOPE]: ClientScopeEntity,\n    [EntityType.CONSENT]: ConsentEntity,\n    [EntityType.EVENT]: EventEntity,\n    [EntityType.IDENTITY_PROVIDER]: IdentityProviderEntity,\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: IdentityProviderRoleMappingEntity,\n    [EntityType.KEY]: KeyEntity,\n    [EntityType.PERMISSION]: PermissionEntity,\n    [EntityType.PERMISSION_POLICY]: PermissionPolicyEntity,\n    [EntityType.POLICY]: PolicyEntity,\n    [EntityType.REALM]: RealmEntity,\n    [EntityType.ROLE]: RoleEntity,\n    [EntityType.ROLE_ATTRIBUTE]: RoleAttributeEntity,\n    [EntityType.ROLE_PERMISSION]: RolePermissionEntity,\n    [EntityType.SCOPE]: ScopeEntity,\n    [EntityType.SESSION]: SessionEntity,\n    [EntityType.TRUST_ANCHOR]: TrustAnchorEntity,\n    [EntityType.USER]: UserEntity,\n    [EntityType.USER_ATTRIBUTE]: UserAttributeEntity,\n    [EntityType.USER_AUTHENTICATOR]: UserAuthenticatorEntity,\n    [EntityType.USER_PERMISSION]: UserPermissionEntity,\n    [EntityType.USER_ROLE]: UserRoleEntity,\n};\n\n/**\n * Selectable columns deliberately kept out of a schema's field\n * allow-list. `select: false` columns are skipped automatically (the\n * entity already declares them hidden); everything listed here is a\n * column that IS selectable but must never ride the API projection.\n */\nconst SCHEMA_FIELD_EXCLUSIONS : Record<string, string[]> = {\n    // device-internal credential blob (TOTP config, WebAuthn public key +\n    // signature counter) — surfaced only through the challenge endpoint's\n    // trimmed view.\n    [EntityType.USER_AUTHENTICATOR]: ['parameters'],\n};\n\n/**\n * Every selectable column must appear in the schema's field allow-list:\n * rapiq derives the root projection from `fields` (`default` when\n * present, else `allowed`), so a column missing from BOTH silently\n * vanishes from every collection response — no error, just an absent\n * property (`role.builtIn` went missing this way).\n */\nexport function assertSchemaFieldsCoverEntity(\n    name: string,\n    schema: { fields?: { default?: string[], allowed?: string[] } },\n    metadata: EntityMetadata,\n) : void {\n    const declared = new Set([\n        ...(schema.fields?.default || []),\n        ...(schema.fields?.allowed || []),\n    ]);\n\n    const excluded = new Set(SCHEMA_FIELD_EXCLUSIONS[name] || []);\n    const missing = metadata.columns\n        .filter((column) => column.isSelect)\n        .map((column) => column.propertyName)\n        .filter((propertyName) => !declared.has(propertyName) && !excluded.has(propertyName));\n\n    if (missing.length > 0) {\n        throw new Error(\n            `The schema \"${name}\" does not declare the field(s): ${missing.join(', ')}.`,\n        );\n    }\n}\n\n/**\n * Validate every registered entity schema against its TypeORM\n * metadata (`@rapiq/adapter-typeorm`'s `assertSchemaMatchesEntity`: allow-lists,\n * fields/sort defaults and the filters default condition tree must\n * reference existing columns/relations) and assert its field allow-list\n * covers every selectable column. Called by\n * `DatabaseModule.setup` once the DataSource is initialized —\n * schema/entity drift fails the boot, fail-fast.\n */\nexport function validateEntitySchemas(dataSource: DataSource) : void {\n    for (const [name, target] of Object.entries(SCHEMA_ENTITY_TARGETS)) {\n        const schema = schemaRegistry.getOrFail(name);\n        const metadata = dataSource.getMetadata(target);\n\n        assertSchemaMatchesEntity(schema, metadata);\n        assertSchemaFieldsCoverEntity(name, schema, metadata);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CA,MAAM2B,wBAAsE;EACvE1B,WAAW2B,SAASzB;EACpBF,WAAW4B,oBAAoBzB;EAC/BH,WAAW6B,cAAczB;EACzBJ,WAAW8B,eAAezB;EAC1BL,WAAW+B,UAAUzB;EACrBN,WAAWgC,QAAQzB;EACnBP,WAAWiC,oBAAoBzB;EAC/BR,WAAWkC,iCAAiCzB;EAC5CT,WAAWmC,MAAMzB;EACjBV,WAAWoC,aAAazB;EACxBX,WAAWqC,oBAAoBzB;EAC/BZ,WAAWsC,SAASzB;EACpBb,WAAWuC,QAAQzB;EACnBd,WAAWwC,OAAOxB;EAClBhB,WAAWyC,iBAAiB1B;EAC5Bf,WAAW0C,kBAAkBzB;EAC7BjB,WAAW2C,QAAQzB;EACnBlB,WAAW4C,UAAUzB;EACrBnB,WAAW6C,eAAezB;EAC1BpB,WAAW8C,OAAOvB;EAClBvB,WAAW+C,iBAAiB1B;EAC5BrB,WAAWgD,qBAAqB1B;EAChCtB,WAAWiD,kBAAkBzB;EAC7BxB,WAAWkD,YAAYzB;AAC5B;;;;;;GAQA,MAAM0B,0BAAqD,GAItDnD,WAAWgD,qBAAqB,CAAC,YAAa,EACnD;;;;;;;GASA,SAAgBI,8BACZC,MACAC,QACAC,UAAwB;CAExB,MAAMC,2BAAW,IAAIC,IAAI,CACjBH,GAAAA,OAAOI,QAAQC,WAAW,CAAA,GAC1BL,GAAAA,OAAOI,QAAQE,WAAW,CAAA,CACjC,CAAA;CAED,MAAMC,WAAW,IAAIJ,IAAIN,wBAAwBE,SAAS,CAAA,CAAE;CAC5D,MAAMS,UAAUP,SAASQ,QACpBC,QAAQC,WAAWA,OAAOC,QAAQ,CAAA,CAClCC,KAAKF,WAAWA,OAAOG,YAAY,CAAA,CACnCJ,QAAQI,iBAAiB,CAACZ,SAASa,IAAID,YAAAA,KAAiB,CAACP,SAASQ,IAAID,YAAAA,CAAAA;CAE3E,IAAIN,QAAQQ,SAAS,GACjB,MAAM,IAAIC,MACN,eAAelB,KAAK,mCAAmCS,QAAQU,KAAK,IAAA,EAAM,EAAE;AAGxF;;;;;;;;;GAWA,SAAgBC,sBAAsBC,YAAsB;CACxD,KAAK,MAAM,CAACrB,MAAMsB,WAAWC,OAAOC,QAAQnD,qBAAAA,GAAwB;EAChE,MAAM4B,SAASrD,eAAe6E,UAAUzB,IAAAA;EACxC,MAAME,WAAWmB,WAAWK,YAAYJ,MAAAA;EAExC5E,0BAA0BuD,QAAQC,QAAAA;EAClCH,8BAA8BC,MAAMC,QAAQC,QAAAA;CAChD;AACJ"}

package/dist/app/modules/database/repositories/scope/repository.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { ScopeEntity } from "../../../../../adapters/database/domains/scope/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
 import "../../../../../adapters/database/index.mjs";
@@ -24,7 +24,7 @@ var ScopeRepositoryAdapter = class {
 		const { pagination } = applyQuery(qb, query);
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/database/repositories/scope/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["isUUID","validateEntityJoinColumns","applyQuery","DatabaseConflictError","isEntityUnique","translateWhereConditions","ScopeEntity","RealmRepositoryAdapter","ScopeRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOneByIdOrName","idOrName","realm","findManyBy","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting"],"sources":["../../../../../../src/app/modules/database/repositories/scope/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm, Scope } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository, IScopeRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport { isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { ScopeEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type ScopeRepositoryAdapterContext = {\n    repository: Repository<Scope>,\n    realmRepository: Repository<Realm>,\n};\n\nexport class ScopeRepositoryAdapter implements IScopeRepository {\n    private readonly repository: Repository<Scope>;\n\n    private readonly realmRepository: IRealmRepository;\n\n    constructor(ctx: ScopeRepositoryAdapterContext) {\n        this.repository = ctx.repository;\n        this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Scope>> {\n        const qb = this.repository.createQueryBuilder('scope');\n        qb.groupBy('scope.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    findOneById(id: string): Promise<Scope | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<Scope | null> {\n        const qb = this.repository.createQueryBuilder('scope');\n        qb.where('scope.name = :name', { name });\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n            qb.andWhere('scope.realmId = :realmId', { realmId });\n        }\n\n        return qb.getOne();\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<Scope | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<Scope[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<Scope | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<Scope>): Scope {\n        return this.repository.create(data);\n    }\n\n    merge(entity: Scope, data: Partial<Scope>): Scope {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: Scope): Promise<Scope> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: Scope): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<Scope>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: ScopeEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<Scope>, existing?: Scope): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.repository.manager.connection,\n            entityTarget: ScopeEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAyBA,IAAaQ,yBAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAAoC;EAC5C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAA+D;EAC1E,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,OAAA;EAC9CD,GAAGE,QAAQ,UAAA;EAEX,MAAM,EAAEC,eAAef,WAAWY,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAAmC;EAC3C,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,cAAcC,MAAcC,UAA0C;EACxE,MAAMd,KAAK,KAAKL,WAAWM,mBAAmB,OAAA;EAC9CD,GAAGe,MAAM,sBAAsB,EAAEF,KAAK,CAAA;EAEtC,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKpB,gBAAgBqB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXhB,GAAGkB,SAAS,4BAA4B,EAAEF,QAAQ,CAAA;EACtD;EAEA,OAAOhB,GAAGmB,OAAM;CACpB;CAEA,MAAMC,kBAAkBC,UAAkBC,OAAuC;EAC7E,OAAOpC,OAAOmC,QAAAA,IACV,KAAKZ,YAAYY,QAAAA,IACjB,KAAKT,cAAcS,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWR,OAA8C;EAC3D,OAAO,KAAKpB,WAAW6B,OAAOjC,yBAAyBwB,KAAAA,CAAAA;CAC3D;CAEA,MAAMJ,UAAUI,OAAmD;EAC/D,OAAO,KAAKpB,WAAWgB,UAAUpB,yBAAyBwB,KAAAA,CAAAA;CAC9D;CAEAU,OAAOlB,MAA6B;EAChC,OAAO,KAAKZ,WAAW8B,OAAOlB,IAAAA;CAClC;CAEAmB,MAAMC,QAAepB,MAA6B;EAC9C,OAAO,KAAKZ,WAAW+B,MAAMC,QAAQpB,IAAAA;CACzC;CAEA,MAAMqB,KAAKD,QAA+B;EACtC,OAAO,KAAKhC,WAAWiC,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAA8B;EACvC,MAAM,KAAKhC,WAAWkC,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBvB,MAAqC;EAC3D,MAAMpB,0BAA0BoB,MAAM;GAClCwB,YAAY,KAAKpC,WAAWqC,QAAQC;GACpCC,cAAc1C;EAClB,CAAA;CACJ;CAEA,MAAM2C,gBAAgB5B,MAAsB6B,UAAiC;EAQzE,IAAI,CAACC,MAPkB/C,eAAe;GAClCyC,YAAY,KAAKpC,WAAWqC,QAAQC;GACpCC,cAAc1C;GACdmC,QAAQpB;GACR+B,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAI/C,sBAAAA;CAElB;AACJ"}
+{"version":3,"file":"repository.mjs","names":["isUUID","validateEntityJoinColumns","applyQuery","redactFieldConditions","DatabaseConflictError","isEntityUnique","translateWhereConditions","ScopeEntity","RealmRepositoryAdapter","ScopeRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOneByIdOrName","idOrName","realm","findManyBy","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting"],"sources":["../../../../../../src/app/modules/database/repositories/scope/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm, Scope } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository, IScopeRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport { isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { ScopeEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type ScopeRepositoryAdapterContext = {\n    repository: Repository<Scope>,\n    realmRepository: Repository<Realm>,\n};\n\nexport class ScopeRepositoryAdapter implements IScopeRepository {\n    private readonly repository: Repository<Scope>;\n\n    private readonly realmRepository: IRealmRepository;\n\n    constructor(ctx: ScopeRepositoryAdapterContext) {\n        this.repository = ctx.repository;\n        this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Scope>> {\n        const qb = this.repository.createQueryBuilder('scope');\n        qb.groupBy('scope.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    findOneById(id: string): Promise<Scope | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<Scope | null> {\n        const qb = this.repository.createQueryBuilder('scope');\n        qb.where('scope.name = :name', { name });\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n            qb.andWhere('scope.realmId = :realmId', { realmId });\n        }\n\n        return qb.getOne();\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<Scope | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<Scope[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<Scope | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<Scope>): Scope {\n        return this.repository.create(data);\n    }\n\n    merge(entity: Scope, data: Partial<Scope>): Scope {\n        return this.repository.merge(entity, data);\n    }\n\n    async save(entity: Scope): Promise<Scope> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: Scope): Promise<void> {\n        await this.repository.remove(entity);\n    }\n\n    async validateJoinColumns(data: Partial<Scope>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.repository.manager.connection,\n            entityTarget: ScopeEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<Scope>, existing?: Scope): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.repository.manager.connection,\n            entityTarget: ScopeEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAyBA,IAAaS,yBAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAAoC;EAC5C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAA+D;EAC1E,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,OAAA;EAC9CD,GAAGE,QAAQ,UAAA;EAEX,MAAM,EAAEC,eAAehB,WAAWa,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMnB,sBAAsBW,OAAOK,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAAmC;EAC3C,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,cAAcC,MAAcC,UAA0C;EACxE,MAAMd,KAAK,KAAKL,WAAWM,mBAAmB,OAAA;EAC9CD,GAAGe,MAAM,sBAAsB,EAAEF,KAAK,CAAA;EAEtC,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKpB,gBAAgBqB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXhB,GAAGkB,SAAS,4BAA4B,EAAEF,QAAQ,CAAA;EACtD;EAEA,OAAOhB,GAAGmB,OAAM;CACpB;CAEA,MAAMC,kBAAkBC,UAAkBC,OAAuC;EAC7E,OAAOrC,OAAOoC,QAAAA,IACV,KAAKZ,YAAYY,QAAAA,IACjB,KAAKT,cAAcS,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWR,OAA8C;EAC3D,OAAO,KAAKpB,WAAW6B,OAAOjC,yBAAyBwB,KAAAA,CAAAA;CAC3D;CAEA,MAAMJ,UAAUI,OAAmD;EAC/D,OAAO,KAAKpB,WAAWgB,UAAUpB,yBAAyBwB,KAAAA,CAAAA;CAC9D;CAEAU,OAAOlB,MAA6B;EAChC,OAAO,KAAKZ,WAAW8B,OAAOlB,IAAAA;CAClC;CAEAmB,MAAMC,QAAepB,MAA6B;EAC9C,OAAO,KAAKZ,WAAW+B,MAAMC,QAAQpB,IAAAA;CACzC;CAEA,MAAMqB,KAAKD,QAA+B;EACtC,OAAO,KAAKhC,WAAWiC,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAA8B;EACvC,MAAM,KAAKhC,WAAWkC,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBvB,MAAqC;EAC3D,MAAMrB,0BAA0BqB,MAAM;GAClCwB,YAAY,KAAKpC,WAAWqC,QAAQC;GACpCC,cAAc1C;EAClB,CAAA;CACJ;CAEA,MAAM2C,gBAAgB5B,MAAsB6B,UAAiC;EAQzE,IAAI,CAACC,MAPkB/C,eAAe;GAClCyC,YAAY,KAAKpC,WAAWqC,QAAQC;GACpCC,cAAc1C;GACdmC,QAAQpB;GACR+B,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAI/C,sBAAAA;CAElB;AACJ"}

package/dist/app/modules/database/repositories/trust-anchor/repository.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { RealmEntity } from "../../../../../adapters/database/domains/realm/entity.mjs";
 import { TrustAnchorEntity } from "../../../../../adapters/database/domains/trust-anchor/entity.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
 import "../../../../../adapters/database/index.mjs";
@@ -28,7 +28,7 @@ var TrustAnchorRepositoryAdapter = class {
 		applyRealmScopeSelect(qb, "trustAnchor");
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/database/repositories/trust-anchor/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["isUUID","validateEntityJoinColumns","applyQuery","DatabaseConflictError","RealmEntity","TrustAnchorEntity","applyRealmScopeSelect","isEntityUnique","translateWhereConditions","RealmRepositoryAdapter","TrustAnchorRepositoryAdapter","dataSource","realmRepository","getRepository","repository","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","name","realmKey","where","realmId","resolveId","findOneByIdOrName","idOrName","realm","findManyBy","findBy","create","merge","entity","save","remove","validateJoinColumns","entityTarget","checkUniqueness","existing","isUnique","entityExisting"],"sources":["../../../../../../src/app/modules/database/repositories/trust-anchor/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { TrustAnchor } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { isUUID } from '@authup/kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { DataSource, FindOptionsWhere, Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery } from '../query.ts';\nimport { DatabaseConflictError, RealmEntity, TrustAnchorEntity } from '../../../../../adapters/database/index.ts';\nimport type { IRealmRepository, ITrustAnchorRepository } from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport class TrustAnchorRepositoryAdapter implements ITrustAnchorRepository {\n    protected dataSource: DataSource;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(dataSource: DataSource) {\n        this.dataSource = dataSource;\n        this.realmRepository = new RealmRepositoryAdapter(dataSource.getRepository(RealmEntity));\n    }\n\n    protected get repository(): Repository<TrustAnchorEntity> {\n        return this.dataSource.getRepository(TrustAnchorEntity);\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<TrustAnchor>> {\n        const qb = this.repository.createQueryBuilder('trustAnchor');\n        qb.groupBy('trustAnchor.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'trustAnchor');\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<TrustAnchor | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<TrustAnchor | null> {\n        const where: FindOptionsWhere<TrustAnchorEntity> = { name };\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n\n            where.realmId = realmId;\n        }\n\n        return this.repository.findOneBy(where);\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<TrustAnchor | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<TrustAnchor[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<TrustAnchor | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<TrustAnchor>): TrustAnchor {\n        return this.repository.create(data);\n    }\n\n    merge(entity: TrustAnchor, data: Partial<TrustAnchor>): TrustAnchor {\n        return this.repository.merge(entity as TrustAnchorEntity, data);\n    }\n\n    async save(entity: TrustAnchor): Promise<TrustAnchor> {\n        return this.repository.save(entity as TrustAnchorEntity);\n    }\n\n    async remove(entity: TrustAnchor): Promise<void> {\n        await this.repository.remove(entity as TrustAnchorEntity);\n    }\n\n    async validateJoinColumns(data: Partial<TrustAnchor>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.dataSource,\n            entityTarget: TrustAnchorEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<TrustAnchor>, existing?: TrustAnchor): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.dataSource,\n            entityTarget: TrustAnchorEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAmBA,IAAaU,+BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,YAAwB;EAChC,KAAKA,aAAaA;EAClB,KAAKC,kBAAkB,IAAIH,uBAAuBE,WAAWE,cAAcT,WAAAA,CAAAA;CAC/E;CAEA,IAAcU,aAA4C;EACtD,OAAO,KAAKH,WAAWE,cAAcR,iBAAAA;CACzC;CAEA,MAAMU,SAASC,OAAqE;EAChF,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,aAAA;EAC9CD,GAAGE,QAAQ,gBAAA;EAEX,MAAM,EAAEC,eAAelB,WAAWe,IAAID,KAAAA;EAEtCV,sBAAsBW,IAAI,aAAA;EAE1B,MAAM,CAACI,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMM,YAAYC,IAAyC;EACvD,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,cAAcC,MAAcC,UAAgD;EAC9E,MAAMC,QAA6C,EAAEF,KAAK;EAE1D,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKrB,gBAAgBsB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAGXD,MAAMC,UAAUA;EACpB;EAEA,OAAO,KAAKnB,WAAWc,UAAUI,KAAAA;CACrC;CAEA,MAAMG,kBAAkBC,UAAkBC,OAA6C;EACnF,OAAOrC,OAAOoC,QAAAA,IACV,KAAKV,YAAYU,QAAAA,IACjB,KAAKP,cAAcO,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWN,OAAoD;EACjE,OAAO,KAAKlB,WAAWyB,OAAO/B,yBAAyBwB,KAAAA,CAAAA;CAC3D;CAEA,MAAMJ,UAAUI,OAAyD;EACrE,OAAO,KAAKlB,WAAWc,UAAUpB,yBAAyBwB,KAAAA,CAAAA;CAC9D;CAEAQ,OAAOhB,MAAyC;EAC5C,OAAO,KAAKV,WAAW0B,OAAOhB,IAAAA;CAClC;CAEAiB,MAAMC,QAAqBlB,MAAyC;EAChE,OAAO,KAAKV,WAAW2B,MAAMC,QAA6BlB,IAAAA;CAC9D;CAEA,MAAMmB,KAAKD,QAA2C;EAClD,OAAO,KAAK5B,WAAW6B,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAAoC;EAC7C,MAAM,KAAK5B,WAAW8B,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBrB,MAA2C;EACjE,MAAMvB,0BAA0BuB,MAAM;GAClCb,YAAY,KAAKA;GACjBmC,cAAczC;EAClB,CAAA;CACJ;CAEA,MAAM0C,gBAAgBvB,MAA4BwB,UAAuC;EAQrF,IAAI,CAACC,MAPkB1C,eAAe;GAClCI,YAAY,KAAKA;GACjBmC,cAAczC;GACdqC,QAAQlB;GACR0B,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAI7C,sBAAAA;CAElB;AACJ"}
+{"version":3,"file":"repository.mjs","names":["isUUID","validateEntityJoinColumns","applyQuery","redactFieldConditions","DatabaseConflictError","RealmEntity","TrustAnchorEntity","applyRealmScopeSelect","isEntityUnique","translateWhereConditions","RealmRepositoryAdapter","TrustAnchorRepositoryAdapter","dataSource","realmRepository","getRepository","repository","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","name","realmKey","where","realmId","resolveId","findOneByIdOrName","idOrName","realm","findManyBy","findBy","create","merge","entity","save","remove","validateJoinColumns","entityTarget","checkUniqueness","existing","isUnique","entityExisting"],"sources":["../../../../../../src/app/modules/database/repositories/trust-anchor/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { TrustAnchor } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { isUUID } from '@authup/kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { DataSource, FindOptionsWhere, Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport { DatabaseConflictError, RealmEntity, TrustAnchorEntity } from '../../../../../adapters/database/index.ts';\nimport type { IRealmRepository, ITrustAnchorRepository } from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport class TrustAnchorRepositoryAdapter implements ITrustAnchorRepository {\n    protected dataSource: DataSource;\n\n    protected realmRepository: IRealmRepository;\n\n    constructor(dataSource: DataSource) {\n        this.dataSource = dataSource;\n        this.realmRepository = new RealmRepositoryAdapter(dataSource.getRepository(RealmEntity));\n    }\n\n    protected get repository(): Repository<TrustAnchorEntity> {\n        return this.dataSource.getRepository(TrustAnchorEntity);\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<TrustAnchor>> {\n        const qb = this.repository.createQueryBuilder('trustAnchor');\n        qb.groupBy('trustAnchor.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'trustAnchor');\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<TrustAnchor | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<TrustAnchor | null> {\n        const where: FindOptionsWhere<TrustAnchorEntity> = { name };\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n\n            where.realmId = realmId;\n        }\n\n        return this.repository.findOneBy(where);\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<TrustAnchor | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<TrustAnchor[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<TrustAnchor | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<TrustAnchor>): TrustAnchor {\n        return this.repository.create(data);\n    }\n\n    merge(entity: TrustAnchor, data: Partial<TrustAnchor>): TrustAnchor {\n        return this.repository.merge(entity as TrustAnchorEntity, data);\n    }\n\n    async save(entity: TrustAnchor): Promise<TrustAnchor> {\n        return this.repository.save(entity as TrustAnchorEntity);\n    }\n\n    async remove(entity: TrustAnchor): Promise<void> {\n        await this.repository.remove(entity as TrustAnchorEntity);\n    }\n\n    async validateJoinColumns(data: Partial<TrustAnchor>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.dataSource,\n            entityTarget: TrustAnchorEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<TrustAnchor>, existing?: TrustAnchor): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.dataSource,\n            entityTarget: TrustAnchorEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAmBA,IAAaW,+BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,YAAwB;EAChC,KAAKA,aAAaA;EAClB,KAAKC,kBAAkB,IAAIH,uBAAuBE,WAAWE,cAAcT,WAAAA,CAAAA;CAC/E;CAEA,IAAcU,aAA4C;EACtD,OAAO,KAAKH,WAAWE,cAAcR,iBAAAA;CACzC;CAEA,MAAMU,SAASC,OAAqE;EAChF,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,aAAA;EAC9CD,GAAGE,QAAQ,gBAAA;EAEX,MAAM,EAAEC,eAAenB,WAAWgB,IAAID,KAAAA;EAEtCV,sBAAsBW,IAAI,aAAA;EAE1B,MAAM,CAACI,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMtB,sBAAsBc,OAAOK,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMM,YAAYC,IAAyC;EACvD,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,cAAcC,MAAcC,UAAgD;EAC9E,MAAMC,QAA6C,EAAEF,KAAK;EAE1D,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKrB,gBAAgBsB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAGXD,MAAMC,UAAUA;EACpB;EAEA,OAAO,KAAKnB,WAAWc,UAAUI,KAAAA;CACrC;CAEA,MAAMG,kBAAkBC,UAAkBC,OAA6C;EACnF,OAAOtC,OAAOqC,QAAAA,IACV,KAAKV,YAAYU,QAAAA,IACjB,KAAKP,cAAcO,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWN,OAAoD;EACjE,OAAO,KAAKlB,WAAWyB,OAAO/B,yBAAyBwB,KAAAA,CAAAA;CAC3D;CAEA,MAAMJ,UAAUI,OAAyD;EACrE,OAAO,KAAKlB,WAAWc,UAAUpB,yBAAyBwB,KAAAA,CAAAA;CAC9D;CAEAQ,OAAOhB,MAAyC;EAC5C,OAAO,KAAKV,WAAW0B,OAAOhB,IAAAA;CAClC;CAEAiB,MAAMC,QAAqBlB,MAAyC;EAChE,OAAO,KAAKV,WAAW2B,MAAMC,QAA6BlB,IAAAA;CAC9D;CAEA,MAAMmB,KAAKD,QAA2C;EAClD,OAAO,KAAK5B,WAAW6B,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAAoC;EAC7C,MAAM,KAAK5B,WAAW8B,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBrB,MAA2C;EACjE,MAAMxB,0BAA0BwB,MAAM;GAClCb,YAAY,KAAKA;GACjBmC,cAAczC;EAClB,CAAA;CACJ;CAEA,MAAM0C,gBAAgBvB,MAA4BwB,UAAuC;EAQrF,IAAI,CAACC,MAPkB1C,eAAe;GAClCI,YAAY,KAAKA;GACjBmC,cAAczC;GACdqC,QAAQlB;GACR0B,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAI7C,sBAAAA;CAElB;AACJ"}

package/dist/app/modules/database/repositories/user/repository.mjs

@@ -6,7 +6,7 @@ import { UserEntity } from "../../../../../adapters/database/domains/user/entity
 import { UserPermissionEntity } from "../../../../../adapters/database/domains/user-permission/entity.mjs";
 import { UserRoleEntity } from "../../../../../adapters/database/domains/user-role/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
 import "../../../../../adapters/database/index.mjs";
@@ -31,7 +31,7 @@ var UserRepositoryAdapter = class {
 		const [entities, total] = await qb.getManyAndCount();
 		await this.repository.extendManyWithEA(entities);
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination