@authup/server-core 1.0.0-beta.57 → 1.0.0-beta.59

package/dist/app/modules/oauth2/module.mjs

@@ -55,19 +55,24 @@ var OAuth2Module = class {
 	async setup(container) {
 		const config = container.resolve(ConfigInjectionKey);
 		container.register(OAuth2InjectionToken.ClientRepository, { useFactory: (c) => {
-			return new OAuth2ClientRepository(c.resolve(ClientEntity));
+			const repository = c.resolve(ClientEntity);
+			return new OAuth2ClientRepository(repository);
 		} });
 		container.register(OAuth2InjectionToken.ScopeRepository, { useFactory: (c) => {
-			return new OAuth2ScopeRepository(c.resolve(ClientScopeEntity));
+			const repository = c.resolve(ClientScopeEntity);
+			return new OAuth2ScopeRepository(repository);
 		} });
 		container.register(OAuth2InjectionToken.AuthorizationCodeRepository, { useFactory: (c) => {
-			return new OAuth2AuthorizationCodeRepository(c.resolve(CacheInjectionKey));
+			const cache = c.resolve(CacheInjectionKey);
+			return new OAuth2AuthorizationCodeRepository(cache);
 		} });
 		container.register(OAuth2InjectionToken.AuthorizationStateRepository, { useFactory: (c) => {
-			return new OAuth2AuthorizationStateRepository(c.resolve(CacheInjectionKey));
+			const cache = c.resolve(CacheInjectionKey);
+			return new OAuth2AuthorizationStateRepository(cache);
 		} });
 		container.register(OAuth2InjectionToken.TokenRepository, { useFactory: (c) => {
-			return new OAuth2TokenRepository(c.resolve(CacheInjectionKey));
+			const cache = c.resolve(CacheInjectionKey);
+			return new OAuth2TokenRepository(cache);
 		} });
 		container.register(OAuth2InjectionToken.SessionTokenRepository, { useFactory: (c) => new SessionTokenRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource)) });
 		container.register(OAuth2InjectionToken.ConsentRepository, { useFactory: (c) => new ConsentRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource)) });
@@ -79,28 +84,38 @@ var OAuth2Module = class {
 			return new KeyRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource), { secretsCipher });
 		} });
 		container.register(OAuth2InjectionToken.TokenSigner, { useFactory: (c) => {
-			return new OAuth2TokenSigner(c.resolve(OAuth2InjectionToken.KeyStore));
+			const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);
+			return new OAuth2TokenSigner(keyStore);
 		} });
 		container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, { useFactory: (c) => {
-			return new OAuth2AuthorizationCodeIssuer(c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository), { maxAge: config.tokenAccessMaxAge });
+			const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);
+			return new OAuth2AuthorizationCodeIssuer(codeRepository, { maxAge: config.tokenAccessMaxAge });
 		} });
 		container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, { useFactory: (c) => {
-			return new OAuth2AuthorizationCodeVerifier(c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository));
+			const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);
+			return new OAuth2AuthorizationCodeVerifier(codeRepository);
 		} });
 		container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, { useFactory: (c) => {
+			const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);
+			const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);
 			return new OAuth2AuthorizationCodeRequestVerifier({
-				clientRepository: c.resolve(OAuth2InjectionToken.ClientRepository),
-				scopeRepository: c.resolve(OAuth2InjectionToken.ScopeRepository)
+				clientRepository,
+				scopeRepository: clientScopeRepository
 			});
 		} });
 		container.register(OAuth2InjectionToken.AuthorizationStateManager, { useFactory: (c) => {
-			return new OAuth2AuthorizationStateManager(c.resolve(OAuth2InjectionToken.AuthorizationStateRepository));
+			const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);
+			return new OAuth2AuthorizationStateManager(stateRepository);
 		} });
 		container.register(OAuth2InjectionToken.TokenRevoker, { useFactory: (c) => {
-			return new OAuth2TokenRevoker(c.resolve(OAuth2InjectionToken.TokenRepository), c.resolve(OAuth2InjectionToken.SessionTokenRepository));
+			const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);
+			const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);
+			return new OAuth2TokenRevoker(tokenRepository, sessionTokenRepository);
 		} });
 		container.register(OAuth2InjectionToken.TokenVerifier, { useFactory: (c) => {
-			return new OAuth2TokenVerifier(c.resolve(OAuth2InjectionToken.KeyStore), c.resolve(OAuth2InjectionToken.TokenRepository));
+			const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);
+			const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);
+			return new OAuth2TokenVerifier(keyStore, tokenRepository);
 		} });
 		container.register(OAuth2InjectionToken.AccessTokenIssuer, { useFactory: (c) => {
 			const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);
@@ -113,7 +128,9 @@ var OAuth2Module = class {
 			}, identityRoleProvider, sessionTokenRepository);
 		} });
 		container.register(OAuth2InjectionToken.MfaTokenIssuer, { useFactory: (c) => {
-			return new OAuth2MfaTokenIssuer(c.resolve(OAuth2InjectionToken.TokenRepository), c.resolve(OAuth2InjectionToken.TokenSigner), {
+			const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);
+			const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);
+			return new OAuth2MfaTokenIssuer(tokenRepository, tokenSigner, {
 				maxAge: config.mfaTicketMaxAge,
 				issuer: config.publicUrl
 			});
@@ -128,10 +145,13 @@ var OAuth2Module = class {
 			}, sessionTokenRepository);
 		} });
 		container.register(OAuth2InjectionToken.OpenIDTokenIssuer, { useFactory: (c) => {
+			const repository = c.resolve(OAuth2InjectionToken.TokenRepository);
+			const signer = c.resolve(OAuth2InjectionToken.TokenSigner);
+			const identityResolver = c.resolve(IdentityInjectionKey.Resolver);
 			return new OAuth2OpenIDTokenIssuer({
-				repository: c.resolve(OAuth2InjectionToken.TokenRepository),
-				signer: c.resolve(OAuth2InjectionToken.TokenSigner),
-				identityResolver: c.resolve(IdentityInjectionKey.Resolver),
+				repository,
+				signer,
+				identityResolver,
 				options: {
 					maxAge: config.tokenAccessMaxAge,
 					issuer: config.publicUrl

package/dist/app/modules/oauth2/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["SymmetricCipher","CacheInjectionKey","ModuleName","LoggerInjectionKey","ConsentRepositoryAdapter","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2ScopeRepository","OAuth2TokenRepository","SessionTokenRepositoryAdapter","KeyRepositoryAdapter","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2MfaTokenIssuer","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","SessionTokenRepository","DataSource","ConsentRepository","KeyStore","secretsCipher","secretsEncryptionKey","env","logger","warn","TokenSigner","keyStore","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","sessionTokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","MfaTokenIssuer","mfaTicketMaxAge","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { SymmetricCipher } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nimport {\n    ConsentRepositoryAdapter,\n    OAuth2AuthorizationCodeRepository,\n    OAuth2AuthorizationStateRepository,\n    OAuth2ClientRepository,\n    OAuth2ScopeRepository,\n    OAuth2TokenRepository,\n    SessionTokenRepositoryAdapter,\n} from './repositories/index.ts';\nimport { KeyRepositoryAdapter } from '../database/repositories/index.ts';\nimport {\n    OAuth2AccessTokenIssuer,\n    OAuth2AuthorizationCodeIssuer,\n    OAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeVerifier,\n    OAuth2AuthorizationStateManager,\n    OAuth2MfaTokenIssuer,\n    OAuth2OpenIDTokenIssuer,\n    OAuth2RefreshTokenIssuer,\n    OAuth2TokenRevoker,\n    OAuth2TokenSigner,\n    OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.OAUTH2;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n    }\n\n    async setup(container: IContainer) : Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        container.register(OAuth2InjectionToken.ClientRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n                return new OAuth2ClientRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.ScopeRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n                return new OAuth2ScopeRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationCodeRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationStateRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2TokenRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.SessionTokenRepository, {\n            useFactory: (c) => new SessionTokenRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.ConsentRepository, {\n            useFactory: (c) => new ConsentRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.KeyStore, {\n            // todo: cache use here\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n\n                let secretsCipher : SymmetricCipher | null = null;\n                if (config.secretsEncryptionKey) {\n                    secretsCipher = new SymmetricCipher(config.secretsEncryptionKey);\n                } else if (config.env === 'production') {\n                    // parity posture without a KEK (Keycloak/authentik store key\n                    // material plaintext too) — but say so once, loudly.\n                    const logger = c.resolve(LoggerInjectionKey);\n                    logger.warn(\n                        'The realm key store persists key material unwrapped; ' +\n                        'set SECRETS_ENCRYPTION_KEY to wrap it at rest.',\n                    );\n                }\n\n                return new KeyRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource), { secretsCipher });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenSigner, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                return new OAuth2TokenSigner(keyStore);\n            },\n        });\n\n        // authorization code issuer\n        container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeIssuer(\n                    codeRepository,\n                    {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                    },\n                );\n            },\n        });\n        container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeVerifier(codeRepository);\n            },\n        });\n\n        // authorization code request verifier\n        container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n            useFactory: (c) => {\n                const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n                const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n                return new OAuth2AuthorizationCodeRequestVerifier({\n                    clientRepository,\n                    scopeRepository: clientScopeRepository,\n                });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n            useFactory: (c) => {\n                const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n                return new OAuth2AuthorizationStateManager(stateRepository);\n            },\n        });\n\n        // token revoker\n        container.register(OAuth2InjectionToken.TokenRevoker, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2TokenRevoker(tokenRepository, sessionTokenRepository);\n            },\n        });\n\n        // token verifier\n        container.register(OAuth2InjectionToken.TokenVerifier, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n                return new OAuth2TokenVerifier(keyStore, tokenRepository);\n            },\n        });\n\n        // access token issuer\n        container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2AccessTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    identityRoleProvider,\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // mfa login-ticket issuer\n        container.register(OAuth2InjectionToken.MfaTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n                return new OAuth2MfaTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.mfaTicketMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                );\n            },\n        });\n\n        // refresh token issuer\n        container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n\n                return new OAuth2RefreshTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenRefreshMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // open-id token issuer\n        container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n            useFactory: (c) => {\n                const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n                return new OAuth2OpenIDTokenIssuer({\n                    repository,\n                    signer,\n\n                    identityResolver,\n\n                    options: {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,IAAa6B,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAO5B,WAAW8B;EACvB,KAAKD,eAAe;GAAC7B,WAAW+B;GAAU/B,WAAWgC;GAAOhC,WAAWiC;GAAQjC,WAAWkC;EAAS;CACvG;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GAET,OAAO,IAAIrC,uBADQqC,EAAEJ,QAAkCf,YACrBoB,CAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GAET,OAAO,IAAIpC,sBADQoC,EAAEJ,QAAuCd,iBAC3BmB,CAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GAET,OAAO,IAAIvC,kCADGuC,EAAEJ,QAAQvC,iBACqB+C,CAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GAET,OAAO,IAAItC,mCADGsC,EAAEJ,QAAQvC,iBACsB+C,CAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GAET,OAAO,IAAInC,sBADGmC,EAAEJ,QAAQvC,iBACS+C,CAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,wBAAwB,EAC5DR,aAAaC,MAAM,IAAIlC,8BACnBkC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,mBAAmB,EACvDV,aAAaC,MAAM,IAAIxC,yBACnBwC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB+B,UAAU,EAE9CX,aAAaC,MAAAA;GACT,MAAML,SAASK,EAAEJ,QAAQb,kBAAAA;GAEzB,IAAI4B,gBAAyC;GAC7C,IAAIhB,OAAOiB,sBACPD,gBAAgB,IAAIvD,gBAAgBuC,OAAOiB,oBAAoB;QAC5D,IAAIjB,OAAOkB,QAAQ,cAItBC,EADiBlB,QAAQrC,kBACzBuD,CAAAA,CAAOC,KACH,qGACA;GAIR,OAAO,IAAIhD,qBAAqBiC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,GAAG,EAAEG,cAAc,CAAA;EAChG,EACJ,CAAA;EAEAjB,UAAUG,SAASlB,qBAAqBqC,aAAa,EACjDjB,aAAaC,MAAAA;GAET,OAAO,IAAIvB,kBADMuB,EAAEJ,QAAQjB,qBAAqB+B,QACnBO,CAAAA;EACjC,EACJ,CAAA;EAGAvB,UAAUG,SAASlB,qBAAqBuC,yBAAyB,EAC7DnB,aAAaC,MAAAA;GAGT,OAAO,IAAI/B,8BAFY+B,EAAEJ,QAAQjB,qBAAqBwB,2BAGlDgB,GACA,EAEIC,QAAQzB,OAAO0B,kBACnB,CAAA;EAER,EACJ,CAAA;EACA3B,UAAUG,SAASlB,qBAAqB2C,2BAA2B,EAC/DvB,aAAaC,MAAAA;GAGT,OAAO,IAAI7B,gCAFY6B,EAAEJ,QAAQjB,qBAAqBwB,2BAEXgB,CAAAA;EAC/C,EACJ,CAAA;EAGAzB,UAAUG,SAASlB,qBAAqB4C,kCAAkC,EACtExB,aAAaC,MAAAA;GAIT,OAAO,IAAI9B,uCAAuC;IAC9CsD,kBAJqBxB,EAAEJ,QAAQjB,qBAAqBmB,gBAIpD0B;IACAE,iBAJ0B1B,EAAEJ,QAAQjB,qBAAqBuB,eAIxCuB;GACrB,CAAA;EACJ,EACJ,CAAA;EAEA/B,UAAUG,SAASlB,qBAAqBgD,2BAA2B,EAC/D5B,aAAaC,MAAAA;GAGT,OAAO,IAAI5B,gCAFa4B,EAAEJ,QAAQjB,qBAAqB0B,4BAEZuB,CAAAA;EAC/C,EACJ,CAAA;EAGAlC,UAAUG,SAASlB,qBAAqBkD,cAAc,EAClD9B,aAAaC,MAAAA;GAGT,OAAO,IAAIxB,mBAFawB,EAAEJ,QAAQjB,qBAAqB2B,eAEzBwB,GADC9B,EAAEJ,QAAQjB,qBAAqB4B,sBACfwB,CAAAA;EACnD,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBqD,eAAe,EACnDjC,aAAaC,MAAAA;GAIT,OAAO,IAAItB,oBAHMsB,EAAEJ,QAAQjB,qBAAqB+B,QAGjBO,GAFPjB,EAAEJ,QAAQjB,qBAAqB2B,eAEdwB,CAAAA;EAC7C,EACJ,CAAA;EAGApC,UAAUG,SAASlB,qBAAqBsD,mBAAmB,EACvDlC,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMmB,uBAAuBnC,EAAEJ,QAAQhB,qBAAqBwD,YAAY;GACxE,MAAML,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAIvC,wBACP8D,iBACAI,aACA;IACId,QAAQzB,OAAO0B;IACfgB,QAAQ1C,OAAO2C;GACnB,GACAH,sBACAJ,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqB4D,gBAAgB,EACpDxC,aAAaC,MAAAA;GAIT,OAAO,IAAI3B,qBAHa2B,EAAEJ,QAAQjB,qBAAqB2B,eAInDwB,GAHgB9B,EAAEJ,QAAQjB,qBAAqBqC,WAI/CkB,GACA;IACId,QAAQzB,OAAO6C;IACfH,QAAQ1C,OAAO2C;GACnB,CAAA;EAER,EACJ,CAAA;EAGA5C,UAAUG,SAASlB,qBAAqB8D,oBAAoB,EACxD1C,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMe,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GAEpF,OAAO,IAAIhC,yBACPuD,iBACAI,aACA;IACId,QAAQzB,OAAO+C;IACfL,QAAQ1C,OAAO2C;GACnB,GACAP,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBgE,mBAAmB,EACvD5C,aAAaC,MAAAA;GAKT,OAAO,IAAI1B,wBAAwB;IAC/B2B,YALeD,EAAEJ,QAAQjB,qBAAqB2B,eAK9CL;IACA2C,QALW5C,EAAEJ,QAAQjB,qBAAqBqC,WAK1C4B;IAEAC,kBANqB7C,EAAEJ,QAAQhB,qBAAqBkE,QAMpDD;IAEAE,SAAS;KAEL3B,QAAQzB,OAAO0B;KACfgB,QAAQ1C,OAAO2C;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["SymmetricCipher","CacheInjectionKey","ModuleName","LoggerInjectionKey","ConsentRepositoryAdapter","OAuth2AuthorizationCodeRepository","OAuth2AuthorizationStateRepository","OAuth2ClientRepository","OAuth2ScopeRepository","OAuth2TokenRepository","SessionTokenRepositoryAdapter","KeyRepositoryAdapter","OAuth2AccessTokenIssuer","OAuth2AuthorizationCodeIssuer","OAuth2AuthorizationCodeRequestVerifier","OAuth2AuthorizationCodeVerifier","OAuth2AuthorizationStateManager","OAuth2MfaTokenIssuer","OAuth2OpenIDTokenIssuer","OAuth2RefreshTokenIssuer","OAuth2TokenRevoker","OAuth2TokenSigner","OAuth2TokenVerifier","OAuth2InjectionToken","IdentityInjectionKey","ClientEntity","ClientScopeEntity","ConfigInjectionKey","DatabaseInjectionKey","OAuth2Module","name","dependencies","OAUTH2","DATABASE","CACHE","CONFIG","IDENTITY","setup","container","config","resolve","register","ClientRepository","useFactory","c","repository","ScopeRepository","AuthorizationCodeRepository","cache","AuthorizationStateRepository","TokenRepository","SessionTokenRepository","DataSource","ConsentRepository","KeyStore","secretsCipher","secretsEncryptionKey","env","logger","warn","TokenSigner","keyStore","AuthorizationCodeIssuer","codeRepository","maxAge","tokenAccessMaxAge","AuthorizationCodeVerifier","AuthorizationCodeRequestVerifier","clientRepository","clientScopeRepository","scopeRepository","AuthorizationStateManager","stateRepository","TokenRevoker","tokenRepository","sessionTokenRepository","TokenVerifier","AccessTokenIssuer","tokenSigner","identityRoleProvider","RoleProvider","issuer","publicUrl","MfaTokenIssuer","mfaTicketMaxAge","RefreshTokenIssuer","tokenRefreshMaxAge","OpenIDTokenIssuer","signer","identityResolver","Resolver","options"],"sources":["../../../../src/app/modules/oauth2/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { SymmetricCipher } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport type { IContainer } from 'eldin';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nimport {\n    ConsentRepositoryAdapter,\n    OAuth2AuthorizationCodeRepository,\n    OAuth2AuthorizationStateRepository,\n    OAuth2ClientRepository,\n    OAuth2ScopeRepository,\n    OAuth2TokenRepository,\n    SessionTokenRepositoryAdapter,\n} from './repositories/index.ts';\nimport { KeyRepositoryAdapter } from '../database/repositories/index.ts';\nimport {\n    OAuth2AccessTokenIssuer,\n    OAuth2AuthorizationCodeIssuer,\n    OAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeVerifier,\n    OAuth2AuthorizationStateManager,\n    OAuth2MfaTokenIssuer,\n    OAuth2OpenIDTokenIssuer,\n    OAuth2RefreshTokenIssuer,\n    OAuth2TokenRevoker,\n    OAuth2TokenSigner,\n    OAuth2TokenVerifier,\n} from '../../../core/index.ts';\nimport { OAuth2InjectionToken } from './constants.ts';\nimport { IdentityInjectionKey } from '../identity/index.ts';\nimport { ClientEntity, ClientScopeEntity } from '../../../adapters/database/domains/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\n\nexport class OAuth2Module implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.OAUTH2;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG, ModuleName.IDENTITY];\n    }\n\n    async setup(container: IContainer) : Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        container.register(OAuth2InjectionToken.ClientRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientEntity>>(ClientEntity);\n                return new OAuth2ClientRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.ScopeRepository, {\n            useFactory: (c) => {\n                const repository = c.resolve<Repository<ClientScopeEntity>>(ClientScopeEntity);\n                return new OAuth2ScopeRepository(repository);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationCodeRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationCodeRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2AuthorizationStateRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                return new OAuth2TokenRepository(cache);\n            },\n        });\n\n        container.register(OAuth2InjectionToken.SessionTokenRepository, {\n            useFactory: (c) => new SessionTokenRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.ConsentRepository, {\n            useFactory: (c) => new ConsentRepositoryAdapter(\n                c.resolve(DatabaseInjectionKey.DataSource),\n            ),\n        });\n\n        container.register(OAuth2InjectionToken.KeyStore, {\n            // todo: cache use here\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n\n                let secretsCipher : SymmetricCipher | null = null;\n                if (config.secretsEncryptionKey) {\n                    secretsCipher = new SymmetricCipher(config.secretsEncryptionKey);\n                } else if (config.env === 'production') {\n                    // parity posture without a KEK (Keycloak/authentik store key\n                    // material plaintext too) — but say so once, loudly.\n                    const logger = c.resolve(LoggerInjectionKey);\n                    logger.warn(\n                        'The realm key store persists key material unwrapped; ' +\n                        'set SECRETS_ENCRYPTION_KEY to wrap it at rest.',\n                    );\n                }\n\n                return new KeyRepositoryAdapter(c.resolve(DatabaseInjectionKey.DataSource), { secretsCipher });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.TokenSigner, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                return new OAuth2TokenSigner(keyStore);\n            },\n        });\n\n        // authorization code issuer\n        container.register(OAuth2InjectionToken.AuthorizationCodeIssuer, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeIssuer(\n                    codeRepository,\n                    {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                    },\n                );\n            },\n        });\n        container.register(OAuth2InjectionToken.AuthorizationCodeVerifier, {\n            useFactory: (c) => {\n                const codeRepository = c.resolve(OAuth2InjectionToken.AuthorizationCodeRepository);\n\n                return new OAuth2AuthorizationCodeVerifier(codeRepository);\n            },\n        });\n\n        // authorization code request verifier\n        container.register(OAuth2InjectionToken.AuthorizationCodeRequestVerifier, {\n            useFactory: (c) => {\n                const clientRepository = c.resolve(OAuth2InjectionToken.ClientRepository);\n                const clientScopeRepository = c.resolve(OAuth2InjectionToken.ScopeRepository);\n\n                return new OAuth2AuthorizationCodeRequestVerifier({\n                    clientRepository,\n                    scopeRepository: clientScopeRepository,\n                });\n            },\n        });\n\n        container.register(OAuth2InjectionToken.AuthorizationStateManager, {\n            useFactory: (c) => {\n                const stateRepository = c.resolve(OAuth2InjectionToken.AuthorizationStateRepository);\n\n                return new OAuth2AuthorizationStateManager(stateRepository);\n            },\n        });\n\n        // token revoker\n        container.register(OAuth2InjectionToken.TokenRevoker, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2TokenRevoker(tokenRepository, sessionTokenRepository);\n            },\n        });\n\n        // token verifier\n        container.register(OAuth2InjectionToken.TokenVerifier, {\n            useFactory: (c) => {\n                const keyStore = c.resolve(OAuth2InjectionToken.KeyStore);\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n\n                return new OAuth2TokenVerifier(keyStore, tokenRepository);\n            },\n        });\n\n        // access token issuer\n        container.register(OAuth2InjectionToken.AccessTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityRoleProvider = c.resolve(IdentityInjectionKey.RoleProvider);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n                return new OAuth2AccessTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    identityRoleProvider,\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // mfa login-ticket issuer\n        container.register(OAuth2InjectionToken.MfaTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n\n                return new OAuth2MfaTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.mfaTicketMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                );\n            },\n        });\n\n        // refresh token issuer\n        container.register(OAuth2InjectionToken.RefreshTokenIssuer, {\n            useFactory: (c) => {\n                const tokenRepository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const tokenSigner = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const sessionTokenRepository = c.resolve(OAuth2InjectionToken.SessionTokenRepository);\n\n                return new OAuth2RefreshTokenIssuer(\n                    tokenRepository,\n                    tokenSigner,\n                    {\n                        maxAge: config.tokenRefreshMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                    sessionTokenRepository,\n                );\n            },\n        });\n\n        // open-id token issuer\n        container.register(OAuth2InjectionToken.OpenIDTokenIssuer, {\n            useFactory: (c) => {\n                const repository = c.resolve(OAuth2InjectionToken.TokenRepository);\n                const signer = c.resolve(OAuth2InjectionToken.TokenSigner);\n                const identityResolver = c.resolve(IdentityInjectionKey.Resolver);\n\n                return new OAuth2OpenIDTokenIssuer({\n                    repository,\n                    signer,\n\n                    identityResolver,\n\n                    options: {\n                        // todo: own constant here\n                        maxAge: config.tokenAccessMaxAge,\n                        issuer: config.publicUrl,\n                    },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,IAAa6B,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAO5B,WAAW8B;EACvB,KAAKD,eAAe;GAAC7B,WAAW+B;GAAU/B,WAAWgC;GAAOhC,WAAWiC;GAAQjC,WAAWkC;EAAS;CACvG;CAEA,MAAMC,MAAMC,WAAuC;EAC/C,MAAMC,SAASD,UAAUE,QAAQb,kBAAAA;EAEjCW,UAAUG,SAASlB,qBAAqBmB,kBAAkB,EACtDC,aAAaC,MAAAA;GACT,MAAMC,aAAaD,EAAEJ,QAAkCf,YAAAA;GACvD,OAAO,IAAIlB,uBAAuBsC,UAAAA;EACtC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBuB,iBAAiB,EACrDH,aAAaC,MAAAA;GACT,MAAMC,aAAaD,EAAEJ,QAAuCd,iBAAAA;GAC5D,OAAO,IAAIlB,sBAAsBqC,UAAAA;EACrC,EACJ,CAAA;EAEAP,UAAUG,SAASlB,qBAAqBwB,6BAA6B,EACjEJ,aAAaC,MAAAA;GACT,MAAMI,QAAQJ,EAAEJ,QAAQvC,iBAAAA;GACxB,OAAO,IAAII,kCAAkC2C,KAAAA;EACjD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB0B,8BAA8B,EAClEN,aAAaC,MAAAA;GACT,MAAMI,QAAQJ,EAAEJ,QAAQvC,iBAAAA;GACxB,OAAO,IAAIK,mCAAmC0C,KAAAA;EAClD,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB2B,iBAAiB,EACrDP,aAAaC,MAAAA;GACT,MAAMI,QAAQJ,EAAEJ,QAAQvC,iBAAAA;GACxB,OAAO,IAAIQ,sBAAsBuC,KAAAA;EACrC,EACJ,CAAA;EAEAV,UAAUG,SAASlB,qBAAqB4B,wBAAwB,EAC5DR,aAAaC,MAAM,IAAIlC,8BACnBkC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB8B,mBAAmB,EACvDV,aAAaC,MAAM,IAAIxC,yBACnBwC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,CAAA,EAEjD,CAAA;EAEAd,UAAUG,SAASlB,qBAAqB+B,UAAU,EAE9CX,aAAaC,MAAAA;GACT,MAAML,SAASK,EAAEJ,QAAQb,kBAAAA;GAEzB,IAAI4B,gBAAyC;GAC7C,IAAIhB,OAAOiB,sBACPD,gBAAgB,IAAIvD,gBAAgBuC,OAAOiB,oBAAoB;QAC5D,IAAIjB,OAAOkB,QAAQ,cAItBC,EADiBlB,QAAQrC,kBACzBuD,CAAAA,CAAOC,KACH,qGACA;GAIR,OAAO,IAAIhD,qBAAqBiC,EAAEJ,QAAQZ,qBAAqBwB,UAAU,GAAG,EAAEG,cAAc,CAAA;EAChG,EACJ,CAAA;EAEAjB,UAAUG,SAASlB,qBAAqBqC,aAAa,EACjDjB,aAAaC,MAAAA;GACT,MAAMiB,WAAWjB,EAAEJ,QAAQjB,qBAAqB+B,QAAQ;GACxD,OAAO,IAAIjC,kBAAkBwC,QAAAA;EACjC,EACJ,CAAA;EAGAvB,UAAUG,SAASlB,qBAAqBuC,yBAAyB,EAC7DnB,aAAaC,MAAAA;GACT,MAAMmB,iBAAiBnB,EAAEJ,QAAQjB,qBAAqBwB,2BAA2B;GAEjF,OAAO,IAAIlC,8BACPkD,gBACA,EAEIC,QAAQzB,OAAO0B,kBACnB,CAAA;EAER,EACJ,CAAA;EACA3B,UAAUG,SAASlB,qBAAqB2C,2BAA2B,EAC/DvB,aAAaC,MAAAA;GACT,MAAMmB,iBAAiBnB,EAAEJ,QAAQjB,qBAAqBwB,2BAA2B;GAEjF,OAAO,IAAIhC,gCAAgCgD,cAAAA;EAC/C,EACJ,CAAA;EAGAzB,UAAUG,SAASlB,qBAAqB4C,kCAAkC,EACtExB,aAAaC,MAAAA;GACT,MAAMwB,mBAAmBxB,EAAEJ,QAAQjB,qBAAqBmB,gBAAgB;GACxE,MAAM2B,wBAAwBzB,EAAEJ,QAAQjB,qBAAqBuB,eAAe;GAE5E,OAAO,IAAIhC,uCAAuC;IAC9CsD;IACAE,iBAAiBD;GACrB,CAAA;EACJ,EACJ,CAAA;EAEA/B,UAAUG,SAASlB,qBAAqBgD,2BAA2B,EAC/D5B,aAAaC,MAAAA;GACT,MAAM4B,kBAAkB5B,EAAEJ,QAAQjB,qBAAqB0B,4BAA4B;GAEnF,OAAO,IAAIjC,gCAAgCwD,eAAAA;EAC/C,EACJ,CAAA;EAGAlC,UAAUG,SAASlB,qBAAqBkD,cAAc,EAClD9B,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAMyB,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAI/B,mBAAmBsD,iBAAiBC,sBAAAA;EACnD,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBqD,eAAe,EACnDjC,aAAaC,MAAAA;GACT,MAAMiB,WAAWjB,EAAEJ,QAAQjB,qBAAqB+B,QAAQ;GACxD,MAAMoB,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GAEtE,OAAO,IAAI5B,oBAAoBuC,UAAUa,eAAAA;EAC7C,EACJ,CAAA;EAGApC,UAAUG,SAASlB,qBAAqBsD,mBAAmB,EACvDlC,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMmB,uBAAuBnC,EAAEJ,QAAQhB,qBAAqBwD,YAAY;GACxE,MAAML,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GACpF,OAAO,IAAIvC,wBACP8D,iBACAI,aACA;IACId,QAAQzB,OAAO0B;IACfgB,QAAQ1C,OAAO2C;GACnB,GACAH,sBACAJ,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqB4D,gBAAgB,EACpDxC,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAE9D,OAAO,IAAI3C,qBACPyD,iBACAI,aACA;IACId,QAAQzB,OAAO6C;IACfH,QAAQ1C,OAAO2C;GACnB,CAAA;EAER,EACJ,CAAA;EAGA5C,UAAUG,SAASlB,qBAAqB8D,oBAAoB,EACxD1C,aAAaC,MAAAA;GACT,MAAM8B,kBAAkB9B,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACtE,MAAM4B,cAAclC,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GAC9D,MAAMe,yBAAyB/B,EAAEJ,QAAQjB,qBAAqB4B,sBAAsB;GAEpF,OAAO,IAAIhC,yBACPuD,iBACAI,aACA;IACId,QAAQzB,OAAO+C;IACfL,QAAQ1C,OAAO2C;GACnB,GACAP,sBAAAA;EAER,EACJ,CAAA;EAGArC,UAAUG,SAASlB,qBAAqBgE,mBAAmB,EACvD5C,aAAaC,MAAAA;GACT,MAAMC,aAAaD,EAAEJ,QAAQjB,qBAAqB2B,eAAe;GACjE,MAAMsC,SAAS5C,EAAEJ,QAAQjB,qBAAqBqC,WAAW;GACzD,MAAM6B,mBAAmB7C,EAAEJ,QAAQhB,qBAAqBkE,QAAQ;GAEhE,OAAO,IAAIxE,wBAAwB;IAC/B2B;IACA2C;IAEAC;IAEAE,SAAS;KAEL3B,QAAQzB,OAAO0B;KACfgB,QAAQ1C,OAAO2C;IACnB;GACJ,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}

package/dist/app/modules/oauth2/repositories/authorize/state/repository.mjs

@@ -30,7 +30,7 @@ var OAuth2AuthorizationStateRepository = class {
 		await this.cache.set(buildCacheKey({
 			prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,
 			key: state
-		}), data, { ttl: 1e3 * 60 * 30 });
+		}), data, { ttl: 18e5 });
 		return state;
 	}
 };

package/dist/app/modules/oauth2/repositories/authorize/state/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["createNanoID","buildCacheKey","CacheOAuth2Prefix","OAuth2AuthorizationStateRepository","cache","findOneById","key","id","prefix","AUTHORIZATION_CODE","payload","get","remove","drop","insert","data","state","set","ttl"],"sources":["../../../../../../../src/app/modules/oauth2/repositories/authorize/state/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createNanoID } from '@authup/kit';\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { IOAuth2AuthorizeStateRepository, OAuth2AuthorizationState } from '../../../../../../core/index.ts';\nimport { CacheOAuth2Prefix } from '../../constants.ts';\n\nexport class OAuth2AuthorizationStateRepository implements IOAuth2AuthorizeStateRepository {\n    protected cache : ICache;\n\n    constructor(cache: ICache) {\n        this.cache = cache;\n    }\n\n    async findOneById(key: string): Promise<OAuth2AuthorizationState | null> {\n        const id = buildCacheKey({\n            prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,\n            key, \n        });\n        const payload = await this.cache.get<OAuth2AuthorizationState>(id);\n        if (payload) {\n            return payload;\n        }\n\n        return null;\n    }\n\n    async remove(key: string): Promise<void> {\n        await this.cache.drop(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,\n                key, \n            }),\n        );\n    }\n\n    async insert(data: OAuth2AuthorizationState): Promise<string> {\n        const state = createNanoID();\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,\n                key: state, \n            }),\n            data,\n            { ttl: 1000 * 60 * 30 }, // 30 min\n        );\n\n        return state;\n    }\n}\n"],"mappings":";;;;;;;AAaA,IAAaG,qCAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAEA,MAAMC,YAAYC,KAAuD;EACrE,MAAMC,KAAKN,cAAc;GACrBO,QAAQN,kBAAkBO;GAC1BH;EACJ,CAAA;EACA,MAAMI,UAAU,MAAM,KAAKN,MAAMO,IAA8BJ,EAAAA;EAC/D,IAAIG,SACA,OAAOA;EAGX,OAAO;CACX;CAEA,MAAME,OAAON,KAA4B;EACrC,MAAM,KAAKF,MAAMS,KACbZ,cAAc;GACVO,QAAQN,kBAAkBO;GAC1BH;EACJ,CAAA,CAAA;CAER;CAEA,MAAMQ,OAAOC,MAAiD;EAC1D,MAAMC,QAAQhB,aAAAA;EAEd,MAAM,KAAKI,MAAMa,IACbhB,cAAc;GACVO,QAAQN,kBAAkBO;GAC1BH,KAAKU;EACT,CAAA,GACAD,MACA,EAAEG,KAAK,MAAO,KAAK,GAAG,CAAA;EAG1B,OAAOF;CACX;AACJ"}
+{"version":3,"file":"repository.mjs","names":["createNanoID","buildCacheKey","CacheOAuth2Prefix","OAuth2AuthorizationStateRepository","cache","findOneById","key","id","prefix","AUTHORIZATION_CODE","payload","get","remove","drop","insert","data","state","set","ttl"],"sources":["../../../../../../../src/app/modules/oauth2/repositories/authorize/state/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createNanoID } from '@authup/kit';\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { IOAuth2AuthorizeStateRepository, OAuth2AuthorizationState } from '../../../../../../core/index.ts';\nimport { CacheOAuth2Prefix } from '../../constants.ts';\n\nexport class OAuth2AuthorizationStateRepository implements IOAuth2AuthorizeStateRepository {\n    protected cache : ICache;\n\n    constructor(cache: ICache) {\n        this.cache = cache;\n    }\n\n    async findOneById(key: string): Promise<OAuth2AuthorizationState | null> {\n        const id = buildCacheKey({\n            prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,\n            key, \n        });\n        const payload = await this.cache.get<OAuth2AuthorizationState>(id);\n        if (payload) {\n            return payload;\n        }\n\n        return null;\n    }\n\n    async remove(key: string): Promise<void> {\n        await this.cache.drop(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,\n                key, \n            }),\n        );\n    }\n\n    async insert(data: OAuth2AuthorizationState): Promise<string> {\n        const state = createNanoID();\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.AUTHORIZATION_CODE,\n                key: state, \n            }),\n            data,\n            { ttl: 1000 * 60 * 30 }, // 30 min\n        );\n\n        return state;\n    }\n}\n"],"mappings":";;;;;;;AAaA,IAAaG,qCAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAEA,MAAMC,YAAYC,KAAuD;EACrE,MAAMC,KAAKN,cAAc;GACrBO,QAAQN,kBAAkBO;GAC1BH;EACJ,CAAA;EACA,MAAMI,UAAU,MAAM,KAAKN,MAAMO,IAA8BJ,EAAAA;EAC/D,IAAIG,SACA,OAAOA;EAGX,OAAO;CACX;CAEA,MAAME,OAAON,KAA4B;EACrC,MAAM,KAAKF,MAAMS,KACbZ,cAAc;GACVO,QAAQN,kBAAkBO;GAC1BH;EACJ,CAAA,CAAA;CAER;CAEA,MAAMQ,OAAOC,MAAiD;EAC1D,MAAMC,QAAQhB,aAAAA;EAEd,MAAM,KAAKI,MAAMa,IACbhB,cAAc;GACVO,QAAQN,kBAAkBO;GAC1BH,KAAKU;EACT,CAAA,GACAD,MACA,EAAEG,KAAK,KAAe,CAAA;EAG1B,OAAOF;CACX;AACJ"}

package/dist/app/modules/oauth2/repositories/token/repository.mjs

@@ -85,7 +85,7 @@ var OAuth2TokenRepository = class {
 			const ttl = utc * 1e3 - Date.now();
 			if (ttl > 0) return ttl;
 		}
-		return 3600 * 1e3;
+		return 36e5;
 	}
 };
 //#endregion

package/dist/app/modules/oauth2/repositories/token/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["buildCacheKey","randomUUID","CacheOAuth2Prefix","OAuth2TokenRepository","cache","findOneBySignature","signature","get","prefix","TOKEN_CLAIMS","key","findOneById","id","TOKEN","removeById","token","drop","setInactive","exp","insert","payload","jti","set","ttl","buildTTL","save","saveWithSignature","data","normalized","isInactive","cacheKey","TOKEN_INACTIVE","response","claimInactive","add","utc","Date","now"],"sources":["../../../../../../src/app/modules/oauth2/repositories/token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { randomUUID } from 'node:crypto';\nimport type { IOAuth2TokenRepository } from '../../../../../core/index.ts';\nimport { CacheOAuth2Prefix } from '../constants.ts';\n\nexport class OAuth2TokenRepository implements IOAuth2TokenRepository {\n    protected cache : ICache;\n\n    constructor(cache: ICache) {\n        this.cache = cache;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneBySignature(signature: string): Promise<OAuth2TokenPayload | null> {\n        return this.cache.get<OAuth2TokenPayload>(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,\n                key: signature, \n            }),\n        );\n    }\n\n    async findOneById(id: string): Promise<OAuth2TokenPayload | null> {\n        return this.cache.get<OAuth2TokenPayload>(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN,\n                key: id, \n            }),\n        );\n    }\n\n    // -----------------------------------------------------\n\n    async removeById(id: string): Promise<void> {\n        const token = await this.findOneById(id);\n        if (!token) {\n            return;\n        }\n\n        const key = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN,\n            key: id, \n        });\n        await this.cache.drop(key);\n\n        await this.setInactive(id, token.exp);\n    }\n\n    // -----------------------------------------------------\n\n    async insert(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload> {\n        payload.jti = randomUUID();\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN,\n                key: payload.jti, \n            }),\n            payload,\n            { ttl: this.buildTTL(payload.exp) },\n        );\n\n        return payload;\n    }\n\n    async save(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload> {\n        if (payload.jti) {\n            return payload;\n        }\n\n        return this.insert(payload);\n    }\n\n    async saveWithSignature(data: OAuth2TokenPayload, signature: string): Promise<OAuth2TokenPayload> {\n        const normalized = await this.save(data);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,\n                key: signature, \n            }),\n            normalized,\n            { ttl: this.buildTTL(data.exp) },\n        );\n\n        return normalized;\n    }\n\n    // -----------------------------------------------------\n\n    async isInactive(key: string): Promise<boolean> {\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        const response = await this.cache.get(cacheKey);\n\n        return !!response;\n    }\n\n    async setInactive(key: string, exp?: number): Promise<void> {\n        const ttl = this.buildTTL(exp);\n\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        await this.cache.set(\n            cacheKey,\n            true,\n            { ttl },\n        );\n    }\n\n    async claimInactive(key: string, exp?: number): Promise<boolean> {\n        const ttl = this.buildTTL(exp);\n\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        // set-if-absent (Redis SET NX / single-tick memory adapter) — returns\n        // true only for the caller that actually transitioned the token to\n        // inactive, so concurrent single-use claims cannot both succeed.\n        return this.cache.add(\n            cacheKey,\n            true,\n            { ttl },\n        );\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Transform timestamp in seconds to ttl in ms.\n     *\n     * @param utc\n     * @protected\n     */\n    protected buildTTL(utc?: number) {\n        if (typeof utc === 'number') {\n            const ttl = (utc * 1000) - Date.now();\n            if (ttl > 0) {\n                return ttl;\n            }\n        }\n\n        return 3_600 * 1000;\n    }\n}\n"],"mappings":";;;;;;;AAcA,IAAaG,wBAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAIA,MAAMC,mBAAmBC,WAAuD;EAC5E,OAAO,KAAKF,MAAMG,IACdP,cAAc;GACVQ,QAAQN,kBAAkBO;GAC1BC,KAAKJ;EACT,CAAA,CAAA;CAER;CAEA,MAAMK,YAAYC,IAAgD;EAC9D,OAAO,KAAKR,MAAMG,IACdP,cAAc;GACVQ,QAAQN,kBAAkBW;GAC1BH,KAAKE;EACT,CAAA,CAAA;CAER;CAIA,MAAME,WAAWF,IAA2B;EACxC,MAAMG,QAAQ,MAAM,KAAKJ,YAAYC,EAAAA;EACrC,IAAI,CAACG,OACD;EAGJ,MAAML,MAAMV,cAAc;GACtBQ,QAAQN,kBAAkBW;GAC1BH,KAAKE;EACT,CAAA;EACA,MAAM,KAAKR,MAAMY,KAAKN,GAAAA;EAEtB,MAAM,KAAKO,YAAYL,IAAIG,MAAMG,GAAG;CACxC;CAIA,MAAMC,OAAOC,SAA0D;EACnEA,QAAQC,MAAMpB,WAAAA;EAEd,MAAM,KAAKG,MAAMkB,IACbtB,cAAc;GACVQ,QAAQN,kBAAkBW;GAC1BH,KAAKU,QAAQC;EACjB,CAAA,GACAD,SACA,EAAEG,KAAK,KAAKC,SAASJ,QAAQF,GAAG,EAAE,CAAA;EAGtC,OAAOE;CACX;CAEA,MAAMK,KAAKL,SAA0D;EACjE,IAAIA,QAAQC,KACR,OAAOD;EAGX,OAAO,KAAKD,OAAOC,OAAAA;CACvB;CAEA,MAAMM,kBAAkBC,MAA0BrB,WAAgD;EAC9F,MAAMsB,aAAa,MAAM,KAAKH,KAAKE,IAAAA;EAEnC,MAAM,KAAKvB,MAAMkB,IACbtB,cAAc;GACVQ,QAAQN,kBAAkBO;GAC1BC,KAAKJ;EACT,CAAA,GACAsB,YACA,EAAEL,KAAK,KAAKC,SAASG,KAAKT,GAAG,EAAE,CAAA;EAGnC,OAAOU;CACX;CAIA,MAAMC,WAAWnB,KAA+B;EAC5C,MAAMoB,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAIA,OAAO,CAAC,CAACsB,MAFc,KAAK5B,MAAMG,IAAIuB,QAAAA;CAG1C;CAEA,MAAMb,YAAYP,KAAaQ,KAA6B;EACxD,MAAMK,MAAM,KAAKC,SAASN,GAAAA;EAE1B,MAAMY,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAEA,MAAM,KAAKN,MAAMkB,IACbQ,UACA,MACA,EAAEP,IAAI,CAAA;CAEd;CAEA,MAAMU,cAAcvB,KAAaQ,KAAgC;EAC7D,MAAMK,MAAM,KAAKC,SAASN,GAAAA;EAE1B,MAAMY,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAKA,OAAO,KAAKN,MAAM8B,IACdJ,UACA,MACA,EAAEP,IAAI,CAAA;CAEd;;;;;;IAUA,SAAmBY,KAAc;EAC7B,IAAI,OAAOA,QAAQ,UAAU;GACzB,MAAMZ,MAAM,MAAO,MAAQa,KAAKC,IAAG;GACnC,IAAId,MAAM,GACN,OAAOA;EAEf;EAEA,OAAO,OAAQ;CACnB;AACJ"}
+{"version":3,"file":"repository.mjs","names":["buildCacheKey","randomUUID","CacheOAuth2Prefix","OAuth2TokenRepository","cache","findOneBySignature","signature","get","prefix","TOKEN_CLAIMS","key","findOneById","id","TOKEN","removeById","token","drop","setInactive","exp","insert","payload","jti","set","ttl","buildTTL","save","saveWithSignature","data","normalized","isInactive","cacheKey","TOKEN_INACTIVE","response","claimInactive","add","utc","Date","now"],"sources":["../../../../../../src/app/modules/oauth2/repositories/token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { randomUUID } from 'node:crypto';\nimport type { IOAuth2TokenRepository } from '../../../../../core/index.ts';\nimport { CacheOAuth2Prefix } from '../constants.ts';\n\nexport class OAuth2TokenRepository implements IOAuth2TokenRepository {\n    protected cache : ICache;\n\n    constructor(cache: ICache) {\n        this.cache = cache;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneBySignature(signature: string): Promise<OAuth2TokenPayload | null> {\n        return this.cache.get<OAuth2TokenPayload>(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,\n                key: signature, \n            }),\n        );\n    }\n\n    async findOneById(id: string): Promise<OAuth2TokenPayload | null> {\n        return this.cache.get<OAuth2TokenPayload>(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN,\n                key: id, \n            }),\n        );\n    }\n\n    // -----------------------------------------------------\n\n    async removeById(id: string): Promise<void> {\n        const token = await this.findOneById(id);\n        if (!token) {\n            return;\n        }\n\n        const key = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN,\n            key: id, \n        });\n        await this.cache.drop(key);\n\n        await this.setInactive(id, token.exp);\n    }\n\n    // -----------------------------------------------------\n\n    async insert(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload> {\n        payload.jti = randomUUID();\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN,\n                key: payload.jti, \n            }),\n            payload,\n            { ttl: this.buildTTL(payload.exp) },\n        );\n\n        return payload;\n    }\n\n    async save(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload> {\n        if (payload.jti) {\n            return payload;\n        }\n\n        return this.insert(payload);\n    }\n\n    async saveWithSignature(data: OAuth2TokenPayload, signature: string): Promise<OAuth2TokenPayload> {\n        const normalized = await this.save(data);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,\n                key: signature, \n            }),\n            normalized,\n            { ttl: this.buildTTL(data.exp) },\n        );\n\n        return normalized;\n    }\n\n    // -----------------------------------------------------\n\n    async isInactive(key: string): Promise<boolean> {\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        const response = await this.cache.get(cacheKey);\n\n        return !!response;\n    }\n\n    async setInactive(key: string, exp?: number): Promise<void> {\n        const ttl = this.buildTTL(exp);\n\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        await this.cache.set(\n            cacheKey,\n            true,\n            { ttl },\n        );\n    }\n\n    async claimInactive(key: string, exp?: number): Promise<boolean> {\n        const ttl = this.buildTTL(exp);\n\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        // set-if-absent (Redis SET NX / single-tick memory adapter) — returns\n        // true only for the caller that actually transitioned the token to\n        // inactive, so concurrent single-use claims cannot both succeed.\n        return this.cache.add(\n            cacheKey,\n            true,\n            { ttl },\n        );\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Transform timestamp in seconds to ttl in ms.\n     *\n     * @param utc\n     * @protected\n     */\n    protected buildTTL(utc?: number) {\n        if (typeof utc === 'number') {\n            const ttl = (utc * 1000) - Date.now();\n            if (ttl > 0) {\n                return ttl;\n            }\n        }\n\n        return 3_600 * 1000;\n    }\n}\n"],"mappings":";;;;;;;AAcA,IAAaG,wBAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAIA,MAAMC,mBAAmBC,WAAuD;EAC5E,OAAO,KAAKF,MAAMG,IACdP,cAAc;GACVQ,QAAQN,kBAAkBO;GAC1BC,KAAKJ;EACT,CAAA,CAAA;CAER;CAEA,MAAMK,YAAYC,IAAgD;EAC9D,OAAO,KAAKR,MAAMG,IACdP,cAAc;GACVQ,QAAQN,kBAAkBW;GAC1BH,KAAKE;EACT,CAAA,CAAA;CAER;CAIA,MAAME,WAAWF,IAA2B;EACxC,MAAMG,QAAQ,MAAM,KAAKJ,YAAYC,EAAAA;EACrC,IAAI,CAACG,OACD;EAGJ,MAAML,MAAMV,cAAc;GACtBQ,QAAQN,kBAAkBW;GAC1BH,KAAKE;EACT,CAAA;EACA,MAAM,KAAKR,MAAMY,KAAKN,GAAAA;EAEtB,MAAM,KAAKO,YAAYL,IAAIG,MAAMG,GAAG;CACxC;CAIA,MAAMC,OAAOC,SAA0D;EACnEA,QAAQC,MAAMpB,WAAAA;EAEd,MAAM,KAAKG,MAAMkB,IACbtB,cAAc;GACVQ,QAAQN,kBAAkBW;GAC1BH,KAAKU,QAAQC;EACjB,CAAA,GACAD,SACA,EAAEG,KAAK,KAAKC,SAASJ,QAAQF,GAAG,EAAE,CAAA;EAGtC,OAAOE;CACX;CAEA,MAAMK,KAAKL,SAA0D;EACjE,IAAIA,QAAQC,KACR,OAAOD;EAGX,OAAO,KAAKD,OAAOC,OAAAA;CACvB;CAEA,MAAMM,kBAAkBC,MAA0BrB,WAAgD;EAC9F,MAAMsB,aAAa,MAAM,KAAKH,KAAKE,IAAAA;EAEnC,MAAM,KAAKvB,MAAMkB,IACbtB,cAAc;GACVQ,QAAQN,kBAAkBO;GAC1BC,KAAKJ;EACT,CAAA,GACAsB,YACA,EAAEL,KAAK,KAAKC,SAASG,KAAKT,GAAG,EAAE,CAAA;EAGnC,OAAOU;CACX;CAIA,MAAMC,WAAWnB,KAA+B;EAC5C,MAAMoB,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAIA,OAAO,CAAC,CAACsB,MAFc,KAAK5B,MAAMG,IAAIuB,QAAAA;CAG1C;CAEA,MAAMb,YAAYP,KAAaQ,KAA6B;EACxD,MAAMK,MAAM,KAAKC,SAASN,GAAAA;EAE1B,MAAMY,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAEA,MAAM,KAAKN,MAAMkB,IACbQ,UACA,MACA,EAAEP,IAAI,CAAA;CAEd;CAEA,MAAMU,cAAcvB,KAAaQ,KAAgC;EAC7D,MAAMK,MAAM,KAAKC,SAASN,GAAAA;EAE1B,MAAMY,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAKA,OAAO,KAAKN,MAAM8B,IACdJ,UACA,MACA,EAAEP,IAAI,CAAA;CAEd;;;;;;IAUA,SAAmBY,KAAc;EAC7B,IAAI,OAAOA,QAAQ,UAAU;GACzB,MAAMZ,MAAM,MAAO,MAAQa,KAAKC,IAAG;GACnC,IAAId,MAAM,GACN,OAAOA;EAEf;EAEA,OAAO;CACX;AACJ"}

package/dist/app/modules/provisioning/constants.d.ts

@@ -0,0 +1,12 @@
+import { TypedToken } from 'eldin';
+import type { IRealmProvisioner } from '../../../core/index.ts';
+export declare const ProvisioningInjectionKey: {
+    /**
+     * Registered by ProvisionerModule.setup iff the loaded provisioning
+     * data carries a wildcard realm entry. Resolved lazily (request time)
+     * by the realm controller factory, so the HTTP module never depends
+     * on provisioning-module boot order.
+     */
+    readonly WildcardRealmProvisioner: TypedToken<IRealmProvisioner>;
+};
+//# sourceMappingURL=constants.d.ts.map

package/dist/app/modules/provisioning/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,eAAO,MAAM,wBAAwB;IACjC;;;;;OAKG;;CAEG,CAAC"}

package/dist/app/modules/provisioning/constants.mjs

@@ -0,0 +1,16 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { TypedToken } from "eldin";
+//#region src/app/modules/provisioning/constants.ts
+const ProvisioningInjectionKey = { 
+/**
+* Registered by ProvisionerModule.setup iff the loaded provisioning
+* data carries a wildcard realm entry. Resolved lazily (request time)
+* by the realm controller factory, so the HTTP module never depends
+* on provisioning-module boot order.
+*/ WildcardRealmProvisioner: new TypedToken("WildcardRealmProvisioner") };
+//#endregion
+export { ProvisioningInjectionKey };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/app/modules/provisioning/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["TypedToken","ProvisioningInjectionKey","WildcardRealmProvisioner"],"sources":["../../../../src/app/modules/provisioning/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { IRealmProvisioner } from '../../../core/index.ts';\n\nexport const ProvisioningInjectionKey = {\n    /**\n     * Registered by ProvisionerModule.setup iff the loaded provisioning\n     * data carries a wildcard realm entry. Resolved lazily (request time)\n     * by the realm controller factory, so the HTTP module never depends\n     * on provisioning-module boot order.\n     */\n    WildcardRealmProvisioner: new TypedToken<IRealmProvisioner>('WildcardRealmProvisioner'),\n} as const;\n"],"mappings":";;;;;AAUA,MAAaC,2BAA2B;;;;;;GAOpCC,0BAA0B,IAAIF,WAA8B,0BAAA,EAChE"}

package/dist/app/modules/provisioning/index.d.ts

@@ -1,3 +1,5 @@
+export * from './constants.ts';
+export * from './lazy-wildcard.ts';
 export * from './sources/index.ts';
 export * from './module.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/app/modules/provisioning/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC"}

package/dist/app/modules/provisioning/index.mjs

@@ -1,9 +1,11 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { ProvisioningInjectionKey } from "./constants.mjs";
+import { LazyWildcardRealmProvisioner } from "./lazy-wildcard.mjs";
 import { DefaultProvisioningSource } from "./sources/default/module.mjs";
 import { CompositeProvisioningSource } from "./sources/composite/module.mjs";
 import { FileProvisioningSource } from "./sources/file/module.mjs";
 import "./sources/index.mjs";
 import { ProvisionerModule } from "./module.mjs";
-export { CompositeProvisioningSource, DefaultProvisioningSource, FileProvisioningSource, ProvisionerModule };
+export { CompositeProvisioningSource, DefaultProvisioningSource, FileProvisioningSource, LazyWildcardRealmProvisioner, ProvisionerModule, ProvisioningInjectionKey };

package/dist/app/modules/provisioning/lazy-wildcard.d.ts

@@ -0,0 +1,15 @@
+import type { Realm } from '@authup/core-kit';
+import type { IContainer } from 'eldin';
+import type { IRealmProvisioner } from '../../../core/index.ts';
+/**
+ * The wildcard realm provisioner is registered by ProvisionerModule AFTER
+ * the async provisioning-source load, and the HTTP module does not depend
+ * on the provisioning module's boot order — resolve it lazily at request
+ * time. No wildcard entry declared => no-op.
+ */
+export declare class LazyWildcardRealmProvisioner implements IRealmProvisioner {
+    protected container: IContainer;
+    constructor(container: IContainer);
+    ensureForRealm(realm: Realm): Promise<void>;
+}
+//# sourceMappingURL=lazy-wildcard.d.ts.map

package/dist/app/modules/provisioning/lazy-wildcard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lazy-wildcard.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/lazy-wildcard.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAGhE;;;;;GAKG;AACH,qBAAa,4BAA6B,YAAW,iBAAiB;IAClE,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC;gBAEpB,SAAS,EAAE,UAAU;IAI3B,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;CAOpD"}

package/dist/app/modules/provisioning/lazy-wildcard.mjs

@@ -0,0 +1,23 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ProvisioningInjectionKey } from "./constants.mjs";
+//#region src/app/modules/provisioning/lazy-wildcard.ts
+/**
+* The wildcard realm provisioner is registered by ProvisionerModule AFTER
+* the async provisioning-source load, and the HTTP module does not depend
+* on the provisioning module's boot order — resolve it lazily at request
+* time. No wildcard entry declared => no-op.
+*/ var LazyWildcardRealmProvisioner = class {
+	container;
+	constructor(container) {
+		this.container = container;
+	}
+	async ensureForRealm(realm) {
+		if (this.container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) await this.container.resolve(ProvisioningInjectionKey.WildcardRealmProvisioner).ensureForRealm(realm);
+	}
+};
+//#endregion
+export { LazyWildcardRealmProvisioner };
+
+//# sourceMappingURL=lazy-wildcard.mjs.map

package/dist/app/modules/provisioning/lazy-wildcard.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"lazy-wildcard.mjs","names":["ProvisioningInjectionKey","LazyWildcardRealmProvisioner","container","ensureForRealm","realm","has","WildcardRealmProvisioner","resolve"],"sources":["../../../../src/app/modules/provisioning/lazy-wildcard.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm } from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport type { IRealmProvisioner } from '../../../core/index.ts';\nimport { ProvisioningInjectionKey } from './constants.ts';\n\n/**\n * The wildcard realm provisioner is registered by ProvisionerModule AFTER\n * the async provisioning-source load, and the HTTP module does not depend\n * on the provisioning module's boot order — resolve it lazily at request\n * time. No wildcard entry declared => no-op.\n */\nexport class LazyWildcardRealmProvisioner implements IRealmProvisioner {\n    protected container: IContainer;\n\n    constructor(container: IContainer) {\n        this.container = container;\n    }\n\n    async ensureForRealm(realm: Realm): Promise<void> {\n        if (this.container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) {\n            await this.container\n                .resolve(ProvisioningInjectionKey.WildcardRealmProvisioner)\n                .ensureForRealm(realm);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;GAkBA,IAAaC,+BAAb,MAAaA;CACCC;CAEV,YAAYA,WAAuB;EAC/B,KAAKA,YAAYA;CACrB;CAEA,MAAMC,eAAeC,OAA6B;EAC9C,IAAI,KAAKF,UAAUG,IAAIL,yBAAyBM,wBAAwB,GACpE,MAAM,KAAKJ,UACNK,QAAQP,yBAAyBM,wBAAwB,CAAA,CACzDH,eAAeC,KAAAA;CAE5B;AACJ"}

package/dist/app/modules/provisioning/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAoBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAWxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAQH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAWrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAuKjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAoBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAiBxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE/E,OAAO,EAQH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAWrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cA+MjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}

package/dist/app/modules/provisioning/module.mjs

@@ -16,7 +16,7 @@ import { RolePermissionEntity } from "../../../adapters/database/domains/role-pe
 import { UserPermissionEntity } from "../../../adapters/database/domains/user-permission/entity.mjs";
 import { UserRoleEntity } from "../../../adapters/database/domains/user-role/entity.mjs";
 import "../../../adapters/database/domains/index.mjs";
-import { WebClientProvisioner } from "../../../core/entities/client/web-client.mjs";
+import { SystemClientProvisioner } from "../../../core/entities/client/system-clients.mjs";
 import "../../../core/entities/client/index.mjs";
 import { KeyProvisioner } from "../../../core/key/provisioner.mjs";
 import "../../../core/key/index.mjs";
@@ -29,6 +29,8 @@ import { GraphProvisioningSynchronizer } from "../../../core/provisioning/synchr
 import { ScopeProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/scope/module.mjs";
 import { UserProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/user/module.mjs";
 import "../../../core/provisioning/synchronizer/index.mjs";
+import { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry } from "../../../core/provisioning/wildcard/module.mjs";
+import "../../../core/provisioning/wildcard/index.mjs";
 import { ModuleName } from "../constants.mjs";
 import { ConfigInjectionKey } from "../config/constants.mjs";
 import { getAppOrigins } from "../config/origins.mjs";
@@ -54,6 +56,7 @@ import { DatabaseInjectionKey } from "../database/constants.mjs";
 import { LoggerInjectionKey } from "../logger/constants.mjs";
 import "../logger/index.mjs";
 import "../database/index.mjs";
+import { ProvisioningInjectionKey } from "./constants.mjs";
 import { CompositeProvisioningSource } from "./sources/composite/module.mjs";
 import { FileProvisioningSource } from "./sources/file/module.mjs";
 import "./sources/index.mjs";
@@ -80,6 +83,9 @@ var ProvisionerModule = class {
 			logger: container.resolve(LoggerInjectionKey)
 		}));
 		const data = await new CompositeProvisioningSource(sources).load(container);
+		const wildcardEntry = extractWildcardRealmEntry(data);
+		let wildcardVariants;
+		if (wildcardEntry) wildcardVariants = expandWildcardRealmEntry(wildcardEntry, data);
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
 		const realmRepository = container.resolve(RealmEntity);
 		const permissionRepository = new PermissionRepositoryAdapter({
@@ -141,21 +147,22 @@ var ProvisionerModule = class {
 			permissionRepository
 		});
 		const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });
+		const realmSynchronizer = new RealmProvisioningSynchronizer({
+			repository: new RealmRepositoryAdapter(realmRepository),
+			clientSynchronizer,
+			roleSynchronizer,
+			permissionSynchronizer,
+			userSynchronizer,
+			scopeSynchronizer
+		});
 		await new GraphProvisioningSynchronizer({
 			policySynchronizer,
 			permissionSynchronizer,
 			roleSynchronizer,
-			realmSynchronizer: new RealmProvisioningSynchronizer({
-				repository: new RealmRepositoryAdapter(realmRepository),
-				clientSynchronizer,
-				roleSynchronizer,
-				permissionSynchronizer,
-				userSynchronizer,
-				scopeSynchronizer
-			}),
+			realmSynchronizer,
 			scopeSynchronizer
 		}).synchronize(data);
-		const webClientProvisioner = new WebClientProvisioner({
+		const systemClientProvisioner = new SystemClientProvisioner({
 			clientRepository,
 			scopeRepository,
 			clientScopeRepository,
@@ -166,10 +173,22 @@ var ProvisionerModule = class {
 			keyStore: new KeyRepositoryAdapter(dataSource, { secretsCipher: config.secretsEncryptionKey ? new SymmetricCipher(config.secretsEncryptionKey) : null }),
 			logger: container.resolve(LoggerInjectionKey)
 		});
+		let wildcardProvisioner;
+		if (container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) container.unregister(ProvisioningInjectionKey.WildcardRealmProvisioner);
+		if (wildcardEntry) {
+			wildcardProvisioner = new WildcardRealmProvisioner({
+				relations: wildcardEntry.relations ?? {},
+				relationsByRealmName: wildcardVariants,
+				synchronizer: realmSynchronizer,
+				logger: container.resolve(LoggerInjectionKey)
+			});
+			container.register(ProvisioningInjectionKey.WildcardRealmProvisioner, { useValue: wildcardProvisioner });
+		}
 		const realms = await realmRepository.find();
 		for (const realm of realms) {
-			await webClientProvisioner.ensureForRealm(realm);
+			await systemClientProvisioner.ensureForRealm(realm);
 			await keyProvisioner.ensureForRealm(realm);
+			if (wildcardProvisioner && !wildcardProvisioner.hasExplicitEntry(realm)) await wildcardProvisioner.ensureForRealm(realm);
 		}
 		if (config.permissionsDefaultPolicyAssignment) await this.assignDefaultPolicy(dataSource, policyRepository);
 	}

package/dist/app/modules/provisioning/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","ClientScopeRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","WebClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","scopeRepository","clientScopeRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    PermissionEntity,\n    RealmEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    ClientScopeRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({\n                cwd: provisioningDir,\n                logger: container.resolve(LoggerInjectionKey),\n            }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n        const clientScopeRepository = new ClientScopeRepositoryAdapter(\n            container.resolve<Repository<ClientScope>>(ClientScopeEntity),\n        );\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n            clientScopeRepository,\n\n            roleRepository,\n            permissionRepository,\n            scopeRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm public `web` client. Single provisioning mechanism:\n        // list every realm (incl. pre-existing) and upsert its web client.\n        // Idempotent; guarded on builtIn inside the provisioner.\n        // ---------------------------------------------------------------\n        const webClientProvisioner = new WebClientProvisioner({\n            clientRepository,\n            scopeRepository,\n            clientScopeRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use. The\n        // adapter is constructed locally (NOT resolved from the oauth2\n        // module's registration) so provisioning stays runnable in minimal\n        // module graphs (test setup, CLI); the KEK handling is identical.\n        const keyProvisioner = new KeyProvisioner({\n            keyStore: new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            }),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await webClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permissionId: permission.id,\n                    permissionRealmId: permission.realmId,\n                    policyId: defaultPolicy.id,\n                    policyRealmId: defaultPolicy.realmId,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgFA,IAAakD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMwB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAElC,MAAMa,aAAab,UAAUE,QAAQtB,qBAAqBkC,UAAU;EACpE,MAAMC,kBAAkBf,UAAUE,QAA2BvD,WAAAA;EAE7D,MAAMqE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYjB,UAAUE,QAAsCxD,gBAAAA;GAC5DqE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI9D,iBAAiB0D,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC8B,UAAUE,QAAsChD,sBAAAA,CAAAA;EAGpD,MAAMkE,qBAAqB,IAAI5D,+BAA+B;GAC1DyD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI9C,sBAAsB;GAC7C0C,YAAYjB,UAAUE,QAA0BtD,UAAAA;GAChDmE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAIxD,wBAAwB;GACjDmD,YAAYjB,UAAUE,QAA4B5D,YAAAA;GAClDyE;EACJ,CAAA;EACA,MAAMQ,kBAAkB,IAAI/C,uBAAuB;GAC/CyC,YAAYjB,UAAUE,QAA2BpD,WAAAA;GACjDiE;EACJ,CAAA;EACA,MAAMS,wBAAwB,IAAIxD,6BAC9BgC,UAAUE,QAAiCzD,iBAAAA,CAAAA;EAG/C,MAAMgF,yBAAyB,IAAIlE,mCAAmC;GAClE0D,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMO,mBAAmB,IAAIhE,6BAA6B;GACtDuD,YAAYI;GACZL;GACAW,0BAA0B,IAAIrD,gCAC1B0B,UAAUE,QAAoCrD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM+E,qBAAqB,IAAIvE,+BAA+B;GAC1DiE;GACAO,sBAAsB,IAAI9D,4BACtBiC,UAAUE,QAAgC1D,gBAAAA,CAAAA;GAE9CsF,4BAA4B,IAAIjE,kCAC5BmC,UAAUE,QAAsC3D,sBAAAA,CAAAA;GAEpDiF;GAEAH;GACAL;GACAO;GAEAG;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAInE,6BAA6B;GACtDoE,gBAAgB,IAAItD,sBAAsB;IACtCuC,YAAY,IAAI7D,eAAeyD,UAAAA;IAC/BE;GACJ,CAAA;GACAkB,oBAAoB,IAAItD,0BACpBqB,UAAUE,QAA8BlD,cAAAA,CAAAA;GAE5CkF,0BAA0B,IAAIzD,gCAC1BuB,UAAUE,QAAoCnD,oBAAAA,CAAAA;GAGlDuE;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMmB,oBAAoB,IAAIxE,8BAA8B,EAAEsD,YAAYM,gBAAgB,CAAA;EAoB1F,MAAMc,IARuB/E,8BAA8B;GACvD8D;GACAK;GACAC;GACAU,mBAAAA,IAd0B3E,8BAA8B;IACxDwD,YAAY,IAAI5C,uBAAuB0C,eAAAA;IAEvCa;IACAF;IACAD;IACAM;IACAI;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY3B,IAAAA;EAOnC,MAAM4B,uBAAuB,IAAInD,qBAAqB;GAClDkC;GACAC;GACAC;GACAgB,YAAYvD,cAAcgB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMsD,iBAAiB,IAAIpD,eAAe;GACtCqD,UAAU,IAAIzE,qBAAqB4C,YAAY,EAC3C8B,eAAe1C,OAAO2C,uBAClB,IAAI1D,gBAAgBe,OAAO2C,oBAAoB,IAC/C,KACR,CAAA;GACAnC,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAEA,MAAM0D,SAAS,MAAM9B,gBAAgB+B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMN,qBAAqBS,eAAeD,KAAAA;GAC1C,MAAMN,eAAeO,eAAeD,KAAAA;EACxC;EAEA,IAAI9C,OAAOgD,oCACP,MAAM,KAAKC,oBAAoBrC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgBgC,oBACZrC,YACAK,kBACa;EACb,MAAMiC,gBAAgB,MAAMjC,iBAAiBkC,cAAcnG,iBAAiBoG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBzC,WAAW0C,cAAc7G,gBAAAA;EAChD,MAAM8G,eAAe3C,WAAW0C,cAAcrG,sBAAAA;EAE9C,MAAMuG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}
+{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","WildcardRealmProvisioner","expandWildcardRealmEntry","extractWildcardRealmEntry","ProvisioningInjectionKey","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","ClientScopeRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","SystemClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","wildcardEntry","wildcardVariants","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","scopeRepository","clientScopeRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","systemClientProvisioner","appOrigins","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","wildcardProvisioner","has","unregister","relations","relationsByRealmName","synchronizer","register","useValue","realms","find","realm","ensureForRealm","hasExplicitEntry","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    PermissionEntity,\n    RealmEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { RealmProvisioningRelations } from '../../../core/provisioning/entities/index.ts';\nimport {\n    WildcardRealmProvisioner,\n    expandWildcardRealmEntry,\n    extractWildcardRealmEntry,\n} from '../../../core/provisioning/wildcard/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport { ProvisioningInjectionKey } from './constants.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    ClientScopeRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { SystemClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({\n                cwd: provisioningDir,\n                logger: container.resolve(LoggerInjectionKey),\n            }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        // ---------------------------------------------------------------\n        // Wildcard realm entry (plan 082): split the `name: \"*\"` entry out\n        // of `data.realms` and deep-merge it UNDER every explicit realm\n        // entry (explicit wins per attribute, relation lists union) so the\n        // graph sync below covers declared realms in one pass. Realms\n        // without an explicit entry get the wildcard applied by the\n        // backfill loop; runtime-created realms via the DI-registered\n        // provisioner (RealmService hook).\n        // ---------------------------------------------------------------\n        const wildcardEntry = extractWildcardRealmEntry(data);\n        let wildcardVariants : Map<string, RealmProvisioningRelations> | undefined;\n        if (wildcardEntry) {\n            wildcardVariants = expandWildcardRealmEntry(wildcardEntry, data);\n        }\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n        const clientScopeRepository = new ClientScopeRepositoryAdapter(\n            container.resolve<Repository<ClientScope>>(ClientScopeEntity),\n        );\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n            clientScopeRepository,\n\n            roleRepository,\n            permissionRepository,\n            scopeRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm system clients (web, admin-console, account-console).\n        // Single provisioning mechanism: list every realm (incl.\n        // pre-existing) and upsert its clients.\n        // Idempotent; guarded on builtIn inside the provisioner.\n        // ---------------------------------------------------------------\n        const systemClientProvisioner = new SystemClientProvisioner({\n            clientRepository,\n            scopeRepository,\n            clientScopeRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use. The\n        // adapter is constructed locally (NOT resolved from the oauth2\n        // module's registration) so provisioning stays runnable in minimal\n        // module graphs (test setup, CLI); the KEK handling is identical.\n        const keyProvisioner = new KeyProvisioner({\n            keyStore: new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            }),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Wildcard realm provisioning (plan 082): one shared instance for\n        // the boot backfill below AND the runtime realm-create hook (the\n        // realm controller factory resolves the DI key lazily), so the two\n        // paths cannot drift. Registered only when a wildcard entry was\n        // declared.\n        let wildcardProvisioner : WildcardRealmProvisioner | undefined;\n        if (container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) {\n            container.unregister(ProvisioningInjectionKey.WildcardRealmProvisioner);\n        }\n        if (wildcardEntry) {\n            wildcardProvisioner = new WildcardRealmProvisioner({\n                relations: wildcardEntry.relations ?? {},\n                relationsByRealmName: wildcardVariants,\n                synchronizer: realmSynchronizer,\n                logger: container.resolve(LoggerInjectionKey),\n            });\n            container.register(ProvisioningInjectionKey.WildcardRealmProvisioner, { useValue: wildcardProvisioner });\n        }\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await systemClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n            // Realms with an explicit entry were already covered by the\n            // wildcard expansion inside the graph sync above.\n            if (wildcardProvisioner && !wildcardProvisioner.hasExplicitEntry(realm)) {\n                await wildcardProvisioner.ensureForRealm(realm);\n            }\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permissionId: permission.id,\n                    permissionRealmId: permission.realmId,\n                    policyId: defaultPolicy.id,\n                    policyRealmId: defaultPolicy.realmId,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuFA,IAAasD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMwB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAWlC,MAAMa,gBAAgBlD,0BAA0BgD,IAAAA;EAChD,IAAIG;EACJ,IAAID,eACAC,mBAAmBpD,yBAAyBmD,eAAeF,IAAAA;EAG/D,MAAMI,aAAaf,UAAUE,QAAQtB,qBAAqBoC,UAAU;EACpE,MAAMC,kBAAkBjB,UAAUE,QAA2B3D,WAAAA;EAE7D,MAAM2E,uBAAuB,IAAI/C,4BAA4B;GACzDgD,YAAYnB,UAAUE,QAAsC5D,gBAAAA;GAC5D2E;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAIhD,wBAAwB;GACjD+C,YAAY,IAAIpE,iBAAiBgE,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAInD,kCACnC8B,UAAUE,QAAsCpD,sBAAAA,CAAAA;EAGpD,MAAMwE,qBAAqB,IAAIlE,+BAA+B;GAC1D+D,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAIhD,sBAAsB;GAC7C4C,YAAYnB,UAAUE,QAA0B1D,UAAAA;GAChDyE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAI1D,wBAAwB;GACjDqD,YAAYnB,UAAUE,QAA4BhE,YAAAA;GAClD+E;EACJ,CAAA;EACA,MAAMQ,kBAAkB,IAAIjD,uBAAuB;GAC/C2C,YAAYnB,UAAUE,QAA2BxD,WAAAA;GACjDuE;EACJ,CAAA;EACA,MAAMS,wBAAwB,IAAI1D,6BAC9BgC,UAAUE,QAAiC7D,iBAAAA,CAAAA;EAG/C,MAAMsF,yBAAyB,IAAIxE,mCAAmC;GAClEgE,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMO,mBAAmB,IAAItE,6BAA6B;GACtD6D,YAAYI;GACZL;GACAW,0BAA0B,IAAIvD,gCAC1B0B,UAAUE,QAAoCzD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAMqF,qBAAqB,IAAI7E,+BAA+B;GAC1DuE;GACAO,sBAAsB,IAAIhE,4BACtBiC,UAAUE,QAAgC9D,gBAAAA,CAAAA;GAE9C4F,4BAA4B,IAAInE,kCAC5BmC,UAAUE,QAAsC/D,sBAAAA,CAAAA;GAEpDuF;GAEAH;GACAL;GACAO;GAEAG;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAIzE,6BAA6B;GACtD0E,gBAAgB,IAAIxD,sBAAsB;IACtCyC,YAAY,IAAInE,eAAe+D,UAAAA;IAC/BE;GACJ,CAAA;GACAkB,oBAAoB,IAAIxD,0BACpBqB,UAAUE,QAA8BtD,cAAAA,CAAAA;GAE5CwF,0BAA0B,IAAI3D,gCAC1BuB,UAAUE,QAAoCvD,oBAAAA,CAAAA;GAGlD6E;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMmB,oBAAoB,IAAI9E,8BAA8B,EAAE4D,YAAYM,gBAAgB,CAAA;EAE1F,MAAMa,oBAAoB,IAAIjF,8BAA8B;GACxD8D,YAAY,IAAI9C,uBAAuB4C,eAAAA;GAEvCa;GACAF;GACAD;GACAM;GACAI;EACJ,CAAA;EAUA,MAAME,IARuBrF,8BAA8B;GACvDoE;GACAK;GACAC;GACAU;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY7B,IAAAA;EAQnC,MAAM8B,0BAA0B,IAAIrD,wBAAwB;GACxDoC;GACAC;GACAC;GACAgB,YAAYzD,cAAcgB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMwD,iBAAiB,IAAItD,eAAe;GACtCuD,UAAU,IAAI3E,qBAAqB8C,YAAY,EAC3C8B,eAAe5C,OAAO6C,uBAClB,IAAI5D,gBAAgBe,OAAO6C,oBAAoB,IAC/C,KACR,CAAA;GACArC,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAOA,IAAI4D;EACJ,IAAI/C,UAAUgD,IAAIpF,yBAAyBH,wBAAwB,GAC/DuC,UAAUiD,WAAWrF,yBAAyBH,wBAAwB;EAE1E,IAAIoD,eAAe;GACfkC,sBAAsB,IAAItF,yBAAyB;IAC/CyF,WAAWrC,cAAcqC,aAAa,CAAC;IACvCC,sBAAsBrC;IACtBsC,cAAcd;IACd7B,QAAQT,UAAUE,QAAQf,kBAAAA;GAC9B,CAAA;GACAa,UAAUqD,SAASzF,yBAAyBH,0BAA0B,EAAE6F,UAAUP,oBAAoB,CAAA;EAC1G;EAEA,MAAMQ,SAAS,MAAMtC,gBAAgBuC,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMd,wBAAwBiB,eAAeD,KAAAA;GAC7C,MAAMd,eAAee,eAAeD,KAAAA;GAGpC,IAAIV,uBAAuB,CAACA,oBAAoBY,iBAAiBF,KAAAA,GAC7D,MAAMV,oBAAoBW,eAAeD,KAAAA;EAEjD;EAEA,IAAIxD,OAAO2D,oCACP,MAAM,KAAKC,oBAAoB9C,YAAYK,gBAAAA;CAEnD;CAEA,MAAgByC,oBACZ9C,YACAK,kBACa;EACb,MAAM0C,gBAAgB,MAAM1C,iBAAiB2C,cAAclH,iBAAiBmH,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBlD,WAAWmD,cAAc5H,gBAAAA;EAChD,MAAM6H,eAAepD,WAAWmD,cAAcpH,sBAAAA;EAE9C,MAAMsH,cAAc,MAAMH,eAAeT,KAAI;EAC7C,KAAK,MAAMa,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}

package/dist/app/modules/provisioning/sources/composite/module.d.ts

@@ -6,24 +6,5 @@ export declare class CompositeProvisioningSource implements IProvisioningSource
     constructor(sources: IProvisioningSource[]);
     load(container: IContainer): Promise<RootProvisioningEntity>;
     merge(target: RootProvisioningEntity, source: RootProvisioningEntity): void;
-    private buildEntityKey;
-    private mergeEntities;
-    /**
-     * Deep-merge two entries sharing a composite key. The later source wins
-     * per attribute, but relations are UNIONED — a later source (e.g. a
-     * mounted provisioning file) extending a built-in entry (the default
-     * source's master realm) must not silently drop the built-in relations
-     * (admin user, system client).
-     *
-     * Policy extraAttributes merge per key with the later source winning —
-     * like attributes, NOT like relations: an EA value (a names denylist,
-     * an ATTRIBUTES query tree) is policy configuration, and unioning would
-     * make shrinking a list impossible and fabricate predicates neither
-     * source authored.
-     */
-    private mergeEntity;
-    private mergeRecord;
-    private mergeValue;
-    private isEntityArray;
 }
 //# sourceMappingURL=module.d.ts.map