npm - @authup/server-core - Versions diffs - 1.0.0-beta.56 → 1.0.0-beta.58 - Mend

@authup/server-core 1.0.0-beta.56 → 1.0.0-beta.58

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (478) hide show

package/dist/app/modules/database/repositories/key/repository.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"repository.mjs","names":["AuthupError","KeyStatus","arrayBufferToBase64","createNanoID","isUUID","AsymmetricKey","CryptoAsymmetricAlgorithm","createAsymmetricKeyPair","JWKType","JWKUse","JWTAlgorithm","Like","validateEntityJoinColumns","applyQuery","getRandomValues","DatabaseConflictError","KeyEntity","RealmEntity","UserAuthenticatorEntity","REALM_CIPHER_BLOB_VERSION","isWrappedKeyMaterial","unwrapKeyMaterial","wrapKeyMaterial","applyRealmScopeSelect","isEntityUnique","translateWhereConditions","RealmRepositoryAdapter","KeyRepositoryAdapter","dataSource","secretsCipher","realmRepository","logger","options","getRepository","repository","resolveOrCreate","realmId","use","entity","findOne","select","id","name","type","status","signatureAlgorithm","encryptionKey","decryptionKey","where","ACTIVE","order","priority","createdAt","afterLoad","total","countBy","ENCRYPTION","createEncryptionKey","createSignatureKey","resolveById","keyPair","RSASSA_PKCS1_V1_5","privateKeyContainer","privateKey","publicKeyContainer","publicKey","material","toBase64","create","generateName","SIGNATURE","RSA","protect","RS256","save","raw","Uint8Array","buffer","OCT","update","e","warn","error","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","getManyAndCount","data","meta","findOneById","findOneBy","findOneByName","realmKey","resolveId","findOneByIdOrName","idOrName","realm","findManyBy","findBy","merge","saved","remove","validateJoinColumns","entityTarget","checkUniqueness","existing","isUnique","entityExisting","countBlobReferences","keyId","secret","findHighestPriority","maximum"],"sources":["../../../../../../src/app/modules/database/repositories/key/repository.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { AuthupError } from '@authup/errors';\nimport type { IQuery } from '@rapiq/core';\nimport type { Key } from '@authup/core-kit';\nimport { KeyStatus } from '@authup/core-kit';\nimport { arrayBufferToBase64, createNanoID, isUUID } from '@authup/kit';\nimport {\n AsymmetricKey,\n CryptoAsymmetricAlgorithm,\n type EntityRepositoryFindManyResult,\n type ISymmetricCipher,\n type Logger,\n createAsymmetricKeyPair,\n} from '@authup/server-kit';\nimport { JWKType, JWKUse, JWTAlgorithm } from '@authup/specs';\nimport type { DataSource, FindOptionsWhere, Repository } from 'typeorm';\nimport { Like } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery } from '../query.ts';\nimport { getRandomValues } from 'uncrypto';\nimport {\n DatabaseConflictError,\n KeyEntity,\n RealmEntity,\n UserAuthenticatorEntity,\n} from '../../../../../adapters/database/index.ts';\nimport type { IKeyRepository, IKeyStore, IRealmRepository } from '../../../../../core/index.ts';\nimport {\n REALM_CIPHER_BLOB_VERSION,\n isWrappedKeyMaterial,\n unwrapKeyMaterial,\n wrapKeyMaterial,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type KeyRepositoryAdapterOptions = {\n /\n Optional KEK (config secretsEncryptionKey) — when present, key\n * material is persisted wrapped and unwrapped transparently on read.\n /\n secretsCipher?: ISymmetricCipher \| null,\n logger?: Logger,\n};\n\n/\n One adapter, two ports: the entity CRUD surface (IKeyRepository) for the\n * key management API and the material-resolving store (IKeyStore) for the\n * signer / verifier / realm cipher. Entity reads never select\n * decryptionKey; only the IKeyStore surface hands out (unwrapped) material.\n */\nexport class KeyRepositoryAdapter implements IKeyRepository, IKeyStore {\n protected dataSource : DataSource;\n\n protected secretsCipher : ISymmetricCipher \| null;\n\n protected realmRepository : IRealmRepository;\n\n protected logger? : Logger;\n\n constructor(dataSource: DataSource, options: KeyRepositoryAdapterOptions = {}) {\n this.dataSource = dataSource;\n this.secretsCipher = options.secretsCipher ?? null;\n this.logger = options.logger;\n this.realmRepository = new RealmRepositoryAdapter(dataSource.getRepository(RealmEntity));\n }\n\n protected get repository() : Repository<KeyEntity> {\n return this.dataSource.getRepository(KeyEntity);\n }\n\n // ------------------------------------------------------------------\n // IKeyStore — material resolution (signer / verifier / realm cipher)\n // ------------------------------------------------------------------\n\n async resolveOrCreate(realmId: string, use: `${JWKUse}`): Promise<Key> {\n const { repository } = this;\n\n const entity = await repository.findOne({\n select: {\n id: true,\n name: true,\n type: true,\n use: true,\n status: true,\n signatureAlgorithm: true,\n encryptionKey: true,\n decryptionKey: true,\n realmId: true,\n },\n where: {\n realmId,\n use,\n status: KeyStatus.ACTIVE,\n },\n // createdAt + id break priority ties deterministically (e.g.\n // duplicate mints from a concurrent zero-row backstop race —\n // benign, both keys verify, but selection must be stable).\n order: {\n priority: 'DESC', \n createdAt: 'DESC', \n id: 'ASC', \n },\n });\n\n if (entity) {\n return this.afterLoad(repository, entity);\n }\n\n const total = await repository.countBy({ realmId, use });\n if (total > 0) {\n // an admin who disabled every key meant it — do not silently\n // re-mint around the kill switch.\n throw new AuthupError(\n `No active ${use} key is available for realm ${realmId} ` +\n `(${total} key(s) exist, none active).`,\n );\n }\n\n if (use === JWKUse.ENCRYPTION) {\n return this.createEncryptionKey(repository, realmId);\n }\n\n return this.createSignatureKey(repository, realmId);\n }\n\n async resolveById(id: string): Promise<Key \| null> {\n const { repository } = this;\n\n // `id` reaches here from an attacker-controlled JWT `kid` header on the\n // token-verification hot path. A non-UUID value binds against a\n // postgres `uuid` column as a driver-level type error (500) instead of\n // a clean miss — short-circuit to \"not found\" so a garbage kid is a\n // plain verification failure.\n if (!isUUID(id)) {\n return null;\n }\n\n const entity = await repository.findOne({\n select: {\n id: true,\n name: true,\n type: true,\n use: true,\n status: true,\n signatureAlgorithm: true,\n encryptionKey: true,\n decryptionKey: true,\n realmId: true,\n },\n where: { id },\n });\n\n if (!entity) {\n return null;\n }\n\n return this.afterLoad(repository, entity);\n }\n\n protected async createSignatureKey(\n repository: Repository<KeyEntity>,\n realmId: string,\n ) : Promise<Key> {\n const keyPair = await createAsymmetricKeyPair({ name: CryptoAsymmetricAlgorithm.RSASSA_PKCS1_V1_5 });\n\n const privateKeyContainer = new AsymmetricKey(keyPair.privateKey);\n const publicKeyContainer = new AsymmetricKey(keyPair.publicKey);\n\n const material = await privateKeyContainer.toBase64();\n\n const entity = repository.create({\n name: this.generateName(JWKUse.SIGNATURE),\n type: JWKType.RSA,\n use: JWKUse.SIGNATURE,\n status: KeyStatus.ACTIVE,\n decryptionKey: await this.protect(material),\n encryptionKey: await publicKeyContainer.toBase64(),\n realmId,\n signatureAlgorithm: `${JWTAlgorithm.RS256}`,\n });\n\n await repository.save(entity);\n\n // hand the caller usable material regardless of the persisted form.\n entity.decryptionKey = material;\n\n return entity;\n }\n\n protected async createEncryptionKey(\n repository: Repository<KeyEntity>,\n realmId: string,\n ) : Promise<Key> {\n const raw = new Uint8Array(32);\n getRandomValues(raw);\n\n const material = arrayBufferToBase64(raw.buffer);\n\n const entity = repository.create({\n name: this.generateName(JWKUse.ENCRYPTION),\n type: JWKType.OCT,\n use: JWKUse.ENCRYPTION,\n status: KeyStatus.ACTIVE,\n decryptionKey: await this.protect(material),\n encryptionKey: null,\n realmId,\n signatureAlgorithm: null,\n });\n\n await repository.save(entity);\n\n entity.decryptionKey = material;\n\n return entity;\n }\n\n protected generateName(use: `${JWKUse}`) : string {\n return `${use}-${createNanoID(10)}`;\n }\n\n protected async afterLoad(\n repository: Repository<KeyEntity>,\n entity: KeyEntity,\n ) : Promise<Key> {\n if (!entity.decryptionKey) {\n return entity;\n }\n\n if (isWrappedKeyMaterial(entity.decryptionKey)) {\n entity.decryptionKey = await unwrapKeyMaterial(this.secretsCipher, entity.decryptionKey);\n return entity;\n }\n\n if (this.secretsCipher) {\n // lazy wrap-on-read: a KEK added to a running deployment\n // hardens existing rows without a migration step. Best-effort —\n // the material stays readable either way.\n const material = entity.decryptionKey;\n try {\n await repository.update(entity.id, { decryptionKey: await wrapKeyMaterial(this.secretsCipher, material) });\n } catch (e) {\n // Best-effort — the material stays readable and the next read\n // retries. Surface it though: a persistent failure (e.g. a\n // read-only replica) means the row is never hardened at rest.\n this.logger?.warn(`Failed to wrap key material at rest for key ${entity.id}.`, { error: e });\n }\n entity.decryptionKey = material;\n }\n\n return entity;\n }\n\n protected async protect(material: string) : Promise<string> {\n if (!this.secretsCipher) {\n return material;\n }\n\n return wrapKeyMaterial(this.secretsCipher, material);\n }\n\n // ------------------------------------------------------------------\n // IKeyRepository — entity CRUD surface (key management API)\n // ------------------------------------------------------------------\n\n async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Key>> {\n const qb = this.repository.createQueryBuilder('keyEntity');\n qb.groupBy('keyEntity.id');\n\n const { pagination } = applyQuery(qb, query);\n\n applyRealmScopeSelect(qb, 'keyEntity');\n\n const [entities, total] = await qb.getManyAndCount();\n\n return {\n data: entities,\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n async findOneById(id: string): Promise<Key \| null> {\n return this.findOneBy({ id });\n }\n\n async findOneByName(name: string, realmKey?: string): Promise<Key \| null> {\n const where : FindOptionsWhere<KeyEntity> = { name };\n\n if (realmKey) {\n const realmId = await this.realmRepository.resolveId(realmKey);\n if (!realmId) {\n return null;\n }\n\n where.realmId = realmId;\n }\n\n return this.repository.findOneBy(where);\n }\n\n async findOneByIdOrName(idOrName: string, realm?: string): Promise<Key \| null> {\n return isUUID(idOrName) ?\n this.findOneById(idOrName) :\n this.findOneByName(idOrName, realm);\n }\n\n async findManyBy(where: Record<string, any>): Promise<Key[]> {\n return this.repository.findBy(translateWhereConditions(where));\n }\n\n async findOneBy(where: Record<string, any>): Promise<Key \| null> {\n return this.repository.findOneBy(translateWhereConditions(where));\n }\n\n create(data: Partial<Key>): Key {\n return this.repository.create(data);\n }\n\n merge(entity: Key, data: Partial<Key>): Key {\n return this.repository.merge(entity as KeyEntity, data);\n }\n\n async save(entity: Key): Promise<Key> {\n if (\n entity.decryptionKey &&\n this.secretsCipher &&\n !isWrappedKeyMaterial(entity.decryptionKey)\n ) {\n const material = entity.decryptionKey;\n entity.decryptionKey = await wrapKeyMaterial(this.secretsCipher, material);\n const saved = await this.repository.save(entity as KeyEntity);\n saved.decryptionKey = material;\n return saved;\n }\n\n return this.repository.save(entity as KeyEntity);\n }\n\n async remove(entity: Key): Promise<void> {\n await this.repository.remove(entity as KeyEntity);\n }\n\n async validateJoinColumns(data: Partial<Key>): Promise<void> {\n await validateEntityJoinColumns(data, {\n dataSource: this.dataSource,\n entityTarget: KeyEntity,\n });\n }\n\n async checkUniqueness(data: Partial<Key>, existing?: Key): Promise<void> {\n const isUnique = await isEntityUnique({\n dataSource: this.dataSource,\n entityTarget: KeyEntity,\n entity: data,\n entityExisting: existing,\n });\n\n if (!isUnique) {\n throw new DatabaseConflictError();\n }\n }\n\n async countBlobReferences(keyId: string): Promise<number> {\n return this.dataSource.getRepository(UserAuthenticatorEntity).countBy({ secret: Like(`${REALM_CIPHER_BLOB_VERSION}.${keyId}.%`) });\n }\n\n async findHighestPriority(realmId: string, use: string): Promise<number \| null> {\n return this.repository.maximum('priority', { realmId, use: use as `${JWKUse}` });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDA,IAAa2B,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYH,YAAwBI,UAAuC,CAAC,GAAG;EAC3E,KAAKJ,aAAaA;EAClB,KAAKC,gBAAgBG,QAAQH,iBAAiB;EAC9C,KAAKE,SAASC,QAAQD;EACtB,KAAKD,kBAAkB,IAAIJ,uBAAuBE,WAAWK,cAAchB,WAAAA,CAAAA;CAC/E;CAEA,IAAciB,aAAqC;EAC/C,OAAO,KAAKN,WAAWK,cAAcjB,SAAAA;CACzC;CAMA,MAAMmB,gBAAgBC,SAAiBC,KAAgC;EACnE,MAAM,EAAEH,eAAe;EAEvB,MAAMI,SAAS,MAAMJ,WAAWK,QAAQ;GACpCC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNN,KAAK;IACLO,QAAQ;IACRC,oBAAoB;IACpBC,eAAe;IACfC,eAAe;IACfX,SAAS;GACb;GACAY,OAAO;IACHZ;IACAC;IACAO,QAAQ3C,UAAUgD;GACtB;GAIAC,OAAO;IACHC,UAAU;IACVC,WAAW;IACXX,IAAI;GACR;EACJ,CAAA;EAEA,IAAIH,QACA,OAAO,KAAKe,UAAUnB,YAAYI,MAAAA;EAGtC,MAAMgB,QAAQ,MAAMpB,WAAWqB,QAAQ;GAAEnB;GAASC;EAAI,CAAA;EACtD,IAAIiB,QAAQ,GAGR,MAAM,IAAItD,YACN,aAAaqC,IAAI,8BAA8BD,QAAQ,IACnDkB,MAAM,6BAA6B;EAI/C,IAAIjB,QAAQ5B,OAAO+C,YACf,OAAO,KAAKC,oBAAoBvB,YAAYE,OAAAA;EAGhD,OAAO,KAAKsB,mBAAmBxB,YAAYE,OAAAA;CAC/C;CAEA,MAAMuB,YAAYlB,IAAiC;EAC/C,MAAM,EAAEP,eAAe;EAOvB,IAAI,CAAC9B,OAAOqC,EAAAA,GACR,OAAO;EAGX,MAAMH,SAAS,MAAMJ,WAAWK,QAAQ;GACpCC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNN,KAAK;IACLO,QAAQ;IACRC,oBAAoB;IACpBC,eAAe;IACfC,eAAe;IACfX,SAAS;GACb;GACAY,OAAO,EAAEP,GAAG;EAChB,CAAA;EAEA,IAAI,CAACH,QACD,OAAO;EAGX,OAAO,KAAKe,UAAUnB,YAAYI,MAAAA;CACtC;CAEA,MAAgBoB,mBACZxB,YACAE,SACa;EACb,MAAMwB,UAAU,MAAMrD,wBAAwB,EAAEmC,MAAMpC,0BAA0BuD,kBAAkB,CAAA;EAElG,MAAMC,sBAAsB,IAAIzD,cAAcuD,QAAQG,UAAU;EAChE,MAAMC,qBAAqB,IAAI3D,cAAcuD,QAAQK,SAAS;EAE9D,MAAMC,WAAW,MAAMJ,oBAAoBK,SAAQ;EAEnD,MAAM7B,SAASJ,WAAWkC,OAAO;GAC7B1B,MAAM,KAAK2B,aAAa5D,OAAO6D,SAAS;GACxC3B,MAAMnC,QAAQ+D;GACdlC,KAAK5B,OAAO6D;GACZ1B,QAAQ3C,UAAUgD;GAClBF,eAAe,MAAM,KAAKyB,QAAQN,QAAAA;GAClCpB,eAAe,MAAMkB,mBAAmBG,SAAQ;GAChD/B;GACAS,oBAAoB,GAAGnC,aAAa+D;EACxC,CAAA;EAEA,MAAMvC,WAAWwC,KAAKpC,MAAAA;EAGtBA,OAAOS,gBAAgBmB;EAEvB,OAAO5B;CACX;CAEA,MAAgBmB,oBACZvB,YACAE,SACa;EACb,MAAMuC,sBAAM,IAAIC,WAAW,EAAA;EAC3B9D,gBAAgB6D,GAAAA;EAEhB,MAAMT,WAAWhE,oBAAoByE,IAAIE,MAAM;EAE/C,MAAMvC,SAASJ,WAAWkC,OAAO;GAC7B1B,MAAM,KAAK2B,aAAa5D,OAAO+C,UAAU;GACzCb,MAAMnC,QAAQsE;GACdzC,KAAK5B,OAAO+C;GACZZ,QAAQ3C,UAAUgD;GAClBF,eAAe,MAAM,KAAKyB,QAAQN,QAAAA;GAClCpB,eAAe;GACfV;GACAS,oBAAoB;EACxB,CAAA;EAEA,MAAMX,WAAWwC,KAAKpC,MAAAA;EAEtBA,OAAOS,gBAAgBmB;EAEvB,OAAO5B;CACX;CAEU+B,aAAahC,KAA2B;EAC9C,OAAO,GAAGA,IAAI,GAAGlC,aAAa,EAAA;CAClC;CAEA,MAAgBkD,UACZnB,YACAI,QACa;EACb,IAAI,CAACA,OAAOS,eACR,OAAOT;EAGX,IAAIlB,qBAAqBkB,OAAOS,aAAa,GAAG;GAC5CT,OAAOS,gBAAgB,MAAM1B,kBAAkB,KAAKQ,eAAeS,OAAOS,aAAa;GACvF,OAAOT;EACX;EAEA,IAAI,KAAKT,eAAe;GAIpB,MAAMqC,WAAW5B,OAAOS;GACxB,IAAI;IACA,MAAMb,WAAW6C,OAAOzC,OAAOG,IAAI,EAAEM,eAAe,MAAMzB,gBAAgB,KAAKO,eAAeqC,QAAAA,EAAU,CAAA;GAC5G,SAASc,GAAG;IAIR,KAAKjD,QAAQkD,KAAK,+CAA+C3C,OAAOG,GAAG,IAAI,EAAEyC,OAAOF,EAAE,CAAA;GAC9F;GACA1C,OAAOS,gBAAgBmB;EAC3B;EAEA,OAAO5B;CACX;CAEA,MAAgBkC,QAAQN,UAAoC;EACxD,IAAI,CAAC,KAAKrC,eACN,OAAOqC;EAGX,OAAO5C,gBAAgB,KAAKO,eAAeqC,QAAAA;CAC/C;CAMA,MAAMiB,SAASC,OAA6D;EACxE,MAAMC,KAAK,KAAKnD,WAAWoD,mBAAmB,WAAA;EAC9CD,GAAGE,QAAQ,cAAA;EAEX,MAAM,EAAEC,eAAe3E,WAAWwE,IAAID,KAAAA;EAEtC7D,sBAAsB8D,IAAI,WAAA;EAE1B,MAAM,CAACI,UAAUnC,SAAS,MAAM+B,GAAGK,gBAAe;EAElD,OAAO;GACHC,MAAMF;GACNG,MAAM;IACFtC;IACA,GAAGkC;GACP;EACJ;CACJ;CAEA,MAAMK,YAAYpD,IAAiC;EAC/C,OAAO,KAAKqD,UAAU,EAAErD,GAAG,CAAA;CAC/B;CAEA,MAAMsD,cAAcrD,MAAcsD,UAAwC;EACtE,MAAMhD,QAAsC,EAAEN,KAAK;EAEnD,IAAIsD,UAAU;GACV,MAAM5D,UAAU,MAAM,KAAKN,gBAAgBmE,UAAUD,QAAAA;GACrD,IAAI,CAAC5D,SACD,OAAO;GAGXY,MAAMZ,UAAUA;EACpB;EAEA,OAAO,KAAKF,WAAW4D,UAAU9C,KAAAA;CACrC;CAEA,MAAMkD,kBAAkBC,UAAkBC,OAAqC;EAC3E,OAAOhG,OAAO+F,QAAAA,IACV,KAAKN,YAAYM,QAAAA,IACjB,KAAKJ,cAAcI,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWrD,OAA4C;EACzD,OAAO,KAAKd,WAAWoE,OAAO7E,yBAAyBuB,KAAAA,CAAAA;CAC3D;CAEA,MAAM8C,UAAU9C,OAAiD;EAC7D,OAAO,KAAKd,WAAW4D,UAAUrE,yBAAyBuB,KAAAA,CAAAA;CAC9D;CAEAoB,OAAOuB,MAAyB;EAC5B,OAAO,KAAKzD,WAAWkC,OAAOuB,IAAAA;CAClC;CAEAY,MAAMjE,QAAaqD,MAAyB;EACxC,OAAO,KAAKzD,WAAWqE,MAAMjE,QAAqBqD,IAAAA;CACtD;CAEA,MAAMjB,KAAKpC,QAA2B;EAClC,IACIA,OAAOS,iBACP,KAAKlB,iBACL,CAACT,qBAAqBkB,OAAOS,aAAa,GAC5C;GACE,MAAMmB,WAAW5B,OAAOS;GACxBT,OAAOS,gBAAgB,MAAMzB,gBAAgB,KAAKO,eAAeqC,QAAAA;GACjE,MAAMsC,QAAQ,MAAM,KAAKtE,WAAWwC,KAAKpC,MAAAA;GACzCkE,MAAMzD,gBAAgBmB;GACtB,OAAOsC;EACX;EAEA,OAAO,KAAKtE,WAAWwC,KAAKpC,MAAAA;CAChC;CAEA,MAAMmE,OAAOnE,QAA4B;EACrC,MAAM,KAAKJ,WAAWuE,OAAOnE,MAAAA;CACjC;CAEA,MAAMoE,oBAAoBf,MAAmC;EACzD,MAAM/E,0BAA0B+E,MAAM;GAClC/D,YAAY,KAAKA;GACjB+E,cAAc3F;EAClB,CAAA;CACJ;CAEA,MAAM4F,gBAAgBjB,MAAoBkB,UAA+B;EAQrE,IAAI,CAACC,MAPkBtF,eAAe;GAClCI,YAAY,KAAKA;GACjB+E,cAAc3F;GACdsB,QAAQqD;GACRoB,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAI9F,sBAAAA;CAElB;CAEA,MAAMiG,oBAAoBC,OAAgC;EACtD,OAAO,KAAKrF,WAAWK,cAAcf,uBAAAA,CAAAA,CAAyBqC,QAAQ,EAAE2D,QAAQvG,KAAK,MAAgCsG,MAAM,GAAG,EAAE,CAAA;CACpI;CAEA,MAAME,oBAAoB/E,SAAiBC,KAAqC;EAC5E,OAAO,KAAKH,WAAWkF,QAAQ,YAAY;GAAEhF;GAAcC;EAAmB,CAAA;CAClF;AACJ"}
1	+ {"version":3,"file":"repository.mjs","names":["AuthupError","KeyStatus","arrayBufferToBase64","createNanoID","isUUID","AsymmetricKey","CryptoAsymmetricAlgorithm","createAsymmetricKeyPair","JWKType","JWKUse","JWTAlgorithm","Like","validateEntityJoinColumns","applyQuery","redactFieldConditions","getRandomValues","DatabaseConflictError","KeyEntity","RealmEntity","UserAuthenticatorEntity","REALM_CIPHER_BLOB_VERSION","isWrappedKeyMaterial","unwrapKeyMaterial","wrapKeyMaterial","applyRealmScopeSelect","isEntityUnique","translateWhereConditions","RealmRepositoryAdapter","KeyRepositoryAdapter","dataSource","secretsCipher","realmRepository","logger","options","getRepository","repository","resolveOrCreate","realmId","use","entity","findOne","select","id","name","type","status","signatureAlgorithm","encryptionKey","decryptionKey","where","ACTIVE","order","priority","createdAt","afterLoad","total","countBy","ENCRYPTION","createEncryptionKey","createSignatureKey","resolveById","keyPair","RSASSA_PKCS1_V1_5","privateKeyContainer","privateKey","publicKeyContainer","publicKey","material","toBase64","create","generateName","SIGNATURE","RSA","protect","RS256","save","raw","Uint8Array","buffer","OCT","update","e","warn","error","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","getManyAndCount","data","meta","findOneById","findOneBy","findOneByName","realmKey","resolveId","findOneByIdOrName","idOrName","realm","findManyBy","findBy","merge","saved","remove","validateJoinColumns","entityTarget","checkUniqueness","existing","isUnique","entityExisting","countBlobReferences","keyId","secret","findHighestPriority","maximum"],"sources":["../../../../../../src/app/modules/database/repositories/key/repository.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { AuthupError } from '@authup/errors';\nimport type { IQuery } from '@rapiq/core';\nimport type { Key } from '@authup/core-kit';\nimport { KeyStatus } from '@authup/core-kit';\nimport { arrayBufferToBase64, createNanoID, isUUID } from '@authup/kit';\nimport {\n AsymmetricKey,\n CryptoAsymmetricAlgorithm,\n type EntityRepositoryFindManyResult,\n type ISymmetricCipher,\n type Logger,\n createAsymmetricKeyPair,\n} from '@authup/server-kit';\nimport { JWKType, JWKUse, JWTAlgorithm } from '@authup/specs';\nimport type { DataSource, FindOptionsWhere, Repository } from 'typeorm';\nimport { Like } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport { getRandomValues } from 'uncrypto';\nimport {\n DatabaseConflictError,\n KeyEntity,\n RealmEntity,\n UserAuthenticatorEntity,\n} from '../../../../../adapters/database/index.ts';\nimport type { IKeyRepository, IKeyStore, IRealmRepository } from '../../../../../core/index.ts';\nimport {\n REALM_CIPHER_BLOB_VERSION,\n isWrappedKeyMaterial,\n unwrapKeyMaterial,\n wrapKeyMaterial,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type KeyRepositoryAdapterOptions = {\n /\n Optional KEK (config secretsEncryptionKey) — when present, key\n * material is persisted wrapped and unwrapped transparently on read.\n /\n secretsCipher?: ISymmetricCipher \| null,\n logger?: Logger,\n};\n\n/\n One adapter, two ports: the entity CRUD surface (IKeyRepository) for the\n * key management API and the material-resolving store (IKeyStore) for the\n * signer / verifier / realm cipher. Entity reads never select\n * decryptionKey; only the IKeyStore surface hands out (unwrapped) material.\n */\nexport class KeyRepositoryAdapter implements IKeyRepository, IKeyStore {\n protected dataSource : DataSource;\n\n protected secretsCipher : ISymmetricCipher \| null;\n\n protected realmRepository : IRealmRepository;\n\n protected logger? : Logger;\n\n constructor(dataSource: DataSource, options: KeyRepositoryAdapterOptions = {}) {\n this.dataSource = dataSource;\n this.secretsCipher = options.secretsCipher ?? null;\n this.logger = options.logger;\n this.realmRepository = new RealmRepositoryAdapter(dataSource.getRepository(RealmEntity));\n }\n\n protected get repository() : Repository<KeyEntity> {\n return this.dataSource.getRepository(KeyEntity);\n }\n\n // ------------------------------------------------------------------\n // IKeyStore — material resolution (signer / verifier / realm cipher)\n // ------------------------------------------------------------------\n\n async resolveOrCreate(realmId: string, use: `${JWKUse}`): Promise<Key> {\n const { repository } = this;\n\n const entity = await repository.findOne({\n select: {\n id: true,\n name: true,\n type: true,\n use: true,\n status: true,\n signatureAlgorithm: true,\n encryptionKey: true,\n decryptionKey: true,\n realmId: true,\n },\n where: {\n realmId,\n use,\n status: KeyStatus.ACTIVE,\n },\n // createdAt + id break priority ties deterministically (e.g.\n // duplicate mints from a concurrent zero-row backstop race —\n // benign, both keys verify, but selection must be stable).\n order: {\n priority: 'DESC', \n createdAt: 'DESC', \n id: 'ASC', \n },\n });\n\n if (entity) {\n return this.afterLoad(repository, entity);\n }\n\n const total = await repository.countBy({ realmId, use });\n if (total > 0) {\n // an admin who disabled every key meant it — do not silently\n // re-mint around the kill switch.\n throw new AuthupError(\n `No active ${use} key is available for realm ${realmId} ` +\n `(${total} key(s) exist, none active).`,\n );\n }\n\n if (use === JWKUse.ENCRYPTION) {\n return this.createEncryptionKey(repository, realmId);\n }\n\n return this.createSignatureKey(repository, realmId);\n }\n\n async resolveById(id: string): Promise<Key \| null> {\n const { repository } = this;\n\n // `id` reaches here from an attacker-controlled JWT `kid` header on the\n // token-verification hot path. A non-UUID value binds against a\n // postgres `uuid` column as a driver-level type error (500) instead of\n // a clean miss — short-circuit to \"not found\" so a garbage kid is a\n // plain verification failure.\n if (!isUUID(id)) {\n return null;\n }\n\n const entity = await repository.findOne({\n select: {\n id: true,\n name: true,\n type: true,\n use: true,\n status: true,\n signatureAlgorithm: true,\n encryptionKey: true,\n decryptionKey: true,\n realmId: true,\n },\n where: { id },\n });\n\n if (!entity) {\n return null;\n }\n\n return this.afterLoad(repository, entity);\n }\n\n protected async createSignatureKey(\n repository: Repository<KeyEntity>,\n realmId: string,\n ) : Promise<Key> {\n const keyPair = await createAsymmetricKeyPair({ name: CryptoAsymmetricAlgorithm.RSASSA_PKCS1_V1_5 });\n\n const privateKeyContainer = new AsymmetricKey(keyPair.privateKey);\n const publicKeyContainer = new AsymmetricKey(keyPair.publicKey);\n\n const material = await privateKeyContainer.toBase64();\n\n const entity = repository.create({\n name: this.generateName(JWKUse.SIGNATURE),\n type: JWKType.RSA,\n use: JWKUse.SIGNATURE,\n status: KeyStatus.ACTIVE,\n decryptionKey: await this.protect(material),\n encryptionKey: await publicKeyContainer.toBase64(),\n realmId,\n signatureAlgorithm: `${JWTAlgorithm.RS256}`,\n });\n\n await repository.save(entity);\n\n // hand the caller usable material regardless of the persisted form.\n entity.decryptionKey = material;\n\n return entity;\n }\n\n protected async createEncryptionKey(\n repository: Repository<KeyEntity>,\n realmId: string,\n ) : Promise<Key> {\n const raw = new Uint8Array(32);\n getRandomValues(raw);\n\n const material = arrayBufferToBase64(raw.buffer);\n\n const entity = repository.create({\n name: this.generateName(JWKUse.ENCRYPTION),\n type: JWKType.OCT,\n use: JWKUse.ENCRYPTION,\n status: KeyStatus.ACTIVE,\n decryptionKey: await this.protect(material),\n encryptionKey: null,\n realmId,\n signatureAlgorithm: null,\n });\n\n await repository.save(entity);\n\n entity.decryptionKey = material;\n\n return entity;\n }\n\n protected generateName(use: `${JWKUse}`) : string {\n return `${use}-${createNanoID(10)}`;\n }\n\n protected async afterLoad(\n repository: Repository<KeyEntity>,\n entity: KeyEntity,\n ) : Promise<Key> {\n if (!entity.decryptionKey) {\n return entity;\n }\n\n if (isWrappedKeyMaterial(entity.decryptionKey)) {\n entity.decryptionKey = await unwrapKeyMaterial(this.secretsCipher, entity.decryptionKey);\n return entity;\n }\n\n if (this.secretsCipher) {\n // lazy wrap-on-read: a KEK added to a running deployment\n // hardens existing rows without a migration step. Best-effort —\n // the material stays readable either way.\n const material = entity.decryptionKey;\n try {\n await repository.update(entity.id, { decryptionKey: await wrapKeyMaterial(this.secretsCipher, material) });\n } catch (e) {\n // Best-effort — the material stays readable and the next read\n // retries. Surface it though: a persistent failure (e.g. a\n // read-only replica) means the row is never hardened at rest.\n this.logger?.warn(`Failed to wrap key material at rest for key ${entity.id}.`, { error: e });\n }\n entity.decryptionKey = material;\n }\n\n return entity;\n }\n\n protected async protect(material: string) : Promise<string> {\n if (!this.secretsCipher) {\n return material;\n }\n\n return wrapKeyMaterial(this.secretsCipher, material);\n }\n\n // ------------------------------------------------------------------\n // IKeyRepository — entity CRUD surface (key management API)\n // ------------------------------------------------------------------\n\n async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Key>> {\n const qb = this.repository.createQueryBuilder('keyEntity');\n qb.groupBy('keyEntity.id');\n\n const { pagination } = applyQuery(qb, query);\n\n applyRealmScopeSelect(qb, 'keyEntity');\n\n const [entities, total] = await qb.getManyAndCount();\n\n return {\n data: redactFieldConditions(query, entities),\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n async findOneById(id: string): Promise<Key \| null> {\n return this.findOneBy({ id });\n }\n\n async findOneByName(name: string, realmKey?: string): Promise<Key \| null> {\n const where : FindOptionsWhere<KeyEntity> = { name };\n\n if (realmKey) {\n const realmId = await this.realmRepository.resolveId(realmKey);\n if (!realmId) {\n return null;\n }\n\n where.realmId = realmId;\n }\n\n return this.repository.findOneBy(where);\n }\n\n async findOneByIdOrName(idOrName: string, realm?: string): Promise<Key \| null> {\n return isUUID(idOrName) ?\n this.findOneById(idOrName) :\n this.findOneByName(idOrName, realm);\n }\n\n async findManyBy(where: Record<string, any>): Promise<Key[]> {\n return this.repository.findBy(translateWhereConditions(where));\n }\n\n async findOneBy(where: Record<string, any>): Promise<Key \| null> {\n return this.repository.findOneBy(translateWhereConditions(where));\n }\n\n create(data: Partial<Key>): Key {\n return this.repository.create(data);\n }\n\n merge(entity: Key, data: Partial<Key>): Key {\n return this.repository.merge(entity as KeyEntity, data);\n }\n\n async save(entity: Key): Promise<Key> {\n if (\n entity.decryptionKey &&\n this.secretsCipher &&\n !isWrappedKeyMaterial(entity.decryptionKey)\n ) {\n const material = entity.decryptionKey;\n entity.decryptionKey = await wrapKeyMaterial(this.secretsCipher, material);\n const saved = await this.repository.save(entity as KeyEntity);\n saved.decryptionKey = material;\n return saved;\n }\n\n return this.repository.save(entity as KeyEntity);\n }\n\n async remove(entity: Key): Promise<void> {\n await this.repository.remove(entity as KeyEntity);\n }\n\n async validateJoinColumns(data: Partial<Key>): Promise<void> {\n await validateEntityJoinColumns(data, {\n dataSource: this.dataSource,\n entityTarget: KeyEntity,\n });\n }\n\n async checkUniqueness(data: Partial<Key>, existing?: Key): Promise<void> {\n const isUnique = await isEntityUnique({\n dataSource: this.dataSource,\n entityTarget: KeyEntity,\n entity: data,\n entityExisting: existing,\n });\n\n if (!isUnique) {\n throw new DatabaseConflictError();\n }\n }\n\n async countBlobReferences(keyId: string): Promise<number> {\n return this.dataSource.getRepository(UserAuthenticatorEntity).countBy({ secret: Like(`${REALM_CIPHER_BLOB_VERSION}.${keyId}.%`) });\n }\n\n async findHighestPriority(realmId: string, use: string): Promise<number \| null> {\n return this.repository.maximum('priority', { realmId, use: use as `${JWKUse}` });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDA,IAAa4B,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYH,YAAwBI,UAAuC,CAAC,GAAG;EAC3E,KAAKJ,aAAaA;EAClB,KAAKC,gBAAgBG,QAAQH,iBAAiB;EAC9C,KAAKE,SAASC,QAAQD;EACtB,KAAKD,kBAAkB,IAAIJ,uBAAuBE,WAAWK,cAAchB,WAAAA,CAAAA;CAC/E;CAEA,IAAciB,aAAqC;EAC/C,OAAO,KAAKN,WAAWK,cAAcjB,SAAAA;CACzC;CAMA,MAAMmB,gBAAgBC,SAAiBC,KAAgC;EACnE,MAAM,EAAEH,eAAe;EAEvB,MAAMI,SAAS,MAAMJ,WAAWK,QAAQ;GACpCC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNN,KAAK;IACLO,QAAQ;IACRC,oBAAoB;IACpBC,eAAe;IACfC,eAAe;IACfX,SAAS;GACb;GACAY,OAAO;IACHZ;IACAC;IACAO,QAAQ5C,UAAUiD;GACtB;GAIAC,OAAO;IACHC,UAAU;IACVC,WAAW;IACXX,IAAI;GACR;EACJ,CAAA;EAEA,IAAIH,QACA,OAAO,KAAKe,UAAUnB,YAAYI,MAAAA;EAGtC,MAAMgB,QAAQ,MAAMpB,WAAWqB,QAAQ;GAAEnB;GAASC;EAAI,CAAA;EACtD,IAAIiB,QAAQ,GAGR,MAAM,IAAIvD,YACN,aAAasC,IAAI,8BAA8BD,QAAQ,IACnDkB,MAAM,6BAA6B;EAI/C,IAAIjB,QAAQ7B,OAAOgD,YACf,OAAO,KAAKC,oBAAoBvB,YAAYE,OAAAA;EAGhD,OAAO,KAAKsB,mBAAmBxB,YAAYE,OAAAA;CAC/C;CAEA,MAAMuB,YAAYlB,IAAiC;EAC/C,MAAM,EAAEP,eAAe;EAOvB,IAAI,CAAC/B,OAAOsC,EAAAA,GACR,OAAO;EAGX,MAAMH,SAAS,MAAMJ,WAAWK,QAAQ;GACpCC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNN,KAAK;IACLO,QAAQ;IACRC,oBAAoB;IACpBC,eAAe;IACfC,eAAe;IACfX,SAAS;GACb;GACAY,OAAO,EAAEP,GAAG;EAChB,CAAA;EAEA,IAAI,CAACH,QACD,OAAO;EAGX,OAAO,KAAKe,UAAUnB,YAAYI,MAAAA;CACtC;CAEA,MAAgBoB,mBACZxB,YACAE,SACa;EACb,MAAMwB,UAAU,MAAMtD,wBAAwB,EAAEoC,MAAMrC,0BAA0BwD,kBAAkB,CAAA;EAElG,MAAMC,sBAAsB,IAAI1D,cAAcwD,QAAQG,UAAU;EAChE,MAAMC,qBAAqB,IAAI5D,cAAcwD,QAAQK,SAAS;EAE9D,MAAMC,WAAW,MAAMJ,oBAAoBK,SAAQ;EAEnD,MAAM7B,SAASJ,WAAWkC,OAAO;GAC7B1B,MAAM,KAAK2B,aAAa7D,OAAO8D,SAAS;GACxC3B,MAAMpC,QAAQgE;GACdlC,KAAK7B,OAAO8D;GACZ1B,QAAQ5C,UAAUiD;GAClBF,eAAe,MAAM,KAAKyB,QAAQN,QAAAA;GAClCpB,eAAe,MAAMkB,mBAAmBG,SAAQ;GAChD/B;GACAS,oBAAoB,GAAGpC,aAAagE;EACxC,CAAA;EAEA,MAAMvC,WAAWwC,KAAKpC,MAAAA;EAGtBA,OAAOS,gBAAgBmB;EAEvB,OAAO5B;CACX;CAEA,MAAgBmB,oBACZvB,YACAE,SACa;EACb,MAAMuC,sBAAM,IAAIC,WAAW,EAAA;EAC3B9D,gBAAgB6D,GAAAA;EAEhB,MAAMT,WAAWjE,oBAAoB0E,IAAIE,MAAM;EAE/C,MAAMvC,SAASJ,WAAWkC,OAAO;GAC7B1B,MAAM,KAAK2B,aAAa7D,OAAOgD,UAAU;GACzCb,MAAMpC,QAAQuE;GACdzC,KAAK7B,OAAOgD;GACZZ,QAAQ5C,UAAUiD;GAClBF,eAAe,MAAM,KAAKyB,QAAQN,QAAAA;GAClCpB,eAAe;GACfV;GACAS,oBAAoB;EACxB,CAAA;EAEA,MAAMX,WAAWwC,KAAKpC,MAAAA;EAEtBA,OAAOS,gBAAgBmB;EAEvB,OAAO5B;CACX;CAEU+B,aAAahC,KAA2B;EAC9C,OAAO,GAAGA,IAAI,GAAGnC,aAAa,EAAA;CAClC;CAEA,MAAgBmD,UACZnB,YACAI,QACa;EACb,IAAI,CAACA,OAAOS,eACR,OAAOT;EAGX,IAAIlB,qBAAqBkB,OAAOS,aAAa,GAAG;GAC5CT,OAAOS,gBAAgB,MAAM1B,kBAAkB,KAAKQ,eAAeS,OAAOS,aAAa;GACvF,OAAOT;EACX;EAEA,IAAI,KAAKT,eAAe;GAIpB,MAAMqC,WAAW5B,OAAOS;GACxB,IAAI;IACA,MAAMb,WAAW6C,OAAOzC,OAAOG,IAAI,EAAEM,eAAe,MAAMzB,gBAAgB,KAAKO,eAAeqC,QAAAA,EAAU,CAAA;GAC5G,SAASc,GAAG;IAIR,KAAKjD,QAAQkD,KAAK,+CAA+C3C,OAAOG,GAAG,IAAI,EAAEyC,OAAOF,EAAE,CAAA;GAC9F;GACA1C,OAAOS,gBAAgBmB;EAC3B;EAEA,OAAO5B;CACX;CAEA,MAAgBkC,QAAQN,UAAoC;EACxD,IAAI,CAAC,KAAKrC,eACN,OAAOqC;EAGX,OAAO5C,gBAAgB,KAAKO,eAAeqC,QAAAA;CAC/C;CAMA,MAAMiB,SAASC,OAA6D;EACxE,MAAMC,KAAK,KAAKnD,WAAWoD,mBAAmB,WAAA;EAC9CD,GAAGE,QAAQ,cAAA;EAEX,MAAM,EAAEC,eAAe5E,WAAWyE,IAAID,KAAAA;EAEtC7D,sBAAsB8D,IAAI,WAAA;EAE1B,MAAM,CAACI,UAAUnC,SAAS,MAAM+B,GAAGK,gBAAe;EAElD,OAAO;GACHC,MAAM9E,sBAAsBuE,OAAOK,QAAAA;GACnCG,MAAM;IACFtC;IACA,GAAGkC;GACP;EACJ;CACJ;CAEA,MAAMK,YAAYpD,IAAiC;EAC/C,OAAO,KAAKqD,UAAU,EAAErD,GAAG,CAAA;CAC/B;CAEA,MAAMsD,cAAcrD,MAAcsD,UAAwC;EACtE,MAAMhD,QAAsC,EAAEN,KAAK;EAEnD,IAAIsD,UAAU;GACV,MAAM5D,UAAU,MAAM,KAAKN,gBAAgBmE,UAAUD,QAAAA;GACrD,IAAI,CAAC5D,SACD,OAAO;GAGXY,MAAMZ,UAAUA;EACpB;EAEA,OAAO,KAAKF,WAAW4D,UAAU9C,KAAAA;CACrC;CAEA,MAAMkD,kBAAkBC,UAAkBC,OAAqC;EAC3E,OAAOjG,OAAOgG,QAAAA,IACV,KAAKN,YAAYM,QAAAA,IACjB,KAAKJ,cAAcI,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWrD,OAA4C;EACzD,OAAO,KAAKd,WAAWoE,OAAO7E,yBAAyBuB,KAAAA,CAAAA;CAC3D;CAEA,MAAM8C,UAAU9C,OAAiD;EAC7D,OAAO,KAAKd,WAAW4D,UAAUrE,yBAAyBuB,KAAAA,CAAAA;CAC9D;CAEAoB,OAAOuB,MAAyB;EAC5B,OAAO,KAAKzD,WAAWkC,OAAOuB,IAAAA;CAClC;CAEAY,MAAMjE,QAAaqD,MAAyB;EACxC,OAAO,KAAKzD,WAAWqE,MAAMjE,QAAqBqD,IAAAA;CACtD;CAEA,MAAMjB,KAAKpC,QAA2B;EAClC,IACIA,OAAOS,iBACP,KAAKlB,iBACL,CAACT,qBAAqBkB,OAAOS,aAAa,GAC5C;GACE,MAAMmB,WAAW5B,OAAOS;GACxBT,OAAOS,gBAAgB,MAAMzB,gBAAgB,KAAKO,eAAeqC,QAAAA;GACjE,MAAMsC,QAAQ,MAAM,KAAKtE,WAAWwC,KAAKpC,MAAAA;GACzCkE,MAAMzD,gBAAgBmB;GACtB,OAAOsC;EACX;EAEA,OAAO,KAAKtE,WAAWwC,KAAKpC,MAAAA;CAChC;CAEA,MAAMmE,OAAOnE,QAA4B;EACrC,MAAM,KAAKJ,WAAWuE,OAAOnE,MAAAA;CACjC;CAEA,MAAMoE,oBAAoBf,MAAmC;EACzD,MAAMhF,0BAA0BgF,MAAM;GAClC/D,YAAY,KAAKA;GACjB+E,cAAc3F;EAClB,CAAA;CACJ;CAEA,MAAM4F,gBAAgBjB,MAAoBkB,UAA+B;EAQrE,IAAI,CAACC,MAPkBtF,eAAe;GAClCI,YAAY,KAAKA;GACjB+E,cAAc3F;GACdsB,QAAQqD;GACRoB,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAI9F,sBAAAA;CAElB;CAEA,MAAMiG,oBAAoBC,OAAgC;EACtD,OAAO,KAAKrF,WAAWK,cAAcf,uBAAAA,CAAAA,CAAyBqC,QAAQ,EAAE2D,QAAQxG,KAAK,MAAgCuG,MAAM,GAAG,EAAE,CAAA;CACpI;CAEA,MAAME,oBAAoB/E,SAAiBC,KAAqC;EAC5E,OAAO,KAAKH,WAAWkF,QAAQ,YAAY;GAAEhF;GAAcC;EAAmB,CAAA;CAClF;AACJ"}

package/dist/app/modules/database/repositories/permission/repository.mjs CHANGED Viewed

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { PermissionEntity } from "../../../../../adapters/database/domains/permission/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
 import "../../../../../adapters/database/index.mjs";
@@ -24,7 +24,7 @@ var PermissionRepositoryAdapter = class {
 		const { pagination } = applyQuery(qb, query);
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/database/repositories/permission/repository.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"repository.mjs","names":["isUUID","validateEntityJoinColumns","applyQuery","DatabaseConflictError","isEntityUnique","translateWhereConditions","PermissionEntity","RealmRepositoryAdapter","PermissionRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOneByIdOrName","idOrName","realm","result","findManyBy","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting"],"sources":["../../../../../../src/app/modules/database/repositories/permission/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Permission, Realm } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IPermissionRepository, IRealmRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport { isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { PermissionEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type PermissionRepositoryAdapterContext = {\n repository: Repository<Permission>,\n realmRepository: Repository<Realm>,\n};\n\nexport class PermissionRepositoryAdapter implements IPermissionRepository {\n private readonly repository: Repository<Permission>;\n\n private readonly realmRepository: IRealmRepository;\n\n constructor(ctx: PermissionRepositoryAdapterContext) {\n this.repository = ctx.repository;\n this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n }\n\n async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Permission>> {\n const qb = this.repository.createQueryBuilder('permission');\n qb.groupBy('permission.id');\n\n const { pagination } = applyQuery(qb, query);\n\n const [entities, total] = await qb.getManyAndCount();\n\n return {\n data: entities,\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n findOneById(id: string): Promise<Permission \| null> {\n return this.findOneBy({ id });\n }\n\n async findOneByName(name: string, realmKey?: string): Promise<Permission \| null> {\n const qb = this.repository.createQueryBuilder('permission');\n qb.where('permission.name = :name', { name });\n\n if (realmKey) {\n const realmId = await this.realmRepository.resolveId(realmKey);\n if (!realmId) {\n return null;\n }\n qb.andWhere('permission.realmId = :realmId', { realmId });\n }\n\n return qb.getOne();\n }\n\n async findOneByIdOrName(idOrName: string, realm?: string): Promise<Permission \| null> {\n const result = isUUID(idOrName) ?\n await this.findOneById(idOrName) :\n await this.findOneByName(idOrName, realm);\n\n return result;\n }\n\n async findManyBy(where: Record<string, any>): Promise<Permission[]> {\n return this.repository.findBy(translateWhereConditions(where));\n }\n\n async findOneBy(where: Record<string, any>): Promise<Permission \| null> {\n return this.repository.findOneBy(translateWhereConditions(where));\n }\n\n create(data: Partial<Permission>): Permission {\n return this.repository.create(data);\n }\n\n merge(entity: Permission, data: Partial<Permission>): Permission {\n return this.repository.merge(entity, data);\n }\n\n async save(entity: Permission): Promise<Permission> {\n return this.repository.save(entity);\n }\n\n async remove(entity: Permission): Promise<void> {\n await this.repository.remove(entity);\n }\n\n async validateJoinColumns(data: Partial<Permission>): Promise<void> {\n await validateEntityJoinColumns(data, {\n dataSource: this.repository.manager.connection,\n entityTarget: PermissionEntity,\n });\n }\n\n async checkUniqueness(data: Partial<Permission>, existing?: Permission): Promise<void> {\n const isUnique = await isEntityUnique({\n dataSource: this.repository.manager.connection,\n entityTarget: PermissionEntity,\n entity: data,\n entityExisting: existing,\n });\n\n if (!isUnique) {\n throw new DatabaseConflictError();\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAyBA,~~IAAaQ~~,8BAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAAyC;EACjD,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAAoE;EAC/E,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,YAAA;EAC9CD,GAAGE,QAAQ,eAAA;EAEX,MAAM,EAAEC,~~eAAef~~,~~WAAWY~~,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,~~MAAMH~~;~~GACNI~~,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAAwC;EAChD,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,cAAcC,MAAcC,UAA+C;EAC7E,MAAMd,KAAK,KAAKL,WAAWM,mBAAmB,YAAA;EAC9CD,GAAGe,MAAM,2BAA2B,EAAEF,KAAK,CAAA;EAE3C,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKpB,gBAAgBqB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXhB,GAAGkB,SAAS,iCAAiC,EAAEF,QAAQ,CAAA;EAC3D;EAEA,OAAOhB,GAAGmB,OAAM;CACpB;CAEA,MAAMC,kBAAkBC,UAAkBC,OAA4C;EAKlF,~~OAJepC~~,~~OAAOmC~~,QAAAA,IAClB,MAAM,KAAKZ,YAAYY,QAAAA,IACvB,MAAM,KAAKT,cAAcS,UAAUC,KAAAA;CAG3C;CAEA,MAAME,WAAWT,OAAmD;EAChE,OAAO,KAAKpB,WAAW8B,OAAOlC,yBAAyBwB,KAAAA,CAAAA;CAC3D;CAEA,MAAMJ,UAAUI,OAAwD;EACpE,OAAO,KAAKpB,WAAWgB,UAAUpB,yBAAyBwB,KAAAA,CAAAA;CAC9D;CAEAW,OAAOnB,MAAuC;EAC1C,OAAO,KAAKZ,WAAW+B,OAAOnB,IAAAA;CAClC;CAEAoB,MAAMC,QAAoBrB,MAAuC;EAC7D,OAAO,KAAKZ,WAAWgC,MAAMC,QAAQrB,IAAAA;CACzC;CAEA,MAAMsB,KAAKD,QAAyC;EAChD,OAAO,KAAKjC,WAAWkC,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAAmC;EAC5C,MAAM,KAAKjC,WAAWmC,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBxB,MAA0C;EAChE,~~MAAMpB~~,~~0BAA0BoB~~,MAAM;GAClCyB,YAAY,KAAKrC,WAAWsC,QAAQC;GACpCC,cAAc3C;EAClB,CAAA;CACJ;CAEA,MAAM4C,gBAAgB7B,MAA2B8B,UAAsC;EAQnF,IAAI,CAACC,MAPkBhD,eAAe;GAClC0C,YAAY,KAAKrC,WAAWsC,QAAQC;GACpCC,cAAc3C;GACdoC,QAAQrB;GACRgC,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAIhD,sBAAAA;CAElB;AACJ"}
1	+ {"version":3,"file":"repository.mjs","names":["isUUID","validateEntityJoinColumns","applyQuery","redactFieldConditions","DatabaseConflictError","isEntityUnique","translateWhereConditions","PermissionEntity","RealmRepositoryAdapter","PermissionRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOneByIdOrName","idOrName","realm","result","findManyBy","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting"],"sources":["../../../../../../src/app/modules/database/repositories/permission/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Permission, Realm } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IPermissionRepository, IRealmRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport { isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { PermissionEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type PermissionRepositoryAdapterContext = {\n repository: Repository<Permission>,\n realmRepository: Repository<Realm>,\n};\n\nexport class PermissionRepositoryAdapter implements IPermissionRepository {\n private readonly repository: Repository<Permission>;\n\n private readonly realmRepository: IRealmRepository;\n\n constructor(ctx: PermissionRepositoryAdapterContext) {\n this.repository = ctx.repository;\n this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n }\n\n async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Permission>> {\n const qb = this.repository.createQueryBuilder('permission');\n qb.groupBy('permission.id');\n\n const { pagination } = applyQuery(qb, query);\n\n const [entities, total] = await qb.getManyAndCount();\n\n return {\n data: redactFieldConditions(query, entities),\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n findOneById(id: string): Promise<Permission \| null> {\n return this.findOneBy({ id });\n }\n\n async findOneByName(name: string, realmKey?: string): Promise<Permission \| null> {\n const qb = this.repository.createQueryBuilder('permission');\n qb.where('permission.name = :name', { name });\n\n if (realmKey) {\n const realmId = await this.realmRepository.resolveId(realmKey);\n if (!realmId) {\n return null;\n }\n qb.andWhere('permission.realmId = :realmId', { realmId });\n }\n\n return qb.getOne();\n }\n\n async findOneByIdOrName(idOrName: string, realm?: string): Promise<Permission \| null> {\n const result = isUUID(idOrName) ?\n await this.findOneById(idOrName) :\n await this.findOneByName(idOrName, realm);\n\n return result;\n }\n\n async findManyBy(where: Record<string, any>): Promise<Permission[]> {\n return this.repository.findBy(translateWhereConditions(where));\n }\n\n async findOneBy(where: Record<string, any>): Promise<Permission \| null> {\n return this.repository.findOneBy(translateWhereConditions(where));\n }\n\n create(data: Partial<Permission>): Permission {\n return this.repository.create(data);\n }\n\n merge(entity: Permission, data: Partial<Permission>): Permission {\n return this.repository.merge(entity, data);\n }\n\n async save(entity: Permission): Promise<Permission> {\n return this.repository.save(entity);\n }\n\n async remove(entity: Permission): Promise<void> {\n await this.repository.remove(entity);\n }\n\n async validateJoinColumns(data: Partial<Permission>): Promise<void> {\n await validateEntityJoinColumns(data, {\n dataSource: this.repository.manager.connection,\n entityTarget: PermissionEntity,\n });\n }\n\n async checkUniqueness(data: Partial<Permission>, existing?: Permission): Promise<void> {\n const isUnique = await isEntityUnique({\n dataSource: this.repository.manager.connection,\n entityTarget: PermissionEntity,\n entity: data,\n entityExisting: existing,\n });\n\n if (!isUnique) {\n throw new DatabaseConflictError();\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAyBA,IAAaS,8BAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAAyC;EACjD,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAAoE;EAC/E,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,YAAA;EAC9CD,GAAGE,QAAQ,eAAA;EAEX,MAAM,EAAEC,eAAehB,WAAWa,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMnB,sBAAsBW,OAAOK,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAAwC;EAChD,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,cAAcC,MAAcC,UAA+C;EAC7E,MAAMd,KAAK,KAAKL,WAAWM,mBAAmB,YAAA;EAC9CD,GAAGe,MAAM,2BAA2B,EAAEF,KAAK,CAAA;EAE3C,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKpB,gBAAgBqB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXhB,GAAGkB,SAAS,iCAAiC,EAAEF,QAAQ,CAAA;EAC3D;EAEA,OAAOhB,GAAGmB,OAAM;CACpB;CAEA,MAAMC,kBAAkBC,UAAkBC,OAA4C;EAKlF,OAJerC,OAAOoC,QAAAA,IAClB,MAAM,KAAKZ,YAAYY,QAAAA,IACvB,MAAM,KAAKT,cAAcS,UAAUC,KAAAA;CAG3C;CAEA,MAAME,WAAWT,OAAmD;EAChE,OAAO,KAAKpB,WAAW8B,OAAOlC,yBAAyBwB,KAAAA,CAAAA;CAC3D;CAEA,MAAMJ,UAAUI,OAAwD;EACpE,OAAO,KAAKpB,WAAWgB,UAAUpB,yBAAyBwB,KAAAA,CAAAA;CAC9D;CAEAW,OAAOnB,MAAuC;EAC1C,OAAO,KAAKZ,WAAW+B,OAAOnB,IAAAA;CAClC;CAEAoB,MAAMC,QAAoBrB,MAAuC;EAC7D,OAAO,KAAKZ,WAAWgC,MAAMC,QAAQrB,IAAAA;CACzC;CAEA,MAAMsB,KAAKD,QAAyC;EAChD,OAAO,KAAKjC,WAAWkC,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAAmC;EAC5C,MAAM,KAAKjC,WAAWmC,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBxB,MAA0C;EAChE,MAAMrB,0BAA0BqB,MAAM;GAClCyB,YAAY,KAAKrC,WAAWsC,QAAQC;GACpCC,cAAc3C;EAClB,CAAA;CACJ;CAEA,MAAM4C,gBAAgB7B,MAA2B8B,UAAsC;EAQnF,IAAI,CAACC,MAPkBhD,eAAe;GAClC0C,YAAY,KAAKrC,WAAWsC,QAAQC;GACpCC,cAAc3C;GACdoC,QAAQrB;GACRgC,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAIhD,sBAAAA;CAElB;AACJ"}

package/dist/app/modules/database/repositories/permission-policy/repository.mjs CHANGED Viewed

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { PermissionPolicyEntity } from "../../../../../adapters/database/domains/permission-policy/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { translateWhereConditions } from "../helpers.mjs";
 import { validateEntityJoinColumns } from "typeorm-extension";
 //#region src/app/modules/database/repositories/permission-policy/repository.ts
@@ -18,7 +18,7 @@ var PermissionPolicyRepositoryAdapter = class {
 		const { pagination } = applyQuery(qb, query);
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/database/repositories/permission-policy/repository.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"repository.mjs","names":["validateEntityJoinColumns","applyQuery","PermissionPolicyEntity","translateWhereConditions","PermissionPolicyRepositoryAdapter","repository","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","findOneByIdOrName","idOrName","findManyBy","where","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget"],"sources":["../../../../../../src/app/modules/database/repositories/permission-policy/repository.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PermissionPolicy } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository } from '../../../../../core/index.ts';\nimport { PermissionPolicyEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { translateWhereConditions } from '../helpers.ts';\n\nexport class PermissionPolicyRepositoryAdapter implements IPermissionPolicyRepository {\n private readonly repository: Repository<PermissionPolicy>;\n\n constructor(repository: Repository<PermissionPolicy>) {\n this.repository = repository;\n }\n\n async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<PermissionPolicy>> {\n const qb = this.repository.createQueryBuilder('permissionPolicy');\n qb.groupBy('permissionPolicy.id');\n\n const { pagination } = applyQuery(qb, query);\n\n const [entities, total] = await qb.getManyAndCount();\n\n return {\n data: entities,\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n findOneById(id: string): Promise<PermissionPolicy \| null> {\n return this.findOneBy({ id });\n }\n\n async findOneByName(): Promise<PermissionPolicy \| null> {\n return null;\n }\n\n findOneByIdOrName(idOrName: string): Promise<PermissionPolicy \| null> {\n return this.findOneById(idOrName);\n }\n\n async findManyBy(where: Record<string, any>): Promise<PermissionPolicy[]> {\n return this.repository.findBy(translateWhereConditions(where));\n }\n\n async findOneBy(where: Record<string, any>): Promise<PermissionPolicy \| null> {\n return this.repository.findOneBy(translateWhereConditions(where));\n }\n\n create(data: Partial<PermissionPolicy>): PermissionPolicy {\n return this.repository.create(data);\n }\n\n merge(entity: PermissionPolicy, data: Partial<PermissionPolicy>): PermissionPolicy {\n return this.repository.merge(entity, data);\n }\n\n async save(entity: PermissionPolicy): Promise<PermissionPolicy> {\n return this.repository.save(entity);\n }\n\n async remove(entity: PermissionPolicy): Promise<void> {\n await this.repository.remove(entity);\n }\n\n async validateJoinColumns(data: Partial<PermissionPolicy>): Promise<void> {\n await validateEntityJoinColumns(data, {\n dataSource: this.repository.manager.connection,\n entityTarget: PermissionPolicyEntity,\n });\n }\n}\n"],"mappings":";;;;;;;;;AAiBA,~~IAAaI~~,oCAAb,MAAaA;CACQC;CAEjB,YAAYA,YAA0C;EAClD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,SAASC,OAA0E;EACrF,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,kBAAA;EAC9CD,GAAGE,QAAQ,qBAAA;EAEX,MAAM,EAAEC,~~eAAeV~~,~~WAAWO~~,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,~~MAAMH~~;~~GACNI~~,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAA8C;EACtD,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,gBAAkD;EACpD,OAAO;CACX;CAEAC,kBAAkBC,UAAoD;EAClE,OAAO,KAAKL,YAAYK,QAAAA;CAC5B;CAEA,MAAMC,WAAWC,OAAyD;EACtE,OAAO,KAAKnB,WAAWoB,OAAOtB,yBAAyBqB,KAAAA,CAAAA;CAC3D;CAEA,MAAML,UAAUK,OAA8D;EAC1E,OAAO,KAAKnB,WAAWc,UAAUhB,yBAAyBqB,KAAAA,CAAAA;CAC9D;CAEAE,OAAOX,MAAmD;EACtD,OAAO,KAAKV,WAAWqB,OAAOX,IAAAA;CAClC;CAEAY,MAAMC,QAA0Bb,MAAmD;EAC/E,OAAO,KAAKV,WAAWsB,MAAMC,QAAQb,IAAAA;CACzC;CAEA,MAAMc,KAAKD,QAAqD;EAC5D,OAAO,KAAKvB,WAAWwB,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAAyC;EAClD,MAAM,KAAKvB,WAAWyB,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBhB,MAAgD;EACtE,~~MAAMf~~,~~0BAA0Be~~,MAAM;GAClCiB,YAAY,KAAK3B,WAAW4B,QAAQC;GACpCC,cAAcjC;EAClB,CAAA;CACJ;AACJ"}
1	+ {"version":3,"file":"repository.mjs","names":["validateEntityJoinColumns","applyQuery","redactFieldConditions","PermissionPolicyEntity","translateWhereConditions","PermissionPolicyRepositoryAdapter","repository","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","findOneByIdOrName","idOrName","findManyBy","where","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget"],"sources":["../../../../../../src/app/modules/database/repositories/permission-policy/repository.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { PermissionPolicy } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository } from '../../../../../core/index.ts';\nimport { PermissionPolicyEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { translateWhereConditions } from '../helpers.ts';\n\nexport class PermissionPolicyRepositoryAdapter implements IPermissionPolicyRepository {\n private readonly repository: Repository<PermissionPolicy>;\n\n constructor(repository: Repository<PermissionPolicy>) {\n this.repository = repository;\n }\n\n async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<PermissionPolicy>> {\n const qb = this.repository.createQueryBuilder('permissionPolicy');\n qb.groupBy('permissionPolicy.id');\n\n const { pagination } = applyQuery(qb, query);\n\n const [entities, total] = await qb.getManyAndCount();\n\n return {\n data: redactFieldConditions(query, entities),\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n findOneById(id: string): Promise<PermissionPolicy \| null> {\n return this.findOneBy({ id });\n }\n\n async findOneByName(): Promise<PermissionPolicy \| null> {\n return null;\n }\n\n findOneByIdOrName(idOrName: string): Promise<PermissionPolicy \| null> {\n return this.findOneById(idOrName);\n }\n\n async findManyBy(where: Record<string, any>): Promise<PermissionPolicy[]> {\n return this.repository.findBy(translateWhereConditions(where));\n }\n\n async findOneBy(where: Record<string, any>): Promise<PermissionPolicy \| null> {\n return this.repository.findOneBy(translateWhereConditions(where));\n }\n\n create(data: Partial<PermissionPolicy>): PermissionPolicy {\n return this.repository.create(data);\n }\n\n merge(entity: PermissionPolicy, data: Partial<PermissionPolicy>): PermissionPolicy {\n return this.repository.merge(entity, data);\n }\n\n async save(entity: PermissionPolicy): Promise<PermissionPolicy> {\n return this.repository.save(entity);\n }\n\n async remove(entity: PermissionPolicy): Promise<void> {\n await this.repository.remove(entity);\n }\n\n async validateJoinColumns(data: Partial<PermissionPolicy>): Promise<void> {\n await validateEntityJoinColumns(data, {\n dataSource: this.repository.manager.connection,\n entityTarget: PermissionPolicyEntity,\n });\n }\n}\n"],"mappings":";;;;;;;;;AAiBA,IAAaK,oCAAb,MAAaA;CACQC;CAEjB,YAAYA,YAA0C;EAClD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,SAASC,OAA0E;EACrF,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,kBAAA;EAC9CD,GAAGE,QAAQ,qBAAA;EAEX,MAAM,EAAEC,eAAeX,WAAWQ,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMd,sBAAsBM,OAAOK,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAA8C;EACtD,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,gBAAkD;EACpD,OAAO;CACX;CAEAC,kBAAkBC,UAAoD;EAClE,OAAO,KAAKL,YAAYK,QAAAA;CAC5B;CAEA,MAAMC,WAAWC,OAAyD;EACtE,OAAO,KAAKnB,WAAWoB,OAAOtB,yBAAyBqB,KAAAA,CAAAA;CAC3D;CAEA,MAAML,UAAUK,OAA8D;EAC1E,OAAO,KAAKnB,WAAWc,UAAUhB,yBAAyBqB,KAAAA,CAAAA;CAC9D;CAEAE,OAAOX,MAAmD;EACtD,OAAO,KAAKV,WAAWqB,OAAOX,IAAAA;CAClC;CAEAY,MAAMC,QAA0Bb,MAAmD;EAC/E,OAAO,KAAKV,WAAWsB,MAAMC,QAAQb,IAAAA;CACzC;CAEA,MAAMc,KAAKD,QAAqD;EAC5D,OAAO,KAAKvB,WAAWwB,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAAyC;EAClD,MAAM,KAAKvB,WAAWyB,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBhB,MAAgD;EACtE,MAAMhB,0BAA0BgB,MAAM;GAClCiB,YAAY,KAAK3B,WAAW4B,QAAQC;GACpCC,cAAcjC;EAClB,CAAA;CACJ;AACJ"}

package/dist/app/modules/database/repositories/policy/repository.mjs CHANGED Viewed

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { PolicyEntity } from "../../../../../adapters/database/domains/policy/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
 import "../../../../../adapters/database/index.mjs";
@@ -25,7 +25,7 @@ var PolicyRepositoryAdapter = class {
 		const [entities, total] = await qb.getManyAndCount();
 		await this.repository.extendManyWithEA(entities);
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/database/repositories/policy/repository.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"repository.mjs","names":["isUUID","validateEntityJoinColumns","applyQuery","DatabaseConflictError","PolicyEntity","isEntityUnique","translateWhereConditions","RealmRepositoryAdapter","PolicyRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","extendManyWithEA","data","meta","findOneById","id","entity","findOneBy","extendOneWithEA","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOneByIdOrName","idOrName","realm","findManyBy","findBy","create","merge","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting","saveWithEA","saveOneWithEA","updateClosureTable","deleteFromTree","treeRepository","getTreeRepository"],"sources":["../../../../../../src/app/modules/database/repositories/policy/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Policy, Realm } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IPolicyRepository, IRealmRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport type { PolicyRepository } from '../../../../../adapters/database/domains/index.ts';\nimport { PolicyEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type PolicyRepositoryAdapterContext = {\n repository: PolicyRepository,\n realmRepository: Repository<Realm>,\n};\n\nexport class PolicyRepositoryAdapter implements IPolicyRepository {\n private readonly repository: PolicyRepository;\n\n private readonly realmRepository: IRealmRepository;\n\n constructor(ctx: PolicyRepositoryAdapterContext) {\n this.repository = ctx.repository;\n this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n }\n\n async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Policy>> {\n const qb = this.repository.createQueryBuilder('policy');\n qb.groupBy('policy.id');\n\n const { pagination } = applyQuery(qb, query);\n\n const [entities, total] = await qb.getManyAndCount();\n await this.repository.extendManyWithEA(entities);\n\n return {\n data: entities,\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n async findOneById(id: string): Promise<Policy \| null> {\n const entity = await this.findOneBy({ id });\n if (entity) {\n await this.repository.extendOneWithEA(entity);\n }\n return entity;\n }\n\n async findOneByName(name: string, realmKey?: string): Promise<Policy \| null> {\n const qb = this.repository.createQueryBuilder('policy');\n qb.where('policy.name = :name', { name });\n\n if (realmKey) {\n const realmId = await this.realmRepository.resolveId(realmKey);\n if (!realmId) {\n return null;\n }\n qb.andWhere('policy.realmId = :realmId', { realmId });\n }\n\n const entity = await qb.getOne();\n if (entity) {\n await this.repository.extendOneWithEA(entity);\n }\n return entity;\n }\n\n async findOneByIdOrName(idOrName: string, realm?: string): Promise<Policy \| null> {\n return isUUID(idOrName) ?\n this.findOneById(idOrName) :\n this.findOneByName(idOrName, realm);\n }\n\n async findManyBy(where: Record<string, any>): Promise<Policy[]> {\n return this.repository.findBy(translateWhereConditions(where));\n }\n\n async findOneBy(where: Record<string, any>): Promise<Policy \| null> {\n return this.repository.findOneBy(translateWhereConditions(where));\n }\n\n create(data: Partial<Policy>): Policy {\n return this.repository.create(data);\n }\n\n merge(entity: Policy, data: Partial<Policy>): Policy {\n return this.repository.merge(entity, data);\n }\n\n async save(entity: Policy): Promise<Policy> {\n return this.repository.save(entity);\n }\n\n async remove(entity: Policy): Promise<void> {\n await this.repository.remove(entity);\n }\n\n async validateJoinColumns(data: Partial<Policy>): Promise<void> {\n await validateEntityJoinColumns(data, {\n dataSource: this.repository.manager.connection,\n entityTarget: PolicyEntity,\n });\n }\n\n async checkUniqueness(data: Partial<Policy>, existing?: Policy): Promise<void> {\n const isUnique = await isEntityUnique({\n dataSource: this.repository.manager.connection,\n entityTarget: PolicyEntity,\n entity: data,\n entityExisting: existing,\n });\n\n if (!isUnique) {\n throw new DatabaseConflictError();\n }\n }\n\n async saveWithEA(entity: Policy, data?: Record<string, any>): Promise<Policy> {\n await this.repository.saveOneWithEA(entity, data);\n await this.repository.updateClosureTable(entity, this.repository.manager);\n\n return entity;\n }\n\n async deleteFromTree(entity: Policy): Promise<void> {\n const treeRepository = this.repository.manager.connection.getTreeRepository(PolicyEntity);\n await treeRepository.remove(entity);\n }\n}\n"],"mappings":";;;;;;;;;;;;;AA0BA,~~IAAaQ~~,0BAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAAqC;EAC7C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAAgE;EAC3E,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,QAAA;EAC9CD,GAAGE,QAAQ,WAAA;EAEX,MAAM,EAAEC,~~eAAef~~,~~WAAWY~~,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAClD,MAAM,KAAKX,WAAWY,iBAAiBH,QAAAA;EAEvC,OAAO;GACHI,~~MAAMJ~~;~~GACNK~~,MAAM;IACFJ;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMO,YAAYC,IAAoC;EAClD,MAAMC,SAAS,MAAM,KAAKC,UAAU,EAAEF,GAAG,CAAA;EACzC,IAAIC,QACA,MAAM,KAAKjB,WAAWmB,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMG,cAAcC,MAAcC,UAA2C;EACzE,MAAMjB,KAAK,KAAKL,WAAWM,mBAAmB,QAAA;EAC9CD,GAAGkB,MAAM,uBAAuB,EAAEF,KAAK,CAAA;EAEvC,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKvB,gBAAgBwB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXnB,GAAGqB,SAAS,6BAA6B,EAAEF,QAAQ,CAAA;EACvD;EAEA,MAAMP,SAAS,MAAMZ,GAAGsB,OAAM;EAC9B,IAAIV,QACA,MAAM,KAAKjB,WAAWmB,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMW,kBAAkBC,UAAkBC,OAAwC;EAC9E,~~OAAOvC~~,~~OAAOsC~~,QAAAA,IACV,KAAKd,YAAYc,QAAAA,IACjB,KAAKT,cAAcS,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWR,OAA+C;EAC5D,OAAO,KAAKvB,WAAWgC,OAAOnC,yBAAyB0B,KAAAA,CAAAA;CAC3D;CAEA,MAAML,UAAUK,OAAoD;EAChE,OAAO,KAAKvB,WAAWkB,UAAUrB,yBAAyB0B,KAAAA,CAAAA;CAC9D;CAEAU,OAAOpB,MAA+B;EAClC,OAAO,KAAKb,WAAWiC,OAAOpB,IAAAA;CAClC;CAEAqB,MAAMjB,QAAgBJ,MAA+B;EACjD,OAAO,KAAKb,WAAWkC,MAAMjB,QAAQJ,IAAAA;CACzC;CAEA,MAAMsB,KAAKlB,QAAiC;EACxC,OAAO,KAAKjB,WAAWmC,KAAKlB,MAAAA;CAChC;CAEA,MAAMmB,OAAOnB,QAA+B;EACxC,MAAM,KAAKjB,WAAWoC,OAAOnB,MAAAA;CACjC;CAEA,MAAMoB,oBAAoBxB,MAAsC;EAC5D,~~MAAMrB~~,~~0BAA0BqB~~,MAAM;GAClCyB,YAAY,KAAKtC,WAAWuC,QAAQC;GACpCC,cAAc9C;EAClB,CAAA;CACJ;CAEA,MAAM+C,gBAAgB7B,MAAuB8B,UAAkC;EAQ3E,IAAI,CAACC,MAPkBhD,eAAe;GAClC0C,YAAY,KAAKtC,WAAWuC,QAAQC;GACpCC,cAAc9C;GACdsB,QAAQJ;GACRgC,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAIjD,sBAAAA;CAElB;CAEA,MAAMoD,WAAW7B,QAAgBJ,MAA6C;EAC1E,MAAM,KAAKb,WAAW+C,cAAc9B,QAAQJ,IAAAA;EAC5C,MAAM,KAAKb,WAAWgD,mBAAmB/B,QAAQ,KAAKjB,WAAWuC,OAAO;EAExE,OAAOtB;CACX;CAEA,MAAMgC,eAAehC,QAA+B;EAEhD,MADuB,KAAKjB,WAAWuC,QAAQC,WAAWW,kBAAkBxD,YACtEuD,CAAAA,CAAed,OAAOnB,MAAAA;CAChC;AACJ"}
1	+ {"version":3,"file":"repository.mjs","names":["isUUID","validateEntityJoinColumns","applyQuery","redactFieldConditions","DatabaseConflictError","PolicyEntity","isEntityUnique","translateWhereConditions","RealmRepositoryAdapter","PolicyRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","extendManyWithEA","data","meta","findOneById","id","entity","findOneBy","extendOneWithEA","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOneByIdOrName","idOrName","realm","findManyBy","findBy","create","merge","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting","saveWithEA","saveOneWithEA","updateClosureTable","deleteFromTree","treeRepository","getTreeRepository"],"sources":["../../../../../../src/app/modules/database/repositories/policy/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Policy, Realm } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IPolicyRepository, IRealmRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport type { PolicyRepository } from '../../../../../adapters/database/domains/index.ts';\nimport { PolicyEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type PolicyRepositoryAdapterContext = {\n repository: PolicyRepository,\n realmRepository: Repository<Realm>,\n};\n\nexport class PolicyRepositoryAdapter implements IPolicyRepository {\n private readonly repository: PolicyRepository;\n\n private readonly realmRepository: IRealmRepository;\n\n constructor(ctx: PolicyRepositoryAdapterContext) {\n this.repository = ctx.repository;\n this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n }\n\n async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Policy>> {\n const qb = this.repository.createQueryBuilder('policy');\n qb.groupBy('policy.id');\n\n const { pagination } = applyQuery(qb, query);\n\n const [entities, total] = await qb.getManyAndCount();\n await this.repository.extendManyWithEA(entities);\n\n return {\n data: redactFieldConditions(query, entities),\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n async findOneById(id: string): Promise<Policy \| null> {\n const entity = await this.findOneBy({ id });\n if (entity) {\n await this.repository.extendOneWithEA(entity);\n }\n return entity;\n }\n\n async findOneByName(name: string, realmKey?: string): Promise<Policy \| null> {\n const qb = this.repository.createQueryBuilder('policy');\n qb.where('policy.name = :name', { name });\n\n if (realmKey) {\n const realmId = await this.realmRepository.resolveId(realmKey);\n if (!realmId) {\n return null;\n }\n qb.andWhere('policy.realmId = :realmId', { realmId });\n }\n\n const entity = await qb.getOne();\n if (entity) {\n await this.repository.extendOneWithEA(entity);\n }\n return entity;\n }\n\n async findOneByIdOrName(idOrName: string, realm?: string): Promise<Policy \| null> {\n return isUUID(idOrName) ?\n this.findOneById(idOrName) :\n this.findOneByName(idOrName, realm);\n }\n\n async findManyBy(where: Record<string, any>): Promise<Policy[]> {\n return this.repository.findBy(translateWhereConditions(where));\n }\n\n async findOneBy(where: Record<string, any>): Promise<Policy \| null> {\n return this.repository.findOneBy(translateWhereConditions(where));\n }\n\n create(data: Partial<Policy>): Policy {\n return this.repository.create(data);\n }\n\n merge(entity: Policy, data: Partial<Policy>): Policy {\n return this.repository.merge(entity, data);\n }\n\n async save(entity: Policy): Promise<Policy> {\n return this.repository.save(entity);\n }\n\n async remove(entity: Policy): Promise<void> {\n await this.repository.remove(entity);\n }\n\n async validateJoinColumns(data: Partial<Policy>): Promise<void> {\n await validateEntityJoinColumns(data, {\n dataSource: this.repository.manager.connection,\n entityTarget: PolicyEntity,\n });\n }\n\n async checkUniqueness(data: Partial<Policy>, existing?: Policy): Promise<void> {\n const isUnique = await isEntityUnique({\n dataSource: this.repository.manager.connection,\n entityTarget: PolicyEntity,\n entity: data,\n entityExisting: existing,\n });\n\n if (!isUnique) {\n throw new DatabaseConflictError();\n }\n }\n\n async saveWithEA(entity: Policy, data?: Record<string, any>): Promise<Policy> {\n await this.repository.saveOneWithEA(entity, data);\n await this.repository.updateClosureTable(entity, this.repository.manager);\n\n return entity;\n }\n\n async deleteFromTree(entity: Policy): Promise<void> {\n const treeRepository = this.repository.manager.connection.getTreeRepository(PolicyEntity);\n await treeRepository.remove(entity);\n }\n}\n"],"mappings":";;;;;;;;;;;;;AA0BA,IAAaS,0BAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAAqC;EAC7C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAAgE;EAC3E,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,QAAA;EAC9CD,GAAGE,QAAQ,WAAA;EAEX,MAAM,EAAEC,eAAehB,WAAWa,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAClD,MAAM,KAAKX,WAAWY,iBAAiBH,QAAAA;EAEvC,OAAO;GACHI,MAAMpB,sBAAsBW,OAAOK,QAAAA;GACnCK,MAAM;IACFJ;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMO,YAAYC,IAAoC;EAClD,MAAMC,SAAS,MAAM,KAAKC,UAAU,EAAEF,GAAG,CAAA;EACzC,IAAIC,QACA,MAAM,KAAKjB,WAAWmB,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMG,cAAcC,MAAcC,UAA2C;EACzE,MAAMjB,KAAK,KAAKL,WAAWM,mBAAmB,QAAA;EAC9CD,GAAGkB,MAAM,uBAAuB,EAAEF,KAAK,CAAA;EAEvC,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKvB,gBAAgBwB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXnB,GAAGqB,SAAS,6BAA6B,EAAEF,QAAQ,CAAA;EACvD;EAEA,MAAMP,SAAS,MAAMZ,GAAGsB,OAAM;EAC9B,IAAIV,QACA,MAAM,KAAKjB,WAAWmB,gBAAgBF,MAAAA;EAE1C,OAAOA;CACX;CAEA,MAAMW,kBAAkBC,UAAkBC,OAAwC;EAC9E,OAAOxC,OAAOuC,QAAAA,IACV,KAAKd,YAAYc,QAAAA,IACjB,KAAKT,cAAcS,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWR,OAA+C;EAC5D,OAAO,KAAKvB,WAAWgC,OAAOnC,yBAAyB0B,KAAAA,CAAAA;CAC3D;CAEA,MAAML,UAAUK,OAAoD;EAChE,OAAO,KAAKvB,WAAWkB,UAAUrB,yBAAyB0B,KAAAA,CAAAA;CAC9D;CAEAU,OAAOpB,MAA+B;EAClC,OAAO,KAAKb,WAAWiC,OAAOpB,IAAAA;CAClC;CAEAqB,MAAMjB,QAAgBJ,MAA+B;EACjD,OAAO,KAAKb,WAAWkC,MAAMjB,QAAQJ,IAAAA;CACzC;CAEA,MAAMsB,KAAKlB,QAAiC;EACxC,OAAO,KAAKjB,WAAWmC,KAAKlB,MAAAA;CAChC;CAEA,MAAMmB,OAAOnB,QAA+B;EACxC,MAAM,KAAKjB,WAAWoC,OAAOnB,MAAAA;CACjC;CAEA,MAAMoB,oBAAoBxB,MAAsC;EAC5D,MAAMtB,0BAA0BsB,MAAM;GAClCyB,YAAY,KAAKtC,WAAWuC,QAAQC;GACpCC,cAAc9C;EAClB,CAAA;CACJ;CAEA,MAAM+C,gBAAgB7B,MAAuB8B,UAAkC;EAQ3E,IAAI,CAACC,MAPkBhD,eAAe;GAClC0C,YAAY,KAAKtC,WAAWuC,QAAQC;GACpCC,cAAc9C;GACdsB,QAAQJ;GACRgC,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAIjD,sBAAAA;CAElB;CAEA,MAAMoD,WAAW7B,QAAgBJ,MAA6C;EAC1E,MAAM,KAAKb,WAAW+C,cAAc9B,QAAQJ,IAAAA;EAC5C,MAAM,KAAKb,WAAWgD,mBAAmB/B,QAAQ,KAAKjB,WAAWuC,OAAO;EAExE,OAAOtB;CACX;CAEA,MAAMgC,eAAehC,QAA+B;EAEhD,MADuB,KAAKjB,WAAWuC,QAAQC,WAAWW,kBAAkBxD,YACtEuD,CAAAA,CAAed,OAAOnB,MAAAA;CAChC;AACJ"}

package/dist/app/modules/database/repositories/query.d.ts CHANGED Viewed

@@ -11,8 +11,28 @@ import type { EntityRepositoryPaginationMeta } from '@authup/server-kit';
  * Joins triggered by the parsed relations replicate the DISTINCT-id
  * pattern: when the builder already groups by the root id, every join
  * contributes its own `GROUP BY <alias>.id`.
+ *
+ * Field visibility conditions (`IField.condition`, attached by a
+ * schema `fields.validateMany` gate) cannot go into the statement — a
+ * TypeORM selection must stay a bare column for entity hydration.
+ * The adapter projects the gated column unconditionally and
+ * force-selects every column its condition reads (rapiq#830's operand
+ * projection — the SQL counterpart of the plan-039 force-select
+ * discipline, so a sparse replace-projection can neither over-redact
+ * nor fail open on missing operands); the fetching adapter MUST then
+ * run the rows through `redactFieldConditions` before returning them.
  */
 export declare function applyQuery(queryBuilder: SelectQueryBuilder<any>, query?: IQuery): {
     pagination: EntityRepositoryPaginationMeta;
 };
+/**
+ * Enforce the field visibility conditions of a decoded query on
+ * already-fetched rows: a gated column is dropped from every row that
+ * fails its condition; no row is ever removed. The SQL execution path
+ * projects gated columns unconditionally, so EVERY `findMany` adapter
+ * must pass its fetched entities through this before returning them —
+ * enforcement is fail-open by construction (a skipped call ships the
+ * value). Condition-less queries pass through untouched.
+ */
+export declare function redactFieldConditions<T>(query: IQuery | undefined, data: T[]): T[];
 //# sourceMappingURL=query.d.ts.map

package/dist/app/modules/database/repositories/query.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/query.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;~~AAG1C~~,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE~~;;;;;;;;;;GAUG~~;AACH,wBAAgB,UAAU,CACtB,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC,EACrC,KAAK,CAAC,EAAE,MAAM,GACd;IAAE,UAAU,EAAE,8BAA8B,CAAA;CAAE,CAejD"}
1	+ {"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/query.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,UAAU,CACtB,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC,EACrC,KAAK,CAAC,EAAE,MAAM,GACd;IAAE,UAAU,EAAE,8BAA8B,CAAA;CAAE,CAejD;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,GAAI,CAAC,EAAE,CAMnF"}

package/dist/app/modules/database/repositories/query.mjs CHANGED Viewed

@@ -1,8 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { Query } from "@rapiq/core";
-import { TypeormAdapter } from "@rapiq/typeorm";
+import { Query, hasFieldConditions } from "@rapiq/core";
+import { applyFieldConditions } from "@rapiq/adapter-memory";
+import { TypeormAdapter } from "@rapiq/adapter-typeorm";
 //#region src/app/modules/database/repositories/query.ts
 /**
 * Apply a decoded rapiq query (IR) to the given TypeORM query builder.
@@ -14,6 +15,16 @@ import { TypeormAdapter } from "@rapiq/typeorm";
 * Joins triggered by the parsed relations replicate the DISTINCT-id
 * pattern: when the builder already groups by the root id, every join
 * contributes its own `GROUP BY <alias>.id`.
+*
+* Field visibility conditions (`IField.condition`, attached by a
+* schema `fields.validateMany` gate) cannot go into the statement — a
+* TypeORM selection must stay a bare column for entity hydration.
+* The adapter projects the gated column unconditionally and
+* force-selects every column its condition reads (rapiq#830's operand
+* projection — the SQL counterpart of the plan-039 force-select
+* discipline, so a sparse replace-projection can neither over-redact
+* nor fail open on missing operands); the fetching adapter MUST then
+* run the rows through `redactFieldConditions` before returning them.
 */ function applyQuery(queryBuilder, query) {
 	const { pagination } = new TypeormAdapter({
 		queryBuilder,
@@ -23,7 +34,19 @@ import { TypeormAdapter } from "@rapiq/typeorm";
 	}).execute(query ?? new Query({}));
 	return { pagination };
 }
+/**
+* Enforce the field visibility conditions of a decoded query on
+* already-fetched rows: a gated column is dropped from every row that
+* fails its condition; no row is ever removed. The SQL execution path
+* projects gated columns unconditionally, so EVERY `findMany` adapter
+* must pass its fetched entities through this before returning them —
+* enforcement is fail-open by construction (a skipped call ships the
+* value). Condition-less queries pass through untouched.
+*/ function redactFieldConditions(query, data) {
+	if (!query || !hasFieldConditions(query.fields)) return data;
+	return applyFieldConditions(query.fields, data);
+}
 //#endregion
-export { applyQuery };
+export { applyQuery, redactFieldConditions };
 //# sourceMappingURL=query.mjs.map

package/dist/app/modules/database/repositories/query.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"query.mjs","names":["Query","TypeormAdapter","applyQuery","queryBuilder","query","adapter","relations","onJoin","_path","alias","qb","expressionMap","groupBys","length","addGroupBy","pagination","execute"],"sources":["../../../../../src/app/modules/database/repositories/query.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { IQuery } from '@rapiq/core';\nimport { Query } from '@rapiq/core';\nimport { TypeormAdapter } from '@rapiq/typeorm';\nimport type { SelectQueryBuilder } from 'typeorm';\nimport type { EntityRepositoryPaginationMeta } from '@authup/server-kit';\n\n/\n Apply a decoded rapiq query (IR) to the given TypeORM query builder.\n * Schema allow-lists, defaults and pagination bounds were already\n * applied at decode time (`decodeQuery` in core/query) — this helper\n * only executes the IR. Returns the applied pagination for the\n * response meta block.\n \n Joins triggered by the parsed relations replicate the DISTINCT-id\n * pattern: when the builder already groups by the root id, every join\n * contributes its own `GROUP BY <alias>.id`.\n */\nexport function applyQuery(\n queryBuilder: SelectQueryBuilder<any>,\n query?: IQuery,\n) : { pagination: EntityRepositoryPaginationMeta } {\n const adapter = new TypeormAdapter({\n queryBuilder,\n relations: {\n onJoin: (_path, alias, qb) => {\n if (qb.expressionMap.groupBys.length > 0) {\n qb.addGroupBy(`${alias}.id`);\n }\n },\n },\n });\n\n const { pagination } = adapter.execute(query ?? new Query({}));\n\n return { pagination };\n}\n"],"mappings":"~~;;;;;;;;;;;;;;;;GAwBA~~,~~SAAgBE~~,WACZC,cACAC,OAAc;CAad,MAAM,EAAEW,eAAeV,IAXHJ,eAAe;EAC/BE;EACAG,WAAW,EACPC,SAASC,OAAOC,OAAOC,OAAAA;GACnB,IAAIA,GAAGC,cAAcC,SAASC,SAAS,GACnCH,GAAGI,WAAW,GAAGL,MAAM,IAAI;EAEnC,EACJ;CACJ,CAEuBJ,CAAAA,CAAQW,QAAQZ,SAAS,~~IAAIJ~~,MAAM,CAAC,CAAA,CAAA;CAE3D,OAAO,~~EAAEe~~,WAAW;AACxB"}
1	+ {"version":3,"file":"query.mjs","names":["Query","hasFieldConditions","applyFieldConditions","TypeormAdapter","applyQuery","queryBuilder","query","adapter","relations","onJoin","_path","alias","qb","expressionMap","groupBys","length","addGroupBy","pagination","execute","redactFieldConditions","data","fields"],"sources":["../../../../../src/app/modules/database/repositories/query.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { IQuery } from '@rapiq/core';\nimport { Query, hasFieldConditions } from '@rapiq/core';\nimport { applyFieldConditions } from '@rapiq/adapter-memory';\nimport { TypeormAdapter } from '@rapiq/adapter-typeorm';\nimport type { SelectQueryBuilder } from 'typeorm';\nimport type { EntityRepositoryPaginationMeta } from '@authup/server-kit';\n\n/\n Apply a decoded rapiq query (IR) to the given TypeORM query builder.\n * Schema allow-lists, defaults and pagination bounds were already\n * applied at decode time (`decodeQuery` in core/query) — this helper\n * only executes the IR. Returns the applied pagination for the\n * response meta block.\n \n Joins triggered by the parsed relations replicate the DISTINCT-id\n * pattern: when the builder already groups by the root id, every join\n * contributes its own `GROUP BY <alias>.id`.\n \n Field visibility conditions (`IField.condition`, attached by a\n * schema `fields.validateMany` gate) cannot go into the statement — a\n * TypeORM selection must stay a bare column for entity hydration.\n * The adapter projects the gated column unconditionally and\n * force-selects every column its condition reads (rapiq#830's operand\n * projection — the SQL counterpart of the plan-039 force-select\n * discipline, so a sparse replace-projection can neither over-redact\n * nor fail open on missing operands); the fetching adapter MUST then\n * run the rows through `redactFieldConditions` before returning them.\n /\nexport function applyQuery(\n queryBuilder: SelectQueryBuilder<any>,\n query?: IQuery,\n) : { pagination: EntityRepositoryPaginationMeta } {\n const adapter = new TypeormAdapter({\n queryBuilder,\n relations: {\n onJoin: (_path, alias, qb) => {\n if (qb.expressionMap.groupBys.length > 0) {\n qb.addGroupBy(`${alias}.id`);\n }\n },\n },\n });\n\n const { pagination } = adapter.execute(query ?? new Query({}));\n\n return { pagination };\n}\n\n/\n Enforce the field visibility conditions of a decoded query on\n * already-fetched rows: a gated column is dropped from every row that\n * fails its condition; no row is ever removed. The SQL execution path\n * projects gated columns unconditionally, so EVERY `findMany` adapter\n * must pass its fetched entities through this before returning them —\n * enforcement is fail-open by construction (a skipped call ships the\n * value). Condition-less queries pass through untouched.\n */\nexport function redactFieldConditions<T>(query: IQuery \| undefined, data: T[]) : T[] {\n if (!query \|\| !hasFieldConditions(query.fields)) {\n return data;\n }\n\n return applyFieldConditions(query.fields, data);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCA,SAAgBI,WACZC,cACAC,OAAc;CAad,MAAM,EAAEW,eAAeV,IAXHJ,eAAe;EAC/BE;EACAG,WAAW,EACPC,SAASC,OAAOC,OAAOC,OAAAA;GACnB,IAAIA,GAAGC,cAAcC,SAASC,SAAS,GACnCH,GAAGI,WAAW,GAAGL,MAAM,IAAI;EAEnC,EACJ;CACJ,CAEuBJ,CAAAA,CAAQW,QAAQZ,SAAS,IAAIN,MAAM,CAAC,CAAA,CAAA;CAE3D,OAAO,EAAEiB,WAAW;AACxB;;;;;;;;;GAWA,SAAgBE,sBAAyBb,OAA2Bc,MAAS;CACzE,IAAI,CAACd,SAAS,CAACL,mBAAmBK,MAAMe,MAAM,GAC1C,OAAOD;CAGX,OAAOlB,qBAAqBI,MAAMe,QAAQD,IAAAA;AAC9C"}

package/dist/app/modules/database/repositories/realm/repository.mjs CHANGED Viewed

@@ -4,7 +4,7 @@ import.meta.url;
 import { RealmEntity } from "../../../../../adapters/database/domains/realm/entity.mjs";
 import { CachePrefix } from "../../../../../adapters/database/domains/constants.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { translateWhereConditions } from "../helpers.mjs";
 import { isUUID } from "@authup/kit";
 import { REALM_MASTER_NAME } from "@authup/core-kit";
@@ -37,7 +37,7 @@ var RealmRepositoryAdapter = class {
 		const { pagination } = applyQuery(qb, query);
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/database/repositories/realm/repository.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"repository.mjs","names":["REALM_MASTER_NAME","InternalError","isUUID","validateEntityJoinColumns","applyQuery","buildRedisKeyPath","CachePrefix","RealmEntity","translateWhereConditions","RealmRepositoryAdapter","repository","findOneById","id","qb","createQueryBuilder","where","cache","prefix","REALM","key","getOne","findOneByName","name","trim","toLowerCase","findMany","query","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneByIdOrName","idOrName","findManyBy","findBy","findOneBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","resolveId","resolve","withFallback"],"sources":["../../../../../../src/app/modules/database/repositories/realm/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { REALM_MASTER_NAME } from '@authup/core-kit';\nimport { InternalError } from '@authup/errors';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { IRealmRepository } from '../../../../../core/index.ts';\nimport { CachePrefix, RealmEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { translateWhereConditions } from '../helpers.ts';\n\nexport class RealmRepositoryAdapter implements IRealmRepository {\n private readonly repository: Repository<Realm>;\n\n constructor(repository: Repository<Realm>) {\n this.repository = repository;\n }\n\n findOneById(id: string): Promise<Realm \| null> {\n const qb = this.repository.createQueryBuilder('realm');\n qb.where('realm.id = :id', { id });\n qb.cache(\n buildRedisKeyPath({\n prefix: CachePrefix.REALM,\n key: id,\n }),\n 60_000,\n );\n\n return qb.getOne();\n }\n\n findOneByName(name: string): Promise<Realm \| null> {\n const qb = this.repository.createQueryBuilder('realm');\n qb.where('realm.name = :name', { name: name.trim().toLowerCase() });\n\n return qb.getOne();\n }\n\n async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Realm>> {\n const qb = this.repository.createQueryBuilder('realm');\n qb.groupBy('realm.id');\n\n const { pagination } = applyQuery(qb, query);\n\n const [entities, total] = await qb.getManyAndCount();\n\n return {\n data: entities,\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n async findOneByIdOrName(idOrName: string): Promise<Realm \| null> {\n return isUUID(idOrName) ?\n this.findOneById(idOrName) :\n this.findOneByName(idOrName);\n }\n\n async findManyBy(where: Record<string, any>): Promise<Realm[]> {\n return this.repository.findBy(translateWhereConditions(where));\n }\n\n async findOneBy(where: Record<string, any>): Promise<Realm \| null> {\n return this.repository.findOneBy(translateWhereConditions(where));\n }\n\n create(data: Partial<Realm>): Realm {\n return this.repository.create(data);\n }\n\n merge(entity: Realm, data: Partial<Realm>): Realm {\n return this.repository.merge(entity, data);\n }\n\n async save(entity: Realm): Promise<Realm> {\n return this.repository.save(entity);\n }\n\n async remove(entity: Realm): Promise<void> {\n await this.repository.remove(entity);\n }\n\n async validateJoinColumns(data: Partial<Realm>): Promise<void> {\n await validateEntityJoinColumns(data, {\n dataSource: this.repository.manager.connection,\n entityTarget: RealmEntity,\n });\n }\n\n async resolveId(key: string): Promise<string \| null> {\n if (isUUID(key)) {\n return key;\n }\n\n const entity = await this.findOneByName(key);\n return entity ? entity.id : null;\n }\n\n async resolve(id: string \| undefined, withFallback: true): Promise<Realm>;\n\n async resolve(id: string \| undefined, withFallback?: boolean): Promise<Realm \| null>;\n\n async resolve(id: string \| undefined, withFallback?: boolean): Promise<Realm \| null> {\n let entity: Realm \| null = null;\n\n if (id) {\n entity = await this.findOneByIdOrName(id);\n }\n\n if (!entity && withFallback) {\n entity = await this.findOneBy({ name: REALM_MASTER_NAME });\n if (!entity) {\n throw new InternalError('The master realm could not be resolved.');\n }\n }\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;AAqBA,~~IAAaS~~,yBAAb,MAAaA;CACQC;CAEjB,YAAYA,YAA+B;EACvC,KAAKA,aAAaA;CACtB;CAEAC,YAAYC,IAAmC;EAC3C,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,OAAA;EAC9CD,GAAGE,MAAM,kBAAkB,EAAEH,GAAG,CAAA;EAChCC,GAAGG,MACCX,kBAAkB;GACdY,QAAQX,YAAYY;GACpBC,KAAKP;EACT,CAAA,GACA,GAAA;EAGJ,OAAOC,GAAGO,OAAM;CACpB;CAEAC,cAAcC,MAAqC;EAC/C,MAAMT,KAAK,KAAKH,WAAWI,mBAAmB,OAAA;EAC9CD,GAAGE,MAAM,sBAAsB,EAAEO,MAAMA,KAAKC,KAAI,CAAA,CAAGC,YAAW,EAAG,CAAA;EAEjE,OAAOX,GAAGO,OAAM;CACpB;CAEA,MAAMK,SAASC,OAA+D;EAC1E,MAAMb,KAAK,KAAKH,WAAWI,mBAAmB,OAAA;EAC9CD,GAAGc,QAAQ,UAAA;EAEX,MAAM,EAAEC,~~eAAexB~~,~~WAAWS~~,IAAIa,KAAAA;EAEtC,MAAM,CAACG,UAAUC,SAAS,MAAMjB,GAAGkB,gBAAe;EAElD,OAAO;GACHC,~~MAAMH~~;~~GACNI~~,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMM,kBAAkBC,UAAyC;EAC7D,~~OAAOjC~~,~~OAAOiC~~,QAAAA,IACV,KAAKxB,YAAYwB,QAAAA,IACjB,KAAKd,cAAcc,QAAAA;CAC3B;CAEA,MAAMC,WAAWrB,OAA8C;EAC3D,OAAO,KAAKL,WAAW2B,OAAO7B,yBAAyBO,KAAAA,CAAAA;CAC3D;CAEA,MAAMuB,UAAUvB,OAAmD;EAC/D,OAAO,KAAKL,WAAW4B,UAAU9B,yBAAyBO,KAAAA,CAAAA;CAC9D;CAEAwB,OAAOP,MAA6B;EAChC,OAAO,KAAKtB,WAAW6B,OAAOP,IAAAA;CAClC;CAEAQ,MAAMC,QAAeT,MAA6B;EAC9C,OAAO,KAAKtB,WAAW8B,MAAMC,QAAQT,IAAAA;CACzC;CAEA,MAAMU,KAAKD,QAA+B;EACtC,OAAO,KAAK/B,WAAWgC,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAA8B;EACvC,MAAM,KAAK/B,WAAWiC,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBZ,MAAqC;EAC3D,~~MAAM7B~~,~~0BAA0B6B~~,MAAM;GAClCa,YAAY,KAAKnC,WAAWoC,QAAQC;GACpCC,cAAczC;EAClB,CAAA;CACJ;CAEA,MAAM0C,UAAU9B,KAAqC;EACjD,~~IAAIjB~~,~~OAAOiB~~,GAAAA,GACP,OAAOA;EAGX,MAAMsB,SAAS,MAAM,KAAKpB,cAAcF,GAAAA;EACxC,OAAOsB,SAASA,OAAO7B,KAAK;CAChC;CAMA,MAAMsC,QAAQtC,IAAwBuC,cAA+C;EACjF,IAAIV,SAAuB;EAE3B,IAAI7B,IACA6B,SAAS,MAAM,KAAKP,kBAAkBtB,EAAAA;EAG1C,IAAI,CAAC6B,UAAUU,cAAc;GACzBV,SAAS,MAAM,KAAKH,UAAU,EAAEhB,~~MAAMtB~~,kBAAkB,CAAA;GACxD,IAAI,~~CAACyC~~,QACD,MAAM,~~IAAIxC~~,cAAc,yCAAA;EAEhC;EAEA,~~OAAOwC~~;CACX;AACJ"}
1	+ {"version":3,"file":"repository.mjs","names":["REALM_MASTER_NAME","InternalError","isUUID","validateEntityJoinColumns","applyQuery","redactFieldConditions","buildRedisKeyPath","CachePrefix","RealmEntity","translateWhereConditions","RealmRepositoryAdapter","repository","findOneById","id","qb","createQueryBuilder","where","cache","prefix","REALM","key","getOne","findOneByName","name","trim","toLowerCase","findMany","query","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneByIdOrName","idOrName","findManyBy","findBy","findOneBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","resolveId","resolve","withFallback"],"sources":["../../../../../../src/app/modules/database/repositories/realm/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { REALM_MASTER_NAME } from '@authup/core-kit';\nimport { InternalError } from '@authup/errors';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { IRealmRepository } from '../../../../../core/index.ts';\nimport { CachePrefix, RealmEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { translateWhereConditions } from '../helpers.ts';\n\nexport class RealmRepositoryAdapter implements IRealmRepository {\n private readonly repository: Repository<Realm>;\n\n constructor(repository: Repository<Realm>) {\n this.repository = repository;\n }\n\n findOneById(id: string): Promise<Realm \| null> {\n const qb = this.repository.createQueryBuilder('realm');\n qb.where('realm.id = :id', { id });\n qb.cache(\n buildRedisKeyPath({\n prefix: CachePrefix.REALM,\n key: id,\n }),\n 60_000,\n );\n\n return qb.getOne();\n }\n\n findOneByName(name: string): Promise<Realm \| null> {\n const qb = this.repository.createQueryBuilder('realm');\n qb.where('realm.name = :name', { name: name.trim().toLowerCase() });\n\n return qb.getOne();\n }\n\n async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Realm>> {\n const qb = this.repository.createQueryBuilder('realm');\n qb.groupBy('realm.id');\n\n const { pagination } = applyQuery(qb, query);\n\n const [entities, total] = await qb.getManyAndCount();\n\n return {\n data: redactFieldConditions(query, entities),\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n async findOneByIdOrName(idOrName: string): Promise<Realm \| null> {\n return isUUID(idOrName) ?\n this.findOneById(idOrName) :\n this.findOneByName(idOrName);\n }\n\n async findManyBy(where: Record<string, any>): Promise<Realm[]> {\n return this.repository.findBy(translateWhereConditions(where));\n }\n\n async findOneBy(where: Record<string, any>): Promise<Realm \| null> {\n return this.repository.findOneBy(translateWhereConditions(where));\n }\n\n create(data: Partial<Realm>): Realm {\n return this.repository.create(data);\n }\n\n merge(entity: Realm, data: Partial<Realm>): Realm {\n return this.repository.merge(entity, data);\n }\n\n async save(entity: Realm): Promise<Realm> {\n return this.repository.save(entity);\n }\n\n async remove(entity: Realm): Promise<void> {\n await this.repository.remove(entity);\n }\n\n async validateJoinColumns(data: Partial<Realm>): Promise<void> {\n await validateEntityJoinColumns(data, {\n dataSource: this.repository.manager.connection,\n entityTarget: RealmEntity,\n });\n }\n\n async resolveId(key: string): Promise<string \| null> {\n if (isUUID(key)) {\n return key;\n }\n\n const entity = await this.findOneByName(key);\n return entity ? entity.id : null;\n }\n\n async resolve(id: string \| undefined, withFallback: true): Promise<Realm>;\n\n async resolve(id: string \| undefined, withFallback?: boolean): Promise<Realm \| null>;\n\n async resolve(id: string \| undefined, withFallback?: boolean): Promise<Realm \| null> {\n let entity: Realm \| null = null;\n\n if (id) {\n entity = await this.findOneByIdOrName(id);\n }\n\n if (!entity && withFallback) {\n entity = await this.findOneBy({ name: REALM_MASTER_NAME });\n if (!entity) {\n throw new InternalError('The master realm could not be resolved.');\n }\n }\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;AAqBA,IAAaU,yBAAb,MAAaA;CACQC;CAEjB,YAAYA,YAA+B;EACvC,KAAKA,aAAaA;CACtB;CAEAC,YAAYC,IAAmC;EAC3C,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,OAAA;EAC9CD,GAAGE,MAAM,kBAAkB,EAAEH,GAAG,CAAA;EAChCC,GAAGG,MACCX,kBAAkB;GACdY,QAAQX,YAAYY;GACpBC,KAAKP;EACT,CAAA,GACA,GAAA;EAGJ,OAAOC,GAAGO,OAAM;CACpB;CAEAC,cAAcC,MAAqC;EAC/C,MAAMT,KAAK,KAAKH,WAAWI,mBAAmB,OAAA;EAC9CD,GAAGE,MAAM,sBAAsB,EAAEO,MAAMA,KAAKC,KAAI,CAAA,CAAGC,YAAW,EAAG,CAAA;EAEjE,OAAOX,GAAGO,OAAM;CACpB;CAEA,MAAMK,SAASC,OAA+D;EAC1E,MAAMb,KAAK,KAAKH,WAAWI,mBAAmB,OAAA;EAC9CD,GAAGc,QAAQ,UAAA;EAEX,MAAM,EAAEC,eAAezB,WAAWU,IAAIa,KAAAA;EAEtC,MAAM,CAACG,UAAUC,SAAS,MAAMjB,GAAGkB,gBAAe;EAElD,OAAO;GACHC,MAAM5B,sBAAsBsB,OAAOG,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMM,kBAAkBC,UAAyC;EAC7D,OAAOlC,OAAOkC,QAAAA,IACV,KAAKxB,YAAYwB,QAAAA,IACjB,KAAKd,cAAcc,QAAAA;CAC3B;CAEA,MAAMC,WAAWrB,OAA8C;EAC3D,OAAO,KAAKL,WAAW2B,OAAO7B,yBAAyBO,KAAAA,CAAAA;CAC3D;CAEA,MAAMuB,UAAUvB,OAAmD;EAC/D,OAAO,KAAKL,WAAW4B,UAAU9B,yBAAyBO,KAAAA,CAAAA;CAC9D;CAEAwB,OAAOP,MAA6B;EAChC,OAAO,KAAKtB,WAAW6B,OAAOP,IAAAA;CAClC;CAEAQ,MAAMC,QAAeT,MAA6B;EAC9C,OAAO,KAAKtB,WAAW8B,MAAMC,QAAQT,IAAAA;CACzC;CAEA,MAAMU,KAAKD,QAA+B;EACtC,OAAO,KAAK/B,WAAWgC,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAA8B;EACvC,MAAM,KAAK/B,WAAWiC,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBZ,MAAqC;EAC3D,MAAM9B,0BAA0B8B,MAAM;GAClCa,YAAY,KAAKnC,WAAWoC,QAAQC;GACpCC,cAAczC;EAClB,CAAA;CACJ;CAEA,MAAM0C,UAAU9B,KAAqC;EACjD,IAAIlB,OAAOkB,GAAAA,GACP,OAAOA;EAGX,MAAMsB,SAAS,MAAM,KAAKpB,cAAcF,GAAAA;EACxC,OAAOsB,SAASA,OAAO7B,KAAK;CAChC;CAMA,MAAMsC,QAAQtC,IAAwBuC,cAA+C;EACjF,IAAIV,SAAuB;EAE3B,IAAI7B,IACA6B,SAAS,MAAM,KAAKP,kBAAkBtB,EAAAA;EAG1C,IAAI,CAAC6B,UAAUU,cAAc;GACzBV,SAAS,MAAM,KAAKH,UAAU,EAAEhB,MAAMvB,kBAAkB,CAAA;GACxD,IAAI,CAAC0C,QACD,MAAM,IAAIzC,cAAc,yCAAA;EAEhC;EAEA,OAAOyC;CACX;AACJ"}

package/dist/app/modules/database/repositories/role/repository.mjs CHANGED Viewed

@@ -5,7 +5,7 @@ import { CachePrefix } from "../../../../../adapters/database/domains/constants.
 import { RoleEntity } from "../../../../../adapters/database/domains/role/entity.mjs";
 import { RolePermissionEntity } from "../../../../../adapters/database/domains/role-permission/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { isEntityUnique, translateWhereConditions } from "../helpers.mjs";
 import { DatabaseConflictError } from "../../../../../adapters/database/errors/conflict.mjs";
 import "../../../../../adapters/database/index.mjs";
@@ -27,7 +27,7 @@ var RoleRepositoryAdapter = class {
 		const { pagination } = applyQuery(qb, query);
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/database/repositories/role/repository.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"repository.mjs","names":["isUUID","validateEntityJoinColumns","applyQuery","DatabaseConflictError","isEntityUnique","translateWhereConditions","loadBoundPermissions","CachePrefix","RoleEntity","RolePermissionEntity","RealmRepositoryAdapter","RoleRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOneByIdOrName","idOrName","realm","findManyBy","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting","getBoundPermissions","junctionTarget","roleId","cachePrefix","ROLE_OWNED_PERMISSIONS","cacheKey","getBoundPermissionsForMany","results","Promise","all","map","flat"],"sources":["../../../../../../src/app/modules/database/repositories/role/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm, Role } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { PermissionPolicyBinding } from '@authup/access';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository, IRoleRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport { isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { loadBoundPermissions } from '../bindings.ts';\nimport {\n CachePrefix,\n RoleEntity,\n RolePermissionEntity,\n} from '../../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type RoleRepositoryAdapterContext = {\n repository: Repository<Role>,\n realmRepository: Repository<Realm>,\n};\n\nexport class RoleRepositoryAdapter implements IRoleRepository {\n private readonly repository: Repository<Role>;\n\n private readonly realmRepository: IRealmRepository;\n\n constructor(ctx: RoleRepositoryAdapterContext) {\n this.repository = ctx.repository;\n this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n }\n\n async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Role>> {\n const qb = this.repository.createQueryBuilder('role');\n qb.groupBy('role.id');\n\n const { pagination } = applyQuery(qb, query);\n\n const [entities, total] = await qb.getManyAndCount();\n\n return {\n data: entities,\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n findOneById(id: string): Promise<Role \| null> {\n return this.findOneBy({ id });\n }\n\n async findOneByName(name: string, realmKey?: string): Promise<Role \| null> {\n const qb = this.repository.createQueryBuilder('role');\n qb.where('role.name = :name', { name });\n\n if (realmKey) {\n const realmId = await this.realmRepository.resolveId(realmKey);\n if (!realmId) {\n return null;\n }\n qb.andWhere('role.realmId = :realmId', { realmId });\n }\n\n return qb.getOne();\n }\n\n async findOneByIdOrName(idOrName: string, realm?: string): Promise<Role \| null> {\n return isUUID(idOrName) ?\n this.findOneById(idOrName) :\n this.findOneByName(idOrName, realm);\n }\n\n async findManyBy(where: Record<string, any>): Promise<Role[]> {\n return this.repository.findBy(translateWhereConditions(where));\n }\n\n async findOneBy(where: Record<string, any>): Promise<Role \| null> {\n return this.repository.findOneBy(translateWhereConditions(where));\n }\n\n create(data: Partial<Role>): Role {\n return this.repository.create(data);\n }\n\n merge(entity: Role, data: Partial<Role>): Role {\n return this.repository.merge(entity, data);\n }\n\n async save(entity: Role): Promise<Role> {\n return this.repository.save(entity);\n }\n\n async remove(entity: Role): Promise<void> {\n await this.repository.remove(entity);\n }\n\n async validateJoinColumns(data: Partial<Role>): Promise<void> {\n await validateEntityJoinColumns(data, {\n dataSource: this.repository.manager.connection,\n entityTarget: RoleEntity,\n });\n }\n\n async checkUniqueness(data: Partial<Role>, existing?: Role): Promise<void> {\n const isUnique = await isEntityUnique({\n dataSource: this.repository.manager.connection,\n entityTarget: RoleEntity,\n entity: data,\n entityExisting: existing,\n });\n\n if (!isUnique) {\n throw new DatabaseConflictError();\n }\n }\n\n async getBoundPermissions(entity: string \| Role): Promise<PermissionPolicyBinding[]> {\n const id = typeof entity === 'string' ? entity : entity.id;\n return loadBoundPermissions({\n manager: this.repository.manager,\n junctionTarget: RolePermissionEntity,\n where: { roleId: id },\n cachePrefix: CachePrefix.ROLE_OWNED_PERMISSIONS,\n cacheKey: id,\n });\n }\n\n async getBoundPermissionsForMany(entities: (string \| Role)[]): Promise<PermissionPolicyBinding[]> {\n const results = await Promise.all(entities.map((entity) => this.getBoundPermissions(entity)));\n return results.flat();\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA+BA,~~IAAaW~~,wBAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAAmC;EAC3C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAA8D;EACzE,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,MAAA;EAC9CD,GAAGE,QAAQ,SAAA;EAEX,MAAM,EAAEC,~~eAAelB~~,~~WAAWe~~,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,~~MAAMH~~;~~GACNI~~,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAAkC;EAC1C,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,cAAcC,MAAcC,UAAyC;EACvE,MAAMd,KAAK,KAAKL,WAAWM,mBAAmB,MAAA;EAC9CD,GAAGe,MAAM,qBAAqB,EAAEF,KAAK,CAAA;EAErC,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKpB,gBAAgBqB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXhB,GAAGkB,SAAS,2BAA2B,EAAEF,QAAQ,CAAA;EACrD;EAEA,OAAOhB,GAAGmB,OAAM;CACpB;CAEA,MAAMC,kBAAkBC,UAAkBC,OAAsC;EAC5E,~~OAAOvC~~,~~OAAOsC~~,QAAAA,IACV,KAAKZ,YAAYY,QAAAA,IACjB,KAAKT,cAAcS,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWR,OAA6C;EAC1D,OAAO,KAAKpB,WAAW6B,OAAOpC,yBAAyB2B,KAAAA,CAAAA;CAC3D;CAEA,MAAMJ,UAAUI,OAAkD;EAC9D,OAAO,KAAKpB,WAAWgB,UAAUvB,yBAAyB2B,KAAAA,CAAAA;CAC9D;CAEAU,OAAOlB,MAA2B;EAC9B,OAAO,KAAKZ,WAAW8B,OAAOlB,IAAAA;CAClC;CAEAmB,MAAMC,QAAcpB,MAA2B;EAC3C,OAAO,KAAKZ,WAAW+B,MAAMC,QAAQpB,IAAAA;CACzC;CAEA,MAAMqB,KAAKD,QAA6B;EACpC,OAAO,KAAKhC,WAAWiC,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAA6B;EACtC,MAAM,KAAKhC,WAAWkC,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBvB,MAAoC;EAC1D,~~MAAMvB~~,~~0BAA0BuB~~,MAAM;GAClCwB,YAAY,KAAKpC,WAAWqC,QAAQC;GACpCC,cAAc3C;EAClB,CAAA;CACJ;CAEA,MAAM4C,gBAAgB5B,MAAqB6B,UAAgC;EAQvE,IAAI,CAACC,MAPkBlD,eAAe;GAClC4C,YAAY,KAAKpC,WAAWqC,QAAQC;GACpCC,cAAc3C;GACdoC,QAAQpB;GACR+B,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAIlD,sBAAAA;CAElB;CAEA,MAAMqD,oBAAoBZ,QAA2D;EACjF,MAAMjB,KAAK,OAAOiB,WAAW,WAAWA,SAASA,OAAOjB;EACxD,OAAOrB,qBAAqB;GACxB2C,SAAS,KAAKrC,WAAWqC;GACzBQ,gBAAgBhD;GAChBuB,OAAO,EAAE0B,QAAQ/B,GAAG;GACpBgC,aAAapD,YAAYqD;GACzBC,UAAUlC;EACd,CAAA;CACJ;CAEA,MAAMmC,2BAA2BzC,UAAiE;EAE9F,QAAO0C,MADeC,QAAQC,IAAI5C,SAAS6C,KAAKtB,WAAW,KAAKY,oBAAoBZ,MAAAA,CAAAA,CAAAA,EAAAA,CACrEuB,KAAI;CACvB;AACJ"}
1	+ {"version":3,"file":"repository.mjs","names":["isUUID","validateEntityJoinColumns","applyQuery","redactFieldConditions","DatabaseConflictError","isEntityUnique","translateWhereConditions","loadBoundPermissions","CachePrefix","RoleEntity","RolePermissionEntity","RealmRepositoryAdapter","RoleRepositoryAdapter","repository","realmRepository","ctx","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","name","realmKey","where","realmId","resolveId","andWhere","getOne","findOneByIdOrName","idOrName","realm","findManyBy","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget","checkUniqueness","existing","isUnique","entityExisting","getBoundPermissions","junctionTarget","roleId","cachePrefix","ROLE_OWNED_PERMISSIONS","cacheKey","getBoundPermissionsForMany","results","Promise","all","map","flat"],"sources":["../../../../../../src/app/modules/database/repositories/role/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm, Role } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { PermissionPolicyBinding } from '@authup/access';\nimport { isUUID } from '@authup/kit';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository, IRoleRepository } from '../../../../../core/index.ts';\nimport { DatabaseConflictError } from '../../../../../adapters/database/index.ts';\nimport { isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { loadBoundPermissions } from '../bindings.ts';\nimport {\n CachePrefix,\n RoleEntity,\n RolePermissionEntity,\n} from '../../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type RoleRepositoryAdapterContext = {\n repository: Repository<Role>,\n realmRepository: Repository<Realm>,\n};\n\nexport class RoleRepositoryAdapter implements IRoleRepository {\n private readonly repository: Repository<Role>;\n\n private readonly realmRepository: IRealmRepository;\n\n constructor(ctx: RoleRepositoryAdapterContext) {\n this.repository = ctx.repository;\n this.realmRepository = new RealmRepositoryAdapter(ctx.realmRepository);\n }\n\n async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Role>> {\n const qb = this.repository.createQueryBuilder('role');\n qb.groupBy('role.id');\n\n const { pagination } = applyQuery(qb, query);\n\n const [entities, total] = await qb.getManyAndCount();\n\n return {\n data: redactFieldConditions(query, entities),\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n findOneById(id: string): Promise<Role \| null> {\n return this.findOneBy({ id });\n }\n\n async findOneByName(name: string, realmKey?: string): Promise<Role \| null> {\n const qb = this.repository.createQueryBuilder('role');\n qb.where('role.name = :name', { name });\n\n if (realmKey) {\n const realmId = await this.realmRepository.resolveId(realmKey);\n if (!realmId) {\n return null;\n }\n qb.andWhere('role.realmId = :realmId', { realmId });\n }\n\n return qb.getOne();\n }\n\n async findOneByIdOrName(idOrName: string, realm?: string): Promise<Role \| null> {\n return isUUID(idOrName) ?\n this.findOneById(idOrName) :\n this.findOneByName(idOrName, realm);\n }\n\n async findManyBy(where: Record<string, any>): Promise<Role[]> {\n return this.repository.findBy(translateWhereConditions(where));\n }\n\n async findOneBy(where: Record<string, any>): Promise<Role \| null> {\n return this.repository.findOneBy(translateWhereConditions(where));\n }\n\n create(data: Partial<Role>): Role {\n return this.repository.create(data);\n }\n\n merge(entity: Role, data: Partial<Role>): Role {\n return this.repository.merge(entity, data);\n }\n\n async save(entity: Role): Promise<Role> {\n return this.repository.save(entity);\n }\n\n async remove(entity: Role): Promise<void> {\n await this.repository.remove(entity);\n }\n\n async validateJoinColumns(data: Partial<Role>): Promise<void> {\n await validateEntityJoinColumns(data, {\n dataSource: this.repository.manager.connection,\n entityTarget: RoleEntity,\n });\n }\n\n async checkUniqueness(data: Partial<Role>, existing?: Role): Promise<void> {\n const isUnique = await isEntityUnique({\n dataSource: this.repository.manager.connection,\n entityTarget: RoleEntity,\n entity: data,\n entityExisting: existing,\n });\n\n if (!isUnique) {\n throw new DatabaseConflictError();\n }\n }\n\n async getBoundPermissions(entity: string \| Role): Promise<PermissionPolicyBinding[]> {\n const id = typeof entity === 'string' ? entity : entity.id;\n return loadBoundPermissions({\n manager: this.repository.manager,\n junctionTarget: RolePermissionEntity,\n where: { roleId: id },\n cachePrefix: CachePrefix.ROLE_OWNED_PERMISSIONS,\n cacheKey: id,\n });\n }\n\n async getBoundPermissionsForMany(entities: (string \| Role)[]): Promise<PermissionPolicyBinding[]> {\n const results = await Promise.all(entities.map((entity) => this.getBoundPermissions(entity)));\n return results.flat();\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA+BA,IAAaY,wBAAb,MAAaA;CACQC;CAEAC;CAEjB,YAAYC,KAAmC;EAC3C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,kBAAkB,IAAIH,uBAAuBI,IAAID,eAAe;CACzE;CAEA,MAAME,SAASC,OAA8D;EACzE,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,MAAA;EAC9CD,GAAGE,QAAQ,SAAA;EAEX,MAAM,EAAEC,eAAenB,WAAWgB,IAAID,KAAAA;EAEtC,MAAM,CAACK,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMtB,sBAAsBc,OAAOK,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAAkC;EAC1C,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,cAAcC,MAAcC,UAAyC;EACvE,MAAMd,KAAK,KAAKL,WAAWM,mBAAmB,MAAA;EAC9CD,GAAGe,MAAM,qBAAqB,EAAEF,KAAK,CAAA;EAErC,IAAIC,UAAU;GACV,MAAME,UAAU,MAAM,KAAKpB,gBAAgBqB,UAAUH,QAAAA;GACrD,IAAI,CAACE,SACD,OAAO;GAEXhB,GAAGkB,SAAS,2BAA2B,EAAEF,QAAQ,CAAA;EACrD;EAEA,OAAOhB,GAAGmB,OAAM;CACpB;CAEA,MAAMC,kBAAkBC,UAAkBC,OAAsC;EAC5E,OAAOxC,OAAOuC,QAAAA,IACV,KAAKZ,YAAYY,QAAAA,IACjB,KAAKT,cAAcS,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWR,OAA6C;EAC1D,OAAO,KAAKpB,WAAW6B,OAAOpC,yBAAyB2B,KAAAA,CAAAA;CAC3D;CAEA,MAAMJ,UAAUI,OAAkD;EAC9D,OAAO,KAAKpB,WAAWgB,UAAUvB,yBAAyB2B,KAAAA,CAAAA;CAC9D;CAEAU,OAAOlB,MAA2B;EAC9B,OAAO,KAAKZ,WAAW8B,OAAOlB,IAAAA;CAClC;CAEAmB,MAAMC,QAAcpB,MAA2B;EAC3C,OAAO,KAAKZ,WAAW+B,MAAMC,QAAQpB,IAAAA;CACzC;CAEA,MAAMqB,KAAKD,QAA6B;EACpC,OAAO,KAAKhC,WAAWiC,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAA6B;EACtC,MAAM,KAAKhC,WAAWkC,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBvB,MAAoC;EAC1D,MAAMxB,0BAA0BwB,MAAM;GAClCwB,YAAY,KAAKpC,WAAWqC,QAAQC;GACpCC,cAAc3C;EAClB,CAAA;CACJ;CAEA,MAAM4C,gBAAgB5B,MAAqB6B,UAAgC;EAQvE,IAAI,CAACC,MAPkBlD,eAAe;GAClC4C,YAAY,KAAKpC,WAAWqC,QAAQC;GACpCC,cAAc3C;GACdoC,QAAQpB;GACR+B,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAIlD,sBAAAA;CAElB;CAEA,MAAMqD,oBAAoBZ,QAA2D;EACjF,MAAMjB,KAAK,OAAOiB,WAAW,WAAWA,SAASA,OAAOjB;EACxD,OAAOrB,qBAAqB;GACxB2C,SAAS,KAAKrC,WAAWqC;GACzBQ,gBAAgBhD;GAChBuB,OAAO,EAAE0B,QAAQ/B,GAAG;GACpBgC,aAAapD,YAAYqD;GACzBC,UAAUlC;EACd,CAAA;CACJ;CAEA,MAAMmC,2BAA2BzC,UAAiE;EAE9F,QAAO0C,MADeC,QAAQC,IAAI5C,SAAS6C,KAAKtB,WAAW,KAAKY,oBAAoBZ,MAAAA,CAAAA,CAAAA,EAAAA,CACrEuB,KAAI;CACvB;AACJ"}

package/dist/app/modules/database/repositories/role-attribute/repository.mjs CHANGED Viewed

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { RoleAttributeEntity } from "../../../../../adapters/database/domains/role-attribute/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { applyRealmScopeSelect, translateWhereConditions } from "../helpers.mjs";
 import { validateEntityJoinColumns } from "typeorm-extension";
 //#region src/app/modules/database/repositories/role-attribute/repository.ts
@@ -19,7 +19,7 @@ var RoleAttributeRepositoryAdapter = class {
 		applyRealmScopeSelect(qb, "roleAttribute");
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/database/repositories/role-attribute/repository.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"repository.mjs","names":["validateEntityJoinColumns","applyQuery","RoleAttributeEntity","applyRealmScopeSelect","translateWhereConditions","RoleAttributeRepositoryAdapter","repository","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","findOneByIdOrName","idOrName","findManyBy","where","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget"],"sources":["../../../../../../src/app/modules/database/repositories/role-attribute/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RoleAttribute } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRoleAttributeRepository } from '../../../../../core/index.ts';\nimport { RoleAttributeEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { applyRealmScopeSelect, translateWhereConditions } from '../helpers.ts';\n\nexport class RoleAttributeRepositoryAdapter implements IRoleAttributeRepository {\n private readonly repository: Repository<RoleAttribute>;\n\n constructor(repository: Repository<RoleAttribute>) {\n this.repository = repository;\n }\n\n async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<RoleAttribute>> {\n const qb = this.repository.createQueryBuilder('roleAttribute');\n qb.groupBy('roleAttribute.id');\n\n const { pagination } = applyQuery(qb, query);\n\n applyRealmScopeSelect(qb, 'roleAttribute');\n\n const [entities, total] = await qb.getManyAndCount();\n\n return {\n data: entities,\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n findOneById(id: string): Promise<RoleAttribute \| null> {\n return this.findOneBy({ id });\n }\n\n async findOneByName(): Promise<RoleAttribute \| null> {\n return null;\n }\n\n async findOneByIdOrName(idOrName: string): Promise<RoleAttribute \| null> {\n return this.findOneById(idOrName);\n }\n\n async findManyBy(where: Record<string, any>): Promise<RoleAttribute[]> {\n return this.repository.findBy(translateWhereConditions(where));\n }\n\n async findOneBy(where: Record<string, any>): Promise<RoleAttribute \| null> {\n return this.repository.findOneBy(translateWhereConditions(where));\n }\n\n create(data: Partial<RoleAttribute>): RoleAttribute {\n return this.repository.create(data);\n }\n\n merge(entity: RoleAttribute, data: Partial<RoleAttribute>): RoleAttribute {\n return this.repository.merge(entity, data);\n }\n\n async save(entity: RoleAttribute): Promise<RoleAttribute> {\n return this.repository.save(entity);\n }\n\n async remove(entity: RoleAttribute): Promise<void> {\n await this.repository.remove(entity);\n }\n\n async validateJoinColumns(data: Partial<RoleAttribute>): Promise<void> {\n await validateEntityJoinColumns(data, {\n dataSource: this.repository.manager.connection,\n entityTarget: RoleAttributeEntity,\n });\n }\n}\n"],"mappings":";;;;;;;;;AAiBA,~~IAAaK~~,iCAAb,MAAaA;CACQC;CAEjB,YAAYA,YAAuC;EAC/C,KAAKA,aAAaA;CACtB;CAEA,MAAMC,SAASC,OAAuE;EAClF,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,eAAA;EAC9CD,GAAGE,QAAQ,kBAAA;EAEX,MAAM,EAAEC,~~eAAeX~~,~~WAAWQ~~,IAAID,KAAAA;EAEtCL,sBAAsBM,IAAI,eAAA;EAE1B,MAAM,CAACI,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,~~MAAMH~~;~~GACNI~~,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAA2C;EACnD,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,gBAA+C;EACjD,OAAO;CACX;CAEA,MAAMC,kBAAkBC,UAAiD;EACrE,OAAO,KAAKL,YAAYK,QAAAA;CAC5B;CAEA,MAAMC,WAAWC,OAAsD;EACnE,OAAO,KAAKnB,WAAWoB,OAAOtB,yBAAyBqB,KAAAA,CAAAA;CAC3D;CAEA,MAAML,UAAUK,OAA2D;EACvE,OAAO,KAAKnB,WAAWc,UAAUhB,yBAAyBqB,KAAAA,CAAAA;CAC9D;CAEAE,OAAOX,MAA6C;EAChD,OAAO,KAAKV,WAAWqB,OAAOX,IAAAA;CAClC;CAEAY,MAAMC,QAAuBb,MAA6C;EACtE,OAAO,KAAKV,WAAWsB,MAAMC,QAAQb,IAAAA;CACzC;CAEA,MAAMc,KAAKD,QAA+C;EACtD,OAAO,KAAKvB,WAAWwB,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAAsC;EAC/C,MAAM,KAAKvB,WAAWyB,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBhB,MAA6C;EACnE,~~MAAMhB~~,~~0BAA0BgB~~,MAAM;GAClCiB,YAAY,KAAK3B,WAAW4B,QAAQC;GACpCC,cAAclC;EAClB,CAAA;CACJ;AACJ"}
1	+ {"version":3,"file":"repository.mjs","names":["validateEntityJoinColumns","applyQuery","redactFieldConditions","RoleAttributeEntity","applyRealmScopeSelect","translateWhereConditions","RoleAttributeRepositoryAdapter","repository","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findOneByName","findOneByIdOrName","idOrName","findManyBy","where","findBy","create","merge","entity","save","remove","validateJoinColumns","dataSource","manager","connection","entityTarget"],"sources":["../../../../../../src/app/modules/database/repositories/role-attribute/repository.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RoleAttribute } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { Repository } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRoleAttributeRepository } from '../../../../../core/index.ts';\nimport { RoleAttributeEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { applyRealmScopeSelect, translateWhereConditions } from '../helpers.ts';\n\nexport class RoleAttributeRepositoryAdapter implements IRoleAttributeRepository {\n private readonly repository: Repository<RoleAttribute>;\n\n constructor(repository: Repository<RoleAttribute>) {\n this.repository = repository;\n }\n\n async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<RoleAttribute>> {\n const qb = this.repository.createQueryBuilder('roleAttribute');\n qb.groupBy('roleAttribute.id');\n\n const { pagination } = applyQuery(qb, query);\n\n applyRealmScopeSelect(qb, 'roleAttribute');\n\n const [entities, total] = await qb.getManyAndCount();\n\n return {\n data: redactFieldConditions(query, entities),\n meta: {\n total,\n ...pagination,\n },\n };\n }\n\n findOneById(id: string): Promise<RoleAttribute \| null> {\n return this.findOneBy({ id });\n }\n\n async findOneByName(): Promise<RoleAttribute \| null> {\n return null;\n }\n\n async findOneByIdOrName(idOrName: string): Promise<RoleAttribute \| null> {\n return this.findOneById(idOrName);\n }\n\n async findManyBy(where: Record<string, any>): Promise<RoleAttribute[]> {\n return this.repository.findBy(translateWhereConditions(where));\n }\n\n async findOneBy(where: Record<string, any>): Promise<RoleAttribute \| null> {\n return this.repository.findOneBy(translateWhereConditions(where));\n }\n\n create(data: Partial<RoleAttribute>): RoleAttribute {\n return this.repository.create(data);\n }\n\n merge(entity: RoleAttribute, data: Partial<RoleAttribute>): RoleAttribute {\n return this.repository.merge(entity, data);\n }\n\n async save(entity: RoleAttribute): Promise<RoleAttribute> {\n return this.repository.save(entity);\n }\n\n async remove(entity: RoleAttribute): Promise<void> {\n await this.repository.remove(entity);\n }\n\n async validateJoinColumns(data: Partial<RoleAttribute>): Promise<void> {\n await validateEntityJoinColumns(data, {\n dataSource: this.repository.manager.connection,\n entityTarget: RoleAttributeEntity,\n });\n }\n}\n"],"mappings":";;;;;;;;;AAiBA,IAAaM,iCAAb,MAAaA;CACQC;CAEjB,YAAYA,YAAuC;EAC/C,KAAKA,aAAaA;CACtB;CAEA,MAAMC,SAASC,OAAuE;EAClF,MAAMC,KAAK,KAAKH,WAAWI,mBAAmB,eAAA;EAC9CD,GAAGE,QAAQ,kBAAA;EAEX,MAAM,EAAEC,eAAeZ,WAAWS,IAAID,KAAAA;EAEtCL,sBAAsBM,IAAI,eAAA;EAE1B,MAAM,CAACI,UAAUC,SAAS,MAAML,GAAGM,gBAAe;EAElD,OAAO;GACHC,MAAMf,sBAAsBO,OAAOK,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEAM,YAAYC,IAA2C;EACnD,OAAO,KAAKC,UAAU,EAAED,GAAG,CAAA;CAC/B;CAEA,MAAME,gBAA+C;EACjD,OAAO;CACX;CAEA,MAAMC,kBAAkBC,UAAiD;EACrE,OAAO,KAAKL,YAAYK,QAAAA;CAC5B;CAEA,MAAMC,WAAWC,OAAsD;EACnE,OAAO,KAAKnB,WAAWoB,OAAOtB,yBAAyBqB,KAAAA,CAAAA;CAC3D;CAEA,MAAML,UAAUK,OAA2D;EACvE,OAAO,KAAKnB,WAAWc,UAAUhB,yBAAyBqB,KAAAA,CAAAA;CAC9D;CAEAE,OAAOX,MAA6C;EAChD,OAAO,KAAKV,WAAWqB,OAAOX,IAAAA;CAClC;CAEAY,MAAMC,QAAuBb,MAA6C;EACtE,OAAO,KAAKV,WAAWsB,MAAMC,QAAQb,IAAAA;CACzC;CAEA,MAAMc,KAAKD,QAA+C;EACtD,OAAO,KAAKvB,WAAWwB,KAAKD,MAAAA;CAChC;CAEA,MAAME,OAAOF,QAAsC;EAC/C,MAAM,KAAKvB,WAAWyB,OAAOF,MAAAA;CACjC;CAEA,MAAMG,oBAAoBhB,MAA6C;EACnE,MAAMjB,0BAA0BiB,MAAM;GAClCiB,YAAY,KAAK3B,WAAW4B,QAAQC;GACpCC,cAAclC;EAClB,CAAA;CACJ;AACJ"}

package/dist/app/modules/database/repositories/role-permission/repository.mjs CHANGED Viewed

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { RolePermissionEntity } from "../../../../../adapters/database/domains/role-permission/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../query.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
 import { translateWhereConditions } from "../helpers.mjs";
 import { validateEntityJoinColumns } from "typeorm-extension";
 //#region src/app/modules/database/repositories/role-permission/repository.ts
@@ -18,7 +18,7 @@ var RolePermissionRepositoryAdapter = class {
 		const { pagination } = applyQuery(qb, query);
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination