npm - @authup/server-core - Versions diffs - 1.0.0-beta.56 → 1.0.0-beta.58 - Mend

@authup/server-core 1.0.0-beta.56 → 1.0.0-beta.58

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (478) hide show

package/dist/core/authentication/login-throttle/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/login-throttle/service.ts"],"names":[],"mappings":"~~AASA~~,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAKlH,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,OAAO,EAAE,2BAA2B,CAAC;gBAEnC,GAAG,EAAE,2BAA2B;IAKtC,kBAAkB,CACpB,GAAG,EAAE;QACD,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC1B,GACF,OAAO,CAAC,IAAI,CAAC;~~CA4BnB~~"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/login-throttle/service.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAKlH,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,OAAO,EAAE,2BAA2B,CAAC;gBAEnC,GAAG,EAAE,2BAA2B;IAKtC,kBAAkB,CACpB,GAAG,EAAE;QACD,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC1B,GACF,OAAO,CAAC,IAAI,CAAC;CA+BnB"}

package/dist/core/authentication/login-throttle/service.mjs CHANGED Viewed

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import "../../entities/event/constants.mjs";
 import { EventName } from "@authup/core-kit";
 import { LoginThrottledError } from "@authup/errors";
 //#region src/core/authentication/login-throttle/service.ts
@@ -20,7 +21,7 @@ var LoginThrottleService = class {
 		const windowSeconds = this.options.windowSeconds ?? DEFAULT_WINDOW_SECONDS;
 		if (await this.repository.countRecent({
 			name: EventName.LOGIN_FAILED,
-			actorName: ctx.identifier,
+			actorName: ctx.identifier.slice(0, 128),
 			requestIpAddress: ctx.ipAddress,
 			realmId: ctx.realmId,
 			since: (/* @__PURE__ */ new Date(Date.now() - windowSeconds * 1e3)).toISOString()

package/dist/core/authentication/login-throttle/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["EventName","LoginThrottledError","DEFAULT_THRESHOLD","DEFAULT_WINDOW_SECONDS","LoginThrottleService","repository","options","ctx","assertNotThrottled","enabled","ipAddress","threshold","windowSeconds","count","countRecent","name","LOGIN_FAILED","actorName","identifier","requestIpAddress","realmId","since","Date","now","toISOString","retryAfter"],"sources":["../../../../src/core/authentication/login-throttle/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { EventName } from '@authup/core-kit';\nimport { LoginThrottledError } from '@authup/errors';\nimport type { IEventRepository } from '../../entities/index.ts';\nimport type { ILoginThrottleService, LoginThrottleServiceContext, LoginThrottleServiceOptions } from './types.ts';\n\nconst DEFAULT_THRESHOLD = 5;\nconst DEFAULT_WINDOW_SECONDS = 900;\n\nexport class LoginThrottleService implements ILoginThrottleService {\n protected repository: IEventRepository;\n\n protected options: LoginThrottleServiceOptions;\n\n constructor(ctx: LoginThrottleServiceContext) {\n this.repository = ctx.repository;\n this.options = ctx.options ?? {};\n }\n\n async assertNotThrottled(\n ctx: {\n identifier: string, \n ipAddress?: string, \n realmId?: string \| null \n },\n ): Promise<void> {\n if (!this.options.enabled) {\n return;\n }\n\n // The (identifier, ip) pair is the account-lockout-DoS mitigation: an\n // attacker on one IP can never lock the victim's other IPs. Without a\n // derivable IP the pair does not exist, so the throttle fails open\n // instead of degrading to a lockable per-identifier key.\n if (!ctx.ipAddress) {\n return;\n }\n\n const threshold = this.options.threshold ?? DEFAULT_THRESHOLD;\n const windowSeconds = this.options.windowSeconds ?? DEFAULT_WINDOW_SECONDS;\n\n const count = await this.repository.countRecent({\n name: EventName.LOGIN_FAILED,\n actorName: ctx.identifier,\n requestIpAddress: ctx.ipAddress,\n realmId: ctx.realmId,\n since: new Date(Date.now() - (windowSeconds 1_000)).toISOString(),\n });\n\n if (count >= threshold) {\n throw new LoginThrottledError({ retryAfter: windowSeconds });\n }\n }\n}\n"],"mappings":"~~;;;;;;AAYA~~,~~MAAME~~,oBAAoB;AAC1B,MAAMC,yBAAyB;AAE/B,IAAaC,uBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,mBACFD,KAKa;EACb,IAAI,CAAC,KAAKD,QAAQG,SACd;EAOJ,IAAI,CAACF,IAAIG,WACL;EAGJ,MAAMC,YAAY,KAAKL,QAAQK,aAAaT;EAC5C,MAAMU,gBAAgB,KAAKN,QAAQM,iBAAiBT;~~EAUpD~~,IAAIU,~~MARgB~~,KAAKR,WAAWS,YAAY;GAC5CC,~~MAAMf~~,~~UAAUgB~~;~~GAChBC~~,WAAWV,IAAIW;~~GACfC~~,~~kBAAkBZ~~,IAAIG;~~GACtBU~~,~~SAASb~~,~~IAAIa~~;GACbC,wBAAO,IAAIC,KAAKA,KAAKC,IAAG,~~IAAMX~~,gBAAgB,GAAA,EAAA,~~CAAQY~~,YAAW;EACrE,CAAA,~~KAEab~~,WACT,MAAM,~~IAAIV~~,oBAAoB,~~EAAEwB~~,~~YAAYb~~,cAAc,CAAA;CAElE;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["EventName","LoginThrottledError","EVENT_ACTOR_NAME_MAX_LENGTH","DEFAULT_THRESHOLD","DEFAULT_WINDOW_SECONDS","LoginThrottleService","repository","options","ctx","assertNotThrottled","enabled","ipAddress","threshold","windowSeconds","count","countRecent","name","LOGIN_FAILED","actorName","identifier","slice","requestIpAddress","realmId","since","Date","now","toISOString","retryAfter"],"sources":["../../../../src/core/authentication/login-throttle/service.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { EventName } from '@authup/core-kit';\nimport { LoginThrottledError } from '@authup/errors';\n// direct file import — the entities barrel reaches every entity service, and a\n// value import of it from here would pull that graph in at module init.\nimport { EVENT_ACTOR_NAME_MAX_LENGTH } from '../../entities/event/constants.ts';\nimport type { IEventRepository } from '../../entities/index.ts';\nimport type { ILoginThrottleService, LoginThrottleServiceContext, LoginThrottleServiceOptions } from './types.ts';\n\nconst DEFAULT_THRESHOLD = 5;\nconst DEFAULT_WINDOW_SECONDS = 900;\n\nexport class LoginThrottleService implements ILoginThrottleService {\n protected repository: IEventRepository;\n\n protected options: LoginThrottleServiceOptions;\n\n constructor(ctx: LoginThrottleServiceContext) {\n this.repository = ctx.repository;\n this.options = ctx.options ?? {};\n }\n\n async assertNotThrottled(\n ctx: {\n identifier: string, \n ipAddress?: string, \n realmId?: string \| null \n },\n ): Promise<void> {\n if (!this.options.enabled) {\n return;\n }\n\n // The (identifier, ip) pair is the account-lockout-DoS mitigation: an\n // attacker on one IP can never lock the victim's other IPs. Without a\n // derivable IP the pair does not exist, so the throttle fails open\n // instead of degrading to a lockable per-identifier key.\n if (!ctx.ipAddress) {\n return;\n }\n\n const threshold = this.options.threshold ?? DEFAULT_THRESHOLD;\n const windowSeconds = this.options.windowSeconds ?? DEFAULT_WINDOW_SECONDS;\n\n const count = await this.repository.countRecent({\n name: EventName.LOGIN_FAILED,\n // the loginFailed rows are persisted with the actor name truncated\n // to the column bound — an untruncated key would never match its\n // own rows, silently failing open for over-long identifiers.\n actorName: ctx.identifier.slice(0, EVENT_ACTOR_NAME_MAX_LENGTH),\n requestIpAddress: ctx.ipAddress,\n realmId: ctx.realmId,\n since: new Date(Date.now() - (windowSeconds 1_000)).toISOString(),\n });\n\n if (count >= threshold) {\n throw new LoginThrottledError({ retryAfter: windowSeconds });\n }\n }\n}\n"],"mappings":";;;;;;;AAeA,MAAMG,oBAAoB;AAC1B,MAAMC,yBAAyB;AAE/B,IAAaC,uBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,mBACFD,KAKa;EACb,IAAI,CAAC,KAAKD,QAAQG,SACd;EAOJ,IAAI,CAACF,IAAIG,WACL;EAGJ,MAAMC,YAAY,KAAKL,QAAQK,aAAaT;EAC5C,MAAMU,gBAAgB,KAAKN,QAAQM,iBAAiBT;EAapD,IAAIU,MAXgB,KAAKR,WAAWS,YAAY;GAC5CC,MAAMhB,UAAUiB;GAIhBC,WAAWV,IAAIW,WAAWC,MAAM,GAAA,GAAGlB;GACnCmB,kBAAkBb,IAAIG;GACtBW,SAASd,IAAIc;GACbC,wBAAO,IAAIC,KAAKA,KAAKC,IAAG,IAAMZ,gBAAgB,GAAA,EAAA,CAAQa,YAAW;EACrE,CAAA,KAEad,WACT,MAAM,IAAIX,oBAAoB,EAAE0B,YAAYd,cAAc,CAAA;CAElE;AACJ"}

package/dist/core/authentication/session/module.mjs CHANGED Viewed

@@ -23,15 +23,13 @@ var SessionManager = class {
 			case IdentityType.CLIENT:
 				input.clientId = input.sub;
 				break;
-			case IdentityType.USER:
-				input.userId = input.sub;
-				break;
+			case IdentityType.USER: input.userId = input.sub;
 		}
 		return this.repository.save(input);
 	}
 	async ping(session) {
 		if (session.seenAt) {
-			if (new Date(session.seenAt).getTime() + 5 * 1e3 > Date.now()) return session;
+			if (new Date(session.seenAt).getTime() + 5e3 > Date.now()) return session;
 		}
 		session.seenAt = (/* @__PURE__ */ new Date()).toISOString();
 		return this.repository.save(session);

package/dist/core/authentication/session/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ipAddress","userAgent","expiresAt","Date","now","maxAge","toISOString","subKind","CLIENT","clientId","sub","USER","userId","save","ping","session","seenAt","getTime","threshold","refresh","refreshedAt","markMfaVerified","mfaAt","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n ISessionManager, \n ISessionRepository, \n SessionManagerContext, \n SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n protected options: SessionManagerOptions;\n\n protected repository: ISessionRepository;\n\n // -----------------------------------------------------\n\n constructor(ctx: SessionManagerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n }\n\n // -----------------------------------------------------\n\n /\n Create/Update session\n \n @param input\n /\n async create(input: Partial<Session>): Promise<Session> {\n input.ipAddress = input.ipAddress \|\| '127.0.0.1';\n input.userAgent = input.userAgent \|\| 'system';\n input.expiresAt = input.expiresAt \|\| new Date(\n Date.now() + (this.options.maxAge 1_000),\n ).toISOString();\n\n switch (input.subKind) {\n case IdentityType.CLIENT: {\n input.clientId = input.sub;\n break;\n }\n case IdentityType.USER: {\n input.userId = input.sub;\n break;\n }\n }\n\n return this.repository.save(input);\n }\n\n // -----------------------------------------------------\n\n async ping(session: Session): Promise<Session> {\n if (session.seenAt) {\n const seenAt = new Date(session.seenAt).getTime();\n const threshold = seenAt + (5 * 1_000);\n\n if (threshold > Date.now()) {\n return session;\n }\n }\n\n session.seenAt = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async refresh(session: Session): Promise<Session> {\n const now = new Date().toISOString();\n session.refreshedAt = now;\n session.seenAt = now;\n\n session.expiresAt = new Date(\n Date.now() + (this.options.maxAge * 1_000),\n ).toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async markMfaVerified(session: Session): Promise<Session> {\n session.mfaAt = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n /*\n Verify session on token inspection/verification.\n \n @param id\n * @throws JWTError\n */\n async findOneById(id: string): Promise<Session \| null> {\n return this.repository.findOneById(id);\n }\n\n // -----------------------------------------------------\n\n async revoke(id: string): Promise<void> {\n await this.repository.removeById(id);\n }\n\n // -----------------------------------------------------\n\n async verify(session: Session): Promise<void> {\n const ms = new Date(session.expiresAt).getTime();\n if (Date.now() > ms) {\n await this.repository.remove(session);\n\n // todo: better error\n throw JWTError.expired();\n }\n }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,YAAYD,MAAMC,aAAa;EACrCD,MAAME,YAAYF,MAAME,aAAa;EACrCF,MAAMG,YAAYH,MAAMG,aAAa,IAAIC,KACrCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,SAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,WAAWV,MAAMW;IACvB;GAEJ,KAAKlB,aAAamB~~;IACdZ~~,MAAMa,SAASb,MAAMW;~~IACrB~~;~~EAER;~~EAEA,OAAO,KAAKd,WAAWiB,KAAKd,KAAAA;CAChC;CAIA,MAAMe,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC,QACO;OAAA,IAAIb,KAAKY,QAAQC,MAAM,CAAA,CAAEC,QACtBD,IAAU,~~IAAI~~,~~MAEhBb,~~KAAKC,IAAG,GACpB,OAAOW;EAAAA;EAIfA,QAAQC,0BAAS,IAAIb,KAAAA,EAAAA,CAAOG,YAAW;EAEvC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMI,QAAQJ,SAAoC;EAC9C,MAAMX,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCS,QAAQK,cAAchB;EACtBW,QAAQC,SAASZ;EAEjBW,QAAQb,YAAY,IAAIC,KACpBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMM,gBAAgBN,SAAoC;EACtDA,QAAQO,yBAAQ,IAAInB,KAAAA,EAAAA,CAAOG,YAAW;EAEtC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMQ,YAAYC,IAAqC;EACnD,OAAO,KAAK5B,WAAW2B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,KAAK5B,WAAW8B,WAAWF,EAAAA;CACrC;CAIA,MAAMG,OAAOZ,SAAiC;EAC1C,MAAMa,KAAK,IAAIzB,KAAKY,QAAQb,SAAS,CAAA,CAAEe,QAAO;EAC9C,IAAId,KAAKC,IAAG,IAAKwB,IAAI;GACjB,MAAM,KAAKhC,WAAWiC,OAAOd,OAAAA;GAG7B,MAAMtB,SAASqC,QAAO;EAC1B;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ipAddress","userAgent","expiresAt","Date","now","maxAge","toISOString","subKind","CLIENT","clientId","sub","USER","userId","save","ping","session","seenAt","getTime","threshold","refresh","refreshedAt","markMfaVerified","mfaAt","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n ISessionManager, \n ISessionRepository, \n SessionManagerContext, \n SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n protected options: SessionManagerOptions;\n\n protected repository: ISessionRepository;\n\n // -----------------------------------------------------\n\n constructor(ctx: SessionManagerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n }\n\n // -----------------------------------------------------\n\n /\n Create/Update session\n \n @param input\n /\n async create(input: Partial<Session>): Promise<Session> {\n input.ipAddress = input.ipAddress \|\| '127.0.0.1';\n input.userAgent = input.userAgent \|\| 'system';\n input.expiresAt = input.expiresAt \|\| new Date(\n Date.now() + (this.options.maxAge 1_000),\n ).toISOString();\n\n switch (input.subKind) {\n case IdentityType.CLIENT: {\n input.clientId = input.sub;\n break;\n }\n case IdentityType.USER: {\n input.userId = input.sub;\n break;\n }\n }\n\n return this.repository.save(input);\n }\n\n // -----------------------------------------------------\n\n async ping(session: Session): Promise<Session> {\n if (session.seenAt) {\n const seenAt = new Date(session.seenAt).getTime();\n const threshold = seenAt + (5 * 1_000);\n\n if (threshold > Date.now()) {\n return session;\n }\n }\n\n session.seenAt = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async refresh(session: Session): Promise<Session> {\n const now = new Date().toISOString();\n session.refreshedAt = now;\n session.seenAt = now;\n\n session.expiresAt = new Date(\n Date.now() + (this.options.maxAge * 1_000),\n ).toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async markMfaVerified(session: Session): Promise<Session> {\n session.mfaAt = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n /*\n Verify session on token inspection/verification.\n \n @param id\n * @throws JWTError\n */\n async findOneById(id: string): Promise<Session \| null> {\n return this.repository.findOneById(id);\n }\n\n // -----------------------------------------------------\n\n async revoke(id: string): Promise<void> {\n await this.repository.removeById(id);\n }\n\n // -----------------------------------------------------\n\n async verify(session: Session): Promise<void> {\n const ms = new Date(session.expiresAt).getTime();\n if (Date.now() > ms) {\n await this.repository.remove(session);\n\n // todo: better error\n throw JWTError.expired();\n }\n }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,YAAYD,MAAMC,aAAa;EACrCD,MAAME,YAAYF,MAAME,aAAa;EACrCF,MAAMG,YAAYH,MAAMG,aAAa,IAAIC,KACrCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,SAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,WAAWV,MAAMW;IACvB;GAEJ,KAAKlB,aAAamB,MACdZ,MAAMa,SAASb,MAAMW;EAG7B;EAEA,OAAO,KAAKd,WAAWiB,KAAKd,KAAAA;CAChC;CAIA,MAAMe,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC,QACO;OAAA,IAAIb,KAAKY,QAAQC,MAAM,CAAA,CAAEC,QACtBD,IAAU,MAEZb,KAAKC,IAAG,GACpB,OAAOW;EAAAA;EAIfA,QAAQC,0BAAS,IAAIb,KAAAA,EAAAA,CAAOG,YAAW;EAEvC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMI,QAAQJ,SAAoC;EAC9C,MAAMX,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCS,QAAQK,cAAchB;EACtBW,QAAQC,SAASZ;EAEjBW,QAAQb,YAAY,IAAIC,KACpBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMM,gBAAgBN,SAAoC;EACtDA,QAAQO,yBAAQ,IAAInB,KAAAA,EAAAA,CAAOG,YAAW;EAEtC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMQ,YAAYC,IAAqC;EACnD,OAAO,KAAK5B,WAAW2B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,KAAK5B,WAAW8B,WAAWF,EAAAA;CACrC;CAIA,MAAMG,OAAOZ,SAAiC;EAC1C,MAAMa,KAAK,IAAIzB,KAAKY,QAAQb,SAAS,CAAA,CAAEe,QAAO;EAC9C,IAAId,KAAKC,IAAG,IAAKwB,IAAI;GACjB,MAAM,KAAKhC,WAAWiC,OAAOd,OAAAA;GAG7B,MAAMtB,SAASqC,QAAO;EAC1B;CACJ;AACJ"}

package/dist/core/entities/client/constants.d.ts ADDED Viewed

@@ -0,0 +1,10 @@
+import { PermissionName } from '@authup/core-kit';
+/**
+ * The client read-permission disjunction: holding ANY of these grants
+ * read access to client rows. Shared between `ClientService`'s
+ * getMany/getOne pre-gates and the schema-level `secret` visibility
+ * gate (issue #3322) — the two MUST evaluate the same disjunction, or
+ * listability and secret visibility silently diverge.
+ */
+export declare const CLIENT_READ_PERMISSIONS: PermissionName[];
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/entities/client/constants.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAG,cAAc,EAIpD,CAAC"}

package/dist/core/entities/client/constants.mjs ADDED Viewed

@@ -0,0 +1,20 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PermissionName } from "@authup/core-kit";
+//#region src/core/entities/client/constants.ts
+/**
+* The client read-permission disjunction: holding ANY of these grants
+* read access to client rows. Shared between `ClientService`'s
+* getMany/getOne pre-gates and the schema-level `secret` visibility
+* gate (issue #3322) — the two MUST evaluate the same disjunction, or
+* listability and secret visibility silently diverge.
+*/ const CLIENT_READ_PERMISSIONS = [
+	PermissionName.CLIENT_READ,
+	PermissionName.CLIENT_UPDATE,
+	PermissionName.CLIENT_DELETE
+];
+//#endregion
+export { CLIENT_READ_PERMISSIONS };
+//# sourceMappingURL=constants.mjs.map

package/dist/core/entities/client/constants.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"constants.mjs","names":["PermissionName","CLIENT_READ_PERMISSIONS","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE"],"sources":["../../../../src/core/entities/client/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { PermissionName } from '@authup/core-kit';\n\n/**\n * The client read-permission disjunction: holding ANY of these grants\n * read access to client rows. Shared between `ClientService`'s\n * getMany/getOne pre-gates and the schema-level `secret` visibility\n * gate (issue #3322) — the two MUST evaluate the same disjunction, or\n * listability and secret visibility silently diverge.\n */\nexport const CLIENT_READ_PERMISSIONS : PermissionName[] = [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n];\n"],"mappings":";;;;;;;;;;;GAgBA,MAAaC,0BAA6C;CACtDD,eAAeE;CACfF,eAAeG;CACfH,eAAeI;AAClB"}

package/dist/core/entities/client/index.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
+export * from './constants.ts';
 export * from './service.ts';
 export * from './types.ts';
 export * from './web-client.ts';

package/dist/core/entities/client/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}

package/dist/core/entities/client/index.mjs CHANGED Viewed

@@ -1,7 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { CLIENT_READ_PERMISSIONS } from "./constants.mjs";
 import { clientSchema } from "./schema.mjs";
 import { ClientService } from "./service.mjs";
-import { WebClientProvisioner, buildWebClientAttributes } from "./web-client.mjs";
-export { ClientService, WebClientProvisioner, buildWebClientAttributes, clientSchema };
+import { WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes } from "./web-client.mjs";
+export { CLIENT_READ_PERMISSIONS, ClientService, WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes, clientSchema };

package/dist/core/entities/client/schema.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/schema.ts"],"names":[],"mappings":"~~AAQA~~,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;~~AAM~~/C,eAAO,MAAM,YAAY,~~2CAgCvB~~,CAAC"}
1	+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/schema.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA2D/C,eAAO,MAAM,YAAY,2CAiCvB,CAAC"}

package/dist/core/entities/client/schema.mjs CHANGED Viewed

@@ -1,14 +1,50 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { CLIENT_READ_PERMISSIONS } from "./constants.mjs";
+import { createFieldsReadGate } from "../../query/fields.mjs";
 import { createRelationsReadGate } from "../../query/relations.mjs";
-import { EntityType } from "@authup/core-kit";
-import { defineSchema } from "@rapiq/core";
+import { EntityType, IdentityType } from "@authup/core-kit";
+import { and, defineSchema, eq, ne, or } from "@rapiq/core";
 //#region src/core/entities/client/schema.ts
 const schemaMapping = {
 	realm: EntityType.REALM,
 	accessPolicy: EntityType.POLICY
 };
+/**
+* Per-row visibility gate for the `secret` column (issue #3322) —
+* schema-level, so it applies wherever the client schema governs a
+* projection: the `/clients` root AND the `include=client` paths of
+* client-permission / client-role / client-scope, which never run
+* `ClientService`'s read path.
+*
+* Only rows exposing a PLAINTEXT secret are guarded: `null`, hashed
+* and encrypted values stay visible to any actor that passed the read
+* pre-gate (the historical service semantics). A plaintext value is
+* additionally visible on the actor's OWN client row (the `getOne`
+* isMe bypass, list-shaped) and on rows the compiled permission
+* condition covers. A non-expressible (`post`) or settled-deny compile
+* yields no permission leg — fail closed for plaintext rows rather
+* than falling back to per-row evaluation.
+*
+* The outer `ne('realmId', null)` guard is semantically inert (clients
+* are realm-bound) but makes the condition fail closed on rows whose
+* gate columns were not fetched — an `ownOrNull` reach compiles to a
+* null-inclusive realm leg that would otherwise MATCH a missing
+* column. The SQL adapter force-selects every column the condition
+* reads (rapiq#830's operand projection), so this is defense in depth.
+*/ async function secretReadGate(actor) {
+	const compiled = await actor.permissionEvaluator.compile({ name: CLIENT_READ_PERMISSIONS });
+	if (compiled.verdict === "allow") return true;
+	const visible = [
+		eq("secret", null),
+		eq("secretHashed", true),
+		eq("secretEncrypted", true)
+	];
+	if (compiled.verdict === "conditional") visible.push(compiled.condition);
+	if (actor.identity && actor.identity.type === IdentityType.CLIENT && actor.identity.data.id) visible.push(eq("id", actor.identity.data.id));
+	return and(ne("realmId", null), or(...visible));
+}
 const clientSchema = defineSchema({
 	name: EntityType.CLIENT,
 	fields: {
@@ -34,7 +70,8 @@ const clientSchema = defineSchema({
 			"updatedAt",
 			"createdAt"
 		],
-		allowed: ["secret"]
+		allowed: ["secret"],
+		validateMany: createFieldsReadGate({ secret: secretReadGate })
 	},
 	filters: { allowed: [
 		"id",

package/dist/core/entities/client/schema.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","accessPolicy","POLICY","~~clientSchema~~","name","CLIENT","fields","default","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ~~defineSchema~~ } from '@rapiq/core';\nimport type { Client } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM, accessPolicy: EntityType.POLICY };\n\nexport const clientSchema = defineSchema<Client>({\n name: EntityType.CLIENT,\n fields: {\n default: [\n 'id',\n 'active',\n 'builtIn',\n 'name',\n 'displayName',\n 'description',\n 'secretHashed',\n 'secretEncrypted',\n 'baseUrl',\n 'rootUrl',\n 'redirectUri',\n 'postLogoutRedirectUri',\n 'grantTypes',\n 'scope',\n 'authMethod',\n 'tokenBindingMethod',\n 'accessPolicyId',\n 'realmId',\n 'updatedAt',\n 'createdAt',\n ],\n allowed: ['secret'],\n },\n filters: { allowed: ['id', 'name', 'realmId'] },\n relations: { allowed: ['realm', 'accessPolicy'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":"~~;;;;;;;AAYA~~,~~MAAMG~~,gBAAgB;CAAEC,~~OAAOH~~,~~WAAWI~~;CAAOC,~~cAAcL~~,~~WAAWM~~;AAAO;~~AAEjF~~,~~MAAaC~~,~~eAAeR~~,aAAqB;~~CAC7CS~~,~~MAAMR~~,~~WAAWS~~;~~CACjBC~~,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,QAAS;~~CACvB~~;~~CACAC~~,SAAS,~~EAAED~~,SAAS;EAAC;EAAM;EAAQ;CAAU,EAAC;~~CAC9CE~~,WAAW;~~EAAEF~~,SAAS,CAAC,SAAS,cAAe;~~EAAEG~~,~~UAAUd~~,~~wBAAwBC~~,aAAAA;CAAe;~~CAClGc~~,MAAM,~~EAAEJ~~,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;~~CAClDK~~,YAAY,EAAEC,UAAU,GAAG;~~CAC3BhB~~;AACJ,CAAA"}
1	+ {"version":3,"file":"schema.mjs","names":["and","defineSchema","eq","ne","or","EntityType","IdentityType","createFieldsReadGate","createRelationsReadGate","CLIENT_READ_PERMISSIONS","schemaMapping","realm","REALM","accessPolicy","POLICY","secretReadGate","actor","compiled","permissionEvaluator","compile","name","verdict","visible","push","condition","identity","type","CLIENT","data","id","clientSchema","fields","default","allowed","validateMany","secret","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client/schema.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { ICondition, KeyValidationVerdict } from '@rapiq/core';\nimport {\n and,\n defineSchema,\n eq,\n ne,\n or,\n} from '@rapiq/core';\nimport type { Client } from '@authup/core-kit';\nimport { EntityType, IdentityType } from '@authup/core-kit';\nimport type { ActorContext } from '@authup/server-kit';\nimport { createFieldsReadGate } from '../../query/fields.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\n\nconst schemaMapping = { realm: EntityType.REALM, accessPolicy: EntityType.POLICY };\n\n/\n Per-row visibility gate for the `secret` column (issue #3322) —\n * schema-level, so it applies wherever the client schema governs a\n * projection: the `/clients` root AND the `include=client` paths of\n * client-permission / client-role / client-scope, which never run\n * `ClientService`'s read path.\n \n Only rows exposing a PLAINTEXT secret are guarded: `null`, hashed\n * and encrypted values stay visible to any actor that passed the read\n * pre-gate (the historical service semantics). A plaintext value is\n * additionally visible on the actor's OWN client row (the `getOne`\n * isMe bypass, list-shaped) and on rows the compiled permission\n * condition covers. A non-expressible (`post`) or settled-deny compile\n * yields no permission leg — fail closed for plaintext rows rather\n * than falling back to per-row evaluation.\n \n The outer `ne('realmId', null)` guard is semantically inert (clients\n * are realm-bound) but makes the condition fail closed on rows whose\n * gate columns were not fetched — an `ownOrNull` reach compiles to a\n * null-inclusive realm leg that would otherwise MATCH a missing\n * column. The SQL adapter force-selects every column the condition\n * reads (rapiq#830's operand projection), so this is defense in depth.\n */\nasync function secretReadGate(actor: ActorContext) : Promise<KeyValidationVerdict> {\n const compiled = await actor.permissionEvaluator.compile({ name: CLIENT_READ_PERMISSIONS });\n if (compiled.verdict === 'allow') {\n return true;\n }\n\n const visible : ICondition[] = [\n eq('secret', null),\n eq('secretHashed', true),\n eq('secretEncrypted', true),\n ];\n\n if (compiled.verdict === 'conditional') {\n visible.push(compiled.condition);\n }\n\n if (\n actor.identity &&\n actor.identity.type === IdentityType.CLIENT &&\n actor.identity.data.id\n ) {\n visible.push(eq('id', actor.identity.data.id));\n }\n\n return and(ne('realmId', null), or(...visible));\n}\n\nexport const clientSchema = defineSchema<Client>({\n name: EntityType.CLIENT,\n fields: {\n default: [\n 'id',\n 'active',\n 'builtIn',\n 'name',\n 'displayName',\n 'description',\n 'secretHashed',\n 'secretEncrypted',\n 'baseUrl',\n 'rootUrl',\n 'redirectUri',\n 'postLogoutRedirectUri',\n 'grantTypes',\n 'scope',\n 'authMethod',\n 'tokenBindingMethod',\n 'accessPolicyId',\n 'realmId',\n 'updatedAt',\n 'createdAt',\n ],\n allowed: ['secret'],\n validateMany: createFieldsReadGate({ secret: secretReadGate }),\n },\n filters: { allowed: ['id', 'name', 'realmId'] },\n relations: { allowed: ['realm', 'accessPolicy'], validate: createRelationsReadGate(schemaMapping) },\n sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n pagination: { maxLimit: 50 },\n schemaMapping,\n});\n"],"mappings":";;;;;;;;;AAsBA,MAAMU,gBAAgB;CAAEC,OAAON,WAAWO;CAAOC,cAAcR,WAAWS;AAAO;;;;;;;;;;;;;;;;;;;;;;;GAyBjF,eAAeC,eAAeC,OAAmB;CAC7C,MAAMC,WAAW,MAAMD,MAAME,oBAAoBC,QAAQ,EAAEC,MAAMX,wBAAwB,CAAA;CACzF,IAAIQ,SAASI,YAAY,SACrB,OAAO;CAGX,MAAMC,UAAyB;EAC3BpB,GAAG,UAAU,IAAA;EACbA,GAAG,gBAAgB,IAAA;EACnBA,GAAG,mBAAmB,IAAA;CACzB;CAED,IAAIe,SAASI,YAAY,eACrBC,QAAQC,KAAKN,SAASO,SAAS;CAGnC,IACIR,MAAMS,YACNT,MAAMS,SAASC,SAASpB,aAAaqB,UACrCX,MAAMS,SAASG,KAAKC,IAEpBP,QAAQC,KAAKrB,GAAG,MAAMc,MAAMS,SAASG,KAAKC,EAAE,CAAA;CAGhD,OAAO7B,IAAIG,GAAG,WAAW,IAAA,GAAOC,GAAAA,GAAMkB,OAAAA,CAAAA;AAC1C;AAEA,MAAaQ,eAAe7B,aAAqB;CAC7CmB,MAAMf,WAAWsB;CACjBI,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,QAAS;EACnBC,cAAc3B,qBAAqB,EAAE4B,QAAQpB,eAAe,CAAA;CAChE;CACAqB,SAAS,EAAEH,SAAS;EAAC;EAAM;EAAQ;CAAU,EAAC;CAC9CI,WAAW;EAAEJ,SAAS,CAAC,SAAS,cAAe;EAAEK,UAAU9B,wBAAwBE,aAAAA;CAAe;CAClG6B,MAAM,EAAEN,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDO,YAAY,EAAEC,UAAU,GAAG;CAC3B/B;AACJ,CAAA"}

package/dist/core/entities/client/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"~~AAiBA~~,OAAO,EAGH,eAAe,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;~~AAIpE~~,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;~~IAmF5C~~,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;~~IAmDZ~~,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;~~IA2JI~~,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,eAAe,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAY5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IA6CZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IA6JI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}

package/dist/core/entities/client/service.mjs CHANGED Viewed

@@ -2,15 +2,15 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "../../authentication/credential/entities/client/module.mjs";
+import { CLIENT_READ_PERMISSIONS } from "./constants.mjs";
 import { clientSchema } from "./schema.mjs";
-import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
+import { decodeQuery } from "../../query/module.mjs";
 import "../../query/index.mjs";
 import { ValidatorGroup, isUUID } from "@authup/kit";
 import { CLIENT_RESERVED_NAMES, ClientAuthMethod, ClientValidator, PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { EntityNotFoundError, ValidationError } from "@authup/errors";
-import { and, eq, ne, not, or } from "@rapiq/core";
 //#region src/core/entities/client/service.ts
 var ClientService = class extends AbstractEntityService {
 	repository;
@@ -23,67 +23,15 @@ var ClientService = class extends AbstractEntityService {
 		this.validator = new ClientValidator();
 	}
 	async getMany(query, actor) {
-		const permissionNames = [
-			PermissionName.CLIENT_READ,
-			PermissionName.CLIENT_UPDATE,
-			PermissionName.CLIENT_DELETE
-		];
-		await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });
-		const parsed = await decodeQuery(query, {
+		await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });
+		return this.repository.findMany(await decodeQuery(query, {
 			schema: clientSchema,
 			actor
-		});
-		const secretSelected = parsed.fields.value.some((field) => field.name === "secret" && field.operator !== "-");
-		const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });
-		if (compiled.verdict !== "post") {
-			let scoped = parsed;
-			if (secretSelected && compiled.verdict !== "allow") {
-				const plaintextSecret = and(ne("secret", null), eq("secretHashed", false), eq("secretEncrypted", false));
-				scoped = appendQueryConditions(parsed, compiled.verdict === "conditional" ? or(not(plaintextSecret), compiled.condition) : not(plaintextSecret));
-			}
-			return this.repository.findMany(scoped);
-		}
-		const { data: entities, meta } = await this.repository.findMany(parsed);
-		let { total } = meta;
-		const data = [];
-		for (const entity of entities) {
-			if (entity.secret && !entity.secretEncrypted && !entity.secretHashed) {
-				try {
-					await actor.permissionEvaluator.evaluateOneOf({
-						name: [
-							PermissionName.CLIENT_READ,
-							PermissionName.CLIENT_UPDATE,
-							PermissionName.CLIENT_DELETE
-						],
-						data: definePolicyData({
-							[BuiltInPolicyType.ATTRIBUTES]: entity,
-							...this.resourceRealmMatch(entity)
-						})
-					});
-					data.push(entity);
-				} catch {
-					total -= 1;
-				}
-				continue;
-			}
-			data.push(entity);
-		}
-		return {
-			data,
-			meta: {
-				...meta,
-				total
-			}
-		};
+		}));
 	}
 	async getOne(idOrName, actor, query, realmId) {
-		const permissionNames = [
-			PermissionName.CLIENT_READ,
-			PermissionName.CLIENT_UPDATE,
-			PermissionName.CLIENT_DELETE
-		];
 		let isMe = !!actor.identity && actor.identity.type === "client" && (actor.identity.data.id === idOrName || actor.identity.data.name === idOrName);
-		if (!isMe) await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });
+		if (!isMe) await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });
 		const entity = await this.repository.findOne(idOrName, await decodeQuery(query, {
 			schema: clientSchema,
 			parameters: ["fields", "relations"],
@@ -92,10 +40,10 @@ var ClientService = class extends AbstractEntityService {
 		if (!entity) throw new EntityNotFoundError();
 		if (isMe && actor.identity.data.id !== entity.id) {
 			isMe = false;
-			await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });
+			await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });
 		}
 		if (!isMe && entity.secret && !entity.secretEncrypted && !entity.secretHashed) await actor.permissionEvaluator.evaluateOneOf({
-			name: permissionNames,
+			name: CLIENT_READ_PERMISSIONS,
 			data: definePolicyData({
 				[BuiltInPolicyType.ATTRIBUTES]: entity,
 				...this.resourceRealmMatch(entity)
@@ -121,7 +69,7 @@ var ClientService = class extends AbstractEntityService {
 			else where.name = idOrName;
 			if (realm) where.realmId = realm.id;
 			entity = await this.repository.findOneWithSecret(where);
-			if (!entity && options.updateOnly) throw new EntityNotFoundError();
+			if (!entity && (options.updateOnly || where.id)) throw new EntityNotFoundError();
 		} else if (options.updateOnly) throw new EntityNotFoundError();
 		let isSelfEdit = false;
 		if (entity) {

package/dist/core/entities/client/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","and","eq","ne","not","or","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","appendQueryConditions","decodeQuery","clientSchema","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionNames","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","secretSelected","fields","value","some","field","operator","compiled","compile","verdict","scoped","plaintextSecret","condition","findMany","data","entities","meta","total","entity","secret","secretEncrypted","secretHashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","push","getOne","idOrName","realmId","isMe","identity","type","id","findOne","parameters","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","builtIn","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","authMethod","SECRET","generateSecret","protect","created","delete","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n and, \n eq, \n ne, \n not, \n or,\n} from '@rapiq/core';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n CLIENT_RESERVED_NAMES,\n ClientAuthMethod,\n ClientValidator,\n PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { clientSchema } from './schema.ts';\n\nexport type ClientServiceContext = {\n repository: IClientRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n protected repository: IClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ClientValidator;\n\n constructor(ctx: ClientServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ClientValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Client>> {\n const permissionNames = [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ];\n\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n\n const parsed = await decodeQuery(query, { schema: clientSchema, actor });\n\n // The per-row gate below only fires for rows exposing a PLAINTEXT secret,\n // and only when the projection actually selects the (non-default) `secret`\n // field — everything else lists freely. Compile the gate into WHERE\n // (#3286 phase 3): a plaintext-secret row is visible iff the compiled\n // permission condition covers it; rows without a plaintext secret always\n // are. A non-expressible policy falls back to the per-row loop below.\n const secretSelected = parsed.fields.value.some(\n (field) => field.name === 'secret' && field.operator !== '-',\n );\n const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });\n if (compiled.verdict !== 'post') {\n let scoped = parsed;\n if (secretSelected && compiled.verdict !== 'allow') {\n const plaintextSecret = and(\n ne('secret', null),\n eq('secretHashed', false),\n eq('secretEncrypted', false),\n );\n\n scoped = appendQueryConditions(\n parsed,\n compiled.verdict === 'conditional' ?\n or(not(plaintextSecret), compiled.condition) :\n not(plaintextSecret),\n );\n }\n\n return this.repository.findMany(scoped);\n }\n\n const {\n data: entities,\n meta,\n } = await this.repository.findMany(parsed);\n let { total } = meta;\n\n const data: Client[] = [];\n for (const entity of entities) {\n if (\n entity.secret &&\n !entity.secretEncrypted &&\n !entity.secretHashed\n ) {\n try {\n await actor.permissionEvaluator.evaluateOneOf({\n name: [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ],\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n data.push(entity);\n } catch {\n total -= 1;\n }\n\n continue;\n }\n\n data.push(entity);\n }\n\n return {\n data,\n meta: {\n ...meta,\n total, \n }, \n };\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<Client> {\n const permissionNames = [\n PermissionName.CLIENT_READ,\n PermissionName.CLIENT_UPDATE,\n PermissionName.CLIENT_DELETE,\n ];\n\n let isMe = !!actor.identity &&\n actor.identity.type === 'client' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n const entity = await this.repository.findOne(\n idOrName,\n await decodeQuery(query, {\n schema: clientSchema, \n parameters: ['fields', 'relations'], \n actor, \n }),\n realmId,\n );\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n }\n\n if (\n !isMe &&\n entity.secret &&\n !entity.secretEncrypted &&\n !entity.secretHashed\n ) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: permissionNames,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Client,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realmId === 'string' ?\n await this.realmRepository.resolve(data.realmId) :\n undefined;\n\n let entity: Client \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realmId = realm.id;\n }\n\n entity = await this.repository.findOneWithSecret(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'client' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n }\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n // Reserve the system-provisioned client names (`system`, `web`) so an\n // API caller can't create or rename a client onto them — that would\n // collide on unique(name, realmId) or shadow the builtIn client.\n // Provisioning and runtime hooks bypass this service, so they remain\n // free to manage the reserved clients. builtIn clients are exempt\n // (they ARE the provisioned ones) but API callers can never produce a\n // builtIn client since the validator strips the flag.\n if (\n typeof validated.name === 'string' &&\n CLIENT_RESERVED_NAMES.includes(validated.name) &&\n !(entity && entity.builtIn && entity.name === validated.name)\n ) {\n throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n }\n\n await this.repository.validateJoinColumns(validated);\n await this.repository.checkUniqueness(validated, entity \|\| undefined);\n\n const credentialsService = new ClientCredentialsService();\n\n if (entity) {\n if (\n !isSelfEdit &&\n !validated.realmId &&\n !entity.realmId\n ) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realmId = actorRealmId;\n }\n }\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n if (entity.authMethod === ClientAuthMethod.SECRET) {\n if (!validated.secret && !entity.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n if (validated.secret) {\n entity.secret = await credentialsService.protect(validated.secret, entity);\n }\n } else {\n entity.secret = null;\n entity.secretHashed = false;\n entity.secretEncrypted = false;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realmId) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realmId = actorRealmId;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n\n entity = this.repository.create(validated);\n\n if (entity.authMethod === ClientAuthMethod.SECRET) {\n if (!validated.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n entity.secret = await credentialsService.protect(validated.secret, validated);\n } else {\n entity.secret = null;\n entity.secretHashed = false;\n entity.secretEncrypted = false;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;AAqCA,IAAaoB,gBAAb,cAAmCL,sBAAAA;CACrBM;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIV,gBAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OAC+C;EAC/C,MAAMC,kBAAkB;GACpBd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;EAClB;EAED,MAAMJ,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAEzE,MAAMO,SAAS,MAAMjB,YAAYQ,OAAO;GAAEU,QAAQjB;GAAcQ;EAAM,CAAA;EAQtE,MAAMU,iBAAiBF,OAAOG,OAAOC,MAAMC,MACtCC,UAAUA,MAAMP,SAAS,YAAYO,MAAMC,aAAa,GAAA;EAE7D,MAAMC,WAAW,MAAMhB,MAAMK,oBAAoBY,QAAQ,EAAEV,MAAMN,gBAAgB,CAAA;EACjF,IAAIe,SAASE,YAAY,QAAQ;GAC7B,IAAIC,SAASX;GACb,IAAIE,kBAAkBM,SAASE,YAAY,SAAS;IAChD,MAAME,kBAAkB7C,IACpBE,GAAG,UAAU,IAAA,GACbD,GAAG,gBAAgB,KAAA,GACnBA,GAAG,mBAAmB,KAAA,CAAA;IAG1B2C,SAAS7B,sBACLkB,QACAQ,SAASE,YAAY,gBACjBvC,GAAGD,IAAI0C,eAAAA,GAAkBJ,SAASK,SAAS,IAC3C3C,IAAI0C,eAAAA,CAAAA;GAEhB;GAEA,OAAO,KAAK1B,WAAW4B,SAASH,MAAAA;EACpC;EAEA,MAAM,EACFI,MAAMC,UACNC,SACA,MAAM,KAAK/B,WAAW4B,SAASd,MAAAA;EACnC,IAAI,EAAEkB,UAAUD;EAEhB,MAAMF,OAAiB,CAAA;EACvB,KAAK,MAAMI,UAAUH,UAAU;GAC3B,IACIG,OAAOC,UACP,CAACD,OAAOE,mBACR,CAACF,OAAOG,cACV;IACE,IAAI;KACA,MAAM9B,MAAMK,oBAAoB0B,cAAc;MAC1CxB,MAAM;OACFpB,eAAee;OACff,eAAegB;OACfhB,eAAeiB;MAClB;MACDmB,MAAMjD,iBAAiB;QAAGD,kBAAkB2D,aAAaL;OAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;MAAQ,CAAA;KACxG,CAAA;KACAJ,KAAKW,KAAKP,MAAAA;IACd,QAAQ;KACJD,SAAS;IACb;IAEA;GACJ;GAEAH,KAAKW,KAAKP,MAAAA;EACd;EAEA,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMS,OACFC,UACApC,OACAD,OACAsC,SACe;EACf,MAAMpC,kBAAkB;GACpBd,eAAee;GACff,eAAegB;GACfhB,eAAeiB;EAClB;EAED,IAAIkC,OAAO,CAAC,CAACtC,MAAMuC,YACfvC,MAAMuC,SAASC,SAAS,aAEpBxC,MAAMuC,SAAShB,KAAKkB,OAAOL,YAC3BpC,MAAMuC,SAAShB,KAAKhB,SAAS6B;EAGrC,IAAI,CAACE,MACD,MAAMtC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAG7E,MAAM0B,SAAS,MAAM,KAAKjC,WAAWgD,QACjCN,UACA,MAAM7C,YAAYQ,OAAO;GACrBU,QAAQjB;GACRmD,YAAY,CAAC,UAAU,WAAY;GACnC3C;EACJ,CAAA,GACAqC,OAAAA;EAEJ,IAAI,CAACV,QACD,MAAM,IAAI7C,oBAAAA;EAGd,IAAIwD,QAAQtC,MAAMuC,SAAUhB,KAAKkB,OAAOd,OAAOc,IAAI;GAC/CH,OAAO;GACP,MAAMtC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAC7E;EAEA,IACI,CAACqC,QACDX,OAAOC,UACP,CAACD,OAAOE,mBACR,CAACF,OAAOG,cAER,MAAM9B,MAAMK,oBAAoB0B,cAAc;GAC1CxB,MAAMN;GACNsB,MAAMjD,iBAAiB;KAAGD,kBAAkB2D,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMiB,OACFrB,MACAvB,OACe;EACf,MAAM,EAAE2B,WAAW,MAAM,KAAKkB,KAAKC,KAAAA,GAAWvB,MAAMvB,KAAAA;EACpD,OAAO2B;CACX;CAEA,MAAMoB,OACFX,UACAb,MACAvB,OACe;EACf,MAAM,EAAE2B,WAAW,MAAM,KAAKkB,KAAKT,UAAUb,MAAMvB,OAAO,EAAEgD,YAAY,KAAK,CAAA;EAC7E,OAAOrB;CACX;CAEA,MAAMkB,KACFT,UACAb,MACAvB,OACAiD,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO5B,KAAKc,YAAY,WAClC,MAAM,KAAK1C,gBAAgByD,QAAQ7B,KAAKc,OAAO,IAC/CS,KAAAA;EAEJ,IAAInB;EACJ,IAAIS,UAAU;GACV,MAAMiB,QAA6B,CAAC;GACpC,IAAIxE,OAAOuD,QAAAA,GACPiB,MAAMZ,KAAKL;QAEXiB,MAAM9C,OAAO6B;GAGjB,IAAIe,OACAE,MAAMhB,UAAUc,MAAMV;GAG1Bd,SAAS,MAAM,KAAKjC,WAAW4D,kBAAkBD,KAAAA;GACjD,IAAI,CAAC1B,UAAUsB,QAAQD,YACnB,MAAM,IAAIlE,oBAAAA;EAElB,OAAO,IAAImE,QAAQD,YACf,MAAM,IAAIlE,oBAAAA;EAGd,IAAIyE,aAAa;EACjB,IAAI5B,QAAQ;GACR,IAAI;IACA,MAAM3B,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAegB,cAAc,CAAA;GACrF,SAASsD,GAAG;IACR,IACI,CAACzD,MAAMuC,YACPvC,MAAMuC,SAASC,SAAS,YACxBxC,MAAMuC,SAAShB,KAAKkB,OAAOd,OAAOc,IAElC,MAAMgB;IAEVF,aAAa;IACb,MAAMvD,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAeuE,mBAAmB,CAAA;GAC1F;GACAR,QAAQtE,eAAe+E;EAC3B,OAAO;GACH,MAAM3D,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAeyE,cAAc,CAAA;GACjFV,QAAQtE,eAAeiF;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKlE,UAAUmE,IAAIxC,MAAM,EAAE2B,MAAM,CAAA;EASzD,IACI,OAAOY,UAAUvD,SAAS,YAC1BvB,sBAAsBgF,SAASF,UAAUvD,IAAI,KAC7C,EAAEoB,UAAUA,OAAOsC,WAAWtC,OAAOpB,SAASuD,UAAUvD,OAExD,MAAM,IAAIxB,gBAAgB,oBAAoB+E,UAAUvD,KAAK,eAAe;EAGhF,MAAM,KAAKb,WAAWwE,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKpE,WAAWyE,gBAAgBL,WAAWnC,UAAUmB,KAAAA,CAAAA;EAE3D,MAAMsB,qBAAqB,IAAI/E,yBAAAA;EAE/B,IAAIsC,QAAQ;GACR,IACI,CAAC4B,cACD,CAACO,UAAUzB,WACX,CAACV,OAAOU,SACV;IACE,MAAMgC,eAAe,KAAKC,gBAAgBtE,KAAAA;IAC1C,IAAIqE,cACAP,UAAUzB,UAAUgC;GAE5B;GAEA,IAAId,YACA,MAAMvD,MAAMK,oBAAoBkE,SAAS;IACrChE,MAAMpB,eAAeuE;IACrBnC,MAAMjD,iBAAiB;MAAGD,kBAAkB2D,aAAa8B;KAAW,GAAG,KAAK7B,mBAAmB6B,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJnC,SAAS,KAAKjC,WAAW8E,MAAM7C,QAAQmC,SAAAA;GAEvC,IAAI,CAACP,YACD,MAAMvD,MAAMK,oBAAoBkE,SAAS;IACrChE,MAAMpB,eAAegB;IACrBoB,MAAMjD,iBAAiB;MAAGD,kBAAkB2D,aAAaL;KAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAO8C,eAAexF,iBAAiByF,QAAQ;IAC/C,IAAI,CAACZ,UAAUlC,UAAU,CAACD,OAAOC,QAC7BkC,UAAUlC,SAASwC,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUlC,QACVD,OAAOC,SAAS,MAAMwC,mBAAmBQ,QAAQd,UAAUlC,QAAQD,MAAAA;GAE3E,OAAO;IACHA,OAAOC,SAAS;IAChBD,OAAOG,eAAe;IACtBH,OAAOE,kBAAkB;GAC7B;GAEA,MAAM,KAAKnC,WAAWmD,KAAKlB,MAAAA;GAE3B,OAAO;IACHA;IACAkD,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUzB,SAAS;GACpB,MAAMgC,eAAe,KAAKC,gBAAgBtE,KAAAA;GAC1C,IAAIqE,cACAP,UAAUzB,UAAUgC;EAE5B;EAEA,MAAMrE,MAAMK,oBAAoBkE,SAAS;GACrChE,MAAMpB,eAAeyE;GACrBrC,MAAMjD,iBAAiB;KAAGD,kBAAkB2D,aAAa8B;IAAW,GAAG,KAAK7B,mBAAmB6B,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEAnC,SAAS,KAAKjC,WAAWkD,OAAOkB,SAAAA;EAEhC,IAAInC,OAAO8C,eAAexF,iBAAiByF,QAAQ;GAC/C,IAAI,CAACZ,UAAUlC,QACXkC,UAAUlC,SAASwC,mBAAmBO,eAAc;GAGxDhD,OAAOC,SAAS,MAAMwC,mBAAmBQ,QAAQd,UAAUlC,QAAQkC,SAAAA;EACvE,OAAO;GACHnC,OAAOC,SAAS;GAChBD,OAAOG,eAAe;GACtBH,OAAOE,kBAAkB;EAC7B;EAEA,MAAM,KAAKnC,WAAWmD,KAAKlB,MAAAA;EAE3B,OAAO;GACHA;GACAkD,SAAS;EACb;CACJ;CAEA,MAAMC,OACFrC,IACAzC,OACe;EACf,MAAMA,MAAMK,oBAAoBmD,YAAY,EAAEjD,MAAMpB,eAAeiB,cAAc,CAAA;EAEjF,MAAMuB,SAAS,MAAM,KAAKjC,WAAWqF,UAAU,EAAEtC,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAI7C,oBAAAA;EAGd,MAAMkB,MAAMK,oBAAoBkE,SAAS;GACrChE,MAAMpB,eAAeiB;GACrBmB,MAAMjD,iBAAiB;KAAGD,kBAAkB2D,aAAaL;IAAQ,GAAG,KAAKM,mBAAmBN,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAIuC,aAAarD;EACzB,MAAM,KAAKjC,WAAWuF,OAAOtD,MAAAA;EAC7BA,OAAOc,KAAKuC;EAEZ,OAAOrD;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","CLIENT_READ_PERMISSIONS","decodeQuery","clientSchema","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","findMany","schema","getOne","idOrName","realmId","isMe","identity","type","data","id","entity","findOne","parameters","secret","secretEncrypted","secretHashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","CLIENT_UPDATE","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","builtIn","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","authMethod","SECRET","generateSecret","protect","created","delete","CLIENT_DELETE","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n CLIENT_RESERVED_NAMES,\n ClientAuthMethod,\n ClientValidator,\n PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientSchema } from './schema.ts';\n\nexport type ClientServiceContext = {\n repository: IClientRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n protected repository: IClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ClientValidator;\n\n constructor(ctx: ClientServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ClientValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Client>> {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n\n // The per-row `secret` visibility gate lives on the client SCHEMA\n // (`fields.validateMany`, issue #3322), so it also covers the\n // `include=client` paths served by other services; the repository\n // layer redacts unauthorized values without dropping rows.\n return this.repository.findMany(\n await decodeQuery(query, { schema: clientSchema, actor }),\n );\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<Client> {\n let isMe = !!actor.identity &&\n actor.identity.type === 'client' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n }\n\n const entity = await this.repository.findOne(\n idOrName,\n await decodeQuery(query, {\n schema: clientSchema, \n parameters: ['fields', 'relations'], \n actor, \n }),\n realmId,\n );\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n }\n\n if (\n !isMe &&\n entity.secret &&\n !entity.secretEncrypted &&\n !entity.secretHashed\n ) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: CLIENT_READ_PERMISSIONS,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Client,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realmId === 'string' ?\n await this.realmRepository.resolve(data.realmId) :\n undefined;\n\n let entity: Client \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realmId = realm.id;\n }\n\n entity = await this.repository.findOneWithSecret(where);\n // Only a NAME key may upsert-create. A UUID addresses one specific\n // row, so a miss is a 404 (creating would write a different id).\n if (!entity && (options.updateOnly \|\| where.id)) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'client' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n }\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n // Reserve the system-provisioned client names (`system`, `web`) so an\n // API caller can't create or rename a client onto them — that would\n // collide on unique(name, realmId) or shadow the builtIn client.\n // Provisioning and runtime hooks bypass this service, so they remain\n // free to manage the reserved clients. builtIn clients are exempt\n // (they ARE the provisioned ones) but API callers can never produce a\n // builtIn client since the validator strips the flag.\n if (\n typeof validated.name === 'string' &&\n CLIENT_RESERVED_NAMES.includes(validated.name) &&\n !(entity && entity.builtIn && entity.name === validated.name)\n ) {\n throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n }\n\n await this.repository.validateJoinColumns(validated);\n await this.repository.checkUniqueness(validated, entity \|\| undefined);\n\n const credentialsService = new ClientCredentialsService();\n\n if (entity) {\n if (\n !isSelfEdit &&\n !validated.realmId &&\n !entity.realmId\n ) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realmId = actorRealmId;\n }\n }\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n if (entity.authMethod === ClientAuthMethod.SECRET) {\n if (!validated.secret && !entity.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n if (validated.secret) {\n entity.secret = await credentialsService.protect(validated.secret, entity);\n }\n } else {\n entity.secret = null;\n entity.secretHashed = false;\n entity.secretEncrypted = false;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realmId) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realmId = actorRealmId;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n\n entity = this.repository.create(validated);\n\n if (entity.authMethod === ClientAuthMethod.SECRET) {\n if (!validated.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n entity.secret = await credentialsService.protect(validated.secret, validated);\n } else {\n entity.secret = null;\n entity.secretHashed = false;\n entity.secretEncrypted = false;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,IAAae,gBAAb,cAAmCL,sBAAAA;CACrBM;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIV,gBAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAMjF,OAAO,KAAKI,WAAWU,SACnB,MAAMb,YAAYQ,OAAO;GAAEM,QAAQb;GAAcQ;EAAM,CAAA,CAAA;CAE/D;CAEA,MAAMM,OACFC,UACAP,OACAD,OACAS,SACe;EACf,IAAIC,OAAO,CAAC,CAACT,MAAMU,YACfV,MAAMU,SAASC,SAAS,aAEpBX,MAAMU,SAASE,KAAKC,OAAON,YAC3BP,MAAMU,SAASE,KAAKT,SAASI;EAGrC,IAAI,CAACE,MACD,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAGrF,MAAMwB,SAAS,MAAM,KAAKpB,WAAWqB,QACjCR,UACA,MAAMhB,YAAYQ,OAAO;GACrBM,QAAQb;GACRwB,YAAY,CAAC,UAAU,WAAY;GACnChB;EACJ,CAAA,GACAQ,OAAAA;EAEJ,IAAI,CAACM,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI2B,QAAQT,MAAMU,SAAUE,KAAKC,OAAOC,OAAOD,IAAI;GAC/CJ,OAAO;GACP,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EACrF;EAEA,IACI,CAACmB,QACDK,OAAOG,UACP,CAACH,OAAOI,mBACR,CAACJ,OAAOK,cAER,MAAMnB,MAAMC,oBAAoBmB,cAAc;GAC1CjB,MAAMb;GACNsB,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMS,OACFX,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKC,KAAAA,GAAWb,MAAMZ,KAAAA;EACpD,OAAOc;CACX;CAEA,MAAMY,OACFnB,UACAK,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKjB,UAAUK,MAAMZ,OAAO,EAAE2B,YAAY,KAAK,CAAA;EAC7E,OAAOb;CACX;CAEA,MAAMU,KACFjB,UACAK,MACAZ,OACA4B,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOlB,KAAKJ,YAAY,WAClC,MAAM,KAAKb,gBAAgBoC,QAAQnB,KAAKJ,OAAO,IAC/CiB,KAAAA;EAEJ,IAAIX;EACJ,IAAIP,UAAU;GACV,MAAMyB,QAA6B,CAAC;GACpC,IAAInD,OAAO0B,QAAAA,GACPyB,MAAMnB,KAAKN;QAEXyB,MAAM7B,OAAOI;GAGjB,IAAIuB,OACAE,MAAMxB,UAAUsB,MAAMjB;GAG1BC,SAAS,MAAM,KAAKpB,WAAWuC,kBAAkBD,KAAAA;GAGjD,IAAI,CAAClB,WAAWc,QAAQD,cAAcK,MAAMnB,KACxC,MAAM,IAAI/B,oBAAAA;EAElB,OAAO,IAAI8C,QAAQD,YACf,MAAM,IAAI7C,oBAAAA;EAGd,IAAIoD,aAAa;EACjB,IAAIpB,QAAQ;GACR,IAAI;IACA,MAAMd,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeiD,cAAc,CAAA;GACrF,SAASC,GAAG;IACR,IACI,CAACrC,MAAMU,YACPV,MAAMU,SAASC,SAAS,YACxBX,MAAMU,SAASE,KAAKC,OAAOC,OAAOD,IAElC,MAAMwB;IAEVH,aAAa;IACb,MAAMlC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAemD,mBAAmB,CAAA;GAC1F;GACAT,QAAQjD,eAAe2D;EAC3B,OAAO;GACH,MAAMvC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeqD,cAAc,CAAA;GACjFX,QAAQjD,eAAe6D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK9C,UAAU+C,IAAI/B,MAAM,EAAEiB,MAAM,CAAA;EASzD,IACI,OAAOa,UAAUvC,SAAS,YAC1BnB,sBAAsB4D,SAASF,UAAUvC,IAAI,KAC7C,EAAEW,UAAUA,OAAO+B,WAAW/B,OAAOX,SAASuC,UAAUvC,OAExD,MAAM,IAAIpB,gBAAgB,oBAAoB2D,UAAUvC,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAWoD,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKhD,WAAWqD,gBAAgBL,WAAW5B,UAAUW,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI3D,yBAAAA;EAE/B,IAAIyB,QAAQ;GACR,IACI,CAACoB,cACD,CAACQ,UAAUlC,WACX,CAACM,OAAON,SACV;IACE,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;IAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;GAE5B;GAEA,IAAIf,YACA,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAemD;IACrB1B,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaqB;KAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJ5B,SAAS,KAAKpB,WAAW0D,MAAMtC,QAAQ4B,SAAAA;GAEvC,IAAI,CAACR,YACD,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAeiD;IACrBxB,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaP;KAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAOuC,eAAepE,iBAAiBqE,QAAQ;IAC/C,IAAI,CAACZ,UAAUzB,UAAU,CAACH,OAAOG,QAC7ByB,UAAUzB,SAAS+B,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUzB,QACVH,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQH,MAAAA;GAE3E,OAAO;IACHA,OAAOG,SAAS;IAChBH,OAAOK,eAAe;IACtBL,OAAOI,kBAAkB;GAC7B;GAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;GAE3B,OAAO;IACHA;IACA2C,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUlC,SAAS;GACpB,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;GAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;EAE5B;EAEA,MAAMjD,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAeqD;GACrB5B,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaqB;IAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA5B,SAAS,KAAKpB,WAAW6B,OAAOmB,SAAAA;EAEhC,IAAI5B,OAAOuC,eAAepE,iBAAiBqE,QAAQ;GAC/C,IAAI,CAACZ,UAAUzB,QACXyB,UAAUzB,SAAS+B,mBAAmBO,eAAc;GAGxDzC,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQyB,SAAAA;EACvE,OAAO;GACH5B,OAAOG,SAAS;GAChBH,OAAOK,eAAe;GACtBL,OAAOI,kBAAkB;EAC7B;EAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;EAE3B,OAAO;GACHA;GACA2C,SAAS;EACb;CACJ;CAEA,MAAMC,OACF7C,IACAb,OACe;EACf,MAAMA,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAewE,cAAc,CAAA;EAEjF,MAAM7C,SAAS,MAAM,KAAKpB,WAAWkE,UAAU,EAAE/C,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAewE;GACrB/C,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAED,IAAIgD,aAAa/C;EACzB,MAAM,KAAKpB,WAAWoE,OAAOhD,MAAAA;EAC7BA,OAAOD,KAAKgD;EAEZ,OAAO/C;CACX;AACJ"}

package/dist/core/entities/client/web-client.d.ts CHANGED Viewed

@@ -1,36 +1,72 @@
 import type { Client, Realm } from '@authup/core-kit';
 import type { Logger } from '@authup/server-kit';
+import type { IClientScopeRepository } from '../client-scope/types.ts';
+import type { IScopeRepository } from '../scope/types.ts';
 import type { IClientRepository, IWebClientProvisioner } from './types.ts';
 export type WebClientProvisionerContext = {
     clientRepository: IClientRepository;
+    scopeRepository: IScopeRepository;
+    clientScopeRepository: IClientScopeRepository;
     appOrigins: string[];
     logger?: Logger;
 };
+/**
+ * The scopes a realm's public `web` client is granted.
+ *
+ * `global` lets the issued token drive the management API (parity with the
+ * legacy password-grant admin login); `openid` yields the id-token.
+ */
+export declare const WEB_CLIENT_SCOPE_NAMES: string[];
 /**
  * Build the attribute set for a realm's public `web` client.
  *
  * Public (PKCE) client used by authup's own client-web and any downstream
  * UI embedding client-web-kit. `builtIn` makes it auto-consent in the
- * /authorize flow and protects it from the API reserved-name guard. The
- * `global` scope lets the issued token drive the management API (parity
- * with the legacy password-grant admin login); `openid` for the id-token.
+ * /authorize flow and protects it from the API reserved-name guard.
  *
  * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the
  * /token grants and the /authorize code-request verifier; null = allow-all),
  * so it must list every flow the client uses. `redirectUri` and
  * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted
  * origin (matched by isSimpleMatch).
+ *
+ * The `scope` column is descriptive only. Scope authorization resolves
+ * through the `auth_client_scopes` junction, which
+ * `WebClientProvisioner.ensureForRealm` fills from
+ * {@see WEB_CLIENT_SCOPE_NAMES}.
  */
 export declare function buildWebClientAttributes(realm: Realm | {
     id: string;
 }, appOrigins: string[]): Partial<Client>;
 export declare class WebClientProvisioner implements IWebClientProvisioner {
     protected clientRepository: IClientRepository;
+    protected scopeRepository: IScopeRepository;
+    protected clientScopeRepository: IClientScopeRepository;
     protected appOrigins: string[];
     protected logger?: Logger;
     constructor(ctx: WebClientProvisionerContext);
     ensureForRealm(realm: Realm | {
         id: string;
     }): Promise<void>;
+    /**
+     * Upsert the client row itself.
+     *
+     * `web` is a reserved client name (`CLIENT_RESERVED_NAMES`), so the row
+     * belongs to the system whatever state it is in. A non-built-in one
+     * predates the reservation and is taken over rather than left to shadow
+     * the realm's login client.
+     */
+    protected ensureClient(realm: Realm | {
+        id: string;
+    }): Promise<Client>;
+    /**
+     * Bind the built-in global scopes through `auth_client_scopes`. That
+     * junction is the only source the /authorize code-request verifier reads
+     * scopes from.
+     *
+     * Additive like the attribute MERGE above: an extra scope an admin bound
+     * by hand is left in place.
+     */
+    protected ensureScopes(client: Client): Promise<void>;
 }
 //# sourceMappingURL=web-client.d.ts.map

package/dist/core/entities/client/web-client.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF~~;;;;;;;;;;;;;;GAcG~~;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;~~IAMtC~~,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;~~CAsCrE~~"}
1	+ {"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,eAAe,EAAE,gBAAgB,CAAC;IAClC,qBAAqB,EAAE,sBAAsB,CAAC;IAC9C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,EAG1C,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;IAExD,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAQtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASlE;;;;;;;OAOG;cACa,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAsD5E;;;;;;;OAOG;cACa,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAiC9D"}