@authup/server-core 1.0.0-beta.56 → 1.0.0-beta.58

package/dist/app/modules/oauth2/module.mjs

@@ -55,19 +55,24 @@ var OAuth2Module = class {
 	async setup(container) {
 		const config = container.resolve(ConfigInjectionKey);
 		container.register(OAuth2InjectionToken.ClientRepository, { useFactory: (c) => {
-			return new OAuth2ClientRepository(c.resolve(ClientEntity));
+			const repository = c.resolve(ClientEntity);
+			return new OAuth2ClientRepository(repository);
 		} });
 		container.register(OAuth2InjectionToken.ScopeRepository, { useFactory: (c) => {
-			return new OAuth2ScopeRepository(c.resolve(ClientScopeEntity));
+			const repository = c.resolve(ClientScopeEntity);
+			return new OAuth2ScopeRepository(repository);
 		} });
 		container.register(OAuth2InjectionToken.AuthorizationCodeRepository, { useFactory: (c) => {
-			return new OAuth2AuthorizationCodeRepository(c.resolve(CacheInjectionKey));
+			const cache = c.resolve(CacheInjectionKey);
+			return new OAuth2AuthorizationCodeRepository(cache);
 		} });
 		container.register(OAuth2InjectionToken.AuthorizationStateRepository, { useFactory: (c) => {
-			return new OAuth2AuthorizationStateRepository(c.resolve(CacheInjectionKey));
+			const cache = c.resolve(CacheInjectionKey);
+			return new OAuth2AuthorizationStateRepository(cache);
 		} });
 		container.register(OAuth2InjectionToken.TokenRepository, { useFactory: (c) => {
-			return new OAuth2TokenRepository(c.resolve(CacheInjectionKey));
+			const cache = c.resolve(CacheInjectionKey);
+			return new OAuth2TokenRepository(cache);
 		} });
 		container.register(OAuth2InjectionToken.SessionTokenRepository, { useFactory: (c) => new SessionTokenRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource)) });
 		container.register(OAuth2InjectionToken.ConsentRepository, { useFactory: (c) => new ConsentRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource)) });
@@ -79,28 +84,38 @@ var OAuth2Module = class {
 			return new KeyRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource), { secretsCipher });
 		} });
 		container.register(OAuth2InjectionToken.TokenSigner, { useFactory: (c) => {
-			return new OAuth2TokenSigner(c.resolve(OAuth2InjectionToken.KeyStore));
+			const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);
+			return new OAuth2TokenSigner(keyStore);
 		} });
 		container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, { useFactory: (c) => {
-			return new OAuth2AuthorizationCodeIssuer(c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository), { maxAge: config.tokenAccessMaxAge });
+			const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);
+			return new OAuth2AuthorizationCodeIssuer(codeRepository, { maxAge: config.tokenAccessMaxAge });
 		} });
 		container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, { useFactory: (c) => {
-			return new OAuth2AuthorizationCodeVerifier(c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository));
+			const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);
+			return new OAuth2AuthorizationCodeVerifier(codeRepository);
 		} });
 		container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, { useFactory: (c) => {
+			const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);
+			const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);
 			return new OAuth2AuthorizationCodeRequestVerifier({
-				clientRepository: c.resolve(OAuth2InjectionToken.ClientRepository),
-				scopeRepository: c.resolve(OAuth2InjectionToken.ScopeRepository)
+				clientRepository,
+				scopeRepository: clientScopeRepository
 			});
 		} });
 		container.register(OAuth2InjectionToken.AuthorizationStateManager, { useFactory: (c) => {
-			return new OAuth2AuthorizationStateManager(c.resolve(OAuth2InjectionToken.AuthorizationStateRepository));
+			const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);
+			return new OAuth2AuthorizationStateManager(stateRepository);
 		} });
 		container.register(OAuth2InjectionToken.TokenRevoker, { useFactory: (c) => {
-			return new OAuth2TokenRevoker(c.resolve(OAuth2InjectionToken.TokenRepository), c.resolve(OAuth2InjectionToken.SessionTokenRepository));
+			const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);
+			const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);
+			return new OAuth2TokenRevoker(tokenRepository, sessionTokenRepository);
 		} });
 		container.register(OAuth2InjectionToken.TokenVerifier, { useFactory: (c) => {
-			return new OAuth2TokenVerifier(c.resolve(OAuth2InjectionToken.KeyStore), c.resolve(OAuth2InjectionToken.TokenRepository));
+			const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);
+			const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);
+			return new OAuth2TokenVerifier(keyStore, tokenRepository);
 		} });
 		container.register(OAuth2InjectionToken.AccessTokenIssuer, { useFactory: (c) => {
 			const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);
@@ -113,7 +128,9 @@ var OAuth2Module = class {
 			}, identityRoleProvider, sessionTokenRepository);
 		} });
 		container.register(OAuth2InjectionToken.MfaTokenIssuer, { useFactory: (c) => {
-			return new OAuth2MfaTokenIssuer(c.resolve(OAuth2InjectionToken.TokenRepository), c.resolve(OAuth2InjectionToken.TokenSigner), {
+			const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);
+			const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);
+			return new OAuth2MfaTokenIssuer(tokenRepository, tokenSigner, {
 				maxAge: config.mfaTicketMaxAge,
 				issuer: config.publicUrl
 			});
@@ -128,10 +145,13 @@ var OAuth2Module = class {
 			}, sessionTokenRepository);
 		} });
 		container.register(OAuth2InjectionToken.OpenIDTokenIssuer, { useFactory: (c) => {
+			const repository = c.resolve(OAuth2InjectionToken.TokenRepository);
+			const signer = c.resolve(OAuth2InjectionToken.TokenSigner);
+			const identityResolver = c.resolve(IdentityInjectionKey.Resolver);
 			return new OAuth2OpenIDTokenIssuer({
-				repository: c.resolve(OAuth2InjectionToken.TokenRepository),
-				signer: c.resolve(OAuth2InjectionToken.TokenSigner),
-				identityResolver: c.resolve(IdentityInjectionKey.Resolver),
+				repository,
+				signer,
+				identityResolver,
 				options: {
 					maxAge: config.tokenAccessMaxAge,
 					issuer: config.publicUrl

package/dist/app/modules/oauth2/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["SymmetricCipher","CacheInjectionKey","ModuleName","LoggerInjectionKey","ConsentRepositoryAdapter","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2ScopeRepository","OAuth2TokenRepository","SessionTokenRepositoryAdapter","KeyRepositoryAdapter","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2MfaTokenIssuer","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","SessionTokenRepository","DataSource","ConsentRepository","KeyStore","secretsCipher","secretsEncryptionKey","env","logger","warn","TokenSigner","keyStore","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","sessionTokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","MfaTokenIssuer","mfaTicketMaxAge","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { SymmetricCipher } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nimport {\n    ConsentRepositoryAdapter,\n    OAuth2AuthorizationCodeRepository,\n    OAuth2AuthorizationStateRepository,\n    OAuth2ClientRepository,\n    OAuth2ScopeRepository,\n    OAuth2TokenRepository,\n    SessionTokenRepositoryAdapter,\n} from './repositories/index.ts';\nimport { KeyRepositoryAdapter } from '../database/repositories/index.ts';\nimport {\n    OAuth2AccessTokenIssuer,\n    OAuth2AuthorizationCodeIssuer,\n    OAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeVerifier,\n    OAuth2AuthorizationStateManager,\n    OAuth2MfaTokenIssuer,\n    OAuth2OpenIDTokenIssuer,\n    OAuth2RefreshTokenIssuer,\n    OAuth2TokenRevoker,\n    OAuth2TokenSigner,\n    OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.OAUTH2;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n    }\n\n    async setup(container: IContainer) : Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        container.register(OAuth2InjectionToken.ClientRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n                return new OAuth2ClientRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.ScopeRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n                return new OAuth2ScopeRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationCodeRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationStateRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2TokenRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.SessionTokenRepository, {\n            useFactory: (c) => new SessionTokenRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.ConsentRepository, {\n            useFactory: (c) => new ConsentRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.KeyStore, {\n            // todo: cache use here\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n\n                let secretsCipher : SymmetricCipher | null = null;\n                if (config.secretsEncryptionKey) {\n                    secretsCipher = new SymmetricCipher(config.secretsEncryptionKey);\n                } else if (config.env === 'production') {\n                    // parity posture without a KEK (Keycloak/authentik store key\n                    // material plaintext too) — but say so once, loudly.\n                    const logger = c.resolve(LoggerInjectionKey);\n                    logger.warn(\n                        'The realm key store persists key material unwrapped; ' +\n                        'set SECRETS_ENCRYPTION_KEY to wrap it at rest.',\n                    );\n                }\n\n                return new KeyRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource), { secretsCipher });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenSigner, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                return new OAuth2TokenSigner(keyStore);\n            },\n        });\n\n        // authorization code issuer\n        container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeIssuer(\n                    codeRepository,\n                    {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                    },\n                );\n            },\n        });\n        container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeVerifier(codeRepository);\n            },\n        });\n\n        // authorization code request verifier\n        container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n            useFactory: (c) => {\n                const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n                const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n                return new OAuth2AuthorizationCodeRequestVerifier({\n                    clientRepository,\n                    scopeRepository: clientScopeRepository,\n                });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n            useFactory: (c) => {\n                const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n                return new OAuth2AuthorizationStateManager(stateRepository);\n            },\n        });\n\n        // token revoker\n        container.register(OAuth2InjectionToken.TokenRevoker, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2TokenRevoker(tokenRepository, sessionTokenRepository);\n            },\n        });\n\n        // token verifier\n        container.register(OAuth2InjectionToken.TokenVerifier, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n                return new OAuth2TokenVerifier(keyStore, tokenRepository);\n            },\n        });\n\n        // access token issuer\n        container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2AccessTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    identityRoleProvider,\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // mfa login-ticket issuer\n        container.register(OAuth2InjectionToken.MfaTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n                return new OAuth2MfaTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.mfaTicketMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                );\n            },\n        });\n\n        // refresh token issuer\n        container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n\n                return new OAuth2RefreshTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenRefreshMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // open-id token issuer\n        container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n            useFactory: (c) => {\n                const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n                return new OAuth2OpenIDTokenIssuer({\n                    repository,\n                    signer,\n\n                    identityResolver,\n\n                    options: {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,IAAa6B,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAO5B,WAAW8B;EACvB,KAAKD,eAAe;GAAC7B,WAAW+B;GAAU/B,WAAWgC;GAAOhC,WAAWiC;GAAQjC,WAAWkC;EAAS;CACvG;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GAET,OAAO,IAAIrC,uBADQqC,EAAEJ,QAAkCf,YACrBoB,CAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GAET,OAAO,IAAIpC,sBADQoC,EAAEJ,QAAuCd,iBAC3BmB,CAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GAET,OAAO,IAAIvC,kCADGuC,EAAEJ,QAAQvC,iBACqB+C,CAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GAET,OAAO,IAAItC,mCADGsC,EAAEJ,QAAQvC,iBACsB+C,CAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GAET,OAAO,IAAInC,sBADGmC,EAAEJ,QAAQvC,iBACS+C,CAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,wBAAwB,EAC5DR,aAAaC,MAAM,IAAIlC,8BACnBkC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,mBAAmB,EACvDV,aAAaC,MAAM,IAAIxC,yBACnBwC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB+B,UAAU,EAE9CX,aAAaC,MAAAA;GACT,MAAML,SAASK,EAAEJ,QAAQb,kBAAAA;GAEzB,IAAI4B,gBAAyC;GAC7C,IAAIhB,OAAOiB,sBACPD,gBAAgB,IAAIvD,gBAAgBuC,OAAOiB,oBAAoB;QAC5D,IAAIjB,OAAOkB,QAAQ,cAItBC,EADiBlB,QAAQrC,kBACzBuD,CAAAA,CAAOC,KACH,qGACA;GAIR,OAAO,IAAIhD,qBAAqBiC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,GAAG,EAAEG,cAAc,CAAA;EAChG,EACJ,CAAA;EAEAjB,UAAUG,SAASlB,qBAAqBqC,aAAa,EACjDjB,aAAaC,MAAAA;GAET,OAAO,IAAIvB,kBADMuB,EAAEJ,QAAQjB,qBAAqB+B,QACnBO,CAAAA;EACjC,EACJ,CAAA;EAGAvB,UAAUG,SAASlB,qBAAqBuC,yBAAyB,EAC7DnB,aAAaC,MAAAA;GAGT,OAAO,IAAI/B,8BAFY+B,EAAEJ,QAAQjB,qBAAqBwB,2BAGlDgB,GACA,EAEIC,QAAQzB,OAAO0B,kBACnB,CAAA;EAER,EACJ,CAAA;EACA3B,UAAUG,SAASlB,qBAAqB2C,2BAA2B,EAC/DvB,aAAaC,MAAAA;GAGT,OAAO,IAAI7B,gCAFY6B,EAAEJ,QAAQjB,qBAAqBwB,2BAEXgB,CAAAA;EAC/C,EACJ,CAAA;EAGAzB,UAAUG,SAASlB,qBAAqB4C,kCAAkC,EACtExB,aAAaC,MAAAA;GAIT,OAAO,IAAI9B,uCAAuC;IAC9CsD,kBAJqBxB,EAAEJ,QAAQjB,qBAAqBmB,gBAIpD0B;IACAE,iBAJ0B1B,EAAEJ,QAAQjB,qBAAqBuB,eAIxCuB;GACrB,CAAA;EACJ,EACJ,CAAA;EAEA/B,UAAUG,SAASlB,qBAAqBgD,2BAA2B,EAC/D5B,aAAaC,MAAAA;GAGT,OAAO,IAAI5B,gCAFa4B,EAAEJ,QAAQjB,qBAAqB0B,4BAEZuB,CAAAA;EAC/C,EACJ,CAAA;EAGAlC,UAAUG,SAASlB,qBAAqBkD,cAAc,EAClD9B,aAAaC,MAAAA;GAGT,OAAO,IAAIxB,mBAFawB,EAAEJ,QAAQjB,qBAAqB2B,eAEzBwB,GADC9B,EAAEJ,QAAQjB,qBAAqB4B,sBACfwB,CAAAA;EACnD,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBqD,eAAe,EACnDjC,aAAaC,MAAAA;GAIT,OAAO,IAAItB,oBAHMsB,EAAEJ,QAAQjB,qBAAqB+B,QAGjBO,GAFPjB,EAAEJ,QAAQjB,qBAAqB2B,eAEdwB,CAAAA;EAC7C,EACJ,CAAA;EAGApC,UAAUG,SAASlB,qBAAqBsD,mBAAmB,EACvDlC,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMmB,uBAAuBnC,EAAEJ,QAAQhB,qBAAqBwD,YAAY;GACxE,MAAML,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAIvC,wBACP8D,iBACAI,aACA;IACId,QAAQzB,OAAO0B;IACfgB,QAAQ1C,OAAO2C;GACnB,GACAH,sBACAJ,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqB4D,gBAAgB,EACpDxC,aAAaC,MAAAA;GAIT,OAAO,IAAI3B,qBAHa2B,EAAEJ,QAAQjB,qBAAqB2B,eAInDwB,GAHgB9B,EAAEJ,QAAQjB,qBAAqBqC,WAI/CkB,GACA;IACId,QAAQzB,OAAO6C;IACfH,QAAQ1C,OAAO2C;GACnB,CAAA;EAER,EACJ,CAAA;EAGA5C,UAAUG,SAASlB,qBAAqB8D,oBAAoB,EACxD1C,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMe,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GAEpF,OAAO,IAAIhC,yBACPuD,iBACAI,aACA;IACId,QAAQzB,OAAO+C;IACfL,QAAQ1C,OAAO2C;GACnB,GACAP,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBgE,mBAAmB,EACvD5C,aAAaC,MAAAA;GAKT,OAAO,IAAI1B,wBAAwB;IAC/B2B,YALeD,EAAEJ,QAAQjB,qBAAqB2B,eAK9CL;IACA2C,QALW5C,EAAEJ,QAAQjB,qBAAqBqC,WAK1C4B;IAEAC,kBANqB7C,EAAEJ,QAAQhB,qBAAqBkE,QAMpDD;IAEAE,SAAS;KAEL3B,QAAQzB,OAAO0B;KACfgB,QAAQ1C,OAAO2C;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["SymmetricCipher","CacheInjectionKey","ModuleName","LoggerInjectionKey","ConsentRepositoryAdapter","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2ScopeRepository","OAuth2TokenRepository","SessionTokenRepositoryAdapter","KeyRepositoryAdapter","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2MfaTokenIssuer","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","SessionTokenRepository","DataSource","ConsentRepository","KeyStore","secretsCipher","secretsEncryptionKey","env","logger","warn","TokenSigner","keyStore","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","sessionTokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","MfaTokenIssuer","mfaTicketMaxAge","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { SymmetricCipher } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nimport {\n    ConsentRepositoryAdapter,\n    OAuth2AuthorizationCodeRepository,\n    OAuth2AuthorizationStateRepository,\n    OAuth2ClientRepository,\n    OAuth2ScopeRepository,\n    OAuth2TokenRepository,\n    SessionTokenRepositoryAdapter,\n} from './repositories/index.ts';\nimport { KeyRepositoryAdapter } from '../database/repositories/index.ts';\nimport {\n    OAuth2AccessTokenIssuer,\n    OAuth2AuthorizationCodeIssuer,\n    OAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeVerifier,\n    OAuth2AuthorizationStateManager,\n    OAuth2MfaTokenIssuer,\n    OAuth2OpenIDTokenIssuer,\n    OAuth2RefreshTokenIssuer,\n    OAuth2TokenRevoker,\n    OAuth2TokenSigner,\n    OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.OAUTH2;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n    }\n\n    async setup(container: IContainer) : Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        container.register(OAuth2InjectionToken.ClientRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n                return new OAuth2ClientRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.ScopeRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n                return new OAuth2ScopeRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationCodeRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationStateRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2TokenRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.SessionTokenRepository, {\n            useFactory: (c) => new SessionTokenRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.ConsentRepository, {\n            useFactory: (c) => new ConsentRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.KeyStore, {\n            // todo: cache use here\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n\n                let secretsCipher : SymmetricCipher | null = null;\n                if (config.secretsEncryptionKey) {\n                    secretsCipher = new SymmetricCipher(config.secretsEncryptionKey);\n                } else if (config.env === 'production') {\n                    // parity posture without a KEK (Keycloak/authentik store key\n                    // material plaintext too) — but say so once, loudly.\n                    const logger = c.resolve(LoggerInjectionKey);\n                    logger.warn(\n                        'The realm key store persists key material unwrapped; ' +\n                        'set SECRETS_ENCRYPTION_KEY to wrap it at rest.',\n                    );\n                }\n\n                return new KeyRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource), { secretsCipher });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenSigner, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                return new OAuth2TokenSigner(keyStore);\n            },\n        });\n\n        // authorization code issuer\n        container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeIssuer(\n                    codeRepository,\n                    {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                    },\n                );\n            },\n        });\n        container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeVerifier(codeRepository);\n            },\n        });\n\n        // authorization code request verifier\n        container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n            useFactory: (c) => {\n                const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n                const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n                return new OAuth2AuthorizationCodeRequestVerifier({\n                    clientRepository,\n                    scopeRepository: clientScopeRepository,\n                });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n            useFactory: (c) => {\n                const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n                return new OAuth2AuthorizationStateManager(stateRepository);\n            },\n        });\n\n        // token revoker\n        container.register(OAuth2InjectionToken.TokenRevoker, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2TokenRevoker(tokenRepository, sessionTokenRepository);\n            },\n        });\n\n        // token verifier\n        container.register(OAuth2InjectionToken.TokenVerifier, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n                return new OAuth2TokenVerifier(keyStore, tokenRepository);\n            },\n        });\n\n        // access token issuer\n        container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2AccessTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    identityRoleProvider,\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // mfa login-ticket issuer\n        container.register(OAuth2InjectionToken.MfaTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n                return new OAuth2MfaTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.mfaTicketMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                );\n            },\n        });\n\n        // refresh token issuer\n        container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n\n                return new OAuth2RefreshTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenRefreshMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // open-id token issuer\n        container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n            useFactory: (c) => {\n                const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n                return new OAuth2OpenIDTokenIssuer({\n                    repository,\n                    signer,\n\n                    identityResolver,\n\n                    options: {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,IAAa6B,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAO5B,WAAW8B;EACvB,KAAKD,eAAe;GAAC7B,WAAW+B;GAAU/B,WAAWgC;GAAOhC,WAAWiC;GAAQjC,WAAWkC;EAAS;CACvG;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GACT,MAAMC,aAAaD,EAAEJ,QAAkCf,YAAAA;GACvD,OAAO,IAAIlB,uBAAuBsC,UAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GACT,MAAMC,aAAaD,EAAEJ,QAAuCd,iBAAAA;GAC5D,OAAO,IAAIlB,sBAAsBqC,UAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GACT,MAAMI,QAAQJ,EAAEJ,QAAQvC,iBAAAA;GACxB,OAAO,IAAII,kCAAkC2C,KAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GACT,MAAMI,QAAQJ,EAAEJ,QAAQvC,iBAAAA;GACxB,OAAO,IAAIK,mCAAmC0C,KAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GACT,MAAMI,QAAQJ,EAAEJ,QAAQvC,iBAAAA;GACxB,OAAO,IAAIQ,sBAAsBuC,KAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,wBAAwB,EAC5DR,aAAaC,MAAM,IAAIlC,8BACnBkC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,mBAAmB,EACvDV,aAAaC,MAAM,IAAIxC,yBACnBwC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB+B,UAAU,EAE9CX,aAAaC,MAAAA;GACT,MAAML,SAASK,EAAEJ,QAAQb,kBAAAA;GAEzB,IAAI4B,gBAAyC;GAC7C,IAAIhB,OAAOiB,sBACPD,gBAAgB,IAAIvD,gBAAgBuC,OAAOiB,oBAAoB;QAC5D,IAAIjB,OAAOkB,QAAQ,cAItBC,EADiBlB,QAAQrC,kBACzBuD,CAAAA,CAAOC,KACH,qGACA;GAIR,OAAO,IAAIhD,qBAAqBiC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,GAAG,EAAEG,cAAc,CAAA;EAChG,EACJ,CAAA;EAEAjB,UAAUG,SAASlB,qBAAqBqC,aAAa,EACjDjB,aAAaC,MAAAA;GACT,MAAMiB,WAAWjB,EAAEJ,QAAQjB,qBAAqB+B,QAAQ;GACxD,OAAO,IAAIjC,kBAAkBwC,QAAAA;EACjC,EACJ,CAAA;EAGAvB,UAAUG,SAASlB,qBAAqBuC,yBAAyB,EAC7DnB,aAAaC,MAAAA;GACT,MAAMmB,iBAAiBnB,EAAEJ,QAAQjB,qBAAqBwB,2BAA2B;GAEjF,OAAO,IAAIlC,8BACPkD,gBACA,EAEIC,QAAQzB,OAAO0B,kBACnB,CAAA;EAER,EACJ,CAAA;EACA3B,UAAUG,SAASlB,qBAAqB2C,2BAA2B,EAC/DvB,aAAaC,MAAAA;GACT,MAAMmB,iBAAiBnB,EAAEJ,QAAQjB,qBAAqBwB,2BAA2B;GAEjF,OAAO,IAAIhC,gCAAgCgD,cAAAA;EAC/C,EACJ,CAAA;EAGAzB,UAAUG,SAASlB,qBAAqB4C,kCAAkC,EACtExB,aAAaC,MAAAA;GACT,MAAMwB,mBAAmBxB,EAAEJ,QAAQjB,qBAAqBmB,gBAAgB;GACxE,MAAM2B,wBAAwBzB,EAAEJ,QAAQjB,qBAAqBuB,eAAe;GAE5E,OAAO,IAAIhC,uCAAuC;IAC9CsD;IACAE,iBAAiBD;GACrB,CAAA;EACJ,EACJ,CAAA;EAEA/B,UAAUG,SAASlB,qBAAqBgD,2BAA2B,EAC/D5B,aAAaC,MAAAA;GACT,MAAM4B,kBAAkB5B,EAAEJ,QAAQjB,qBAAqB0B,4BAA4B;GAEnF,OAAO,IAAIjC,gCAAgCwD,eAAAA;EAC/C,EACJ,CAAA;EAGAlC,UAAUG,SAASlB,qBAAqBkD,cAAc,EAClD9B,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAMyB,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAI/B,mBAAmBsD,iBAAiBC,sBAAAA;EACnD,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBqD,eAAe,EACnDjC,aAAaC,MAAAA;GACT,MAAMiB,WAAWjB,EAAEJ,QAAQjB,qBAAqB+B,QAAQ;GACxD,MAAMoB,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GAEtE,OAAO,IAAI5B,oBAAoBuC,UAAUa,eAAAA;EAC7C,EACJ,CAAA;EAGApC,UAAUG,SAASlB,qBAAqBsD,mBAAmB,EACvDlC,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMmB,uBAAuBnC,EAAEJ,QAAQhB,qBAAqBwD,YAAY;GACxE,MAAML,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAIvC,wBACP8D,iBACAI,aACA;IACId,QAAQzB,OAAO0B;IACfgB,QAAQ1C,OAAO2C;GACnB,GACAH,sBACAJ,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqB4D,gBAAgB,EACpDxC,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAE9D,OAAO,IAAI3C,qBACPyD,iBACAI,aACA;IACId,QAAQzB,OAAO6C;IACfH,QAAQ1C,OAAO2C;GACnB,CAAA;EAER,EACJ,CAAA;EAGA5C,UAAUG,SAASlB,qBAAqB8D,oBAAoB,EACxD1C,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMe,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GAEpF,OAAO,IAAIhC,yBACPuD,iBACAI,aACA;IACId,QAAQzB,OAAO+C;IACfL,QAAQ1C,OAAO2C;GACnB,GACAP,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBgE,mBAAmB,EACvD5C,aAAaC,MAAAA;GACT,MAAMC,aAAaD,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACjE,MAAMsC,SAAS5C,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GACzD,MAAM6B,mBAAmB7C,EAAEJ,QAAQhB,qBAAqBkE,QAAQ;GAEhE,OAAO,IAAIxE,wBAAwB;IAC/B2B;IACA2C;IAEAC;IAEAE,SAAS;KAEL3B,QAAQzB,OAAO0B;KACfgB,QAAQ1C,OAAO2C;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}

package/dist/app/modules/oauth2/repositories/authorize/state/repository.mjs

@@ -30,7 +30,7 @@ var OAuth2AuthorizationStateRepository = class {
 		await this.cache.set(buildCacheKey({
 			prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,
 			key: state
-		}), data, { ttl: 1e3 * 60 * 30 });
+		}), data, { ttl: 18e5 });
 		return state;
 	}
 };

package/dist/app/modules/oauth2/repositories/authorize/state/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["createNanoID","buildCacheKey","CacheOAuth2Prefix","OAuth2AuthorizationStateRepository","cache","findOneById","key","id","prefix","AUTHORIZATION_CODE","payload","get","remove","drop","insert","data","state","set","ttl"],"sources":["../../../../../../../src/app/modules/oauth2/repositories/authorize/state/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createNanoID } from '@authup/kit';\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { IOAuth2AuthorizeStateRepository, OAuth2AuthorizationState } from '../../../../../../core/index.ts';\nimport { CacheOAuth2Prefix } from '../../constants.ts';\n\nexport class OAuth2AuthorizationStateRepository implements IOAuth2AuthorizeStateRepository {\n    protected cache : ICache;\n\n    constructor(cache: ICache) {\n        this.cache = cache;\n    }\n\n    async findOneById(key: string): Promise<OAuth2AuthorizationState | null> {\n        const id = buildCacheKey({\n            prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,\n            key, \n        });\n        const payload = await this.cache.get<OAuth2AuthorizationState>(id);\n        if (payload) {\n            return payload;\n        }\n\n        return null;\n    }\n\n    async remove(key: string): Promise<void> {\n        await this.cache.drop(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,\n                key, \n            }),\n        );\n    }\n\n    async insert(data: OAuth2AuthorizationState): Promise<string> {\n        const state = createNanoID();\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,\n                key: state, \n            }),\n            data,\n            { ttl: 1000 * 60 * 30 }, // 30 min\n        );\n\n        return state;\n    }\n}\n"],"mappings":";;;;;;;AAaA,IAAaG,qCAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAEA,MAAMC,YAAYC,KAAuD;EACrE,MAAMC,KAAKN,cAAc;GACrBO,QAAQN,kBAAkBO;GAC1BH;EACJ,CAAA;EACA,MAAMI,UAAU,MAAM,KAAKN,MAAMO,IAA8BJ,EAAAA;EAC/D,IAAIG,SACA,OAAOA;EAGX,OAAO;CACX;CAEA,MAAME,OAAON,KAA4B;EACrC,MAAM,KAAKF,MAAMS,KACbZ,cAAc;GACVO,QAAQN,kBAAkBO;GAC1BH;EACJ,CAAA,CAAA;CAER;CAEA,MAAMQ,OAAOC,MAAiD;EAC1D,MAAMC,QAAQhB,aAAAA;EAEd,MAAM,KAAKI,MAAMa,IACbhB,cAAc;GACVO,QAAQN,kBAAkBO;GAC1BH,KAAKU;EACT,CAAA,GACAD,MACA,EAAEG,KAAK,MAAO,KAAK,GAAG,CAAA;EAG1B,OAAOF;CACX;AACJ"}
+{"version":3,"file":"repository.mjs","names":["createNanoID","buildCacheKey","CacheOAuth2Prefix","OAuth2AuthorizationStateRepository","cache","findOneById","key","id","prefix","AUTHORIZATION_CODE","payload","get","remove","drop","insert","data","state","set","ttl"],"sources":["../../../../../../../src/app/modules/oauth2/repositories/authorize/state/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createNanoID } from '@authup/kit';\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { IOAuth2AuthorizeStateRepository, OAuth2AuthorizationState } from '../../../../../../core/index.ts';\nimport { CacheOAuth2Prefix } from '../../constants.ts';\n\nexport class OAuth2AuthorizationStateRepository implements IOAuth2AuthorizeStateRepository {\n    protected cache : ICache;\n\n    constructor(cache: ICache) {\n        this.cache = cache;\n    }\n\n    async findOneById(key: string): Promise<OAuth2AuthorizationState | null> {\n        const id = buildCacheKey({\n            prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,\n            key, \n        });\n        const payload = await this.cache.get<OAuth2AuthorizationState>(id);\n        if (payload) {\n            return payload;\n        }\n\n        return null;\n    }\n\n    async remove(key: string): Promise<void> {\n        await this.cache.drop(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,\n                key, \n            }),\n        );\n    }\n\n    async insert(data: OAuth2AuthorizationState): Promise<string> {\n        const state = createNanoID();\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,\n                key: state, \n            }),\n            data,\n            { ttl: 1000 * 60 * 30 }, // 30 min\n        );\n\n        return state;\n    }\n}\n"],"mappings":";;;;;;;AAaA,IAAaG,qCAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAEA,MAAMC,YAAYC,KAAuD;EACrE,MAAMC,KAAKN,cAAc;GACrBO,QAAQN,kBAAkBO;GAC1BH;EACJ,CAAA;EACA,MAAMI,UAAU,MAAM,KAAKN,MAAMO,IAA8BJ,EAAAA;EAC/D,IAAIG,SACA,OAAOA;EAGX,OAAO;CACX;CAEA,MAAME,OAAON,KAA4B;EACrC,MAAM,KAAKF,MAAMS,KACbZ,cAAc;GACVO,QAAQN,kBAAkBO;GAC1BH;EACJ,CAAA,CAAA;CAER;CAEA,MAAMQ,OAAOC,MAAiD;EAC1D,MAAMC,QAAQhB,aAAAA;EAEd,MAAM,KAAKI,MAAMa,IACbhB,cAAc;GACVO,QAAQN,kBAAkBO;GAC1BH,KAAKU;EACT,CAAA,GACAD,MACA,EAAEG,KAAK,KAAe,CAAA;EAG1B,OAAOF;CACX;AACJ"}

package/dist/app/modules/oauth2/repositories/consent/repository.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { CachePrefix } from "../../../../../adapters/database/domains/constants.mjs";
 import { ConsentEntity } from "../../../../../adapters/database/domains/consent/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../../../database/repositories/query.mjs";
+import { applyQuery, redactFieldConditions } from "../../../database/repositories/query.mjs";
 import { applyRealmScopeSelect } from "../../../database/repositories/helpers.mjs";
 import { isUniqueConstraintDatabaseError } from "../../../../../adapters/database/errors/driver.mjs";
 import "../../../../../adapters/database/errors/index.mjs";
@@ -33,7 +33,7 @@ var ConsentRepositoryAdapter = class {
 		if (options.realmId) qb.andWhere("consent.realmId = :realmId", { realmId: options.realmId });
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/oauth2/repositories/consent/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["IdentityType","buildRedisKeyPath","applyQuery","CachePrefix","ConsentEntity","isUniqueConstraintDatabaseError","applyRealmScopeSelect","ConsentRepositoryAdapter","repository","dataSource","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","leftJoin","addSelect","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","realmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findAllBySubjectClient","clientId","where","cache","prefix","CONSENT_COVERING","key","getMany","insertMissing","input","existing","existingTokens","Set","map","row","scope","missing","scopes","filter","token","has","userId","USER","entity","create","expiresAt","save","e","remove"],"sources":["../../../../../../src/app/modules/oauth2/repositories/consent/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { IdentityType  } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { applyQuery } from '../../../database/repositories/query.ts';\nimport { CachePrefix, ConsentEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isUniqueConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport type {\n    ConsentFindManyOptions,\n    ConsentOwner,\n    IConsentRepository,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../../database/repositories/helpers.ts';\n\nexport class ConsentRepositoryAdapter implements IConsentRepository {\n    protected repository: Repository<ConsentEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(ConsentEntity);\n    }\n\n    async findMany(\n        query: IQuery,\n        options: ConsentFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Consent>> {\n        const qb = this.repository.createQueryBuilder('consent');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'consent', ['sub', 'subKind']);\n\n        // Always expose only a client SUMMARY (id / name / displayName /\n        // builtIn) — NEVER the full ClientEntity (redirectUri + post-logout\n        // patterns = the trusted-origin set, grantTypes, baseUrl/rootUrl,\n        // secret-storage flags, accessPolicyId). `client` is deliberately\n        // absent from relations.allowed so a raw ?include=client cannot force\n        // the full-column join; the self-service Applications tab still gets\n        // the display name from this fixed projection.\n        qb.leftJoin('consent.client', 'client')\n            .addSelect([\n                'client.id',\n                'client.name',\n                'client.displayName',\n                'client.builtIn',\n            ]);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('consent.sub = :ownerSub AND consent.subKind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        if (options.realmId) {\n            // nested `/realms/:realmId/consents` mount — mandatory constraint,\n            // not overridable by a rapiq filter\n            qb.andWhere('consent.realmId = :realmId', { realmId: options.realmId });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Consent | null> {\n        return this.repository.findOneBy({ id });\n    }\n\n    async findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]> {\n        const qb = this.repository.createQueryBuilder('consent');\n        qb.where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n            clientId,\n            sub: owner.sub,\n            subKind: owner.subKind,\n        });\n        qb.cache(\n            buildRedisKeyPath({\n                prefix: CachePrefix.CONSENT_COVERING,\n                key: `${clientId}:${owner.subKind}:${owner.sub}`,\n            }),\n            60_000,\n        );\n\n        return qb.getMany();\n    }\n\n    async insertMissing(input: {\n        clientId: string,\n        realmId: string,\n        owner: ConsentOwner,\n        scopes: string[]\n    }): Promise<void> {\n        // uncached read — the diff must see the latest rows, and the covering\n        // cache entry must not be refreshed on the write path.\n        const existing = await this.repository.createQueryBuilder('consent')\n            .where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n                clientId: input.clientId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n            })\n            .getMany();\n\n        const existingTokens = new Set(existing.map((row) => row.scope));\n        const missing = input.scopes.filter((token) => !existingTokens.has(token));\n\n        // save-per-row (never a raw qb insert): entity-manager saves fire the\n        // ConsentEntitySubscriber — covering-cache invalidation, realtime\n        // destinations and audit mirroring depend on it. A duplicate-key\n        // violation is the benign race outcome under the unique index.\n        // Set the userId FK only when the subject is a user, so a user\n        // deletion cascade-drops its consent rows; non-user subjects leave it\n        // null (the row is still cleaned up when its client/realm is deleted).\n        const userId = input.owner.subKind === IdentityType.USER ?\n            input.owner.sub :\n            null;\n\n        for (const scope of missing) {\n            const entity = this.repository.create({\n                clientId: input.clientId,\n                realmId: input.realmId,\n                userId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n                scope,\n                expiresAt: null,\n            });\n\n            try {\n                await this.repository.save(entity);\n            } catch (e) {\n                if (!isUniqueConstraintDatabaseError(e)) {\n                    throw e;\n                }\n            }\n        }\n    }\n\n    async remove(entity: Consent): Promise<void> {\n        await this.repository.remove(entity as ConsentEntity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,IAAaO,2BAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcN,aAAAA;CAC/C;CAEA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAed,WAAWY,IAAIF,KAAAA;EAEtCN,sBAAsBQ,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EASvDA,GAAGG,SAAS,kBAAkB,QAAA,CAAA,CACzBC,UAAU;GACP;GACA;GACA;GACA;EACH,CAAA;EAEL,IAAIL,QAAQM,OAERL,GAAGM,SAAS,+DAA+D;GACvEC,UAAUR,QAAQM,MAAMG;GACxBC,cAAcV,QAAQM,MAAMK;EAChC,CAAA;EAGJ,IAAIX,QAAQY,SAGRX,GAAGM,SAAS,8BAA8B,EAAEK,SAASZ,QAAQY,QAAQ,CAAA;EAGzE,MAAM,CAACC,UAAUC,SAAS,MAAMb,GAAGc,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGX;GACP;EACJ;CACJ;CAEA,MAAMe,YAAYC,IAAqC;EACnD,OAAO,KAAKxB,WAAWyB,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,uBAAuBC,UAAkBhB,OAAyC;EACpF,MAAML,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAC9CD,GAAGsB,MAAM,sFAAsF;GAC3FD;GACAb,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA;EACAV,GAAGuB,MACCpC,kBAAkB;GACdqC,QAAQnC,YAAYoC;GACpBC,KAAK,GAAGL,SAAS,GAAGhB,MAAMK,QAAQ,GAAGL,MAAMG;EAC/C,CAAA,GACA,GAAA;EAGJ,OAAOR,GAAG2B,QAAO;CACrB;CAEA,MAAMC,cAAcC,OAKF;EAGd,MAAMC,WAAW,MAAM,KAAKpC,WAAWO,mBAAmB,SAAA,CAAA,CACrDqB,MAAM,sFAAsF;GACzFD,UAAUQ,MAAMR;GAChBb,KAAKqB,MAAMxB,MAAMG;GACjBE,SAASmB,MAAMxB,MAAMK;EACzB,CAAA,CAAA,CACCiB,QAAO;EAEZ,MAAMI,iBAAiB,IAAIC,IAAIF,SAASG,KAAKC,QAAQA,IAAIC,KAAK,CAAA;EAC9D,MAAMC,UAAUP,MAAMQ,OAAOC,QAAQC,UAAU,CAACR,eAAeS,IAAID,KAAAA,CAAAA;EASnE,MAAME,SAASZ,MAAMxB,MAAMK,YAAYxB,aAAawD,OAChDb,MAAMxB,MAAMG,MACZ;EAEJ,KAAK,MAAM2B,SAASC,SAAS;GACzB,MAAMO,SAAS,KAAKjD,WAAWkD,OAAO;IAClCvB,UAAUQ,MAAMR;IAChBV,SAASkB,MAAMlB;IACf8B;IACAjC,KAAKqB,MAAMxB,MAAMG;IACjBE,SAASmB,MAAMxB,MAAMK;IACrByB;IACAU,WAAW;GACf,CAAA;GAEA,IAAI;IACA,MAAM,KAAKnD,WAAWoD,KAAKH,MAAAA;GAC/B,SAASI,GAAG;IACR,IAAI,CAACxD,gCAAgCwD,CAAAA,GACjC,MAAMA;GAEd;EACJ;CACJ;CAEA,MAAMC,OAAOL,QAAgC;EACzC,MAAM,KAAKjD,WAAWsD,OAAOL,MAAAA;CACjC;AACJ"}
+{"version":3,"file":"repository.mjs","names":["IdentityType","buildRedisKeyPath","applyQuery","redactFieldConditions","CachePrefix","ConsentEntity","isUniqueConstraintDatabaseError","applyRealmScopeSelect","ConsentRepositoryAdapter","repository","dataSource","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","leftJoin","addSelect","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","realmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findAllBySubjectClient","clientId","where","cache","prefix","CONSENT_COVERING","key","getMany","insertMissing","input","existing","existingTokens","Set","map","row","scope","missing","scopes","filter","token","has","userId","USER","entity","create","expiresAt","save","e","remove"],"sources":["../../../../../../src/app/modules/oauth2/repositories/consent/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { IdentityType  } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { applyQuery, redactFieldConditions } from '../../../database/repositories/query.ts';\nimport { CachePrefix, ConsentEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isUniqueConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport type {\n    ConsentFindManyOptions,\n    ConsentOwner,\n    IConsentRepository,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../../database/repositories/helpers.ts';\n\nexport class ConsentRepositoryAdapter implements IConsentRepository {\n    protected repository: Repository<ConsentEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(ConsentEntity);\n    }\n\n    async findMany(\n        query: IQuery,\n        options: ConsentFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Consent>> {\n        const qb = this.repository.createQueryBuilder('consent');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'consent', ['sub', 'subKind']);\n\n        // Always expose only a client SUMMARY (id / name / displayName /\n        // builtIn) — NEVER the full ClientEntity (redirectUri + post-logout\n        // patterns = the trusted-origin set, grantTypes, baseUrl/rootUrl,\n        // secret-storage flags, accessPolicyId). `client` is deliberately\n        // absent from relations.allowed so a raw ?include=client cannot force\n        // the full-column join; the self-service Applications tab still gets\n        // the display name from this fixed projection.\n        qb.leftJoin('consent.client', 'client')\n            .addSelect([\n                'client.id',\n                'client.name',\n                'client.displayName',\n                'client.builtIn',\n            ]);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('consent.sub = :ownerSub AND consent.subKind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        if (options.realmId) {\n            // nested `/realms/:realmId/consents` mount — mandatory constraint,\n            // not overridable by a rapiq filter\n            qb.andWhere('consent.realmId = :realmId', { realmId: options.realmId });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Consent | null> {\n        return this.repository.findOneBy({ id });\n    }\n\n    async findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]> {\n        const qb = this.repository.createQueryBuilder('consent');\n        qb.where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n            clientId,\n            sub: owner.sub,\n            subKind: owner.subKind,\n        });\n        qb.cache(\n            buildRedisKeyPath({\n                prefix: CachePrefix.CONSENT_COVERING,\n                key: `${clientId}:${owner.subKind}:${owner.sub}`,\n            }),\n            60_000,\n        );\n\n        return qb.getMany();\n    }\n\n    async insertMissing(input: {\n        clientId: string,\n        realmId: string,\n        owner: ConsentOwner,\n        scopes: string[]\n    }): Promise<void> {\n        // uncached read — the diff must see the latest rows, and the covering\n        // cache entry must not be refreshed on the write path.\n        const existing = await this.repository.createQueryBuilder('consent')\n            .where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n                clientId: input.clientId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n            })\n            .getMany();\n\n        const existingTokens = new Set(existing.map((row) => row.scope));\n        const missing = input.scopes.filter((token) => !existingTokens.has(token));\n\n        // save-per-row (never a raw qb insert): entity-manager saves fire the\n        // ConsentEntitySubscriber — covering-cache invalidation, realtime\n        // destinations and audit mirroring depend on it. A duplicate-key\n        // violation is the benign race outcome under the unique index.\n        // Set the userId FK only when the subject is a user, so a user\n        // deletion cascade-drops its consent rows; non-user subjects leave it\n        // null (the row is still cleaned up when its client/realm is deleted).\n        const userId = input.owner.subKind === IdentityType.USER ?\n            input.owner.sub :\n            null;\n\n        for (const scope of missing) {\n            const entity = this.repository.create({\n                clientId: input.clientId,\n                realmId: input.realmId,\n                userId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n                scope,\n                expiresAt: null,\n            });\n\n            try {\n                await this.repository.save(entity);\n            } catch (e) {\n                if (!isUniqueConstraintDatabaseError(e)) {\n                    throw e;\n                }\n            }\n        }\n    }\n\n    async remove(entity: Consent): Promise<void> {\n        await this.repository.remove(entity as ConsentEntity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,IAAaQ,2BAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcN,aAAAA;CAC/C;CAEA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAef,WAAWa,IAAIF,KAAAA;EAEtCN,sBAAsBQ,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EASvDA,GAAGG,SAAS,kBAAkB,QAAA,CAAA,CACzBC,UAAU;GACP;GACA;GACA;GACA;EACH,CAAA;EAEL,IAAIL,QAAQM,OAERL,GAAGM,SAAS,+DAA+D;GACvEC,UAAUR,QAAQM,MAAMG;GACxBC,cAAcV,QAAQM,MAAMK;EAChC,CAAA;EAGJ,IAAIX,QAAQY,SAGRX,GAAGM,SAAS,8BAA8B,EAAEK,SAASZ,QAAQY,QAAQ,CAAA;EAGzE,MAAM,CAACC,UAAUC,SAAS,MAAMb,GAAGc,gBAAe;EAElD,OAAO;GACHC,MAAM3B,sBAAsBU,OAAOc,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGX;GACP;EACJ;CACJ;CAEA,MAAMe,YAAYC,IAAqC;EACnD,OAAO,KAAKxB,WAAWyB,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,uBAAuBC,UAAkBhB,OAAyC;EACpF,MAAML,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAC9CD,GAAGsB,MAAM,sFAAsF;GAC3FD;GACAb,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA;EACAV,GAAGuB,MACCrC,kBAAkB;GACdsC,QAAQnC,YAAYoC;GACpBC,KAAK,GAAGL,SAAS,GAAGhB,MAAMK,QAAQ,GAAGL,MAAMG;EAC/C,CAAA,GACA,GAAA;EAGJ,OAAOR,GAAG2B,QAAO;CACrB;CAEA,MAAMC,cAAcC,OAKF;EAGd,MAAMC,WAAW,MAAM,KAAKpC,WAAWO,mBAAmB,SAAA,CAAA,CACrDqB,MAAM,sFAAsF;GACzFD,UAAUQ,MAAMR;GAChBb,KAAKqB,MAAMxB,MAAMG;GACjBE,SAASmB,MAAMxB,MAAMK;EACzB,CAAA,CAAA,CACCiB,QAAO;EAEZ,MAAMI,iBAAiB,IAAIC,IAAIF,SAASG,KAAKC,QAAQA,IAAIC,KAAK,CAAA;EAC9D,MAAMC,UAAUP,MAAMQ,OAAOC,QAAQC,UAAU,CAACR,eAAeS,IAAID,KAAAA,CAAAA;EASnE,MAAME,SAASZ,MAAMxB,MAAMK,YAAYzB,aAAayD,OAChDb,MAAMxB,MAAMG,MACZ;EAEJ,KAAK,MAAM2B,SAASC,SAAS;GACzB,MAAMO,SAAS,KAAKjD,WAAWkD,OAAO;IAClCvB,UAAUQ,MAAMR;IAChBV,SAASkB,MAAMlB;IACf8B;IACAjC,KAAKqB,MAAMxB,MAAMG;IACjBE,SAASmB,MAAMxB,MAAMK;IACrByB;IACAU,WAAW;GACf,CAAA;GAEA,IAAI;IACA,MAAM,KAAKnD,WAAWoD,KAAKH,MAAAA;GAC/B,SAASI,GAAG;IACR,IAAI,CAACxD,gCAAgCwD,CAAAA,GACjC,MAAMA;GAEd;EACJ;CACJ;CAEA,MAAMC,OAAOL,QAAgC;EACzC,MAAM,KAAKjD,WAAWsD,OAAOL,MAAAA;CACjC;AACJ"}

package/dist/app/modules/oauth2/repositories/token/repository.mjs

@@ -85,7 +85,7 @@ var OAuth2TokenRepository = class {
 			const ttl = utc * 1e3 - Date.now();
 			if (ttl > 0) return ttl;
 		}
-		return 3600 * 1e3;
+		return 36e5;
 	}
 };
 //#endregion

package/dist/app/modules/oauth2/repositories/token/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["buildCacheKey","randomUUID","CacheOAuth2Prefix","OAuth2TokenRepository","cache","findOneBySignature","signature","get","prefix","TOKEN_CLAIMS","key","findOneById","id","TOKEN","removeById","token","drop","setInactive","exp","insert","payload","jti","set","ttl","buildTTL","save","saveWithSignature","data","normalized","isInactive","cacheKey","TOKEN_INACTIVE","response","claimInactive","add","utc","Date","now"],"sources":["../../../../../../src/app/modules/oauth2/repositories/token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { randomUUID } from 'node:crypto';\nimport type { IOAuth2TokenRepository } from '../../../../../core/index.ts';\nimport { CacheOAuth2Prefix } from '../constants.ts';\n\nexport class OAuth2TokenRepository implements IOAuth2TokenRepository {\n    protected cache : ICache;\n\n    constructor(cache: ICache) {\n        this.cache = cache;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneBySignature(signature: string): Promise<OAuth2TokenPayload | null> {\n        return this.cache.get<OAuth2TokenPayload>(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,\n                key: signature, \n            }),\n        );\n    }\n\n    async findOneById(id: string): Promise<OAuth2TokenPayload | null> {\n        return this.cache.get<OAuth2TokenPayload>(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN,\n                key: id, \n            }),\n        );\n    }\n\n    // -----------------------------------------------------\n\n    async removeById(id: string): Promise<void> {\n        const token = await this.findOneById(id);\n        if (!token) {\n            return;\n        }\n\n        const key = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN,\n            key: id, \n        });\n        await this.cache.drop(key);\n\n        await this.setInactive(id, token.exp);\n    }\n\n    // -----------------------------------------------------\n\n    async insert(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload> {\n        payload.jti = randomUUID();\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN,\n                key: payload.jti, \n            }),\n            payload,\n            { ttl: this.buildTTL(payload.exp) },\n        );\n\n        return payload;\n    }\n\n    async save(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload> {\n        if (payload.jti) {\n            return payload;\n        }\n\n        return this.insert(payload);\n    }\n\n    async saveWithSignature(data: OAuth2TokenPayload, signature: string): Promise<OAuth2TokenPayload> {\n        const normalized = await this.save(data);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,\n                key: signature, \n            }),\n            normalized,\n            { ttl: this.buildTTL(data.exp) },\n        );\n\n        return normalized;\n    }\n\n    // -----------------------------------------------------\n\n    async isInactive(key: string): Promise<boolean> {\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        const response = await this.cache.get(cacheKey);\n\n        return !!response;\n    }\n\n    async setInactive(key: string, exp?: number): Promise<void> {\n        const ttl = this.buildTTL(exp);\n\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        await this.cache.set(\n            cacheKey,\n            true,\n            { ttl },\n        );\n    }\n\n    async claimInactive(key: string, exp?: number): Promise<boolean> {\n        const ttl = this.buildTTL(exp);\n\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        // set-if-absent (Redis SET NX / single-tick memory adapter) — returns\n        // true only for the caller that actually transitioned the token to\n        // inactive, so concurrent single-use claims cannot both succeed.\n        return this.cache.add(\n            cacheKey,\n            true,\n            { ttl },\n        );\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Transform timestamp in seconds to ttl in ms.\n     *\n     * @param utc\n     * @protected\n     */\n    protected buildTTL(utc?: number) {\n        if (typeof utc === 'number') {\n            const ttl = (utc * 1000) - Date.now();\n            if (ttl > 0) {\n                return ttl;\n            }\n        }\n\n        return 3_600 * 1000;\n    }\n}\n"],"mappings":";;;;;;;AAcA,IAAaG,wBAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAIA,MAAMC,mBAAmBC,WAAuD;EAC5E,OAAO,KAAKF,MAAMG,IACdP,cAAc;GACVQ,QAAQN,kBAAkBO;GAC1BC,KAAKJ;EACT,CAAA,CAAA;CAER;CAEA,MAAMK,YAAYC,IAAgD;EAC9D,OAAO,KAAKR,MAAMG,IACdP,cAAc;GACVQ,QAAQN,kBAAkBW;GAC1BH,KAAKE;EACT,CAAA,CAAA;CAER;CAIA,MAAME,WAAWF,IAA2B;EACxC,MAAMG,QAAQ,MAAM,KAAKJ,YAAYC,EAAAA;EACrC,IAAI,CAACG,OACD;EAGJ,MAAML,MAAMV,cAAc;GACtBQ,QAAQN,kBAAkBW;GAC1BH,KAAKE;EACT,CAAA;EACA,MAAM,KAAKR,MAAMY,KAAKN,GAAAA;EAEtB,MAAM,KAAKO,YAAYL,IAAIG,MAAMG,GAAG;CACxC;CAIA,MAAMC,OAAOC,SAA0D;EACnEA,QAAQC,MAAMpB,WAAAA;EAEd,MAAM,KAAKG,MAAMkB,IACbtB,cAAc;GACVQ,QAAQN,kBAAkBW;GAC1BH,KAAKU,QAAQC;EACjB,CAAA,GACAD,SACA,EAAEG,KAAK,KAAKC,SAASJ,QAAQF,GAAG,EAAE,CAAA;EAGtC,OAAOE;CACX;CAEA,MAAMK,KAAKL,SAA0D;EACjE,IAAIA,QAAQC,KACR,OAAOD;EAGX,OAAO,KAAKD,OAAOC,OAAAA;CACvB;CAEA,MAAMM,kBAAkBC,MAA0BrB,WAAgD;EAC9F,MAAMsB,aAAa,MAAM,KAAKH,KAAKE,IAAAA;EAEnC,MAAM,KAAKvB,MAAMkB,IACbtB,cAAc;GACVQ,QAAQN,kBAAkBO;GAC1BC,KAAKJ;EACT,CAAA,GACAsB,YACA,EAAEL,KAAK,KAAKC,SAASG,KAAKT,GAAG,EAAE,CAAA;EAGnC,OAAOU;CACX;CAIA,MAAMC,WAAWnB,KAA+B;EAC5C,MAAMoB,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAIA,OAAO,CAAC,CAACsB,MAFc,KAAK5B,MAAMG,IAAIuB,QAAAA;CAG1C;CAEA,MAAMb,YAAYP,KAAaQ,KAA6B;EACxD,MAAMK,MAAM,KAAKC,SAASN,GAAAA;EAE1B,MAAMY,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAEA,MAAM,KAAKN,MAAMkB,IACbQ,UACA,MACA,EAAEP,IAAI,CAAA;CAEd;CAEA,MAAMU,cAAcvB,KAAaQ,KAAgC;EAC7D,MAAMK,MAAM,KAAKC,SAASN,GAAAA;EAE1B,MAAMY,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAKA,OAAO,KAAKN,MAAM8B,IACdJ,UACA,MACA,EAAEP,IAAI,CAAA;CAEd;;;;;;IAUA,SAAmBY,KAAc;EAC7B,IAAI,OAAOA,QAAQ,UAAU;GACzB,MAAMZ,MAAM,MAAO,MAAQa,KAAKC,IAAG;GACnC,IAAId,MAAM,GACN,OAAOA;EAEf;EAEA,OAAO,OAAQ;CACnB;AACJ"}
+{"version":3,"file":"repository.mjs","names":["buildCacheKey","randomUUID","CacheOAuth2Prefix","OAuth2TokenRepository","cache","findOneBySignature","signature","get","prefix","TOKEN_CLAIMS","key","findOneById","id","TOKEN","removeById","token","drop","setInactive","exp","insert","payload","jti","set","ttl","buildTTL","save","saveWithSignature","data","normalized","isInactive","cacheKey","TOKEN_INACTIVE","response","claimInactive","add","utc","Date","now"],"sources":["../../../../../../src/app/modules/oauth2/repositories/token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { randomUUID } from 'node:crypto';\nimport type { IOAuth2TokenRepository } from '../../../../../core/index.ts';\nimport { CacheOAuth2Prefix } from '../constants.ts';\n\nexport class OAuth2TokenRepository implements IOAuth2TokenRepository {\n    protected cache : ICache;\n\n    constructor(cache: ICache) {\n        this.cache = cache;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneBySignature(signature: string): Promise<OAuth2TokenPayload | null> {\n        return this.cache.get<OAuth2TokenPayload>(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,\n                key: signature, \n            }),\n        );\n    }\n\n    async findOneById(id: string): Promise<OAuth2TokenPayload | null> {\n        return this.cache.get<OAuth2TokenPayload>(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN,\n                key: id, \n            }),\n        );\n    }\n\n    // -----------------------------------------------------\n\n    async removeById(id: string): Promise<void> {\n        const token = await this.findOneById(id);\n        if (!token) {\n            return;\n        }\n\n        const key = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN,\n            key: id, \n        });\n        await this.cache.drop(key);\n\n        await this.setInactive(id, token.exp);\n    }\n\n    // -----------------------------------------------------\n\n    async insert(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload> {\n        payload.jti = randomUUID();\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN,\n                key: payload.jti, \n            }),\n            payload,\n            { ttl: this.buildTTL(payload.exp) },\n        );\n\n        return payload;\n    }\n\n    async save(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload> {\n        if (payload.jti) {\n            return payload;\n        }\n\n        return this.insert(payload);\n    }\n\n    async saveWithSignature(data: OAuth2TokenPayload, signature: string): Promise<OAuth2TokenPayload> {\n        const normalized = await this.save(data);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,\n                key: signature, \n            }),\n            normalized,\n            { ttl: this.buildTTL(data.exp) },\n        );\n\n        return normalized;\n    }\n\n    // -----------------------------------------------------\n\n    async isInactive(key: string): Promise<boolean> {\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        const response = await this.cache.get(cacheKey);\n\n        return !!response;\n    }\n\n    async setInactive(key: string, exp?: number): Promise<void> {\n        const ttl = this.buildTTL(exp);\n\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        await this.cache.set(\n            cacheKey,\n            true,\n            { ttl },\n        );\n    }\n\n    async claimInactive(key: string, exp?: number): Promise<boolean> {\n        const ttl = this.buildTTL(exp);\n\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        // set-if-absent (Redis SET NX / single-tick memory adapter) — returns\n        // true only for the caller that actually transitioned the token to\n        // inactive, so concurrent single-use claims cannot both succeed.\n        return this.cache.add(\n            cacheKey,\n            true,\n            { ttl },\n        );\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Transform timestamp in seconds to ttl in ms.\n     *\n     * @param utc\n     * @protected\n     */\n    protected buildTTL(utc?: number) {\n        if (typeof utc === 'number') {\n            const ttl = (utc * 1000) - Date.now();\n            if (ttl > 0) {\n                return ttl;\n            }\n        }\n\n        return 3_600 * 1000;\n    }\n}\n"],"mappings":";;;;;;;AAcA,IAAaG,wBAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAIA,MAAMC,mBAAmBC,WAAuD;EAC5E,OAAO,KAAKF,MAAMG,IACdP,cAAc;GACVQ,QAAQN,kBAAkBO;GAC1BC,KAAKJ;EACT,CAAA,CAAA;CAER;CAEA,MAAMK,YAAYC,IAAgD;EAC9D,OAAO,KAAKR,MAAMG,IACdP,cAAc;GACVQ,QAAQN,kBAAkBW;GAC1BH,KAAKE;EACT,CAAA,CAAA;CAER;CAIA,MAAME,WAAWF,IAA2B;EACxC,MAAMG,QAAQ,MAAM,KAAKJ,YAAYC,EAAAA;EACrC,IAAI,CAACG,OACD;EAGJ,MAAML,MAAMV,cAAc;GACtBQ,QAAQN,kBAAkBW;GAC1BH,KAAKE;EACT,CAAA;EACA,MAAM,KAAKR,MAAMY,KAAKN,GAAAA;EAEtB,MAAM,KAAKO,YAAYL,IAAIG,MAAMG,GAAG;CACxC;CAIA,MAAMC,OAAOC,SAA0D;EACnEA,QAAQC,MAAMpB,WAAAA;EAEd,MAAM,KAAKG,MAAMkB,IACbtB,cAAc;GACVQ,QAAQN,kBAAkBW;GAC1BH,KAAKU,QAAQC;EACjB,CAAA,GACAD,SACA,EAAEG,KAAK,KAAKC,SAASJ,QAAQF,GAAG,EAAE,CAAA;EAGtC,OAAOE;CACX;CAEA,MAAMK,KAAKL,SAA0D;EACjE,IAAIA,QAAQC,KACR,OAAOD;EAGX,OAAO,KAAKD,OAAOC,OAAAA;CACvB;CAEA,MAAMM,kBAAkBC,MAA0BrB,WAAgD;EAC9F,MAAMsB,aAAa,MAAM,KAAKH,KAAKE,IAAAA;EAEnC,MAAM,KAAKvB,MAAMkB,IACbtB,cAAc;GACVQ,QAAQN,kBAAkBO;GAC1BC,KAAKJ;EACT,CAAA,GACAsB,YACA,EAAEL,KAAK,KAAKC,SAASG,KAAKT,GAAG,EAAE,CAAA;EAGnC,OAAOU;CACX;CAIA,MAAMC,WAAWnB,KAA+B;EAC5C,MAAMoB,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAIA,OAAO,CAAC,CAACsB,MAFc,KAAK5B,MAAMG,IAAIuB,QAAAA;CAG1C;CAEA,MAAMb,YAAYP,KAAaQ,KAA6B;EACxD,MAAMK,MAAM,KAAKC,SAASN,GAAAA;EAE1B,MAAMY,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAEA,MAAM,KAAKN,MAAMkB,IACbQ,UACA,MACA,EAAEP,IAAI,CAAA;CAEd;CAEA,MAAMU,cAAcvB,KAAaQ,KAAgC;EAC7D,MAAMK,MAAM,KAAKC,SAASN,GAAAA;EAE1B,MAAMY,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAKA,OAAO,KAAKN,MAAM8B,IACdJ,UACA,MACA,EAAEP,IAAI,CAAA;CAEd;;;;;;IAUA,SAAmBY,KAAc;EAC7B,IAAI,OAAOA,QAAQ,UAAU;GACzB,MAAMZ,MAAM,MAAO,MAAQa,KAAKC,IAAG;GACnC,IAAId,MAAM,GACN,OAAOA;EAEf;EAEA,OAAO;CACX;AACJ"}

package/dist/app/modules/provisioning/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAmBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAWxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAOH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAWrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAiKjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAoBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAWxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAQH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAWrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAuKjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}

package/dist/app/modules/provisioning/module.mjs

@@ -9,6 +9,7 @@ import { ClientRoleEntity } from "../../../adapters/database/domains/client-role
 import { PermissionEntity } from "../../../adapters/database/domains/permission/entity.mjs";
 import { ClientPermissionEntity } from "../../../adapters/database/domains/client-permission/entity.mjs";
 import { ScopeEntity } from "../../../adapters/database/domains/scope/entity.mjs";
+import { ClientScopeEntity } from "../../../adapters/database/domains/client-scope/entity.mjs";
 import { UserRepository } from "../../../adapters/database/domains/user/repository.mjs";
 import { PermissionPolicyEntity } from "../../../adapters/database/domains/permission-policy/entity.mjs";
 import { RolePermissionEntity } from "../../../adapters/database/domains/role-permission/entity.mjs";
@@ -37,6 +38,7 @@ import { RealmRepositoryAdapter } from "../database/repositories/realm/repositor
 import { ClientRepositoryAdapter } from "../database/repositories/client/repository.mjs";
 import { ClientPermissionRepositoryAdapter } from "../database/repositories/client-permission/repository.mjs";
 import { ClientRoleRepositoryAdapter } from "../database/repositories/client-role/repository.mjs";
+import { ClientScopeRepositoryAdapter } from "../database/repositories/client-scope/repository.mjs";
 import { KeyRepositoryAdapter } from "../database/repositories/key/repository.mjs";
 import { PermissionRepositoryAdapter } from "../database/repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "../database/repositories/permission-policy/repository.mjs";
@@ -101,6 +103,11 @@ var ProvisionerModule = class {
 			repository: container.resolve(ClientEntity),
 			realmRepository
 		});
+		const scopeRepository = new ScopeRepositoryAdapter({
+			repository: container.resolve(ScopeEntity),
+			realmRepository
+		});
+		const clientScopeRepository = new ClientScopeRepositoryAdapter(container.resolve(ClientScopeEntity));
 		const permissionSynchronizer = new PermissionProvisioningSynchronizer({
 			repository: permissionRepository,
 			policyRepository,
@@ -115,8 +122,10 @@ var ProvisionerModule = class {
 			clientRepository,
 			clientRoleRepository: new ClientRoleRepositoryAdapter(container.resolve(ClientRoleEntity)),
 			clientPermissionRepository: new ClientPermissionRepositoryAdapter(container.resolve(ClientPermissionEntity)),
+			clientScopeRepository,
 			roleRepository,
 			permissionRepository,
+			scopeRepository,
 			roleSynchronizer,
 			permissionSynchronizer
 		});
@@ -131,26 +140,26 @@ var ProvisionerModule = class {
 			roleRepository,
 			permissionRepository
 		});
-		const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: new ScopeRepositoryAdapter({
-			repository: container.resolve(ScopeEntity),
-			realmRepository
-		}) });
+		const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });
+		const realmSynchronizer = new RealmProvisioningSynchronizer({
+			repository: new RealmRepositoryAdapter(realmRepository),
+			clientSynchronizer,
+			roleSynchronizer,
+			permissionSynchronizer,
+			userSynchronizer,
+			scopeSynchronizer
+		});
 		await new GraphProvisioningSynchronizer({
 			policySynchronizer,
 			permissionSynchronizer,
 			roleSynchronizer,
-			realmSynchronizer: new RealmProvisioningSynchronizer({
-				repository: new RealmRepositoryAdapter(realmRepository),
-				clientSynchronizer,
-				roleSynchronizer,
-				permissionSynchronizer,
-				userSynchronizer,
-				scopeSynchronizer
-			}),
+			realmSynchronizer,
 			scopeSynchronizer
 		}).synchronize(data);
 		const webClientProvisioner = new WebClientProvisioner({
 			clientRepository,
+			scopeRepository,
+			clientScopeRepository,
 			appOrigins: getAppOrigins(config),
 			logger: container.resolve(LoggerInjectionKey)
 		});

package/dist/app/modules/provisioning/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","WebClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    PermissionEntity,\n    RealmEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({\n                cwd: provisioningDir,\n                logger: container.resolve(LoggerInjectionKey),\n            }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm public `web` client. Single provisioning mechanism:\n        // list every realm (incl. pre-existing) and upsert its web client.\n        // Idempotent; guarded on builtIn inside the provisioner.\n        // ---------------------------------------------------------------\n        const webClientProvisioner = new WebClientProvisioner({\n            clientRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use. The\n        // adapter is constructed locally (NOT resolved from the oauth2\n        // module's registration) so provisioning stays runnable in minimal\n        // module graphs (test setup, CLI); the KEK handling is identical.\n        const keyProvisioner = new KeyProvisioner({\n            keyStore: new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            }),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await webClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permissionId: permission.id,\n                    permissionRealmId: permission.realmId,\n                    policyId: defaultPolicy.id,\n                    policyRealmId: defaultPolicy.realmId,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6EA,IAAagD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMwB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAElC,MAAMa,aAAab,UAAUE,QAAQtB,qBAAqBkC,UAAU;EACpE,MAAMC,kBAAkBf,UAAUE,QAA2BtD,WAAAA;EAE7D,MAAMoE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYjB,UAAUE,QAAsCvD,gBAAAA;GAC5DoE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI7D,iBAAiByD,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC8B,UAAUE,QAAsC/C,sBAAAA,CAAAA;EAGpD,MAAMiE,qBAAqB,IAAI3D,+BAA+B;GAC1DwD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI9C,sBAAsB;GAC7C0C,YAAYjB,UAAUE,QAA0BrD,UAAAA;GAChDkE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAIvD,wBAAwB;GACjDkD,YAAYjB,UAAUE,QAA4B1D,YAAAA;GAClDuE;EACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI/D,mCAAmC;GAClEyD,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAI7D,6BAA6B;GACtDsD,YAAYI;GACZL;GACAS,0BAA0B,IAAInD,gCAC1B0B,UAAUE,QAAoCpD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM4E,qBAAqB,IAAIpE,+BAA+B;GAC1DgE;GACAK,sBAAsB,IAAI3D,4BACtBgC,UAAUE,QAAgCxD,gBAAAA,CAAAA;GAE9CkF,4BAA4B,IAAI9D,kCAC5BkC,UAAUE,QAAsCzD,sBAAAA,CAAAA;GAGpD4E;GACAL;GAEAQ;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAIhE,6BAA6B;GACtDiE,gBAAgB,IAAIpD,sBAAsB;IACtCuC,YAAY,IAAI5D,eAAewD,UAAAA;IAC/BE;GACJ,CAAA;GACAgB,oBAAoB,IAAIpD,0BACpBqB,UAAUE,QAA8BjD,cAAAA,CAAAA;GAE5C+E,0BAA0B,IAAIvD,gCAC1BuB,UAAUE,QAAoClD,oBAAAA,CAAAA;GAGlDsE;GACAD;GACAL;EACJ,CAAA;EAOA,MAAMkB,oBAAoB,IAAItE,8BAA8B,EAAEqD,YAAYgB,IAL9CzD,uBAAuB;GAC/CyC,YAAYjB,UAAUE,QAA2BnD,WAAAA;GACjDgE;EACJ,CAE0EkB,EAAgB,CAAA;EAoB1F,MAAMG,IARuB7E,8BAA8B;GACvD6D;GACAG;GACAC;GACAW,mBAAAA,IAd0BzE,8BAA8B;IACxDuD,YAAY,IAAI5C,uBAAuB0C,eAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAK;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY1B,IAAAA;EAOnC,MAAM2B,uBAAuB,IAAIlD,qBAAqB;GAClDkC;GACAiB,YAAYtD,cAAcgB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMqD,iBAAiB,IAAInD,eAAe;GACtCoD,UAAU,IAAIxE,qBAAqB4C,YAAY,EAC3C6B,eAAezC,OAAO0C,uBAClB,IAAIzD,gBAAgBe,OAAO0C,oBAAoB,IAC/C,KACR,CAAA;GACAlC,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAEA,MAAMyD,SAAS,MAAM7B,gBAAgB8B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMN,qBAAqBS,eAAeD,KAAAA;GAC1C,MAAMN,eAAeO,eAAeD,KAAAA;EACxC;EAEA,IAAI7C,OAAO+C,oCACP,MAAM,KAAKC,oBAAoBpC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgB+B,oBACZpC,YACAK,kBACa;EACb,MAAMgC,gBAAgB,MAAMhC,iBAAiBiC,cAAcjG,iBAAiBkG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBxC,WAAWyC,cAAc3G,gBAAAA;EAChD,MAAM4G,eAAe1C,WAAWyC,cAAcnG,sBAAAA;EAE9C,MAAMqG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}
+{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","ClientScopeRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","WebClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","scopeRepository","clientScopeRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    PermissionEntity,\n    RealmEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    ClientScopeRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({\n                cwd: provisioningDir,\n                logger: container.resolve(LoggerInjectionKey),\n            }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n        const clientScopeRepository = new ClientScopeRepositoryAdapter(\n            container.resolve<Repository<ClientScope>>(ClientScopeEntity),\n        );\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n            clientScopeRepository,\n\n            roleRepository,\n            permissionRepository,\n            scopeRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm public `web` client. Single provisioning mechanism:\n        // list every realm (incl. pre-existing) and upsert its web client.\n        // Idempotent; guarded on builtIn inside the provisioner.\n        // ---------------------------------------------------------------\n        const webClientProvisioner = new WebClientProvisioner({\n            clientRepository,\n            scopeRepository,\n            clientScopeRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use. The\n        // adapter is constructed locally (NOT resolved from the oauth2\n        // module's registration) so provisioning stays runnable in minimal\n        // module graphs (test setup, CLI); the KEK handling is identical.\n        const keyProvisioner = new KeyProvisioner({\n            keyStore: new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            }),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await webClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permissionId: permission.id,\n                    permissionRealmId: permission.realmId,\n                    policyId: defaultPolicy.id,\n                    policyRealmId: defaultPolicy.realmId,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgFA,IAAakD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMwB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAElC,MAAMa,aAAab,UAAUE,QAAQtB,qBAAqBkC,UAAU;EACpE,MAAMC,kBAAkBf,UAAUE,QAA2BvD,WAAAA;EAE7D,MAAMqE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYjB,UAAUE,QAAsCxD,gBAAAA;GAC5DqE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI9D,iBAAiB0D,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC8B,UAAUE,QAAsChD,sBAAAA,CAAAA;EAGpD,MAAMkE,qBAAqB,IAAI5D,+BAA+B;GAC1DyD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI9C,sBAAsB;GAC7C0C,YAAYjB,UAAUE,QAA0BtD,UAAAA;GAChDmE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAIxD,wBAAwB;GACjDmD,YAAYjB,UAAUE,QAA4B5D,YAAAA;GAClDyE;EACJ,CAAA;EACA,MAAMQ,kBAAkB,IAAI/C,uBAAuB;GAC/CyC,YAAYjB,UAAUE,QAA2BpD,WAAAA;GACjDiE;EACJ,CAAA;EACA,MAAMS,wBAAwB,IAAIxD,6BAC9BgC,UAAUE,QAAiCzD,iBAAAA,CAAAA;EAG/C,MAAMgF,yBAAyB,IAAIlE,mCAAmC;GAClE0D,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMO,mBAAmB,IAAIhE,6BAA6B;GACtDuD,YAAYI;GACZL;GACAW,0BAA0B,IAAIrD,gCAC1B0B,UAAUE,QAAoCrD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM+E,qBAAqB,IAAIvE,+BAA+B;GAC1DiE;GACAO,sBAAsB,IAAI9D,4BACtBiC,UAAUE,QAAgC1D,gBAAAA,CAAAA;GAE9CsF,4BAA4B,IAAIjE,kCAC5BmC,UAAUE,QAAsC3D,sBAAAA,CAAAA;GAEpDiF;GAEAH;GACAL;GACAO;GAEAG;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAInE,6BAA6B;GACtDoE,gBAAgB,IAAItD,sBAAsB;IACtCuC,YAAY,IAAI7D,eAAeyD,UAAAA;IAC/BE;GACJ,CAAA;GACAkB,oBAAoB,IAAItD,0BACpBqB,UAAUE,QAA8BlD,cAAAA,CAAAA;GAE5CkF,0BAA0B,IAAIzD,gCAC1BuB,UAAUE,QAAoCnD,oBAAAA,CAAAA;GAGlDuE;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMmB,oBAAoB,IAAIxE,8BAA8B,EAAEsD,YAAYM,gBAAgB,CAAA;EAE1F,MAAMa,oBAAoB,IAAI3E,8BAA8B;GACxDwD,YAAY,IAAI5C,uBAAuB0C,eAAAA;GAEvCa;GACAF;GACAD;GACAM;GACAI;EACJ,CAAA;EAUA,MAAME,IARuB/E,8BAA8B;GACvD8D;GACAK;GACAC;GACAU;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY3B,IAAAA;EAOnC,MAAM4B,uBAAuB,IAAInD,qBAAqB;GAClDkC;GACAC;GACAC;GACAgB,YAAYvD,cAAcgB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMsD,iBAAiB,IAAIpD,eAAe;GACtCqD,UAAU,IAAIzE,qBAAqB4C,YAAY,EAC3C8B,eAAe1C,OAAO2C,uBAClB,IAAI1D,gBAAgBe,OAAO2C,oBAAoB,IAC/C,KACR,CAAA;GACAnC,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAEA,MAAM0D,SAAS,MAAM9B,gBAAgB+B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMN,qBAAqBS,eAAeD,KAAAA;GAC1C,MAAMN,eAAeO,eAAeD,KAAAA;EACxC;EAEA,IAAI9C,OAAOgD,oCACP,MAAM,KAAKC,oBAAoBrC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgBgC,oBACZrC,YACAK,kBACa;EACb,MAAMiC,gBAAgB,MAAMjC,iBAAiBkC,cAAcnG,iBAAiBoG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBzC,WAAW0C,cAAc7G,gBAAAA;EAChD,MAAM8G,eAAe3C,WAAW0C,cAAcrG,sBAAAA;EAE9C,MAAMuG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}

package/dist/app/modules/provisioning/sources/file/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAOlE,qBAAa,sBAAuB,YAAW,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,OAAO,EAAE,+BAA+B;IAM9C,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;CA4ChD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAOlE,qBAAa,sBAAuB,YAAW,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,OAAO,EAAE,+BAA+B;IAM9C,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;CAiEhD"}

package/dist/app/modules/provisioning/sources/file/module.mjs

@@ -6,6 +6,7 @@ import "../../../../../core/provisioning/entities/index.mjs";
 import { CompositeProvisioningSource } from "../composite/module.mjs";
 import "../composite/index.mjs";
 import { ValidatorGroup, isObject } from "@authup/kit";
+import { isValidupError, stringifyPath } from "validup";
 import path from "node:path";
 import { locateMany, read } from "locter";
 //#region src/app/modules/provisioning/sources/file/module.ts
@@ -25,14 +26,22 @@ var FileProvisioningSource = class {
 		this.rootValidator = new RootProvisioningValidator();
 	}
 	async load() {
-		const locations = await locateMany("*.{json,yaml,yml,ts,mts,mjs,js}", { cwd: path.isAbsolute(this.options.cwd) ? this.options.cwd : path.join(process.cwd(), this.options.cwd) });
+		const cwd = path.isAbsolute(this.options.cwd) ? this.options.cwd : path.join(process.cwd(), this.options.cwd);
+		const locations = await locateMany("*.{json,yaml,yml,ts,mts,mjs,js}", { cwd });
 		const compositeSource = new CompositeProvisioningSource([]);
 		const output = {};
 		for (const location of locations) {
 			const raw = await read(location);
 			const entity = typeof location.extension === "string" && MODULE_FILE_EXTENSIONS.has(location.extension.toLowerCase()) && isObject(raw) && "default" in raw ? raw.default : raw;
 			if (!isObject(entity)) throw new Error(`The provisioning file "${location.path}" must contain an object at its root.`);
-			const data = await this.rootValidator.run(entity, { group: ValidatorGroup.PROVISIONING });
+			let data;
+			try {
+				data = await this.rootValidator.run(entity, { group: ValidatorGroup.PROVISIONING });
+			} catch (e) {
+				if (!isValidupError(e)) throw e;
+				const issues = e.issues.map((issue) => `  ${stringifyPath(issue.path)}: ${issue.message}`).join("\n");
+				throw new Error(`The provisioning file "${location.path}" is invalid.\n${issues}`, { cause: e });
+			}
 			compositeSource.merge(output, data);
 		}
 		return output;

package/dist/app/modules/provisioning/sources/file/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ValidatorGroup","isObject","locateMany","read","path","RootProvisioningValidator","CompositeProvisioningSource","MODULE_FILE_EXTENSIONS","Set","FileProvisioningSource","options","rootValidator","load","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","isModule","extension","has","toLowerCase","entity","default","Error","data","run","group","PROVISIONING","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { ValidatorGroup, isObject } from '@authup/kit';\nimport { locateMany, read } from 'locter';\nimport path from 'node:path';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\n// Extensions locter loads as an ES module namespace ({ default, ...named }),\n// as opposed to data files (json/yaml/yml) whose parsed value is returned\n// directly. Only the former should have their `default` export unwrapped.\nconst MODULE_FILE_EXTENSIONS = new Set(['.ts', '.mts', '.cts', '.js', '.mjs', '.cjs']);\n\nexport class FileProvisioningSource implements IProvisioningSource {\n    protected options: FileEntitySchemaImporterOptions;\n\n    protected rootValidator: RootProvisioningValidator;\n\n    constructor(options: FileEntitySchemaImporterOptions) {\n        this.options = options;\n\n        this.rootValidator = new RootProvisioningValidator();\n    }\n\n    async load(): Promise<RootProvisioningEntity> {\n        const cwd = path.isAbsolute(this.options.cwd) ?\n            this.options.cwd :\n            path.join(process.cwd(), this.options.cwd);\n\n        const locations = await locateMany('*.{json,yaml,yml,ts,mts,mjs,js}', { cwd });\n\n        const compositeSource = new CompositeProvisioningSource([]);\n\n        const output : RootProvisioningEntity = {};\n        for (const location of locations) {\n            const raw = await read(location);\n            // Unwrap the default export only for module files; a data file\n            // (json/yaml) whose root legitimately carries a `default` key must\n            // keep all of its keys.\n            const isModule = typeof location.extension === 'string' &&\n                MODULE_FILE_EXTENSIONS.has(location.extension.toLowerCase());\n            const entity = isModule && isObject(raw) && 'default' in raw ?\n                raw.default :\n                raw;\n\n            // Fail closed on a malformed root (top-level list/scalar, or an\n            // empty file parsing to null) instead of silently provisioning\n            // nothing — the same silent-skip class the loader otherwise avoids.\n            if (!isObject(entity)) {\n                throw new Error(`The provisioning file \"${location.path}\" must contain an object at its root.`);\n            }\n\n            // Provisioning files use the camelCase management vocabulary\n            // (plan 073). Keys are NOT rewritten here: a blanket snake->camel\n            // pass cannot tell a schema property from a data-identifier map key\n            // (`clientPermissions`/`clientRoles` are keyed by client name, and\n            // client names may contain underscores), so it would silently\n            // corrupt those keys. Unmounted keys are stripped by the validator.\n            const data = await this.rootValidator.run(\n                entity as Record<string, any>,\n                { group: ValidatorGroup.PROVISIONING },\n            );\n\n            compositeSource.merge(output, data);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;;;AAmBA,MAAMO,yCAAyB,IAAIC,IAAI;CAAC;CAAO;CAAQ;CAAQ;CAAO;CAAQ;AAAO,CAAA;AAErF,IAAaC,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMO,OAAwC;EAK1C,MAAMK,YAAY,MAAMf,WAAW,mCAAmC,EAAEW,KAJ5DT,KAAKU,WAAW,KAAKJ,QAAQG,GAAG,IACxC,KAAKH,QAAQG,MACbT,KAAKW,KAAKC,QAAQH,IAAG,GAAI,KAAKH,QAAQG,GAAG,EAE+B,CAAA;EAE5E,MAAMK,kBAAkB,IAAIZ,4BAA4B,CAAA,CAAE;EAE1D,MAAMa,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,MAAMlB,KAAKiB,QAAAA;GAMvB,MAAMM,SAFW,OAAON,SAASG,cAAc,YAC3ChB,uBAAuBiB,IAAIJ,SAASG,UAAUE,YAAW,CAAA,KAClCxB,SAASoB,GAAAA,KAAQ,aAAaA,MACrDA,IAAIM,UACJN;GAKJ,IAAI,CAACpB,SAASyB,MAAAA,GACV,MAAM,IAAIE,MAAM,0BAA0BR,SAAShB,KAAK,sCAAsC;GASlG,MAAMyB,OAAO,MAAM,KAAKlB,cAAcmB,IAClCJ,QACA,EAAEK,OAAO/B,eAAegC,aAAa,CAAA;GAGzCd,gBAAgBe,MAAMd,QAAQU,IAAAA;EAClC;EAEA,OAAOV;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["ValidatorGroup","isObject","locateMany","read","path","isValidupError","stringifyPath","RootProvisioningValidator","CompositeProvisioningSource","MODULE_FILE_EXTENSIONS","Set","FileProvisioningSource","options","rootValidator","load","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","isModule","extension","has","toLowerCase","entity","default","Error","data","run","group","PROVISIONING","e","issues","map","issue","message","cause","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { ValidatorGroup, isObject } from '@authup/kit';\nimport { locateMany, read } from 'locter';\nimport path from 'node:path';\nimport { isValidupError, stringifyPath } from 'validup';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\n// Extensions locter loads as an ES module namespace ({ default, ...named }),\n// as opposed to data files (json/yaml/yml) whose parsed value is returned\n// directly. Only the former should have their `default` export unwrapped.\nconst MODULE_FILE_EXTENSIONS = new Set(['.ts', '.mts', '.cts', '.js', '.mjs', '.cjs']);\n\nexport class FileProvisioningSource implements IProvisioningSource {\n    protected options: FileEntitySchemaImporterOptions;\n\n    protected rootValidator: RootProvisioningValidator;\n\n    constructor(options: FileEntitySchemaImporterOptions) {\n        this.options = options;\n\n        this.rootValidator = new RootProvisioningValidator();\n    }\n\n    async load(): Promise<RootProvisioningEntity> {\n        const cwd = path.isAbsolute(this.options.cwd) ?\n            this.options.cwd :\n            path.join(process.cwd(), this.options.cwd);\n\n        const locations = await locateMany('*.{json,yaml,yml,ts,mts,mjs,js}', { cwd });\n\n        const compositeSource = new CompositeProvisioningSource([]);\n\n        const output : RootProvisioningEntity = {};\n        for (const location of locations) {\n            const raw = await read(location);\n            // Unwrap the default export only for module files; a data file\n            // (json/yaml) whose root legitimately carries a `default` key must\n            // keep all of its keys.\n            const isModule = typeof location.extension === 'string' &&\n                MODULE_FILE_EXTENSIONS.has(location.extension.toLowerCase());\n            const entity = isModule && isObject(raw) && 'default' in raw ?\n                raw.default :\n                raw;\n\n            // Fail closed on a malformed root (top-level list/scalar, or an\n            // empty file parsing to null) instead of silently provisioning\n            // nothing — the same silent-skip class the loader otherwise avoids.\n            if (!isObject(entity)) {\n                throw new Error(`The provisioning file \"${location.path}\" must contain an object at its root.`);\n            }\n\n            // Provisioning files use the camelCase management vocabulary\n            // (plan 073). Keys are NOT rewritten here: a blanket snake->camel\n            // pass cannot tell a schema property from a data-identifier map key\n            // (`clientPermissions`/`clientRoles` are keyed by client name, and\n            // client names may contain underscores), so it would silently\n            // corrupt those keys. Unmounted keys are stripped by the validator.\n            let data : RootProvisioningEntity;\n            try {\n                data = await this.rootValidator.run(\n                    entity as Record<string, any>,\n                    { group: ValidatorGroup.PROVISIONING },\n                );\n            } catch (e) {\n                // The raw ValidupError message is a generic\n                // \"Property <path> is invalid\" and names neither the file nor\n                // the reason, so a bad entry in one of several mounted files\n                // aborted the boot with nothing to act on. Re-throw with the\n                // file path and every issue message attached.\n                if (!isValidupError(e)) {\n                    throw e;\n                }\n\n                const issues = e.issues\n                    .map((issue) => `  ${stringifyPath(issue.path)}: ${issue.message}`)\n                    .join('\\n');\n\n                throw new Error(\n                    `The provisioning file \"${location.path}\" is invalid.\\n${issues}`,\n                    { cause: e },\n                );\n            }\n\n            compositeSource.merge(output, data);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,MAAMS,yCAAyB,IAAIC,IAAI;CAAC;CAAO;CAAQ;CAAQ;CAAO;CAAQ;AAAO,CAAA;AAErF,IAAaC,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMO,OAAwC;EAC1C,MAAMC,MAAMX,KAAKY,WAAW,KAAKJ,QAAQG,GAAG,IACxC,KAAKH,QAAQG,MACbX,KAAKa,KAAKC,QAAQH,IAAG,GAAI,KAAKH,QAAQG,GAAG;EAE7C,MAAMI,YAAY,MAAMjB,WAAW,mCAAmC,EAAEa,IAAI,CAAA;EAE5E,MAAMK,kBAAkB,IAAIZ,4BAA4B,CAAA,CAAE;EAE1D,MAAMa,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,MAAMpB,KAAKmB,QAAAA;GAMvB,MAAMM,SAFW,OAAON,SAASG,cAAc,YAC3ChB,uBAAuBiB,IAAIJ,SAASG,UAAUE,YAAW,CAAA,KAClC1B,SAASsB,GAAAA,KAAQ,aAAaA,MACrDA,IAAIM,UACJN;GAKJ,IAAI,CAACtB,SAAS2B,MAAAA,GACV,MAAM,IAAIE,MAAM,0BAA0BR,SAASlB,KAAK,sCAAsC;GASlG,IAAI2B;GACJ,IAAI;IACAA,OAAO,MAAM,KAAKlB,cAAcmB,IAC5BJ,QACA,EAAEK,OAAOjC,eAAekC,aAAa,CAAA;GAE7C,SAASC,GAAG;IAMR,IAAI,CAAC9B,eAAe8B,CAAAA,GAChB,MAAMA;IAGV,MAAMC,SAASD,EAAEC,OACZC,KAAKC,UAAU,KAAKhC,cAAcgC,MAAMlC,IAAI,EAAE,IAAIkC,MAAMC,SAAS,CAAA,CACjEtB,KAAK,IAAA;IAEV,MAAM,IAAIa,MACN,0BAA0BR,SAASlB,KAAK,iBAAiBgC,UACzD,EAAEI,OAAOL,EAAE,CAAA;GAEnB;GAEAf,gBAAgBqB,MAAMpB,QAAQU,IAAAA;EAClC;EAEA,OAAOV;CACX;AACJ"}

package/dist/app/types.d.ts

@@ -0,0 +1,5 @@
+import type { ConfigModule } from './modules/index.ts';
+export type CreateApplicationContext = {
+    config?: ConfigModule;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/app/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/app/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,MAAM,wBAAwB,GAAG;IACnC,MAAM,CAAC,EAAE,YAAY,CAAC;CACzB,CAAC"}

package/dist/app/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};