npm - @authup/server-core - Versions diffs - 1.0.0-beta.57 → 1.0.0-beta.59 - Mend

@authup/server-core 1.0.0-beta.57 → 1.0.0-beta.59

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (416) hide show

package/dist/app/modules/provisioning/sources/composite/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"names":[],"mappings":"~~AAQA~~,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;~~AACtG~~,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;~~AAmBxC~~,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,SAAS,CAAC,OAAO,EAAG,mBAAmB,EAAE,CAAC;gBAE9B,OAAO,EAAG,mBAAmB,EAAE;IAIrC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAYlE,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB;~~IAQpE,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,aAAa;IAyBrB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,WAAW;IAiCnB,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,UAAU;IAqBlB,OAAO,CAAC,aAAa;CAKxB~~"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AAEtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,SAAS,CAAC,OAAO,EAAG,mBAAmB,EAAE,CAAC;gBAE9B,OAAO,EAAG,mBAAmB,EAAE;IAIrC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAYlE,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB;CAOvE"}

package/dist/app/modules/provisioning/sources/composite/module.mjs CHANGED Viewed

@@ -1,7 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { isObject } from "@authup/kit";
+import { mergeProvisioningEntities } from "../../../../../core/provisioning/merge/module.mjs";
+import "../../../../../core/provisioning/merge/index.mjs";
 //#region src/app/modules/provisioning/sources/composite/module.ts
 var CompositeProvisioningSource = class {
 	sources;
@@ -14,82 +15,11 @@ var CompositeProvisioningSource = class {
 		return output;
 	}
 	merge(target, source) {
-		target.policies = this.mergeEntities(target.policies, source.policies);
-		target.permissions = this.mergeEntities(target.permissions, source.permissions);
-		target.roles = this.mergeEntities(target.roles, source.roles);
-		target.scopes = this.mergeEntities(target.scopes, source.scopes);
-		target.realms = this.mergeEntities(target.realms, source.realms);
-	}
-	buildEntityKey(attributes) {
-		if (!attributes.name) return void 0;
-		return `${attributes.name}:${attributes.realmId || ""}:${attributes.clientId || ""}`;
-	}
-	mergeEntities(target, source) {
-		if (!source) return target;
-		if (!target) return [...source];
-		const result = [...target];
-		source.forEach((item) => {
-			const key = this.buildEntityKey(item.attributes);
-			if (!key) {
-				result.push(item);
-				return;
-			}
-			const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);
-			if (idx !== -1) result[idx] = this.mergeEntity(result[idx], item);
-			else result.push(item);
-		});
-		return result;
-	}
-	/**
-	* Deep-merge two entries sharing a composite key. The later source wins
-	* per attribute, but relations are UNIONED — a later source (e.g. a
-	* mounted provisioning file) extending a built-in entry (the default
-	* source's master realm) must not silently drop the built-in relations
-	* (admin user, system client).
-	*
-	* Policy extraAttributes merge per key with the later source winning —
-	* like attributes, NOT like relations: an EA value (a names denylist,
-	* an ATTRIBUTES query tree) is policy configuration, and unioning would
-	* make shrinking a list impossible and fabricate predicates neither
-	* source authored.
-	*/ mergeEntity(target, source) {
-		const output = {
-			...target,
-			...source
-		};
-		output.attributes = {
-			...target.attributes,
-			...source.attributes
-		};
-		if (target.strategy && !source.strategy) output.strategy = target.strategy;
-		if (target.relations && source.relations) output.relations = this.mergeRecord(target.relations, source.relations);
-		else if (target.relations && !source.relations) output.relations = target.relations;
-		if (target.extraAttributes && source.extraAttributes) output.extraAttributes = {
-			...target.extraAttributes,
-			...source.extraAttributes
-		};
-		else if (target.extraAttributes && !source.extraAttributes) output.extraAttributes = target.extraAttributes;
-		if (target.children && source.children) output.children = this.mergeEntities(target.children, source.children);
-		else if (target.children && !source.children) output.children = target.children;
-		return output;
-	}
-	mergeRecord(target, source) {
-		const output = { ...target };
-		for (const key of Object.keys(source)) output[key] = key in target ? this.mergeValue(target[key], source[key]) : source[key];
-		return output;
-	}
-	mergeValue(target, source) {
-		if (typeof target === "undefined") return source;
-		if (typeof source === "undefined") return target;
-		if (Array.isArray(target) && Array.isArray(source)) {
-			if (this.isEntityArray(target) || this.isEntityArray(source)) return this.mergeEntities(target, source);
-			return [.../* @__PURE__ */ new Set([...target, ...source])];
-		}
-		if (isObject(target) && isObject(source)) return this.mergeRecord(target, source);
-		return source;
-	}
-	isEntityArray(value) {
-		return value.some((item) => isObject(item) && "attributes" in item);
+		target.policies = mergeProvisioningEntities(target.policies, source.policies);
+		target.permissions = mergeProvisioningEntities(target.permissions, source.permissions);
+		target.roles = mergeProvisioningEntities(target.roles, source.roles);
+		target.scopes = mergeProvisioningEntities(target.scopes, source.scopes);
+		target.realms = mergeProvisioningEntities(target.realms, source.realms);
 	}
 };
 //#endregion

package/dist/app/modules/provisioning/sources/composite/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["~~isObject~~","CompositeProvisioningSource","sources","load","container","output","sourcesData","Promise","all","map","source","sourceData","merge","target","policies","~~mergeEntities","~~permissions","roles","scopes","realms","buildEntityKey","attributes","name","undefined","realmId","clientId","result","forEach","item","key","push","idx","findIndex","r","mergeEntity","strategy","relations","mergeRecord","extraAttributes","children","Object","keys","mergeValue","Array","isArray","isEntityArray","Set","value","some"],"sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { ~~isObject~~ } from '~~@authup~~/~~kit~~';\nimport ~~type~~ { ~~RootProvisioningEntity~~ } from '../../../../../core/provisioning/~~entities~~/~~root/~~index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport type { IContainer } from 'eldin';\n\n/\n Structural view of a provisioning entity used by the composite merge.\n * Covers every entity shape (realm, client, user, role, permission, scope,\n * policy): the composite-key attribute bag plus the deep-mergeable groups.\n /\ntype MergeableProvisioningEntity = {\n attributes: {\n name?: string,\n realmId?: string \| null,\n clientId?: string \| null,\n },\n strategy?: unknown,\n relations?: Record<string, unknown>,\n children?: MergeableProvisioningEntity[],\n extraAttributes?: Record<string, unknown>,\n};\n\nexport class CompositeProvisioningSource implements IProvisioningSource {\n protected sources : IProvisioningSource[];\n\n constructor(sources : IProvisioningSource[]) {\n this.sources = sources;\n }\n\n async load(container: IContainer): Promise<RootProvisioningEntity> {\n const output : RootProvisioningEntity = {};\n\n const sourcesData = await Promise.all(\n (this.sources).map((source) => source.load(container)),\n );\n\n sourcesData.map((sourceData) => this.merge(output, sourceData));\n\n return output;\n }\n\n merge(target: RootProvisioningEntity, source: RootProvisioningEntity) {\n target.policies = ~~this.mergeEntities~~(target.policies, source.policies);\n target.permissions = ~~this.mergeEntities~~(target.permissions, source.permissions);\n target.roles = ~~this.mergeEntities~~(target.roles, source.roles);\n target.scopes = ~~this.mergeEntities~~(target.scopes, source.scopes);\n target.realms = ~~this.mergeEntities~~(target.realms, source.realms);\n }\n\n private buildEntityKey(\n attributes: MergeableProvisioningEntity['attributes'],\n ): string \| undefined {\n if (!attributes.name) return undefined;\n return `${attributes.name}~~:${attributes.realmId \|\| ''}:${attributes.clientId \|\| ''}`;\n }~~\n\n private mergeEntities<T extends MergeableProvisioningEntity>(\n target: T[] \| undefined,\n source: T[] \| undefined,\n ): T[] \| undefined {\n if (!source) return target;\n if (!target) return [...source];\n\n const result = [...target];\n source.forEach((item) => {\n const key = this.buildEntityKey(item.attributes);\n if (!key) {\n result.push(item);\n return;\n }\n\n const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);\n if (idx !== -1) {\n result[idx] = this.mergeEntity(result[idx], item) as T;\n } else {\n result.push(item);\n }\n });\n return result;\n }\n\n /\n Deep-merge two entries sharing a composite key. The later source wins\n * per attribute, but relations are UNIONED — a later source (e.g. a\n * mounted provisioning file) extending a built-in entry (the default\n * source's master realm) must not silently drop the built-in relations\n * (admin user, system client).\n \n Policy extraAttributes merge per key with the later source winning —\n * like attributes, NOT like relations: an EA value (a names denylist,\n * an ATTRIBUTES query tree) is policy configuration, and unioning would\n * make shrinking a list impossible and fabricate predicates neither\n * source authored.\n */\n private mergeEntity(\n target: MergeableProvisioningEntity,\n source: MergeableProvisioningEntity,\n ): MergeableProvisioningEntity {\n const output = { ...target, ...source };\n\n output.attributes = { ...target.attributes, ...source.attributes };\n\n if (target.strategy && !source.strategy) {\n output.strategy = target.strategy;\n }\n\n if (target.relations && source.relations) {\n output.relations = this.mergeRecord(target.relations, source.relations);\n } else if (target.relations && !source.relations) {\n output.relations = target.relations;\n }\n\n if (target.extraAttributes && source.extraAttributes) {\n output.extraAttributes = { ...target.extraAttributes, ...source.extraAttributes };\n } else if (target.extraAttributes && !source.extraAttributes) {\n output.extraAttributes = target.extraAttributes;\n }\n\n if (target.children && source.children) {\n output.children = this.mergeEntities(target.children, source.children);\n } else if (target.children && !source.children) {\n output.children = target.children;\n }\n\n return output;\n }\n\n private mergeRecord(\n target: Record<string, unknown>,\n source: Record<string, unknown>,\n ): Record<string, unknown> {\n const output : Record<string, unknown> = { ...target };\n for (const key of Object.keys(source)) {\n output[key] = key in target ?\n this.mergeValue(target[key], source[key]) :\n source[key];\n }\n return output;\n }\n\n private mergeValue(target: unknown, source: unknown): unknown {\n if (typeof target === 'undefined') return source;\n if (typeof source === 'undefined') return target;\n\n if (Array.isArray(target) && Array.isArray(source)) {\n if (this.isEntityArray(target) \|\| this.isEntityArray(source)) {\n return this.mergeEntities(\n target as MergeableProvisioningEntity[],\n source as MergeableProvisioningEntity[],\n );\n }\n return [...new Set([...target, ...source])];\n }\n\n if (isObject(target) && isObject(source)) {\n return this.mergeRecord(target, source);\n }\n\n return source;\n }\n\n private isEntityArray(value: unknown[]): value is MergeableProvisioningEntity[] {\n return value.some(\n (item) => isObject(item) && 'attributes' in item,\n );\n }\n}\n"],"mappings":"~~;;;;;AA6BA~~,IAAaC,8BAAb,MAAaA;CACCC;CAEV,YAAYA,SAAiC;EACzC,KAAKA,UAAUA;CACnB;CAEA,MAAMC,KAAKC,WAAwD;EAC/D,MAAMC,SAAkC,CAAC;EAMzCC,CAAAA,MAJ0BC,QAAQC,IAC9B,KAAMN,QAASO,KAAKC,WAAWA,OAAOP,KAAKC,SAAAA,CAAAA,CAAAA,EAAAA,CAGnCK,KAAKE,eAAe,KAAKC,MAAMP,QAAQM,UAAAA,CAAAA;EAEnD,OAAON;CACX;CAEAO,MAAMC,QAAgCH,QAAgC;EAClEG,OAAOC,~~WAAW~~,~~KAAKC~~,~~cAAcF,~~OAAOC,UAAUJ,OAAOI,QAAQ;~~EACrED~~,~~OAAOG~~,~~cAAc~~,~~KAAKD~~,~~cAAcF~~,~~OAAOG~~,~~aAAaN,OAAOM,WAAW;EAC9EH,OAAOI,QAAQ,KAAKF,cAAcF,OAAOI,OAAOP,OAAOO,KAAK;EAC5DJ,~~OAAOK,~~SAAS,KAAKH,cAAcF,OAAOK,QAAQR,OAAOQ,MAAM;EAC/DL,OAAOM,SAAS,KAAKJ,cAAcF,OAAOM,QAAQT,OAAOS,MAAM;CACnE;CAEQC,eACJC,YACkB;EAClB,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;EAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,~~WAAW~~,GAAG,GAAGH,WAAWI,YAAY~~;~~CACpF;CAEQV~~,~~cACJF~~,~~QACAH~~,~~QACe;EACf~~,~~IAAI,CAACA,QAAQ,~~OAAOG~~;EACpB~~,~~IAAI~~,~~CAACA~~,~~QAAQ,OAAO,CAAIH,GAAAA,MAAO;EAE/B,MAAMgB,SAAS,CAAIb,GAAAA,MAAO;EAC1BH,OAAOiB,SAASC,SAAAA;GACZ,MAAMC,MAAM,KAAKT,eAAeQ,KAAKP,UAAU;GAC/C,IAAI,CAACQ,~~KAAK;~~IACNH~~,OAAOI,~~KAAKF~~,~~IAAAA;IACZ;GACJ;GAEA~~,~~MAAMG~~,~~MAAML~~,~~OAAOM~~,~~WAAWC,~~MAAM~~,KAAKb,eAAea,EAAEZ,UAAU,MAAMQ,GAAAA~~;~~GAC1E~~,~~IAAIE,QAAQ,IACRL,~~OAAOK,~~OAAO~~,~~KAAKG~~,~~YAAYR,~~OAAOK,~~MAAMH~~,~~IAAAA;QAE5CF,OAAOI,KAAKF,IAAAA;EAEpB,CAAA;EACA,OAAOF;CACX;;;;;;;;;;;;;IAeA,YACIb,QACAH,QAC2B;EAC3B,MAAML,SAAS;GAAE,GAAGQ;GAAQ,GAAGH;EAAO;EAEtCL,OAAOgB,aAAa;GAAE,GAAGR,~~OAAOQ~~;GAAY~~,~~GAAGX,OAAOW~~;~~EAAW~~;EAEjE,IAAIR,OAAOsB,YAAY,CAACzB,OAAOyB,UAC3B9B,OAAO8B,WAAWtB,OAAOsB;EAG7B,IAAItB,OAAOuB,aAAa1B,OAAO0B,WAC3B/B,OAAO+B,YAAY,KAAKC,YAAYxB,OAAOuB,WAAW1B,OAAO0B,SAAS;OACnE,IAAIvB,OAAOuB,aAAa,CAAC1B,OAAO0B,WACnC/B,OAAO+B,YAAYvB,OAAOuB;EAG9B,IAAIvB,OAAOyB,mBAAmB5B,OAAO4B,iBACjCjC,OAAOiC,kBAAkB;GAAE,GAAGzB,OAAOyB;GAAiB,GAAG5B,OAAO4B;EAAgB;OAC7E,IAAIzB,OAAOyB,mBAAmB,CAAC5B,OAAO4B,iBACzCjC,OAAOiC,kBAAkBzB,OAAOyB;EAGpC,IAAIzB,OAAO0B,YAAY7B,OAAO6B,UAC1BlC,OAAOkC,WAAW,KAAKxB,cAAcF,OAAO0B,UAAU7B,OAAO6B,QAAQ;OAClE,IAAI1B,OAAO0B,YAAY,CAAC7B,OAAO6B,UAClClC,OAAOkC,WAAW1B,OAAO0B;EAG7B,OAAOlC;CACX;CAEQgC,YACJxB,QACAH,QACuB;EACvB,MAAML,SAAmC,EAAE,GAAGQ,OAAO;EACrD,KAAK,MAAMgB,OAAOW,OAAOC,KAAK/B,MAAAA,GAC1BL,OAAOwB,OAAOA,OAAOhB,SACjB,KAAK6B,WAAW7B,OAAOgB,MAAMnB,OAAOmB,IAAI,IACxCnB,OAAOmB;EAEf,OAAOxB;CACX;CAEQqC,WAAW7B,QAAiBH,QAA0B;EAC1D,IAAI,OAAOG,WAAW,aAAa,OAAOH;EAC1C,IAAI,OAAOA,WAAW,aAAa,OAAOG;EAE1C,IAAI8B,MAAMC,QAAQ/B,MAAAA,KAAW8B,MAAMC,QAAQlC,MAAAA,GAAS;GAChD,IAAI,KAAKmC,cAAchC,MAAAA,KAAW,KAAKgC,cAAcnC,MAAAA,GACjD,OAAO,KAAKK,cACRF,QACAH,MAAAA;GAGR,OAAO,CAAI,mBAAA,IAAIoC,IAAI,CAAIjC,GAAAA,QAAWH,GAAAA,MAAO,CAAA,CAAE;EAC/C;EAEA,IAAIV,SAASa,MAAAA,KAAWb,SAASU,MAAAA,GAC7B,OAAO,KAAK2B,YAAYxB,QAAQH,MAAAA;EAGpC,OAAOA;CACX;CAEQmC,cAAcE,OAA0D;EAC5E,OAAOA,MAAMC,MACRpB,SAAS5B,SAAS4B,IAAAA,KAAS,gBAAgBA,IAAAA;CAEpD;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["mergeProvisioningEntities","CompositeProvisioningSource","sources","load","container","output","sourcesData","Promise","all","map","source","sourceData","merge","target","policies","permissions","roles","scopes","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport { mergeProvisioningEntities } from '../../../../../core/provisioning/merge/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport type { IContainer } from 'eldin';\n\nexport class CompositeProvisioningSource implements IProvisioningSource {\n protected sources : IProvisioningSource[];\n\n constructor(sources : IProvisioningSource[]) {\n this.sources = sources;\n }\n\n async load(container: IContainer): Promise<RootProvisioningEntity> {\n const output : RootProvisioningEntity = {};\n\n const sourcesData = await Promise.all(\n (this.sources).map((source) => source.load(container)),\n );\n\n sourcesData.map((sourceData) => this.merge(output, sourceData));\n\n return output;\n }\n\n merge(target: RootProvisioningEntity, source: RootProvisioningEntity) {\n target.policies = mergeProvisioningEntities(target.policies, source.policies);\n target.permissions = mergeProvisioningEntities(target.permissions, source.permissions);\n target.roles = mergeProvisioningEntities(target.roles, source.roles);\n target.scopes = mergeProvisioningEntities(target.scopes, source.scopes);\n target.realms = mergeProvisioningEntities(target.realms, source.realms);\n }\n}\n"],"mappings":";;;;;;AAYA,IAAaC,8BAAb,MAAaA;CACCC;CAEV,YAAYA,SAAiC;EACzC,KAAKA,UAAUA;CACnB;CAEA,MAAMC,KAAKC,WAAwD;EAC/D,MAAMC,SAAkC,CAAC;EAMzCC,CAAAA,MAJ0BC,QAAQC,IAC9B,KAAMN,QAASO,KAAKC,WAAWA,OAAOP,KAAKC,SAAAA,CAAAA,CAAAA,EAAAA,CAGnCK,KAAKE,eAAe,KAAKC,MAAMP,QAAQM,UAAAA,CAAAA;EAEnD,OAAON;CACX;CAEAO,MAAMC,QAAgCH,QAAgC;EAClEG,OAAOC,WAAWd,0BAA0Ba,OAAOC,UAAUJ,OAAOI,QAAQ;EAC5ED,OAAOE,cAAcf,0BAA0Ba,OAAOE,aAAaL,OAAOK,WAAW;EACrFF,OAAOG,QAAQhB,0BAA0Ba,OAAOG,OAAON,OAAOM,KAAK;EACnEH,OAAOI,SAASjB,0BAA0Ba,OAAOI,QAAQP,OAAOO,MAAM;EACtEJ,OAAOK,SAASlB,0BAA0Ba,OAAOK,QAAQR,OAAOQ,MAAM;CAC1E;AACJ"}

package/dist/app/modules/provisioning/sources/file/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"names":[],"mappings":"~~AAUA~~,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAOlE,qBAAa,sBAAuB,YAAW,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,OAAO,EAAE,+BAA+B;IAM9C,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;~~CA4ChD~~"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAOlE,qBAAa,sBAAuB,YAAW,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,OAAO,EAAE,+BAA+B;IAM9C,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;CAiEhD"}

package/dist/app/modules/provisioning/sources/file/module.mjs CHANGED Viewed

@@ -6,6 +6,7 @@ import "../../../../../core/provisioning/entities/index.mjs";
 import { CompositeProvisioningSource } from "../composite/module.mjs";
 import "../composite/index.mjs";
 import { ValidatorGroup, isObject } from "@authup/kit";
+import { isValidupError, stringifyPath } from "validup";
 import path from "node:path";
 import { locateMany, read } from "locter";
 //#region src/app/modules/provisioning/sources/file/module.ts
@@ -25,14 +26,22 @@ var FileProvisioningSource = class {
 		this.rootValidator = new RootProvisioningValidator();
 	}
 	async load() {
-		const locations = await locateMany("*.{json,yaml,yml,ts,mts,mjs,js}", { cwd: path.isAbsolute(this.options.cwd) ? this.options.cwd : path.join(process.cwd(), this.options.cwd) });
+		const cwd = path.isAbsolute(this.options.cwd) ? this.options.cwd : path.join(process.cwd(), this.options.cwd);
+		const locations = await locateMany("*.{json,yaml,yml,ts,mts,mjs,js}", { cwd });
 		const compositeSource = new CompositeProvisioningSource([]);
 		const output = {};
 		for (const location of locations) {
 			const raw = await read(location);
 			const entity = typeof location.extension === "string" && MODULE_FILE_EXTENSIONS.has(location.extension.toLowerCase()) && isObject(raw) && "default" in raw ? raw.default : raw;
 			if (!isObject(entity)) throw new Error(`The provisioning file "${location.path}" must contain an object at its root.`);
-			const data = await this.rootValidator.run(entity, { group: ValidatorGroup.PROVISIONING });
+			let data;
+			try {
+				data = await this.rootValidator.run(entity, { group: ValidatorGroup.PROVISIONING });
+			} catch (e) {
+				if (!isValidupError(e)) throw e;
+				const issues = e.issues.map((issue) => `  ${stringifyPath(issue.path)}: ${issue.message}`).join("\n");
+				throw new Error(`The provisioning file "${location.path}" is invalid.\n${issues}`, { cause: e });
+			}
 			compositeSource.merge(output, data);
 		}
 		return output;

package/dist/app/modules/provisioning/sources/file/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["ValidatorGroup","isObject","locateMany","read","path","RootProvisioningValidator","CompositeProvisioningSource","MODULE_FILE_EXTENSIONS","Set","FileProvisioningSource","options","rootValidator","load","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","isModule","extension","has","toLowerCase","entity","default","Error","data","run","group","PROVISIONING","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { ValidatorGroup, isObject } from '@authup/kit';\nimport { locateMany, read } from 'locter';\nimport path from 'node:path';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\n// Extensions locter loads as an ES module namespace ({ default, ...named }),\n// as opposed to data files (json/yaml/yml) whose parsed value is returned\n// directly. Only the former should have their `default` export unwrapped.\nconst MODULE_FILE_EXTENSIONS = new Set(['.ts', '.mts', '.cts', '.js', '.mjs', '.cjs']);\n\nexport class FileProvisioningSource implements IProvisioningSource {\n protected options: FileEntitySchemaImporterOptions;\n\n protected rootValidator: RootProvisioningValidator;\n\n constructor(options: FileEntitySchemaImporterOptions) {\n this.options = options;\n\n this.rootValidator = new RootProvisioningValidator();\n }\n\n async load(): Promise<RootProvisioningEntity> {\n const cwd = path.isAbsolute(this.options.cwd) ?\n this.options.cwd :\n path.join(process.cwd(), this.options.cwd);\n\n const locations = await locateMany('.{json,yaml,yml,ts,mts,mjs,js}', { cwd });\n\n const compositeSource = new CompositeProvisioningSource([]);\n\n const output : RootProvisioningEntity = {};\n for (const location of locations) {\n const raw = await read(location);\n // Unwrap the default export only for module files; a data file\n // (json/yaml) whose root legitimately carries a `default` key must\n // keep all of its keys.\n const isModule = typeof location.extension === 'string' &&\n MODULE_FILE_EXTENSIONS.has(location.extension.toLowerCase());\n const entity = isModule && isObject(raw) && 'default' in raw ?\n raw.default :\n raw;\n\n // Fail closed on a malformed root (top-level list/scalar, or an\n // empty file parsing to null) instead of silently provisioning\n // nothing — the same silent-skip class the loader otherwise avoids.\n if (!isObject(entity)) {\n throw new Error(`The provisioning file \"${location.path}\" must contain an object at its root.`);\n }\n\n // Provisioning files use the camelCase management vocabulary\n // (plan 073). Keys are NOT rewritten here: a blanket snake->camel\n // pass cannot tell a schema property from a data-identifier map key\n // (`clientPermissions`/`clientRoles` are keyed by client name, and\n // client names may contain underscores), so it would silently\n // corrupt those keys. Unmounted keys are stripped by the validator.\n ~~const~~ data = await this.rootValidator.run(\n entity as Record<string, any>,\n { group: ValidatorGroup.PROVISIONING },\n );\n\n compositeSource.merge(output, data);\n }\n\n return output;\n }\n}\n"],"mappings":"~~;;;;;;;;;;;AAmBA~~,~~MAAMO~~,yCAAyB,IAAIC,IAAI;CAAC;CAAO;CAAQ;CAAQ;CAAO;CAAQ;AAAO,CAAA;AAErF,IAAaC,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMO,OAAwC;~~EAK1C~~,~~MAAMK~~,~~YAAY~~,~~MAAMf~~,WAAW,~~mCAAmC,EAAEW,KAJ5DT,KAAKU,WAAW,~~KAAKJ,QAAQG,GAAG,IACxC,KAAKH,QAAQG,~~MACbT~~,~~KAAKW~~,KAAKC,QAAQH,IAAG,GAAI,KAAKH,QAAQG,GAAG,~~EAE+B~~,CAAA;EAE5E,MAAMK,kBAAkB,IAAIZ,4BAA4B,CAAA,CAAE;EAE1D,MAAMa,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,~~MAAMlB~~,~~KAAKiB~~,QAAAA;GAMvB,MAAMM,SAFW,OAAON,SAASG,cAAc,YAC3ChB,uBAAuBiB,IAAIJ,SAASG,UAAUE,YAAW,CAAA,~~KAClCxB~~,~~SAASoB~~,GAAAA,KAAQ,aAAaA,MACrDA,IAAIM,UACJN;GAKJ,IAAI,~~CAACpB~~,~~SAASyB~~,MAAAA,GACV,MAAM,IAAIE,MAAM,0BAA0BR,~~SAAShB~~,KAAK,sCAAsC;GASlG,~~MAAMyB~~,OAAO,MAAM,KAAKlB,cAAcmB,~~IAClCJ~~,QACA,EAAEK,~~OAAO/B~~,~~eAAegC~~,aAAa,CAAA;~~GAGzCd~~,~~gBAAgBe~~,~~MAAMd~~,QAAQU,IAAAA;EAClC;EAEA,OAAOV;CACX;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["ValidatorGroup","isObject","locateMany","read","path","isValidupError","stringifyPath","RootProvisioningValidator","CompositeProvisioningSource","MODULE_FILE_EXTENSIONS","Set","FileProvisioningSource","options","rootValidator","load","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","isModule","extension","has","toLowerCase","entity","default","Error","data","run","group","PROVISIONING","e","issues","map","issue","message","cause","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { ValidatorGroup, isObject } from '@authup/kit';\nimport { locateMany, read } from 'locter';\nimport path from 'node:path';\nimport { isValidupError, stringifyPath } from 'validup';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\n// Extensions locter loads as an ES module namespace ({ default, ...named }),\n// as opposed to data files (json/yaml/yml) whose parsed value is returned\n// directly. Only the former should have their `default` export unwrapped.\nconst MODULE_FILE_EXTENSIONS = new Set(['.ts', '.mts', '.cts', '.js', '.mjs', '.cjs']);\n\nexport class FileProvisioningSource implements IProvisioningSource {\n protected options: FileEntitySchemaImporterOptions;\n\n protected rootValidator: RootProvisioningValidator;\n\n constructor(options: FileEntitySchemaImporterOptions) {\n this.options = options;\n\n this.rootValidator = new RootProvisioningValidator();\n }\n\n async load(): Promise<RootProvisioningEntity> {\n const cwd = path.isAbsolute(this.options.cwd) ?\n this.options.cwd :\n path.join(process.cwd(), this.options.cwd);\n\n const locations = await locateMany('.{json,yaml,yml,ts,mts,mjs,js}', { cwd });\n\n const compositeSource = new CompositeProvisioningSource([]);\n\n const output : RootProvisioningEntity = {};\n for (const location of locations) {\n const raw = await read(location);\n // Unwrap the default export only for module files; a data file\n // (json/yaml) whose root legitimately carries a `default` key must\n // keep all of its keys.\n const isModule = typeof location.extension === 'string' &&\n MODULE_FILE_EXTENSIONS.has(location.extension.toLowerCase());\n const entity = isModule && isObject(raw) && 'default' in raw ?\n raw.default :\n raw;\n\n // Fail closed on a malformed root (top-level list/scalar, or an\n // empty file parsing to null) instead of silently provisioning\n // nothing — the same silent-skip class the loader otherwise avoids.\n if (!isObject(entity)) {\n throw new Error(`The provisioning file \"${location.path}\" must contain an object at its root.`);\n }\n\n // Provisioning files use the camelCase management vocabulary\n // (plan 073). Keys are NOT rewritten here: a blanket snake->camel\n // pass cannot tell a schema property from a data-identifier map key\n // (`clientPermissions`/`clientRoles` are keyed by client name, and\n // client names may contain underscores), so it would silently\n // corrupt those keys. Unmounted keys are stripped by the validator.\n let data : RootProvisioningEntity;\n try {\n data = await this.rootValidator.run(\n entity as Record<string, any>,\n { group: ValidatorGroup.PROVISIONING },\n );\n } catch (e) {\n // The raw ValidupError message is a generic\n // \"Property <path> is invalid\" and names neither the file nor\n // the reason, so a bad entry in one of several mounted files\n // aborted the boot with nothing to act on. Re-throw with the\n // file path and every issue message attached.\n if (!isValidupError(e)) {\n throw e;\n }\n\n const issues = e.issues\n .map((issue) => ` ${stringifyPath(issue.path)}: ${issue.message}`)\n .join('\\n');\n\n throw new Error(\n `The provisioning file \"${location.path}\" is invalid.\\n${issues}`,\n { cause: e },\n );\n }\n\n compositeSource.merge(output, data);\n }\n\n return output;\n }\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,MAAMS,yCAAyB,IAAIC,IAAI;CAAC;CAAO;CAAQ;CAAQ;CAAO;CAAQ;AAAO,CAAA;AAErF,IAAaC,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMO,OAAwC;EAC1C,MAAMC,MAAMX,KAAKY,WAAW,KAAKJ,QAAQG,GAAG,IACxC,KAAKH,QAAQG,MACbX,KAAKa,KAAKC,QAAQH,IAAG,GAAI,KAAKH,QAAQG,GAAG;EAE7C,MAAMI,YAAY,MAAMjB,WAAW,mCAAmC,EAAEa,IAAI,CAAA;EAE5E,MAAMK,kBAAkB,IAAIZ,4BAA4B,CAAA,CAAE;EAE1D,MAAMa,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,MAAMpB,KAAKmB,QAAAA;GAMvB,MAAMM,SAFW,OAAON,SAASG,cAAc,YAC3ChB,uBAAuBiB,IAAIJ,SAASG,UAAUE,YAAW,CAAA,KAClC1B,SAASsB,GAAAA,KAAQ,aAAaA,MACrDA,IAAIM,UACJN;GAKJ,IAAI,CAACtB,SAAS2B,MAAAA,GACV,MAAM,IAAIE,MAAM,0BAA0BR,SAASlB,KAAK,sCAAsC;GASlG,IAAI2B;GACJ,IAAI;IACAA,OAAO,MAAM,KAAKlB,cAAcmB,IAC5BJ,QACA,EAAEK,OAAOjC,eAAekC,aAAa,CAAA;GAE7C,SAASC,GAAG;IAMR,IAAI,CAAC9B,eAAe8B,CAAAA,GAChB,MAAMA;IAGV,MAAMC,SAASD,EAAEC,OACZC,KAAKC,UAAU,KAAKhC,cAAcgC,MAAMlC,IAAI,EAAE,IAAIkC,MAAMC,SAAS,CAAA,CACjEtB,KAAK,IAAA;IAEV,MAAM,IAAIa,MACN,0BAA0BR,SAASlB,KAAK,iBAAiBgC,UACzD,EAAEI,OAAOL,EAAE,CAAA;GAEnB;GAEAf,gBAAgBqB,MAAMpB,QAAQU,IAAAA;EAClC;EAEA,OAAOV;CACX;AACJ"}

package/dist/core/authentication/session/module.mjs CHANGED Viewed

@@ -23,15 +23,13 @@ var SessionManager = class {
 			case IdentityType.CLIENT:
 				input.clientId = input.sub;
 				break;
-			case IdentityType.USER:
-				input.userId = input.sub;
-				break;
+			case IdentityType.USER: input.userId = input.sub;
 		}
 		return this.repository.save(input);
 	}
 	async ping(session) {
 		if (session.seenAt) {
-			if (new Date(session.seenAt).getTime() + 5 * 1e3 > Date.now()) return session;
+			if (new Date(session.seenAt).getTime() + 5e3 > Date.now()) return session;
 		}
 		session.seenAt = (/* @__PURE__ */ new Date()).toISOString();
 		return this.repository.save(session);

package/dist/core/authentication/session/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ipAddress","userAgent","expiresAt","Date","now","maxAge","toISOString","subKind","CLIENT","clientId","sub","USER","userId","save","ping","session","seenAt","getTime","threshold","refresh","refreshedAt","markMfaVerified","mfaAt","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n ISessionManager, \n ISessionRepository, \n SessionManagerContext, \n SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n protected options: SessionManagerOptions;\n\n protected repository: ISessionRepository;\n\n // -----------------------------------------------------\n\n constructor(ctx: SessionManagerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n }\n\n // -----------------------------------------------------\n\n /\n Create/Update session\n \n @param input\n /\n async create(input: Partial<Session>): Promise<Session> {\n input.ipAddress = input.ipAddress \|\| '127.0.0.1';\n input.userAgent = input.userAgent \|\| 'system';\n input.expiresAt = input.expiresAt \|\| new Date(\n Date.now() + (this.options.maxAge 1_000),\n ).toISOString();\n\n switch (input.subKind) {\n case IdentityType.CLIENT: {\n input.clientId = input.sub;\n break;\n }\n case IdentityType.USER: {\n input.userId = input.sub;\n break;\n }\n }\n\n return this.repository.save(input);\n }\n\n // -----------------------------------------------------\n\n async ping(session: Session): Promise<Session> {\n if (session.seenAt) {\n const seenAt = new Date(session.seenAt).getTime();\n const threshold = seenAt + (5 * 1_000);\n\n if (threshold > Date.now()) {\n return session;\n }\n }\n\n session.seenAt = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async refresh(session: Session): Promise<Session> {\n const now = new Date().toISOString();\n session.refreshedAt = now;\n session.seenAt = now;\n\n session.expiresAt = new Date(\n Date.now() + (this.options.maxAge * 1_000),\n ).toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async markMfaVerified(session: Session): Promise<Session> {\n session.mfaAt = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n /*\n Verify session on token inspection/verification.\n \n @param id\n * @throws JWTError\n */\n async findOneById(id: string): Promise<Session \| null> {\n return this.repository.findOneById(id);\n }\n\n // -----------------------------------------------------\n\n async revoke(id: string): Promise<void> {\n await this.repository.removeById(id);\n }\n\n // -----------------------------------------------------\n\n async verify(session: Session): Promise<void> {\n const ms = new Date(session.expiresAt).getTime();\n if (Date.now() > ms) {\n await this.repository.remove(session);\n\n // todo: better error\n throw JWTError.expired();\n }\n }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,YAAYD,MAAMC,aAAa;EACrCD,MAAME,YAAYF,MAAME,aAAa;EACrCF,MAAMG,YAAYH,MAAMG,aAAa,IAAIC,KACrCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,SAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,WAAWV,MAAMW;IACvB;GAEJ,KAAKlB,aAAamB~~;IACdZ~~,MAAMa,SAASb,MAAMW;~~IACrB~~;~~EAER;~~EAEA,OAAO,KAAKd,WAAWiB,KAAKd,KAAAA;CAChC;CAIA,MAAMe,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC,QACO;OAAA,IAAIb,KAAKY,QAAQC,MAAM,CAAA,CAAEC,QACtBD,IAAU,~~IAAI~~,~~MAEhBb,~~KAAKC,IAAG,GACpB,OAAOW;EAAAA;EAIfA,QAAQC,0BAAS,IAAIb,KAAAA,EAAAA,CAAOG,YAAW;EAEvC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMI,QAAQJ,SAAoC;EAC9C,MAAMX,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCS,QAAQK,cAAchB;EACtBW,QAAQC,SAASZ;EAEjBW,QAAQb,YAAY,IAAIC,KACpBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMM,gBAAgBN,SAAoC;EACtDA,QAAQO,yBAAQ,IAAInB,KAAAA,EAAAA,CAAOG,YAAW;EAEtC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMQ,YAAYC,IAAqC;EACnD,OAAO,KAAK5B,WAAW2B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,KAAK5B,WAAW8B,WAAWF,EAAAA;CACrC;CAIA,MAAMG,OAAOZ,SAAiC;EAC1C,MAAMa,KAAK,IAAIzB,KAAKY,QAAQb,SAAS,CAAA,CAAEe,QAAO;EAC9C,IAAId,KAAKC,IAAG,IAAKwB,IAAI;GACjB,MAAM,KAAKhC,WAAWiC,OAAOd,OAAAA;GAG7B,MAAMtB,SAASqC,QAAO;EAC1B;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ipAddress","userAgent","expiresAt","Date","now","maxAge","toISOString","subKind","CLIENT","clientId","sub","USER","userId","save","ping","session","seenAt","getTime","threshold","refresh","refreshedAt","markMfaVerified","mfaAt","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n ISessionManager, \n ISessionRepository, \n SessionManagerContext, \n SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n protected options: SessionManagerOptions;\n\n protected repository: ISessionRepository;\n\n // -----------------------------------------------------\n\n constructor(ctx: SessionManagerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n }\n\n // -----------------------------------------------------\n\n /\n Create/Update session\n \n @param input\n /\n async create(input: Partial<Session>): Promise<Session> {\n input.ipAddress = input.ipAddress \|\| '127.0.0.1';\n input.userAgent = input.userAgent \|\| 'system';\n input.expiresAt = input.expiresAt \|\| new Date(\n Date.now() + (this.options.maxAge 1_000),\n ).toISOString();\n\n switch (input.subKind) {\n case IdentityType.CLIENT: {\n input.clientId = input.sub;\n break;\n }\n case IdentityType.USER: {\n input.userId = input.sub;\n break;\n }\n }\n\n return this.repository.save(input);\n }\n\n // -----------------------------------------------------\n\n async ping(session: Session): Promise<Session> {\n if (session.seenAt) {\n const seenAt = new Date(session.seenAt).getTime();\n const threshold = seenAt + (5 * 1_000);\n\n if (threshold > Date.now()) {\n return session;\n }\n }\n\n session.seenAt = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async refresh(session: Session): Promise<Session> {\n const now = new Date().toISOString();\n session.refreshedAt = now;\n session.seenAt = now;\n\n session.expiresAt = new Date(\n Date.now() + (this.options.maxAge * 1_000),\n ).toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n async markMfaVerified(session: Session): Promise<Session> {\n session.mfaAt = new Date().toISOString();\n\n return this.repository.save(session);\n }\n\n // -----------------------------------------------------\n\n /*\n Verify session on token inspection/verification.\n \n @param id\n * @throws JWTError\n */\n async findOneById(id: string): Promise<Session \| null> {\n return this.repository.findOneById(id);\n }\n\n // -----------------------------------------------------\n\n async revoke(id: string): Promise<void> {\n await this.repository.removeById(id);\n }\n\n // -----------------------------------------------------\n\n async verify(session: Session): Promise<void> {\n const ms = new Date(session.expiresAt).getTime();\n if (Date.now() > ms) {\n await this.repository.remove(session);\n\n // todo: better error\n throw JWTError.expired();\n }\n }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,YAAYD,MAAMC,aAAa;EACrCD,MAAME,YAAYF,MAAME,aAAa;EACrCF,MAAMG,YAAYH,MAAMG,aAAa,IAAIC,KACrCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,SAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,WAAWV,MAAMW;IACvB;GAEJ,KAAKlB,aAAamB,MACdZ,MAAMa,SAASb,MAAMW;EAG7B;EAEA,OAAO,KAAKd,WAAWiB,KAAKd,KAAAA;CAChC;CAIA,MAAMe,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC,QACO;OAAA,IAAIb,KAAKY,QAAQC,MAAM,CAAA,CAAEC,QACtBD,IAAU,MAEZb,KAAKC,IAAG,GACpB,OAAOW;EAAAA;EAIfA,QAAQC,0BAAS,IAAIb,KAAAA,EAAAA,CAAOG,YAAW;EAEvC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMI,QAAQJ,SAAoC;EAC9C,MAAMX,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCS,QAAQK,cAAchB;EACtBW,QAAQC,SAASZ;EAEjBW,QAAQb,YAAY,IAAIC,KACpBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMM,gBAAgBN,SAAoC;EACtDA,QAAQO,yBAAQ,IAAInB,KAAAA,EAAAA,CAAOG,YAAW;EAEtC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMQ,YAAYC,IAAqC;EACnD,OAAO,KAAK5B,WAAW2B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,KAAK5B,WAAW8B,WAAWF,EAAAA;CACrC;CAIA,MAAMG,OAAOZ,SAAiC;EAC1C,MAAMa,KAAK,IAAIzB,KAAKY,QAAQb,SAAS,CAAA,CAAEe,QAAO;EAC9C,IAAId,KAAKC,IAAG,IAAKwB,IAAI;GACjB,MAAM,KAAKhC,WAAWiC,OAAOd,OAAAA;GAG7B,MAAMtB,SAASqC,QAAO;EAC1B;CACJ;AACJ"}

package/dist/core/entities/client/index.d.ts CHANGED Viewed

@@ -1,6 +1,6 @@
 export * from './constants.ts';
 export * from './service.ts';
 export * from './types.ts';
-export * from './web-client.ts';
+export * from './system-clients.ts';
 export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/client/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,~~iBAAiB~~,CAAC;~~AAChC~~,cAAc,aAAa,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC"}

package/dist/core/entities/client/index.mjs CHANGED Viewed

@@ -4,5 +4,5 @@ import.meta.url;
 import { CLIENT_READ_PERMISSIONS } from "./constants.mjs";
 import { clientSchema } from "./schema.mjs";
 import { ClientService } from "./service.mjs";
-import { WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes } from "./web-client.mjs";
-export { CLIENT_READ_PERMISSIONS, ClientService, WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes, clientSchema };
+import { SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, SystemClientProvisioner, buildSystemClientAttributes } from "./system-clients.mjs";
+export { CLIENT_READ_PERMISSIONS, ClientService, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, SystemClientProvisioner, buildSystemClientAttributes, clientSchema };

package/dist/core/entities/client/service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,eAAe,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAY5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IA6CZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;~~IA2JI~~,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}
1	+ {"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,eAAe,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAY5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IA6CZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IA6JI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}

package/dist/core/entities/client/service.mjs CHANGED Viewed

@@ -69,7 +69,7 @@ var ClientService = class extends AbstractEntityService {
 			else where.name = idOrName;
 			if (realm) where.realmId = realm.id;
 			entity = await this.repository.findOneWithSecret(where);
-			if (!entity && options.updateOnly) throw new EntityNotFoundError();
+			if (!entity && (options.updateOnly || where.id)) throw new EntityNotFoundError();
 		} else if (options.updateOnly) throw new EntityNotFoundError();
 		let isSelfEdit = false;
 		if (entity) {

package/dist/core/entities/client/service.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","CLIENT_READ_PERMISSIONS","decodeQuery","clientSchema","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","findMany","schema","getOne","idOrName","realmId","isMe","identity","type","data","id","entity","findOne","parameters","secret","secretEncrypted","secretHashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","CLIENT_UPDATE","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","builtIn","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","authMethod","SECRET","generateSecret","protect","created","delete","CLIENT_DELETE","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n CLIENT_RESERVED_NAMES,\n ClientAuthMethod,\n ClientValidator,\n PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientSchema } from './schema.ts';\n\nexport type ClientServiceContext = {\n repository: IClientRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n protected repository: IClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ClientValidator;\n\n constructor(ctx: ClientServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ClientValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Client>> {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n\n // The per-row `secret` visibility gate lives on the client SCHEMA\n // (`fields.validateMany`, issue #3322), so it also covers the\n // `include=client` paths served by other services; the repository\n // layer redacts unauthorized values without dropping rows.\n return this.repository.findMany(\n await decodeQuery(query, { schema: clientSchema, actor }),\n );\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<Client> {\n let isMe = !!actor.identity &&\n actor.identity.type === 'client' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n }\n\n const entity = await this.repository.findOne(\n idOrName,\n await decodeQuery(query, {\n schema: clientSchema, \n parameters: ['fields', 'relations'], \n actor, \n }),\n realmId,\n );\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n }\n\n if (\n !isMe &&\n entity.secret &&\n !entity.secretEncrypted &&\n !entity.secretHashed\n ) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: CLIENT_READ_PERMISSIONS,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Client,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realmId === 'string' ?\n await this.realmRepository.resolve(data.realmId) :\n undefined;\n\n let entity: Client \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realmId = realm.id;\n }\n\n entity = await this.repository.findOneWithSecret(where);\n if (!entity && options.updateOnly) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'client' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n }\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n // Reserve the system-provisioned client names (`system`, `web`) so an\n // API caller can't create or rename a client onto them — that would\n // collide on unique(name, realmId) or shadow the builtIn client.\n // Provisioning and runtime hooks bypass this service, so they remain\n // free to manage the reserved clients. builtIn clients are exempt\n // (they ARE the provisioned ones) but API callers can never produce a\n // builtIn client since the validator strips the flag.\n if (\n typeof validated.name === 'string' &&\n CLIENT_RESERVED_NAMES.includes(validated.name) &&\n !(entity && entity.builtIn && entity.name === validated.name)\n ) {\n throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n }\n\n await this.repository.validateJoinColumns(validated);\n await this.repository.checkUniqueness(validated, entity \|\| undefined);\n\n const credentialsService = new ClientCredentialsService();\n\n if (entity) {\n if (\n !isSelfEdit &&\n !validated.realmId &&\n !entity.realmId\n ) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realmId = actorRealmId;\n }\n }\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n if (entity.authMethod === ClientAuthMethod.SECRET) {\n if (!validated.secret && !entity.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n if (validated.secret) {\n entity.secret = await credentialsService.protect(validated.secret, entity);\n }\n } else {\n entity.secret = null;\n entity.secretHashed = false;\n entity.secretEncrypted = false;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realmId) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realmId = actorRealmId;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n\n entity = this.repository.create(validated);\n\n if (entity.authMethod === ClientAuthMethod.SECRET) {\n if (!validated.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n entity.secret = await credentialsService.protect(validated.secret, validated);\n } else {\n entity.secret = null;\n entity.secretHashed = false;\n entity.secretEncrypted = false;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,IAAae,gBAAb,cAAmCL,sBAAAA;CACrBM;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIV,gBAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAMjF,OAAO,KAAKI,WAAWU,SACnB,MAAMb,YAAYQ,OAAO;GAAEM,QAAQb;GAAcQ;EAAM,CAAA,CAAA;CAE/D;CAEA,MAAMM,OACFC,UACAP,OACAD,OACAS,SACe;EACf,IAAIC,OAAO,CAAC,CAACT,MAAMU,YACfV,MAAMU,SAASC,SAAS,aAEpBX,MAAMU,SAASE,KAAKC,OAAON,YAC3BP,MAAMU,SAASE,KAAKT,SAASI;EAGrC,IAAI,CAACE,MACD,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAGrF,MAAMwB,SAAS,MAAM,KAAKpB,WAAWqB,QACjCR,UACA,MAAMhB,YAAYQ,OAAO;GACrBM,QAAQb;GACRwB,YAAY,CAAC,UAAU,WAAY;GACnChB;EACJ,CAAA,GACAQ,OAAAA;EAEJ,IAAI,CAACM,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI2B,QAAQT,MAAMU,SAAUE,KAAKC,OAAOC,OAAOD,IAAI;GAC/CJ,OAAO;GACP,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EACrF;EAEA,IACI,CAACmB,QACDK,OAAOG,UACP,CAACH,OAAOI,mBACR,CAACJ,OAAOK,cAER,MAAMnB,MAAMC,oBAAoBmB,cAAc;GAC1CjB,MAAMb;GACNsB,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMS,OACFX,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKC,KAAAA,GAAWb,MAAMZ,KAAAA;EACpD,OAAOc;CACX;CAEA,MAAMY,OACFnB,UACAK,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKjB,UAAUK,MAAMZ,OAAO,EAAE2B,YAAY,KAAK,CAAA;EAC7E,OAAOb;CACX;CAEA,MAAMU,KACFjB,UACAK,MACAZ,OACA4B,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOlB,KAAKJ,YAAY,WAClC,MAAM,KAAKb,gBAAgBoC,QAAQnB,KAAKJ,OAAO,IAC/CiB,KAAAA;EAEJ,IAAIX;EACJ,IAAIP,UAAU;GACV,MAAMyB,QAA6B,CAAC;GACpC,IAAInD,OAAO0B,QAAAA,GACPyB,MAAMnB,KAAKN;QAEXyB,MAAM7B,OAAOI;GAGjB,IAAIuB,OACAE,MAAMxB,UAAUsB,MAAMjB;GAG1BC,SAAS,MAAM,KAAKpB,WAAWuC,kBAAkBD,KAAAA;GACjD,IAAI,CAAClB,UAAUc,QAAQD,YACnB,MAAM,IAAI7C,oBAAAA;EAElB,OAAO,IAAI8C,QAAQD,YACf,MAAM,IAAI7C,oBAAAA;EAGd,IAAIoD,aAAa;EACjB,IAAIpB,QAAQ;GACR,IAAI;IACA,MAAMd,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeiD,cAAc,CAAA;GACrF,SAASC,GAAG;IACR,IACI,CAACrC,MAAMU,YACPV,MAAMU,SAASC,SAAS,YACxBX,MAAMU,SAASE,KAAKC,OAAOC,OAAOD,IAElC,MAAMwB;IAEVH,aAAa;IACb,MAAMlC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAemD,mBAAmB,CAAA;GAC1F;GACAT,QAAQjD,eAAe2D;EAC3B,OAAO;GACH,MAAMvC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeqD,cAAc,CAAA;GACjFX,QAAQjD,eAAe6D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK9C,UAAU+C,IAAI/B,MAAM,EAAEiB,MAAM,CAAA;EASzD,IACI,OAAOa,UAAUvC,SAAS,YAC1BnB,sBAAsB4D,SAASF,UAAUvC,IAAI,KAC7C,EAAEW,UAAUA,OAAO+B,WAAW/B,OAAOX,SAASuC,UAAUvC,OAExD,MAAM,IAAIpB,gBAAgB,oBAAoB2D,UAAUvC,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAWoD,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKhD,WAAWqD,gBAAgBL,WAAW5B,UAAUW,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI3D,yBAAAA;EAE/B,IAAIyB,QAAQ;GACR,IACI,CAACoB,cACD,CAACQ,UAAUlC,WACX,CAACM,OAAON,SACV;IACE,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;IAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;GAE5B;GAEA,IAAIf,YACA,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAemD;IACrB1B,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaqB;KAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJ5B,SAAS,KAAKpB,WAAW0D,MAAMtC,QAAQ4B,SAAAA;GAEvC,IAAI,CAACR,YACD,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAeiD;IACrBxB,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaP;KAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAOuC,eAAepE,iBAAiBqE,QAAQ;IAC/C,IAAI,CAACZ,UAAUzB,UAAU,CAACH,OAAOG,QAC7ByB,UAAUzB,SAAS+B,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUzB,QACVH,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQH,MAAAA;GAE3E,OAAO;IACHA,OAAOG,SAAS;IAChBH,OAAOK,eAAe;IACtBL,OAAOI,kBAAkB;GAC7B;GAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;GAE3B,OAAO;IACHA;IACA2C,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUlC,SAAS;GACpB,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;GAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;EAE5B;EAEA,MAAMjD,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAeqD;GACrB5B,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaqB;IAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA5B,SAAS,KAAKpB,WAAW6B,OAAOmB,SAAAA;EAEhC,IAAI5B,OAAOuC,eAAepE,iBAAiBqE,QAAQ;GAC/C,IAAI,CAACZ,UAAUzB,QACXyB,UAAUzB,SAAS+B,mBAAmBO,eAAc;GAGxDzC,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQyB,SAAAA;EACvE,OAAO;GACH5B,OAAOG,SAAS;GAChBH,OAAOK,eAAe;GACtBL,OAAOI,kBAAkB;EAC7B;EAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;EAE3B,OAAO;GACHA;GACA2C,SAAS;EACb;CACJ;CAEA,MAAMC,OACF7C,IACAb,OACe;EACf,MAAMA,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAewE,cAAc,CAAA;EAEjF,MAAM7C,SAAS,MAAM,KAAKpB,WAAWkE,UAAU,EAAE/C,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAewE;GACrB/C,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAED,IAAIgD,aAAa/C;EACzB,MAAM,KAAKpB,WAAWoE,OAAOhD,MAAAA;EAC7BA,OAAOD,KAAKgD;EAEZ,OAAO/C;CACX;AACJ"}
1	+ {"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","CLIENT_READ_PERMISSIONS","decodeQuery","clientSchema","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","findMany","schema","getOne","idOrName","realmId","isMe","identity","type","data","id","entity","findOne","parameters","secret","secretEncrypted","secretHashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","CLIENT_UPDATE","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","builtIn","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","authMethod","SECRET","generateSecret","protect","created","delete","CLIENT_DELETE","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n CLIENT_RESERVED_NAMES,\n ClientAuthMethod,\n ClientValidator,\n PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientSchema } from './schema.ts';\n\nexport type ClientServiceContext = {\n repository: IClientRepository;\n realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n protected repository: IClientRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected validator: ClientValidator;\n\n constructor(ctx: ClientServiceContext) {\n super();\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.validator = new ClientValidator();\n }\n\n async getMany(\n query: Record<string, any>,\n actor: ActorContext,\n ): Promise<EntityRepositoryFindManyResult<Client>> {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n\n // The per-row `secret` visibility gate lives on the client SCHEMA\n // (`fields.validateMany`, issue #3322), so it also covers the\n // `include=client` paths served by other services; the repository\n // layer redacts unauthorized values without dropping rows.\n return this.repository.findMany(\n await decodeQuery(query, { schema: clientSchema, actor }),\n );\n }\n\n async getOne(\n idOrName: string,\n actor: ActorContext,\n query?: Record<string, any>,\n realmId?: string,\n ): Promise<Client> {\n let isMe = !!actor.identity &&\n actor.identity.type === 'client' &&\n (\n actor.identity.data.id === idOrName \|\|\n actor.identity.data.name === idOrName\n );\n\n if (!isMe) {\n await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n }\n\n const entity = await this.repository.findOne(\n idOrName,\n await decodeQuery(query, {\n schema: clientSchema, \n parameters: ['fields', 'relations'], \n actor, \n }),\n realmId,\n );\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n if (isMe && actor.identity!.data.id !== entity.id) {\n isMe = false;\n await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n }\n\n if (\n !isMe &&\n entity.secret &&\n !entity.secretEncrypted &&\n !entity.secretHashed\n ) {\n await actor.permissionEvaluator.evaluateOneOf({\n name: CLIENT_READ_PERMISSIONS,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n return entity;\n }\n\n async create(\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(undefined, data, actor);\n return entity;\n }\n\n async update(\n idOrName: string,\n data: Record<string, any>,\n actor: ActorContext,\n ): Promise<Client> {\n const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n return entity;\n }\n\n async save(\n idOrName: string \| undefined,\n data: Record<string, any>,\n actor: ActorContext,\n options: { updateOnly?: boolean } = {},\n ): Promise<{\n entity: Client,\n created: boolean \n }> {\n let group: string;\n\n const realm = typeof data.realmId === 'string' ?\n await this.realmRepository.resolve(data.realmId) :\n undefined;\n\n let entity: Client \| null \| undefined;\n if (idOrName) {\n const where: Record<string, any> = {};\n if (isUUID(idOrName)) {\n where.id = idOrName;\n } else {\n where.name = idOrName;\n }\n\n if (realm) {\n where.realmId = realm.id;\n }\n\n entity = await this.repository.findOneWithSecret(where);\n // Only a NAME key may upsert-create. A UUID addresses one specific\n // row, so a miss is a 404 (creating would write a different id).\n if (!entity && (options.updateOnly \|\| where.id)) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n let isSelfEdit = false;\n if (entity) {\n try {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n } catch (e) {\n if (\n !actor.identity \|\|\n actor.identity.type !== 'client' \|\|\n actor.identity.data.id !== entity.id\n ) {\n throw e;\n }\n isSelfEdit = true;\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n }\n group = ValidatorGroup.UPDATE;\n } else {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n group = ValidatorGroup.CREATE;\n }\n\n const validated = await this.validator.run(data, { group });\n\n // Reserve the system-provisioned client names (`system`, the console\n // clients) so an API caller can't create or rename a client onto them — that would\n // collide on unique(name, realmId) or shadow the builtIn client.\n // Provisioning and runtime hooks bypass this service, so they remain\n // free to manage the reserved clients. builtIn clients are exempt\n // (they ARE the provisioned ones) but API callers can never produce a\n // builtIn client since the validator strips the flag.\n if (\n typeof validated.name === 'string' &&\n CLIENT_RESERVED_NAMES.includes(validated.name) &&\n !(entity && entity.builtIn && entity.name === validated.name)\n ) {\n throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n }\n\n await this.repository.validateJoinColumns(validated);\n await this.repository.checkUniqueness(validated, entity \|\| undefined);\n\n const credentialsService = new ClientCredentialsService();\n\n if (entity) {\n if (\n !isSelfEdit &&\n !validated.realmId &&\n !entity.realmId\n ) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realmId = actorRealmId;\n }\n }\n\n if (isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_SELF_MANAGE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n }\n\n entity = this.repository.merge(entity, validated);\n\n if (!isSelfEdit) {\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_UPDATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n }\n\n if (entity.authMethod === ClientAuthMethod.SECRET) {\n if (!validated.secret && !entity.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n if (validated.secret) {\n entity.secret = await credentialsService.protect(validated.secret, entity);\n }\n } else {\n entity.secret = null;\n entity.secretHashed = false;\n entity.secretEncrypted = false;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: false, \n };\n }\n\n if (!validated.realmId) {\n const actorRealmId = this.getActorRealmId(actor);\n if (actorRealmId) {\n validated.realmId = actorRealmId;\n }\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n });\n\n entity = this.repository.create(validated);\n\n if (entity.authMethod === ClientAuthMethod.SECRET) {\n if (!validated.secret) {\n validated.secret = credentialsService.generateSecret();\n }\n\n entity.secret = await credentialsService.protect(validated.secret, validated);\n } else {\n entity.secret = null;\n entity.secretHashed = false;\n entity.secretEncrypted = false;\n }\n\n await this.repository.save(entity);\n\n return {\n entity,\n created: true, \n };\n }\n\n async delete(\n id: string,\n actor: ActorContext,\n ): Promise<Client> {\n await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n const entity = await this.repository.findOneBy({ id });\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await actor.permissionEvaluator.evaluate({\n name: PermissionName.CLIENT_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n });\n\n const { id: entityId } = entity;\n await this.repository.remove(entity);\n entity.id = entityId;\n\n return entity;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,IAAae,gBAAb,cAAmCL,sBAAAA;CACrBM;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIV,gBAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAMjF,OAAO,KAAKI,WAAWU,SACnB,MAAMb,YAAYQ,OAAO;GAAEM,QAAQb;GAAcQ;EAAM,CAAA,CAAA;CAE/D;CAEA,MAAMM,OACFC,UACAP,OACAD,OACAS,SACe;EACf,IAAIC,OAAO,CAAC,CAACT,MAAMU,YACfV,MAAMU,SAASC,SAAS,aAEpBX,MAAMU,SAASE,KAAKC,OAAON,YAC3BP,MAAMU,SAASE,KAAKT,SAASI;EAGrC,IAAI,CAACE,MACD,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAGrF,MAAMwB,SAAS,MAAM,KAAKpB,WAAWqB,QACjCR,UACA,MAAMhB,YAAYQ,OAAO;GACrBM,QAAQb;GACRwB,YAAY,CAAC,UAAU,WAAY;GACnChB;EACJ,CAAA,GACAQ,OAAAA;EAEJ,IAAI,CAACM,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI2B,QAAQT,MAAMU,SAAUE,KAAKC,OAAOC,OAAOD,IAAI;GAC/CJ,OAAO;GACP,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EACrF;EAEA,IACI,CAACmB,QACDK,OAAOG,UACP,CAACH,OAAOI,mBACR,CAACJ,OAAOK,cAER,MAAMnB,MAAMC,oBAAoBmB,cAAc;GAC1CjB,MAAMb;GACNsB,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMS,OACFX,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKC,KAAAA,GAAWb,MAAMZ,KAAAA;EACpD,OAAOc;CACX;CAEA,MAAMY,OACFnB,UACAK,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKjB,UAAUK,MAAMZ,OAAO,EAAE2B,YAAY,KAAK,CAAA;EAC7E,OAAOb;CACX;CAEA,MAAMU,KACFjB,UACAK,MACAZ,OACA4B,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOlB,KAAKJ,YAAY,WAClC,MAAM,KAAKb,gBAAgBoC,QAAQnB,KAAKJ,OAAO,IAC/CiB,KAAAA;EAEJ,IAAIX;EACJ,IAAIP,UAAU;GACV,MAAMyB,QAA6B,CAAC;GACpC,IAAInD,OAAO0B,QAAAA,GACPyB,MAAMnB,KAAKN;QAEXyB,MAAM7B,OAAOI;GAGjB,IAAIuB,OACAE,MAAMxB,UAAUsB,MAAMjB;GAG1BC,SAAS,MAAM,KAAKpB,WAAWuC,kBAAkBD,KAAAA;GAGjD,IAAI,CAAClB,WAAWc,QAAQD,cAAcK,MAAMnB,KACxC,MAAM,IAAI/B,oBAAAA;EAElB,OAAO,IAAI8C,QAAQD,YACf,MAAM,IAAI7C,oBAAAA;EAGd,IAAIoD,aAAa;EACjB,IAAIpB,QAAQ;GACR,IAAI;IACA,MAAMd,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeiD,cAAc,CAAA;GACrF,SAASC,GAAG;IACR,IACI,CAACrC,MAAMU,YACPV,MAAMU,SAASC,SAAS,YACxBX,MAAMU,SAASE,KAAKC,OAAOC,OAAOD,IAElC,MAAMwB;IAEVH,aAAa;IACb,MAAMlC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAemD,mBAAmB,CAAA;GAC1F;GACAT,QAAQjD,eAAe2D;EAC3B,OAAO;GACH,MAAMvC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeqD,cAAc,CAAA;GACjFX,QAAQjD,eAAe6D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK9C,UAAU+C,IAAI/B,MAAM,EAAEiB,MAAM,CAAA;EASzD,IACI,OAAOa,UAAUvC,SAAS,YAC1BnB,sBAAsB4D,SAASF,UAAUvC,IAAI,KAC7C,EAAEW,UAAUA,OAAO+B,WAAW/B,OAAOX,SAASuC,UAAUvC,OAExD,MAAM,IAAIpB,gBAAgB,oBAAoB2D,UAAUvC,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAWoD,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKhD,WAAWqD,gBAAgBL,WAAW5B,UAAUW,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI3D,yBAAAA;EAE/B,IAAIyB,QAAQ;GACR,IACI,CAACoB,cACD,CAACQ,UAAUlC,WACX,CAACM,OAAON,SACV;IACE,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;IAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;GAE5B;GAEA,IAAIf,YACA,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAemD;IACrB1B,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaqB;KAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJ5B,SAAS,KAAKpB,WAAW0D,MAAMtC,QAAQ4B,SAAAA;GAEvC,IAAI,CAACR,YACD,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAeiD;IACrBxB,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaP;KAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAOuC,eAAepE,iBAAiBqE,QAAQ;IAC/C,IAAI,CAACZ,UAAUzB,UAAU,CAACH,OAAOG,QAC7ByB,UAAUzB,SAAS+B,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUzB,QACVH,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQH,MAAAA;GAE3E,OAAO;IACHA,OAAOG,SAAS;IAChBH,OAAOK,eAAe;IACtBL,OAAOI,kBAAkB;GAC7B;GAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;GAE3B,OAAO;IACHA;IACA2C,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUlC,SAAS;GACpB,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;GAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;EAE5B;EAEA,MAAMjD,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAeqD;GACrB5B,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaqB;IAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA5B,SAAS,KAAKpB,WAAW6B,OAAOmB,SAAAA;EAEhC,IAAI5B,OAAOuC,eAAepE,iBAAiBqE,QAAQ;GAC/C,IAAI,CAACZ,UAAUzB,QACXyB,UAAUzB,SAAS+B,mBAAmBO,eAAc;GAGxDzC,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQyB,SAAAA;EACvE,OAAO;GACH5B,OAAOG,SAAS;GAChBH,OAAOK,eAAe;GACtBL,OAAOI,kBAAkB;EAC7B;EAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;EAE3B,OAAO;GACHA;GACA2C,SAAS;EACb;CACJ;CAEA,MAAMC,OACF7C,IACAb,OACe;EACf,MAAMA,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAewE,cAAc,CAAA;EAEjF,MAAM7C,SAAS,MAAM,KAAKpB,WAAWkE,UAAU,EAAE/C,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAewE;GACrB/C,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAED,IAAIgD,aAAa/C;EACzB,MAAM,KAAKpB,WAAWoE,OAAOhD,MAAAA;EAC7BA,OAAOD,KAAKgD;EAEZ,OAAO/C;CACX;AACJ"}

package/dist/core/entities/client/system-clients.d.ts ADDED Viewed

@@ -0,0 +1,95 @@
+import type { Client, Realm } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
+import type { IClientScopeRepository } from '../client-scope/types.ts';
+import type { IScopeRepository } from '../scope/types.ts';
+import type { IClientRepository, ISystemClientProvisioner, SystemClientDefinition } from './types.ts';
+export type SystemClientProvisionerContext = {
+    clientRepository: IClientRepository;
+    scopeRepository: IScopeRepository;
+    clientScopeRepository: IClientScopeRepository;
+    appOrigins: string[];
+    logger?: Logger;
+};
+/**
+ * The scopes every system client is granted.
+ *
+ * `global` lets the issued token drive the management API (parity with the
+ * legacy password-grant admin login); `openid` yields the id-token.
+ */
+export declare const SYSTEM_CLIENT_SCOPE_NAMES: string[];
+/**
+ * The public (PKCE) clients provisioned for every realm (plan 079):
+ *
+ * - `admin-console` — authup's own admin console (apps/client-admin-console),
+ * - `account-console` — the account self-service surface (plan 080; each
+ *   definition gets its own `<origin>/**` patterns from
+ *   `buildSystemClientAttributes`, so an inert row adds no redirect
+ *   surface).
+ *
+ * Downstream RPs register their own clients (per realm, or in every realm
+ * via a wildcard realm provisioning entry, plan 082) — the former shared
+ * `web` client was removed.
+ *
+ * `displayName` is seeded at CREATE only and never re-asserted by the
+ * MERGE, so an admin may relabel a client without the next boot undoing it.
+ */
+export declare const SYSTEM_CLIENT_DEFINITIONS: SystemClientDefinition[];
+/**
+ * Build the MERGE-owned attribute set for a realm's system client.
+ *
+ * `builtIn` makes the client auto-consent in the /authorize flow and
+ * protects it from the API reserved-name guard.
+ *
+ * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the
+ * /token grants and the /authorize code-request verifier; null = allow-all),
+ * so it must list every flow the client uses. `redirectUri` and
+ * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted
+ * origin (matched by isSimpleMatch) — deliberately the shared app-origin
+ * set for every definition: `redirectUri` is re-asserted on each boot, so a
+ * separately-hosted surface (plan 078 "relocatable by choice") registers
+ * its origin via TRUSTED_ORIGINS rather than editing the client row.
+ *
+ * The `scope` column is descriptive only. Scope authorization resolves
+ * through the `auth_client_scopes` junction, which
+ * `SystemClientProvisioner.ensureForRealm` fills from the definition's
+ * `scopeNames`.
+ *
+ * `accessPolicyId` and `displayName` are deliberately NOT part of this set:
+ * the MERGE must neither wipe an admin-bound access policy nor undo a
+ * relabel.
+ */
+export declare function buildSystemClientAttributes(definition: SystemClientDefinition, realm: Realm | {
+    id: string;
+}, appOrigins: string[]): Partial<Client>;
+export declare class SystemClientProvisioner implements ISystemClientProvisioner {
+    protected clientRepository: IClientRepository;
+    protected scopeRepository: IScopeRepository;
+    protected clientScopeRepository: IClientScopeRepository;
+    protected appOrigins: string[];
+    protected logger?: Logger;
+    constructor(ctx: SystemClientProvisionerContext);
+    ensureForRealm(realm: Realm | {
+        id: string;
+    }): Promise<void>;
+    /**
+     * Upsert the client row itself.
+     *
+     * Every system client name is reserved (`CLIENT_RESERVED_NAMES`), so the
+     * row belongs to the system whatever state it is in. A non-built-in one
+     * predates the reservation and is taken over rather than left to shadow
+     * the realm's system client.
+     */
+    protected ensureClient(definition: SystemClientDefinition, realm: Realm | {
+        id: string;
+    }): Promise<Client>;
+    /**
+     * Bind the definition's scopes through `auth_client_scopes`. That
+     * junction is the only source the /authorize code-request verifier reads
+     * scopes from.
+     *
+     * Additive like the attribute MERGE above: an extra scope an admin bound
+     * by hand is left in place.
+     */
+    protected ensureScopes(definition: SystemClientDefinition, client: Client): Promise<void>;
+}
+//# sourceMappingURL=system-clients.d.ts.map

package/dist/core/entities/client/system-clients.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"system-clients.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/system-clients.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEtG,MAAM,MAAM,8BAA8B,GAAG;IACzC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,eAAe,EAAE,gBAAgB,CAAC;IAClC,qBAAqB,EAAE,sBAAsB,CAAC;IAC9C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,EAG7C,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAAsB,EAW7D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,2BAA2B,CACvC,UAAU,EAAE,sBAAsB,EAClC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;IAExD,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,8BAA8B;IAQzC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlE;;;;;;;OAOG;cACa,YAAY,CACxB,UAAU,EAAE,sBAAsB,EAClC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,MAAM,CAAC;IAyDlB;;;;;;;OAOG;cACa,YAAY,CAAC,UAAU,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAiClG"}