@authup/server-core 1.0.0-beta.57 → 1.0.0-beta.59

package/dist/core/entities/permission/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","definePolicyData","ValidatorGroup","isPropertySet","isUUID","AuthupError","EntityNotFoundError","ValidationError","PermissionName","PermissionValidator","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","AbstractEntityService","decodeQuery","permissionSchema","REALM_ADMIN_EXCLUDED_PERMISSIONS","REALM_CREATE","REALM_UPDATE","REALM_DELETE","REALM_ADMIN_BOUND_PERMISSIONS","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","PermissionService","repository","realmRepository","roleRepository","rolePermissionRepository","policyRepository","permissionPolicyRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","findMany","schema","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","CREATE","validated","run","validateJoinColumns","builtIn","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","merge","created","identity","getActorRealmId","resourceRealmMatch","assignToAdminRole","assignToRealmAdminRoles","assignDefaultPolicy","e","remove","catch","delete","entityId","permission","defaultPolicy","findOneByName","DEFAULT","existing","permissionId","policyId","entry","permissionRealmId","policyRealmId","adminRole","roleId","roleRealmId","realmScope","ANY","includes","isBuiltIn","Object","values","OWN","OWN_OR_NULL","realmAdminRoles","findManyBy","role"],"sources":["../../../../src/core/entities/permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { \n    BuiltInPolicyType, \n    RealmScope, \n    SystemPolicyName, \n    definePolicyData, \n} from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { AuthupError, EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    PermissionValidator,\n    ROLE_ADMIN_NAME,\n    ROLE_REALM_ADMIN_NAME,\n} from '@authup/core-kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository } from '../permission-policy/types.ts';\nimport type { IPolicyRepository } from '../policy/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport type { IRoleRepository } from '../role/types.ts';\nimport type { IRolePermissionRepository } from '../role-permission/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IPermissionRepository, IPermissionService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { permissionSchema } from './schema.ts';\n\nconst REALM_ADMIN_EXCLUDED_PERMISSIONS = [\n    PermissionName.REALM_CREATE,\n    PermissionName.REALM_UPDATE,\n    PermissionName.REALM_DELETE,\n];\n\n/**\n * Direct-entity CUD permissions that realm_admin grants at `realmScope: own`\n * (strictly the actor's own realm — see line 372). Every other realm_admin\n * permission defaults to `ownOrNull` (own realm OR global/null resources) so it\n * can act on global building blocks.\n *\n * Junction CUD (e.g. user_role, role_permission) is intentionally NOT listed here:\n * it stays `ownOrNull` because a junction can legitimately reference a global\n * side (realmId: null) — a strict `own` would reject those.\n */\nconst REALM_ADMIN_BOUND_PERMISSIONS = [\n    PermissionName.CLIENT_CREATE,\n    PermissionName.CLIENT_UPDATE,\n    PermissionName.CLIENT_DELETE,\n    PermissionName.IDENTITY_PROVIDER_CREATE,\n    PermissionName.IDENTITY_PROVIDER_UPDATE,\n    PermissionName.IDENTITY_PROVIDER_DELETE,\n    PermissionName.PERMISSION_CREATE,\n    PermissionName.PERMISSION_UPDATE,\n    PermissionName.PERMISSION_DELETE,\n    PermissionName.ROLE_CREATE,\n    PermissionName.ROLE_UPDATE,\n    PermissionName.ROLE_DELETE,\n    PermissionName.SCOPE_CREATE,\n    PermissionName.SCOPE_UPDATE,\n    PermissionName.SCOPE_DELETE,\n    PermissionName.USER_CREATE,\n    PermissionName.USER_UPDATE,\n    PermissionName.USER_DELETE,\n];\n\nexport type PermissionServiceContext = {\n    repository: IPermissionRepository;\n    realmRepository: IRealmRepository;\n    roleRepository: IRoleRepository;\n    rolePermissionRepository: IRolePermissionRepository;\n    policyRepository: IPolicyRepository;\n    permissionPolicyRepository: IPermissionPolicyRepository;\n};\n\nexport class PermissionService extends AbstractEntityService implements IPermissionService {\n    protected repository: IPermissionRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected roleRepository: IRoleRepository;\n\n    protected rolePermissionRepository: IRolePermissionRepository;\n\n    protected policyRepository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    protected validator: PermissionValidator;\n\n    constructor(ctx: PermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.rolePermissionRepository = ctx.rolePermissionRepository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n        this.validator = new PermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Permission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: permissionSchema, actor }));\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Permission,\n        created: boolean\n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Permission | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            if (\n                entity.builtIn &&\n                isPropertySet(validated, 'name') &&\n                entity.name !== validated.name\n            ) {\n                throw new ValidationError('The name of a built-in permission can not be changed.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            entity = this.repository.merge(entity, validated);\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false,\n            };\n        }\n\n        if (!isPropertySet(validated, 'realmId') && actor.identity) {\n            validated.realmId = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        // The permission row is now committed, but its security wiring — the\n        // admin/realm_admin grants and the system.default binding — is written\n        // through separate repositories with no shared transaction. A failure\n        // partway through would strand the permission bound by system.default\n        // yet held by nobody, which the uniform member gate on\n        // POST /role-permissions then makes permanently un-grantable (#3303).\n        // Two safeguards:\n        //   1. Establish the grants BEFORE binding system.default, so even an\n        //      un-compensated interruption (a hard process crash) cannot produce\n        //      the bound-but-ungranted strand — at worst a benign, still-grantable\n        //      permission that lacks its baseline policy.\n        //   2. On any thrown failure, remove the just-created permission — its\n        //      CASCADE foreign keys drop any partial junction/binding rows — and\n        //      rethrow so the caller sees the failure instead of a stale record.\n        try {\n            await this.assignToAdminRole(entity);\n            await this.assignToRealmAdminRoles(entity);\n            await this.assignDefaultPolicy(entity);\n        } catch (e) {\n            await this.repository.remove(entity).catch(() => { /* best-effort rollback */ });\n            throw e;\n        }\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.builtIn) {\n            throw new ValidationError('A built-in permission can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    /**\n     * Assign the system.default policy to a newly created permission.\n     * This ensures all permissions are evaluated with the baseline security\n     * policy (identity, permission-binding, realm-match) by default.\n     */\n    private async assignDefaultPolicy(permission: Permission): Promise<void> {\n        const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);\n        }\n\n        const existing = await this.permissionPolicyRepository.findOneBy({\n            permissionId: permission.id,\n            policyId: defaultPolicy.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.permissionPolicyRepository.create({\n            permissionId: permission.id,\n            permissionRealmId: permission.realmId,\n            policyId: defaultPolicy.id,\n            policyRealmId: defaultPolicy.realmId,\n        });\n        await this.permissionPolicyRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to the global admin role.\n     * The admin role receives every permission without policy restrictions.\n     *\n     * Throws when the admin role is not provisioned: without an admin grant the\n     * permission is bound by `system.default` yet held by nobody, and the uniform\n     * member gate on junction creation makes it permanently un-grantable (even by\n     * admin). Fail loud so the stranded state is surfaced instead of swallowed.\n     */\n    private async assignToAdminRole(permission: Permission): Promise<void> {\n        const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);\n        if (!adminRole) {\n            throw new AuthupError(`The ${ROLE_ADMIN_NAME} role is not provisioned. Cannot grant the created permission to the administrator role.`);\n        }\n\n        const existing = await this.rolePermissionRepository.findOneBy({\n            roleId: adminRole.id,\n            permissionId: permission.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.rolePermissionRepository.create({\n            roleId: adminRole.id,\n            roleRealmId: adminRole.realmId,\n            permissionId: permission.id,\n            permissionRealmId: permission.realmId,\n            // Global admin: unrestricted realm reach.\n            realmScope: RealmScope.ANY,\n        });\n        await this.rolePermissionRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to all matching realm_admin roles.\n     *\n     * Uses differentiated realmScope on the junction:\n     * - CUD on global-capable entity types → own (strictly own realm)\n     * - Everything else → ownOrNull (own realm + null/global resources)\n     *\n     * Eligible permissions:\n     * - Built-in authup permissions (global) — assigned to all realm_admin roles\n     * - Realm-scoped permissions — assigned to the realm_admin in the matching realm\n     *\n     * Excluded:\n     * - Realm CRUD permissions (realm_create, realm_update, realm_delete)\n     * - Custom global permissions (non-built-in with realmId: null)\n     */\n    private async assignToRealmAdminRoles(permission: Permission): Promise<void> {\n        if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name as PermissionName)) {\n            return;\n        }\n\n        const isBuiltIn = (Object.values(PermissionName) as string[]).includes(permission.name);\n        if (!permission.realmId && !isBuiltIn) {\n            return;\n        }\n\n        const realmScope = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name as PermissionName) ?\n            RealmScope.OWN :\n            RealmScope.OWN_OR_NULL;\n\n        const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });\n\n        for (const role of realmAdminRoles) {\n            if (permission.realmId && permission.realmId !== role.realmId) {\n                continue;\n            }\n\n            const existing = await this.rolePermissionRepository.findOneBy({\n                roleId: role.id,\n                permissionId: permission.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.rolePermissionRepository.create({\n                roleId: role.id,\n                roleRealmId: role.realmId,\n                permissionId: permission.id,\n                permissionRealmId: permission.realmId,\n                realmScope,\n            });\n            await this.rolePermissionRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAiCA,MAAMiB,mCAAmC;CACrCP,eAAeQ;CACfR,eAAeS;CACfT,eAAeU;AAClB;;;;;;;;;;GAYD,MAAMC,gCAAgC;CAClCX,eAAeY;CACfZ,eAAea;CACfb,eAAec;CACfd,eAAee;CACff,eAAegB;CACfhB,eAAeiB;CACfjB,eAAekB;CACflB,eAAemB;CACfnB,eAAeoB;CACfpB,eAAeqB;CACfrB,eAAesB;CACftB,eAAeuB;CACfvB,eAAewB;CACfxB,eAAeyB;CACfzB,eAAe0B;CACf1B,eAAe2B;CACf3B,eAAe4B;CACf5B,eAAe6B;AAClB;AAWD,IAAaC,oBAAb,cAAuC1B,sBAAAA;CACzB2B;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKP,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIpC,oBAAAA;CACzB;CAEA,MAAMsC,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF5C,eAAe6C;GACf7C,eAAemB;GACfnB,eAAeoB;EAClB,EACL,CAAA;EAEA,OAAO,KAAKW,WAAWe,SAAS,MAAMzC,YAAYmC,OAAO;GAAEO,QAAQzC;GAAkBmC;EAAM,CAAA,CAAA;CAC/F;CAEA,MAAMO,OACFC,UACAR,OACAS,OACmB;EACnB,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF5C,eAAe6C;GACf7C,eAAemB;GACfnB,eAAeoB;EAClB,EACL,CAAA;EAEA,MAAM+B,SAAS,MAAM,KAAKpB,WAAWqB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAIrD,oBAAAA;EAGd,OAAOqD;CACX;CAEA,MAAME,OACFC,MACAb,OACmB;EACnB,MAAM,EAAEU,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMb,KAAAA;EACpD,OAAOU;CACX;CAEA,MAAMM,OACFR,UACAK,MACAb,OACmB;EACnB,MAAM,EAAEU,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMb,OAAO,EAAEiB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAb,OACAkB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,YAAY,WAClC,MAAM,KAAK7B,gBAAgB8B,QAAQR,KAAKO,OAAO,IAC/CL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAInE,OAAOqD,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMnB,OAAOK;GAGjB,IAAIC,OACAa,MAAMF,UAAUX,MAAMc;GAG1Bb,SAAS,MAAM,KAAKpB,WAAWkC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAI5D,oBAAAA;EAElB,OAAO,IAAI6D,QAAQD,YACf,MAAM,IAAI5D,oBAAAA;EAGd,IAAIqD,QAAQ;GACR,MAAMV,MAAMC,oBAAoBwB,YAAY,EAAEtB,MAAM5C,eAAemB,kBAAkB,CAAA;GACrFyC,QAAQlE,eAAeyE;EAC3B,OAAO;GACH,MAAM1B,MAAMC,oBAAoBwB,YAAY,EAAEtB,MAAM5C,eAAekB,kBAAkB,CAAA;GACrF0C,QAAQlE,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKhC,UAAUiC,IAAIhB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK7B,WAAWwC,oBAAoBF,SAAAA;EAE1C,IAAIlB,QAAQ;GACR,IACIA,OAAOqB,WACP7E,cAAc0E,WAAW,MAAA,KACzBlB,OAAOP,SAASyB,UAAUzB,MAE1B,MAAM,IAAI7C,gBAAgB,uDAAA;GAG9B,MAAM0C,MAAMC,oBAAoB+B,SAAS;IACrC7B,MAAM5C,eAAemB;IACrBmC,MAAM7D,iBAAiB;MAClBH,kBAAkBoF,aAAa;MAC5B,GAAGvB;MACH,GAAGkB;KACP;MACC/E,kBAAkBqF,cAAcN,UAAUR,WAAWV,OAAOU,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK9B,WAAW6C,gBAAgBP,WAAWlB,MAAAA;GAEjDA,SAAS,KAAKpB,WAAW8C,MAAM1B,QAAQkB,SAAAA;GAEvC,MAAM,KAAKtC,WAAWwB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,IAAI,CAACnF,cAAc0E,WAAW,SAAA,KAAc5B,MAAMsC,UAC9CV,UAAUR,UAAU,KAAKmB,gBAAgBvC,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoB+B,SAAS;GACrC7B,MAAM5C,eAAekB;GACrBoC,MAAM7D,iBAAiB;KAAGH,kBAAkBoF,aAAaL;IAAW,GAAG,KAAKY,mBAAmBZ,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKtC,WAAW6C,gBAAgBP,SAAAA;EAEtClB,SAAS,KAAKpB,WAAWsB,OAAOgB,SAAAA;EAChClB,SAAS,MAAM,KAAKpB,WAAWwB,KAAKJ,MAAAA;EAgBpC,IAAI;GACA,MAAM,KAAK+B,kBAAkB/B,MAAAA;GAC7B,MAAM,KAAKgC,wBAAwBhC,MAAAA;GACnC,MAAM,KAAKiC,oBAAoBjC,MAAAA;EACnC,SAASkC,GAAG;GACR,MAAM,KAAKtD,WAAWuD,OAAOnC,MAAAA,CAAAA,CAAQoC,YAAM,CAAmC,CAAA;GAC9E,MAAMF;EACV;EAEA,OAAO;GACHlC;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMU,OACFxB,IACAvB,OACmB;EACnB,MAAMA,MAAMC,oBAAoBwB,YAAY,EAAEtB,MAAM5C,eAAeoB,kBAAkB,CAAA;EAErF,MAAM+B,SAAS,MAAM,KAAKpB,WAAWkC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAIrD,oBAAAA;EAGd,IAAIqD,OAAOqB,SACP,MAAM,IAAIzE,gBAAgB,2CAAA;EAG9B,MAAM0C,MAAMC,oBAAoB+B,SAAS;GACrC7B,MAAM5C,eAAeoB;GACrBkC,MAAM7D,iBAAiB;KAAGH,kBAAkBoF,aAAavB;IAAQ,GAAG,KAAK8B,mBAAmB9B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEa,IAAIyB,aAAatC;EACzB,MAAM,KAAKpB,WAAWuD,OAAOnC,MAAAA;EAC7BA,OAAOa,KAAKyB;EAEZ,OAAOtC;CACX;;;;;IAOA,MAAciC,oBAAoBM,YAAuC;EACrE,MAAMC,gBAAgB,MAAM,KAAKxD,iBAAiByD,cAAcpG,iBAAiBqG,OAAO;EACxF,IAAI,CAACF,eACD,MAAM,IAAI9F,YAAY,OAAOL,iBAAiBqG,QAAQ,2FAA2F;EAOrJ,IAAIC,MAJmB,KAAK1D,2BAA2B6B,UAAU;GAC7D8B,cAAcL,WAAW1B;GACzBgC,UAAUL,cAAc3B;EAC5B,CAAA,GAEI;EAGJ,MAAMiC,QAAQ,KAAK7D,2BAA2BiB,OAAO;GACjD0C,cAAcL,WAAW1B;GACzBkC,mBAAmBR,WAAW7B;GAC9BmC,UAAUL,cAAc3B;GACxBmC,eAAeR,cAAc9B;EACjC,CAAA;EACA,MAAM,KAAKzB,2BAA2BmB,KAAK0C,KAAAA;CAC/C;;;;;;;;;IAWA,MAAcf,kBAAkBQ,YAAuC;EACnE,MAAMU,YAAY,MAAM,KAAKnE,eAAe2D,cAAc1F,eAAAA;EAC1D,IAAI,CAACkG,WACD,MAAM,IAAIvG,YAAY,OAAOK,gBAAgB,yFAAyF;EAO1I,IAAI4F,MAJmB,KAAK5D,yBAAyB+B,UAAU;GAC3DoC,QAAQD,UAAUpC;GAClB+B,cAAcL,WAAW1B;EAC7B,CAAA,GAEI;EAGJ,MAAMiC,QAAQ,KAAK/D,yBAAyBmB,OAAO;GAC/CgD,QAAQD,UAAUpC;GAClBsC,aAAaF,UAAUvC;GACvBkC,cAAcL,WAAW1B;GACzBkC,mBAAmBR,WAAW7B;GAE9B0C,YAAYhH,WAAWiH;EAC3B,CAAA;EACA,MAAM,KAAKtE,yBAAyBqB,KAAK0C,KAAAA;CAC7C;;;;;;;;;;;;;;;IAiBA,MAAcd,wBAAwBO,YAAuC;EACzE,IAAInF,iCAAiCkG,SAASf,WAAW9C,IAAI,GACzD;EAGJ,MAAM8D,YAAY,OAAQE,OAAO5G,cAAAA,CAAAA,CAA6ByG,SAASf,WAAW9C,IAAI;EACtF,IAAI,CAAC8C,WAAW7B,WAAW,CAAC6C,WACxB;EAGJ,MAAMH,aAAa5F,8BAA8B8F,SAASf,WAAW9C,IAAI,IACrErD,WAAWsH,MACXtH,WAAWuH;EAEf,MAAMC,kBAAkB,MAAM,KAAK9E,eAAe+E,WAAW,EAAEpE,MAAMzC,sBAAsB,CAAA;EAE3F,KAAK,MAAM8G,QAAQF,iBAAiB;GAChC,IAAIrB,WAAW7B,WAAW6B,WAAW7B,YAAYoD,KAAKpD,SAClD;GAOJ,IAAIiC,MAJmB,KAAK5D,yBAAyB+B,UAAU;IAC3DoC,QAAQY,KAAKjD;IACb+B,cAAcL,WAAW1B;GAC7B,CAAA,GAEI;GAGJ,MAAMiC,QAAQ,KAAK/D,yBAAyBmB,OAAO;IAC/CgD,QAAQY,KAAKjD;IACbsC,aAAaW,KAAKpD;IAClBkC,cAAcL,WAAW1B;IACzBkC,mBAAmBR,WAAW7B;IAC9B0C;GACJ,CAAA;GACA,MAAM,KAAKrE,yBAAyBqB,KAAK0C,KAAAA;EAC7C;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","definePolicyData","ValidatorGroup","isPropertySet","isUUID","AuthupError","EntityNotFoundError","ValidationError","PermissionName","PermissionValidator","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","AbstractEntityService","decodeQuery","permissionSchema","REALM_ADMIN_EXCLUDED_PERMISSIONS","REALM_CREATE","REALM_UPDATE","REALM_DELETE","REALM_ADMIN_BOUND_PERMISSIONS","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","PermissionService","repository","realmRepository","roleRepository","rolePermissionRepository","policyRepository","permissionPolicyRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","findMany","schema","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","CREATE","validated","run","validateJoinColumns","builtIn","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","merge","created","identity","getActorRealmId","resourceRealmMatch","assignToAdminRole","assignToRealmAdminRoles","assignDefaultPolicy","e","remove","catch","delete","entityId","permission","defaultPolicy","findOneByName","DEFAULT","existing","permissionId","policyId","entry","permissionRealmId","policyRealmId","adminRole","roleId","roleRealmId","realmScope","ANY","includes","isBuiltIn","Object","values","OWN","OWN_OR_NULL","realmAdminRoles","findManyBy","role"],"sources":["../../../../src/core/entities/permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { \n    BuiltInPolicyType, \n    RealmScope, \n    SystemPolicyName, \n    definePolicyData, \n} from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { AuthupError, EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    PermissionValidator,\n    ROLE_ADMIN_NAME,\n    ROLE_REALM_ADMIN_NAME,\n} from '@authup/core-kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IPermissionPolicyRepository } from '../permission-policy/types.ts';\nimport type { IPolicyRepository } from '../policy/types.ts';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport type { IRoleRepository } from '../role/types.ts';\nimport type { IRolePermissionRepository } from '../role-permission/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IPermissionRepository, IPermissionService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { permissionSchema } from './schema.ts';\n\nconst REALM_ADMIN_EXCLUDED_PERMISSIONS = [\n    PermissionName.REALM_CREATE,\n    PermissionName.REALM_UPDATE,\n    PermissionName.REALM_DELETE,\n];\n\n/**\n * Direct-entity CUD permissions that realm_admin grants at `realmScope: own`\n * (strictly the actor's own realm — see line 372). Every other realm_admin\n * permission defaults to `ownOrNull` (own realm OR global/null resources) so it\n * can act on global building blocks.\n *\n * Junction CUD (e.g. user_role, role_permission) is intentionally NOT listed here:\n * it stays `ownOrNull` because a junction can legitimately reference a global\n * side (realmId: null) — a strict `own` would reject those.\n */\nconst REALM_ADMIN_BOUND_PERMISSIONS = [\n    PermissionName.CLIENT_CREATE,\n    PermissionName.CLIENT_UPDATE,\n    PermissionName.CLIENT_DELETE,\n    PermissionName.IDENTITY_PROVIDER_CREATE,\n    PermissionName.IDENTITY_PROVIDER_UPDATE,\n    PermissionName.IDENTITY_PROVIDER_DELETE,\n    PermissionName.PERMISSION_CREATE,\n    PermissionName.PERMISSION_UPDATE,\n    PermissionName.PERMISSION_DELETE,\n    PermissionName.ROLE_CREATE,\n    PermissionName.ROLE_UPDATE,\n    PermissionName.ROLE_DELETE,\n    PermissionName.SCOPE_CREATE,\n    PermissionName.SCOPE_UPDATE,\n    PermissionName.SCOPE_DELETE,\n    PermissionName.USER_CREATE,\n    PermissionName.USER_UPDATE,\n    PermissionName.USER_DELETE,\n];\n\nexport type PermissionServiceContext = {\n    repository: IPermissionRepository;\n    realmRepository: IRealmRepository;\n    roleRepository: IRoleRepository;\n    rolePermissionRepository: IRolePermissionRepository;\n    policyRepository: IPolicyRepository;\n    permissionPolicyRepository: IPermissionPolicyRepository;\n};\n\nexport class PermissionService extends AbstractEntityService implements IPermissionService {\n    protected repository: IPermissionRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected roleRepository: IRoleRepository;\n\n    protected rolePermissionRepository: IRolePermissionRepository;\n\n    protected policyRepository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    protected validator: PermissionValidator;\n\n    constructor(ctx: PermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.roleRepository = ctx.roleRepository;\n        this.rolePermissionRepository = ctx.rolePermissionRepository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n        this.validator = new PermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Permission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: permissionSchema, actor }));\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Permission,\n        created: boolean\n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Permission | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            if (\n                entity.builtIn &&\n                isPropertySet(validated, 'name') &&\n                entity.name !== validated.name\n            ) {\n                throw new ValidationError('The name of a built-in permission can not be changed.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            entity = this.repository.merge(entity, validated);\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false,\n            };\n        }\n\n        if (!isPropertySet(validated, 'realmId') && actor.identity) {\n            validated.realmId = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        // The permission row is now committed, but its security wiring — the\n        // admin/realm_admin grants and the system.default binding — is written\n        // through separate repositories with no shared transaction. A failure\n        // partway through would strand the permission bound by system.default\n        // yet held by nobody, which the uniform member gate on\n        // POST /role-permissions then makes permanently un-grantable (#3303).\n        // Two safeguards:\n        //   1. Establish the grants BEFORE binding system.default, so even an\n        //      un-compensated interruption (a hard process crash) cannot produce\n        //      the bound-but-ungranted strand — at worst a benign, still-grantable\n        //      permission that lacks its baseline policy.\n        //   2. On any thrown failure, remove the just-created permission — its\n        //      CASCADE foreign keys drop any partial junction/binding rows — and\n        //      rethrow so the caller sees the failure instead of a stale record.\n        try {\n            await this.assignToAdminRole(entity);\n            await this.assignToRealmAdminRoles(entity);\n            await this.assignDefaultPolicy(entity);\n        } catch (e) {\n            await this.repository.remove(entity).catch(() => { /* best-effort rollback */ });\n            throw e;\n        }\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Permission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.builtIn) {\n            throw new ValidationError('A built-in permission can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    /**\n     * Assign the system.default policy to a newly created permission.\n     * This ensures all permissions are evaluated with the baseline security\n     * policy (identity, permission-binding, realm-match) by default.\n     */\n    private async assignDefaultPolicy(permission: Permission): Promise<void> {\n        const defaultPolicy = await this.policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            throw new AuthupError(`The ${SystemPolicyName.DEFAULT} policy is not provisioned. Cannot create permissions without the default security policy.`);\n        }\n\n        const existing = await this.permissionPolicyRepository.findOneBy({\n            permissionId: permission.id,\n            policyId: defaultPolicy.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.permissionPolicyRepository.create({\n            permissionId: permission.id,\n            permissionRealmId: permission.realmId,\n            policyId: defaultPolicy.id,\n            policyRealmId: defaultPolicy.realmId,\n        });\n        await this.permissionPolicyRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to the global admin role.\n     * The admin role receives every permission without policy restrictions.\n     *\n     * Throws when the admin role is not provisioned: without an admin grant the\n     * permission is bound by `system.default` yet held by nobody, and the uniform\n     * member gate on junction creation makes it permanently un-grantable (even by\n     * admin). Fail loud so the stranded state is surfaced instead of swallowed.\n     */\n    private async assignToAdminRole(permission: Permission): Promise<void> {\n        const adminRole = await this.roleRepository.findOneByName(ROLE_ADMIN_NAME);\n        if (!adminRole) {\n            throw new AuthupError(`The ${ROLE_ADMIN_NAME} role is not provisioned. Cannot grant the created permission to the administrator role.`);\n        }\n\n        const existing = await this.rolePermissionRepository.findOneBy({\n            roleId: adminRole.id,\n            permissionId: permission.id,\n        });\n        if (existing) {\n            return;\n        }\n\n        const entry = this.rolePermissionRepository.create({\n            roleId: adminRole.id,\n            roleRealmId: adminRole.realmId,\n            permissionId: permission.id,\n            permissionRealmId: permission.realmId,\n            // Global admin: unrestricted realm reach.\n            realmScope: RealmScope.ANY,\n        });\n        await this.rolePermissionRepository.save(entry);\n    }\n\n    /**\n     * Assign a newly created permission to all matching realm_admin roles.\n     *\n     * Uses differentiated realmScope on the junction:\n     * - CUD on global-capable entity types → own (strictly own realm)\n     * - Everything else → ownOrNull (own realm + null/global resources)\n     *\n     * Eligible permissions:\n     * - Built-in authup permissions (global) — assigned to all realm_admin roles\n     * - Realm-scoped permissions — assigned to the realm_admin in the matching realm\n     *\n     * Excluded:\n     * - Realm CRUD permissions (realm_create, realm_update, realm_delete)\n     * - Custom global permissions (non-built-in with realmId: null)\n     */\n    private async assignToRealmAdminRoles(permission: Permission): Promise<void> {\n        if (REALM_ADMIN_EXCLUDED_PERMISSIONS.includes(permission.name as PermissionName)) {\n            return;\n        }\n\n        const isBuiltIn = (Object.values(PermissionName) as string[]).includes(permission.name);\n        if (!permission.realmId && !isBuiltIn) {\n            return;\n        }\n\n        const realmScope = REALM_ADMIN_BOUND_PERMISSIONS.includes(permission.name as PermissionName) ?\n            RealmScope.OWN :\n            RealmScope.OWN_OR_NULL;\n\n        const realmAdminRoles = await this.roleRepository.findManyBy({ name: ROLE_REALM_ADMIN_NAME });\n\n        for (const role of realmAdminRoles) {\n            if (permission.realmId && permission.realmId !== role.realmId) {\n                continue;\n            }\n\n            const existing = await this.rolePermissionRepository.findOneBy({\n                roleId: role.id,\n                permissionId: permission.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.rolePermissionRepository.create({\n                roleId: role.id,\n                roleRealmId: role.realmId,\n                permissionId: permission.id,\n                permissionRealmId: permission.realmId,\n                realmScope,\n            });\n            await this.rolePermissionRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAiCA,MAAMiB,mCAAmC;CACrCP,eAAeQ;CACfR,eAAeS;CACfT,eAAeU;AAClB;;;;;;;;;;GAYD,MAAMC,gCAAgC;CAClCX,eAAeY;CACfZ,eAAea;CACfb,eAAec;CACfd,eAAee;CACff,eAAegB;CACfhB,eAAeiB;CACfjB,eAAekB;CACflB,eAAemB;CACfnB,eAAeoB;CACfpB,eAAeqB;CACfrB,eAAesB;CACftB,eAAeuB;CACfvB,eAAewB;CACfxB,eAAeyB;CACfzB,eAAe0B;CACf1B,eAAe2B;CACf3B,eAAe4B;CACf5B,eAAe6B;AAClB;AAWD,IAAaC,oBAAb,cAAuC1B,sBAAAA;CACzB2B;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,MAAK;EACL,KAAKP,aAAaO,IAAIP;EACtB,KAAKC,kBAAkBM,IAAIN;EAC3B,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,2BAA2BI,IAAIJ;EACpC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIpC,oBAAAA;CACzB;CAEA,MAAMsC,QACFC,OACAC,OACmD;EACnD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF5C,eAAe6C;GACf7C,eAAemB;GACfnB,eAAeoB;EAClB,EACL,CAAA;EAEA,OAAO,KAAKW,WAAWe,SAAS,MAAMzC,YAAYmC,OAAO;GAAEO,QAAQzC;GAAkBmC;EAAM,CAAA,CAAA;CAC/F;CAEA,MAAMO,OACFC,UACAR,OACAS,OACmB;EACnB,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACF5C,eAAe6C;GACf7C,eAAemB;GACfnB,eAAeoB;EAClB,EACL,CAAA;EAEA,MAAM+B,SAAS,MAAM,KAAKpB,WAAWqB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAIrD,oBAAAA;EAGd,OAAOqD;CACX;CAEA,MAAME,OACFC,MACAb,OACmB;EACnB,MAAM,EAAEU,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMb,KAAAA;EACpD,OAAOU;CACX;CAEA,MAAMM,OACFR,UACAK,MACAb,OACmB;EACnB,MAAM,EAAEU,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMb,OAAO,EAAEiB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAb,OACAkB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,YAAY,WAClC,MAAM,KAAK7B,gBAAgB8B,QAAQR,KAAKO,OAAO,IAC/CL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAInE,OAAOqD,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMnB,OAAOK;GAGjB,IAAIC,OACAa,MAAMF,UAAUX,MAAMc;GAG1Bb,SAAS,MAAM,KAAKpB,WAAWkC,UAAUF,KAAAA;GAGzC,IAAI,CAACZ,WAAWQ,QAAQD,cAAcK,MAAMC,KACxC,MAAM,IAAIlE,oBAAAA;EAElB,OAAO,IAAI6D,QAAQD,YACf,MAAM,IAAI5D,oBAAAA;EAGd,IAAIqD,QAAQ;GACR,MAAMV,MAAMC,oBAAoBwB,YAAY,EAAEtB,MAAM5C,eAAemB,kBAAkB,CAAA;GACrFyC,QAAQlE,eAAeyE;EAC3B,OAAO;GACH,MAAM1B,MAAMC,oBAAoBwB,YAAY,EAAEtB,MAAM5C,eAAekB,kBAAkB,CAAA;GACrF0C,QAAQlE,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKhC,UAAUiC,IAAIhB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK7B,WAAWwC,oBAAoBF,SAAAA;EAE1C,IAAIlB,QAAQ;GACR,IACIA,OAAOqB,WACP7E,cAAc0E,WAAW,MAAA,KACzBlB,OAAOP,SAASyB,UAAUzB,MAE1B,MAAM,IAAI7C,gBAAgB,uDAAA;GAG9B,MAAM0C,MAAMC,oBAAoB+B,SAAS;IACrC7B,MAAM5C,eAAemB;IACrBmC,MAAM7D,iBAAiB;MAClBH,kBAAkBoF,aAAa;MAC5B,GAAGvB;MACH,GAAGkB;KACP;MACC/E,kBAAkBqF,cAAcN,UAAUR,WAAWV,OAAOU,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK9B,WAAW6C,gBAAgBP,WAAWlB,MAAAA;GAEjDA,SAAS,KAAKpB,WAAW8C,MAAM1B,QAAQkB,SAAAA;GAEvC,MAAM,KAAKtC,WAAWwB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,IAAI,CAACnF,cAAc0E,WAAW,SAAA,KAAc5B,MAAMsC,UAC9CV,UAAUR,UAAU,KAAKmB,gBAAgBvC,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoB+B,SAAS;GACrC7B,MAAM5C,eAAekB;GACrBoC,MAAM7D,iBAAiB;KAAGH,kBAAkBoF,aAAaL;IAAW,GAAG,KAAKY,mBAAmBZ,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKtC,WAAW6C,gBAAgBP,SAAAA;EAEtClB,SAAS,KAAKpB,WAAWsB,OAAOgB,SAAAA;EAChClB,SAAS,MAAM,KAAKpB,WAAWwB,KAAKJ,MAAAA;EAgBpC,IAAI;GACA,MAAM,KAAK+B,kBAAkB/B,MAAAA;GAC7B,MAAM,KAAKgC,wBAAwBhC,MAAAA;GACnC,MAAM,KAAKiC,oBAAoBjC,MAAAA;EACnC,SAASkC,GAAG;GACR,MAAM,KAAKtD,WAAWuD,OAAOnC,MAAAA,CAAAA,CAAQoC,YAAM,CAAmC,CAAA;GAC9E,MAAMF;EACV;EAEA,OAAO;GACHlC;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMU,OACFxB,IACAvB,OACmB;EACnB,MAAMA,MAAMC,oBAAoBwB,YAAY,EAAEtB,MAAM5C,eAAeoB,kBAAkB,CAAA;EAErF,MAAM+B,SAAS,MAAM,KAAKpB,WAAWkC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAIrD,oBAAAA;EAGd,IAAIqD,OAAOqB,SACP,MAAM,IAAIzE,gBAAgB,2CAAA;EAG9B,MAAM0C,MAAMC,oBAAoB+B,SAAS;GACrC7B,MAAM5C,eAAeoB;GACrBkC,MAAM7D,iBAAiB;KAAGH,kBAAkBoF,aAAavB;IAAQ,GAAG,KAAK8B,mBAAmB9B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEa,IAAIyB,aAAatC;EACzB,MAAM,KAAKpB,WAAWuD,OAAOnC,MAAAA;EAC7BA,OAAOa,KAAKyB;EAEZ,OAAOtC;CACX;;;;;IAOA,MAAciC,oBAAoBM,YAAuC;EACrE,MAAMC,gBAAgB,MAAM,KAAKxD,iBAAiByD,cAAcpG,iBAAiBqG,OAAO;EACxF,IAAI,CAACF,eACD,MAAM,IAAI9F,YAAY,OAAOL,iBAAiBqG,QAAQ,2FAA2F;EAOrJ,IAAIC,MAJmB,KAAK1D,2BAA2B6B,UAAU;GAC7D8B,cAAcL,WAAW1B;GACzBgC,UAAUL,cAAc3B;EAC5B,CAAA,GAEI;EAGJ,MAAMiC,QAAQ,KAAK7D,2BAA2BiB,OAAO;GACjD0C,cAAcL,WAAW1B;GACzBkC,mBAAmBR,WAAW7B;GAC9BmC,UAAUL,cAAc3B;GACxBmC,eAAeR,cAAc9B;EACjC,CAAA;EACA,MAAM,KAAKzB,2BAA2BmB,KAAK0C,KAAAA;CAC/C;;;;;;;;;IAWA,MAAcf,kBAAkBQ,YAAuC;EACnE,MAAMU,YAAY,MAAM,KAAKnE,eAAe2D,cAAc1F,eAAAA;EAC1D,IAAI,CAACkG,WACD,MAAM,IAAIvG,YAAY,OAAOK,gBAAgB,yFAAyF;EAO1I,IAAI4F,MAJmB,KAAK5D,yBAAyB+B,UAAU;GAC3DoC,QAAQD,UAAUpC;GAClB+B,cAAcL,WAAW1B;EAC7B,CAAA,GAEI;EAGJ,MAAMiC,QAAQ,KAAK/D,yBAAyBmB,OAAO;GAC/CgD,QAAQD,UAAUpC;GAClBsC,aAAaF,UAAUvC;GACvBkC,cAAcL,WAAW1B;GACzBkC,mBAAmBR,WAAW7B;GAE9B0C,YAAYhH,WAAWiH;EAC3B,CAAA;EACA,MAAM,KAAKtE,yBAAyBqB,KAAK0C,KAAAA;CAC7C;;;;;;;;;;;;;;;IAiBA,MAAcd,wBAAwBO,YAAuC;EACzE,IAAInF,iCAAiCkG,SAASf,WAAW9C,IAAI,GACzD;EAGJ,MAAM8D,YAAY,OAAQE,OAAO5G,cAAAA,CAAAA,CAA6ByG,SAASf,WAAW9C,IAAI;EACtF,IAAI,CAAC8C,WAAW7B,WAAW,CAAC6C,WACxB;EAGJ,MAAMH,aAAa5F,8BAA8B8F,SAASf,WAAW9C,IAAI,IACrErD,WAAWsH,MACXtH,WAAWuH;EAEf,MAAMC,kBAAkB,MAAM,KAAK9E,eAAe+E,WAAW,EAAEpE,MAAMzC,sBAAsB,CAAA;EAE3F,KAAK,MAAM8G,QAAQF,iBAAiB;GAChC,IAAIrB,WAAW7B,WAAW6B,WAAW7B,YAAYoD,KAAKpD,SAClD;GAOJ,IAAIiC,MAJmB,KAAK5D,yBAAyB+B,UAAU;IAC3DoC,QAAQY,KAAKjD;IACb+B,cAAcL,WAAW1B;GAC7B,CAAA,GAEI;GAGJ,MAAMiC,QAAQ,KAAK/D,yBAAyBmB,OAAO;IAC/CgD,QAAQY,KAAKjD;IACbsC,aAAaW,KAAKpD;IAClBkC,cAAcL,WAAW1B;IACzBkC,mBAAmBR,WAAW7B;IAC9B0C;GACJ,CAAA;GACA,MAAM,KAAKrE,yBAAyBqB,KAAK0C,KAAAA;EAC7C;CACJ;AACJ"}

package/dist/core/entities/policy/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/policy/service.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEH,eAAe,EAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;IAErC,SAAS,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;gBAE7C,GAAG,EAAE,oBAAoB;IAQ/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAY5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;IAiBZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;YA+FY,QAAQ;IAqBhB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CA4BrB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/policy/service.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEH,eAAe,EAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;IAErC,SAAS,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;gBAE7C,GAAG,EAAE,oBAAoB;IAQ/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAY5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;IAiBZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;YAiGY,QAAQ;IAqBhB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CA4BrB"}

package/dist/core/entities/policy/service.mjs

@@ -62,7 +62,7 @@ var PolicyService = class extends AbstractEntityService {
 			else where.name = idOrName;
 			if (realm) where.realmId = realm.id;
 			entity = await this.repository.findOneBy(where);
-			if (!entity && options.updateOnly) throw new EntityNotFoundError();
+			if (!entity && (options.updateOnly || where.id)) throw new EntityNotFoundError();
 		} else if (options.updateOnly) throw new EntityNotFoundError();
 		if (entity) {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });
@@ -112,7 +112,8 @@ var PolicyService = class extends AbstractEntityService {
 	}
 	async validate(data, group) {
 		const validated = await this.validator.run(data, { group });
-		extendObject(validated, await this.attributesValidator.run(data));
+		const attributes = await this.attributesValidator.run(data);
+		extendObject(validated, attributes);
 		if (Array.isArray(data.children)) {
 			if (data.type === BuiltInPolicyType.COMPOSITE) {
 				const promises = data.children.map((child) => this.validate(child, group));

package/dist/core/entities/policy/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","extendObject","isPropertySet","isUUID","removeObjectProperty","EntityNotFoundError","ValidationError","PermissionName","PolicyValidator","AbstractEntityService","PolicyAttributesValidator","decodeQuery","policySchema","PolicyService","repository","realmRepository","validator","attributesValidator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","PERMISSION_DELETE","findMany","schema","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","PERMISSION_CREATE","CREATE","validated","validate","validateJoinColumns","parent","type","COMPOSITE","builtIn","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","saveWithEA","created","identity","getActorRealmId","resourceRealmMatch","run","attributes","Array","isArray","children","promises","map","child","Promise","all","delete","entityId","deleteFromTree"],"sources":["../../../../src/core/entities/policy/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    ValidatorGroup,\n    extendObject,\n    isPropertySet,\n    isUUID,\n    removeObjectProperty,\n} from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    PolicyValidator,\n} from '@authup/core-kit';\nimport type { Policy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { PolicyAttributesValidator } from './attributes-validator.ts';\nimport type { IPolicyRepository, IPolicyService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { policySchema } from './schema.ts';\n\nexport type PolicyServiceContext = {\n    repository: IPolicyRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class PolicyService extends AbstractEntityService implements IPolicyService {\n    protected repository: IPolicyRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: PolicyValidator;\n\n    protected attributesValidator: PolicyAttributesValidator;\n\n    constructor(ctx: PolicyServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new PolicyValidator();\n        this.attributesValidator = new PolicyAttributesValidator({});\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Policy>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: policySchema, actor }));\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Policy> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Policy,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Policy | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validate(data, group);\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (\n            validated.parent &&\n            validated.parent.type !== BuiltInPolicyType.COMPOSITE\n        ) {\n            throw new ValidationError('The parent policy must be of type group.');\n        }\n\n        if (entity) {\n            if (entity.builtIn) {\n                throw new ValidationError('A built-in policy can not be updated.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            extendObject(entity, validated);\n\n            await this.repository.saveWithEA(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realmId') && actor.identity) {\n            validated.realmId = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        await this.repository.saveWithEA(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    private async validate(\n        data: Record<string, any>,\n        group: string,\n    ): Promise<Policy> {\n        const validated = await this.validator.run(data, { group });\n\n        const attributes = await this.attributesValidator.run(data);\n        extendObject(validated, attributes);\n\n        if (Array.isArray(data.children)) {\n            if (data.type === BuiltInPolicyType.COMPOSITE) {\n                const promises = data.children.map(\n                    (child) => this.validate(child, group),\n                );\n                validated.children = await Promise.all(promises);\n            }\n        }\n\n        return validated;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.builtIn) {\n            throw new ValidationError('A built-in policy can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n\n        await this.repository.deleteFromTree(entity);\n\n        entity.id = entityId;\n\n        // todo: remove after PolicyEntity - parent delete on cascade\n        removeObjectProperty(entity, 'children');\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAkCA,IAAae,gBAAb,cAAmCJ,sBAAAA;CACrBK;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,YAAY,IAAIR,gBAAAA;EACrB,KAAKS,sBAAsB,IAAIP,0BAA0B,CAAC,CAAA;CAC9D;CAEA,MAAMS,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFjB,eAAekB;GACflB,eAAemB;GACfnB,eAAeoB;EAClB,EACL,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAAS,MAAMjB,YAAYS,OAAO;GAAES,QAAQjB;GAAcS;EAAM,CAAA,CAAA;CAC3F;CAEA,MAAMS,OACFC,UACAV,OACAW,OACe;EACf,MAAMX,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFjB,eAAekB;GACflB,eAAemB;GACfnB,eAAeoB;EAClB,EACL,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKnB,WAAWoB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,OAAO4B;CACX;CAEA,MAAME,OACFC,MACAf,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMf,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMM,OACFR,UACAK,MACAf,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMf,OAAO,EAAEmB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAf,OACAoB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,YAAY,WAClC,MAAM,KAAK5B,gBAAgB6B,QAAQR,KAAKO,OAAO,IAC/CL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAI1C,OAAO4B,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMrB,OAAOO;GAGjB,IAAIC,OACAa,MAAMF,UAAUX,MAAMc;GAG1Bb,SAAS,MAAM,KAAKnB,WAAWiC,UAAUF,KAAAA;GACzC,IAAI,CAACZ,UAAUQ,QAAQD,YACnB,MAAM,IAAInC,oBAAAA;EAElB,OAAO,IAAIoC,QAAQD,YACf,MAAM,IAAInC,oBAAAA;EAGd,IAAI4B,QAAQ;GACR,MAAMZ,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMjB,eAAemB,kBAAkB,CAAA;GACrFgB,QAAQ1C,eAAeiD;EAC3B,OAAO;GACH,MAAM5B,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMjB,eAAe2C,kBAAkB,CAAA;GACrFR,QAAQ1C,eAAemD;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKC,SAASjB,MAAMM,KAAAA;EAE5C,MAAM,KAAK5B,WAAWwC,oBAAoBF,SAAAA;EAE1C,IACIA,UAAUG,UACVH,UAAUG,OAAOC,SAAS1D,kBAAkB2D,WAE5C,MAAM,IAAInD,gBAAgB,0CAAA;EAG9B,IAAI2B,QAAQ;GACR,IAAIA,OAAOyB,SACP,MAAM,IAAIpD,gBAAgB,uCAAA;GAG9B,MAAMe,MAAMC,oBAAoBqC,SAAS;IACrCnC,MAAMjB,eAAemB;IACrBU,MAAMrC,iBAAiB;MAClBD,kBAAkB8D,aAAa;MAC5B,GAAG3B;MACH,GAAGmB;KACP;MACCtD,kBAAkB+D,cAAcT,UAAUT,WAAWV,OAAOU,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK7B,WAAWgD,gBAAgBV,WAAWnB,MAAAA;GAEjDhC,aAAagC,QAAQmB,SAAAA;GAErB,MAAM,KAAKtC,WAAWiD,WAAW9B,MAAAA;GAEjC,OAAO;IACHA;IACA+B,SAAS;GACb;EACJ;EAEA,IAAI,CAAC9D,cAAckD,WAAW,SAAA,KAAc/B,MAAM4C,UAC9Cb,UAAUT,UAAU,KAAKuB,gBAAgB7C,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAe2C;GACrBd,MAAMrC,iBAAiB;KAAGD,kBAAkB8D,aAAaR;IAAW,GAAG,KAAKe,mBAAmBf,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKtC,WAAWgD,gBAAgBV,SAAAA;EAEtCnB,SAAS,KAAKnB,WAAWqB,OAAOiB,SAAAA;EAChC,MAAM,KAAKtC,WAAWiD,WAAW9B,MAAAA;EAEjC,OAAO;GACHA;GACA+B,SAAS;EACb;CACJ;CAEA,MAAcX,SACVjB,MACAM,OACe;EACf,MAAMU,YAAY,MAAM,KAAKpC,UAAUoD,IAAIhC,MAAM,EAAEM,MAAM,CAAA;EAGzDzC,aAAamD,WAAWiB,MADC,KAAKpD,oBAAoBmD,IAAIhC,IAAAA,CAC9BiC;EAExB,IAAIC,MAAMC,QAAQnC,KAAKoC,QAAQ,GACvBpC;OAAAA,KAAKoB,SAAS1D,kBAAkB2D,WAAW;IAC3C,MAAMgB,WAAWrC,KAAKoC,SAASE,KAC1BC,UAAU,KAAKtB,SAASsB,OAAOjC,KAAAA,CAAAA;IAEpCU,UAAUoB,WAAW,MAAMI,QAAQC,IAAIJ,QAAAA;GAC3C;;EAGJ,OAAOrB;CACX;CAEA,MAAM0B,OACFhC,IACAzB,OACe;EACf,MAAMA,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMjB,eAAeoB,kBAAkB,CAAA;EAErF,MAAMM,SAAS,MAAM,KAAKnB,WAAWiC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAI5B,oBAAAA;EAGd,IAAI4B,OAAOyB,SACP,MAAM,IAAIpD,gBAAgB,uCAAA;EAG9B,MAAMe,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAeoB;GACrBS,MAAMrC,iBAAiB;KAAGD,kBAAkB8D,aAAa3B;IAAQ,GAAG,KAAKkC,mBAAmBlC,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEa,IAAIiC,aAAa9C;EAEzB,MAAM,KAAKnB,WAAWkE,eAAe/C,MAAAA;EAErCA,OAAOa,KAAKiC;EAGZ3E,qBAAqB6B,QAAQ,UAAA;EAE7B,OAAOA;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","extendObject","isPropertySet","isUUID","removeObjectProperty","EntityNotFoundError","ValidationError","PermissionName","PolicyValidator","AbstractEntityService","PolicyAttributesValidator","decodeQuery","policySchema","PolicyService","repository","realmRepository","validator","attributesValidator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","PERMISSION_READ","PERMISSION_UPDATE","PERMISSION_DELETE","findMany","schema","getOne","idOrName","realm","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","PERMISSION_CREATE","CREATE","validated","validate","validateJoinColumns","parent","type","COMPOSITE","builtIn","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","saveWithEA","created","identity","getActorRealmId","resourceRealmMatch","run","attributes","Array","isArray","children","promises","map","child","Promise","all","delete","entityId","deleteFromTree"],"sources":["../../../../src/core/entities/policy/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    ValidatorGroup,\n    extendObject,\n    isPropertySet,\n    isUUID,\n    removeObjectProperty,\n} from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    PolicyValidator,\n} from '@authup/core-kit';\nimport type { Policy } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { PolicyAttributesValidator } from './attributes-validator.ts';\nimport type { IPolicyRepository, IPolicyService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { policySchema } from './schema.ts';\n\nexport type PolicyServiceContext = {\n    repository: IPolicyRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class PolicyService extends AbstractEntityService implements IPolicyService {\n    protected repository: IPolicyRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: PolicyValidator;\n\n    protected attributesValidator: PolicyAttributesValidator;\n\n    constructor(ctx: PolicyServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new PolicyValidator();\n        this.attributesValidator = new PolicyAttributesValidator({});\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Policy>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: policySchema, actor }));\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        realm?: string,\n    ): Promise<Policy> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.PERMISSION_READ,\n                PermissionName.PERMISSION_UPDATE,\n                PermissionName.PERMISSION_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName, realm);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Policy,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Policy | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validate(data, group);\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (\n            validated.parent &&\n            validated.parent.type !== BuiltInPolicyType.COMPOSITE\n        ) {\n            throw new ValidationError('The parent policy must be of type group.');\n        }\n\n        if (entity) {\n            if (entity.builtIn) {\n                throw new ValidationError('A built-in policy can not be updated.');\n            }\n\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.PERMISSION_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            extendObject(entity, validated);\n\n            await this.repository.saveWithEA(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realmId') && actor.identity) {\n            validated.realmId = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        await this.repository.saveWithEA(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    private async validate(\n        data: Record<string, any>,\n        group: string,\n    ): Promise<Policy> {\n        const validated = await this.validator.run(data, { group });\n\n        const attributes = await this.attributesValidator.run(data);\n        extendObject(validated, attributes);\n\n        if (Array.isArray(data.children)) {\n            if (data.type === BuiltInPolicyType.COMPOSITE) {\n                const promises = data.children.map(\n                    (child) => this.validate(child, group),\n                );\n                validated.children = await Promise.all(promises);\n            }\n        }\n\n        return validated;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Policy> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.builtIn) {\n            throw new ValidationError('A built-in policy can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.PERMISSION_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n\n        await this.repository.deleteFromTree(entity);\n\n        entity.id = entityId;\n\n        // todo: remove after PolicyEntity - parent delete on cascade\n        removeObjectProperty(entity, 'children');\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAkCA,IAAae,gBAAb,cAAmCJ,sBAAAA;CACrBK;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,YAAY,IAAIR,gBAAAA;EACrB,KAAKS,sBAAsB,IAAIP,0BAA0B,CAAC,CAAA;CAC9D;CAEA,MAAMS,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFjB,eAAekB;GACflB,eAAemB;GACfnB,eAAeoB;EAClB,EACL,CAAA;EAEA,OAAO,KAAKb,WAAWc,SAAS,MAAMjB,YAAYS,OAAO;GAAES,QAAQjB;GAAcS;EAAM,CAAA,CAAA;CAC3F;CAEA,MAAMS,OACFC,UACAV,OACAW,OACe;EACf,MAAMX,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFjB,eAAekB;GACflB,eAAemB;GACfnB,eAAeoB;EAClB,EACL,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKnB,WAAWoB,kBAAkBH,UAAUC,KAAAA;EACjE,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,OAAO4B;CACX;CAEA,MAAME,OACFC,MACAf,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMf,KAAAA;EACpD,OAAOY;CACX;CAEA,MAAMM,OACFR,UACAK,MACAf,OACe;EACf,MAAM,EAAEY,WAAW,MAAM,KAAKI,KAAKN,UAAUK,MAAMf,OAAO,EAAEmB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFN,UACAK,MACAf,OACAoB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMV,QAAQ,OAAOI,KAAKO,YAAY,WAClC,MAAM,KAAK5B,gBAAgB6B,QAAQR,KAAKO,OAAO,IAC/CL,KAAAA;EAEJ,IAAIL;EACJ,IAAIF,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAI1C,OAAO4B,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMrB,OAAOO;GAGjB,IAAIC,OACAa,MAAMF,UAAUX,MAAMc;GAG1Bb,SAAS,MAAM,KAAKnB,WAAWiC,UAAUF,KAAAA;GAGzC,IAAI,CAACZ,WAAWQ,QAAQD,cAAcK,MAAMC,KACxC,MAAM,IAAIzC,oBAAAA;EAElB,OAAO,IAAIoC,QAAQD,YACf,MAAM,IAAInC,oBAAAA;EAGd,IAAI4B,QAAQ;GACR,MAAMZ,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMjB,eAAemB,kBAAkB,CAAA;GACrFgB,QAAQ1C,eAAeiD;EAC3B,OAAO;GACH,MAAM5B,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMjB,eAAe2C,kBAAkB,CAAA;GACrFR,QAAQ1C,eAAemD;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKC,SAASjB,MAAMM,KAAAA;EAE5C,MAAM,KAAK5B,WAAWwC,oBAAoBF,SAAAA;EAE1C,IACIA,UAAUG,UACVH,UAAUG,OAAOC,SAAS1D,kBAAkB2D,WAE5C,MAAM,IAAInD,gBAAgB,0CAAA;EAG9B,IAAI2B,QAAQ;GACR,IAAIA,OAAOyB,SACP,MAAM,IAAIpD,gBAAgB,uCAAA;GAG9B,MAAMe,MAAMC,oBAAoBqC,SAAS;IACrCnC,MAAMjB,eAAemB;IACrBU,MAAMrC,iBAAiB;MAClBD,kBAAkB8D,aAAa;MAC5B,GAAG3B;MACH,GAAGmB;KACP;MACCtD,kBAAkB+D,cAAcT,UAAUT,WAAWV,OAAOU,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK7B,WAAWgD,gBAAgBV,WAAWnB,MAAAA;GAEjDhC,aAAagC,QAAQmB,SAAAA;GAErB,MAAM,KAAKtC,WAAWiD,WAAW9B,MAAAA;GAEjC,OAAO;IACHA;IACA+B,SAAS;GACb;EACJ;EAEA,IAAI,CAAC9D,cAAckD,WAAW,SAAA,KAAc/B,MAAM4C,UAC9Cb,UAAUT,UAAU,KAAKuB,gBAAgB7C,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAe2C;GACrBd,MAAMrC,iBAAiB;KAAGD,kBAAkB8D,aAAaR;IAAW,GAAG,KAAKe,mBAAmBf,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKtC,WAAWgD,gBAAgBV,SAAAA;EAEtCnB,SAAS,KAAKnB,WAAWqB,OAAOiB,SAAAA;EAChC,MAAM,KAAKtC,WAAWiD,WAAW9B,MAAAA;EAEjC,OAAO;GACHA;GACA+B,SAAS;EACb;CACJ;CAEA,MAAcX,SACVjB,MACAM,OACe;EACf,MAAMU,YAAY,MAAM,KAAKpC,UAAUoD,IAAIhC,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM2B,aAAa,MAAM,KAAKpD,oBAAoBmD,IAAIhC,IAAAA;EACtDnC,aAAamD,WAAWiB,UAAAA;EAExB,IAAIC,MAAMC,QAAQnC,KAAKoC,QAAQ,GACvBpC;OAAAA,KAAKoB,SAAS1D,kBAAkB2D,WAAW;IAC3C,MAAMgB,WAAWrC,KAAKoC,SAASE,KAC1BC,UAAU,KAAKtB,SAASsB,OAAOjC,KAAAA,CAAAA;IAEpCU,UAAUoB,WAAW,MAAMI,QAAQC,IAAIJ,QAAAA;GAC3C;;EAGJ,OAAOrB;CACX;CAEA,MAAM0B,OACFhC,IACAzB,OACe;EACf,MAAMA,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMjB,eAAeoB,kBAAkB,CAAA;EAErF,MAAMM,SAAS,MAAM,KAAKnB,WAAWiC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACb,QACD,MAAM,IAAI5B,oBAAAA;EAGd,IAAI4B,OAAOyB,SACP,MAAM,IAAIpD,gBAAgB,uCAAA;EAG9B,MAAMe,MAAMC,oBAAoBqC,SAAS;GACrCnC,MAAMjB,eAAeoB;GACrBS,MAAMrC,iBAAiB;KAAGD,kBAAkB8D,aAAa3B;IAAQ,GAAG,KAAKkC,mBAAmBlC,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEa,IAAIiC,aAAa9C;EAEzB,MAAM,KAAKnB,WAAWkE,eAAe/C,MAAAA;EAErCA,OAAOa,KAAKiC;EAGZ3E,qBAAqB6B,QAAQ,UAAA;EAE7B,OAAOA;CACX;AACJ"}

package/dist/core/entities/realm/service.d.ts

@@ -2,20 +2,22 @@ import { RealmValidator } from '@authup/core-kit';
 import type { Realm } from '@authup/core-kit';
 import type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';
 import { AbstractEntityService } from '@authup/server-kit';
-import type { IWebClientProvisioner } from '../client/types.ts';
-import type { IKeyProvisioner } from '../../key/types.ts';
+import type { IRealmProvisioner } from '../../provisioning/types.ts';
 import type { IRealmRepository, IRealmService } from './types.ts';
 export type RealmServiceContext = {
     repository: IRealmRepository;
-    webClientProvisioner?: IWebClientProvisioner;
-    keyProvisioner?: IKeyProvisioner;
+    /**
+     * Applied in order on realm CREATE (system clients, keys, wildcard
+     * provisioning defaults). Never-fail: a provisioner failure is logged
+     * and swallowed.
+     */
+    realmProvisioners?: IRealmProvisioner[];
     logger?: Logger;
 };
 export declare class RealmService extends AbstractEntityService implements IRealmService {
     protected repository: IRealmRepository;
     protected validator: RealmValidator;
-    protected webClientProvisioner?: IWebClientProvisioner;
-    protected keyProvisioner?: IKeyProvisioner;
+    protected realmProvisioners?: IRealmProvisioner[];
     protected logger?: Logger;
     constructor(ctx: RealmServiceContext);
     getMany(query: Record<string, any>): Promise<EntityRepositoryFindManyResult<Realm>>;

package/dist/core/entities/realm/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/realm/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAG,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIlE,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC;IAEpC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAEvD,SAAS,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC;IAE3C,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAS9B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAI3C,MAAM,CACR,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,KAAK,CAAC;IASX,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IA8FI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;CAuBpB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/realm/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAG,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIlE,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC;IAEpC,SAAS,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAElD,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAQ9B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAI3C,MAAM,CACR,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,KAAK,CAAC;IASX,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IA8FI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;CAuBpB"}

package/dist/core/entities/realm/service.mjs

@@ -13,14 +13,12 @@ import { EntityNotFoundError, ValidationError } from "@authup/errors";
 var RealmService = class extends AbstractEntityService {
 	repository;
 	validator;
-	webClientProvisioner;
-	keyProvisioner;
+	realmProvisioners;
 	logger;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
-		this.webClientProvisioner = ctx.webClientProvisioner;
-		this.keyProvisioner = ctx.keyProvisioner;
+		this.realmProvisioners = ctx.realmProvisioners;
 		this.logger = ctx.logger;
 		this.validator = new RealmValidator();
 	}
@@ -48,7 +46,7 @@ var RealmService = class extends AbstractEntityService {
 			if (isUUID(idOrName)) where.id = idOrName;
 			else where.name = idOrName;
 			entity = await this.repository.findOneBy(where);
-			if (!entity && options.updateOnly) throw new EntityNotFoundError();
+			if (!entity && (options.updateOnly || where.id)) throw new EntityNotFoundError();
 		} else if (options.updateOnly) throw new EntityNotFoundError();
 		if (entity) {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_UPDATE });
@@ -81,12 +79,11 @@ var RealmService = class extends AbstractEntityService {
 		});
 		entity = this.repository.create(validated);
 		await this.repository.save(entity);
-		if (this.webClientProvisioner) try {
-			await this.webClientProvisioner.ensureForRealm(entity);
+		if (this.realmProvisioners) for (const provisioner of this.realmProvisioners) try {
+			await provisioner.ensureForRealm(entity);
 		} catch (e) {
-			if (this.logger) this.logger.warn(`Failed to provision web client for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`);
+			if (this.logger) this.logger.warn(`${provisioner.constructor.name} failed for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`);
 		}
-		if (this.keyProvisioner) await this.keyProvisioner.ensureForRealm(entity);
 		return {
 			entity,
 			created: true

package/dist/core/entities/realm/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","ValidationError","PermissionName","REALM_MASTER_NAME","RealmValidator","AbstractEntityService","decodeQuery","realmSchema","RealmService","repository","validator","webClientProvisioner","keyProvisioner","logger","ctx","getMany","query","findMany","schema","getOne","idOrName","entity","findOneByIdOrName","create","data","actor","save","undefined","update","updateOnly","options","group","where","id","name","findOneBy","permissionEvaluator","preEvaluate","REALM_UPDATE","UPDATE","REALM_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","merge","created","ensureForRealm","e","warn","Error","message","String","delete","REALM_DELETE","builtIn","entityId","remove"],"sources":["../../../../src/core/entities/realm/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    REALM_MASTER_NAME,\n    RealmValidator,\n} from '@authup/core-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IWebClientProvisioner } from '../client/types.ts';\nimport type { IKeyProvisioner } from '../../key/types.ts';\nimport type { IRealmRepository, IRealmService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { realmSchema } from './schema.ts';\n\nexport type RealmServiceContext = {\n    repository: IRealmRepository;\n    webClientProvisioner?: IWebClientProvisioner;\n    keyProvisioner?: IKeyProvisioner;\n    logger?: Logger;\n};\n\nexport class RealmService extends AbstractEntityService implements IRealmService {\n    protected repository: IRealmRepository;\n\n    protected validator: RealmValidator;\n\n    protected webClientProvisioner?: IWebClientProvisioner;\n\n    protected keyProvisioner?: IKeyProvisioner;\n\n    protected logger?: Logger;\n\n    constructor(ctx: RealmServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.webClientProvisioner = ctx.webClientProvisioner;\n        this.keyProvisioner = ctx.keyProvisioner;\n        this.logger = ctx.logger;\n        this.validator = new RealmValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n    ): Promise<EntityRepositoryFindManyResult<Realm>> {\n        return this.repository.findMany(await decodeQuery(query, { schema: realmSchema }));\n    }\n\n    async getOne(\n        idOrName: string,\n    ): Promise<Realm> {\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Realm,\n        created: boolean \n    }> {\n        let group: string;\n\n        let entity: Realm | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.REALM_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            if (entity.name === REALM_MASTER_NAME && isPropertySet(validated, 'name') && entity.name !== validated.name) {\n                throw new ValidationError(`The name of the ${REALM_MASTER_NAME} can not be changed.`);\n            }\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        // Provision the realm's public `web` client via the system-level\n        // provisioner (NOT clientService.create) — it must not be gated on\n        // the actor's CLIENT_CREATE, since a realm creator may lack it.\n        // Realm creation must stay atomic from the caller's perspective: the\n        // realm is already persisted, so a provisioning failure is logged and\n        // swallowed (startup provisioning reconciles every realm's web client).\n        if (this.webClientProvisioner) {\n            try {\n                await this.webClientProvisioner.ensureForRealm(entity);\n            } catch (e) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Failed to provision web client for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`,\n                    );\n                }\n            }\n        }\n\n        // Mint the realm's sig + enc keys eagerly (plan 071 hybrid model) —\n        // same system-level, never-fail posture as the web client above.\n        if (this.keyProvisioner) {\n            await this.keyProvisioner.ensureForRealm(entity);\n        }\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.builtIn) {\n            throw new ValidationError('A built-in realm can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA+BA,IAAaa,eAAb,cAAkCH,sBAAAA;CACpBI;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKL,aAAaK,IAAIL;EACtB,KAAKE,uBAAuBG,IAAIH;EAChC,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,SAASC,IAAID;EAClB,KAAKH,YAAY,IAAIN,eAAAA;CACzB;CAEA,MAAMW,QACFC,OAC8C;EAC9C,OAAO,KAAKP,WAAWQ,SAAS,MAAMX,YAAYU,OAAO,EAAEE,QAAQX,YAAY,CAAA,CAAA;CACnF;CAEA,MAAMY,OACFC,UACc;EACd,MAAMC,SAAS,MAAM,KAAKZ,WAAWa,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIrB,oBAAAA;EAGd,OAAOqB;CACX;CAEA,MAAME,OACFC,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKC,KAAAA,GAAWH,MAAMC,KAAAA;EACpD,OAAOJ;CACX;CAEA,MAAMO,OACFR,UACAI,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKN,UAAUI,MAAMC,OAAO,EAAEI,YAAY,KAAK,CAAA;EAC7E,OAAOR;CACX;CAEA,MAAMK,KACFN,UACAI,MACAC,OACAK,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,IAAIV;EACJ,IAAID,UAAU;GACV,MAAMY,QAA6B,CAAC;GACpC,IAAIjC,OAAOqB,QAAAA,GACPY,MAAMC,KAAKb;QAEXY,MAAME,OAAOd;GAGjBC,SAAS,MAAM,KAAKZ,WAAW0B,UAAUH,KAAAA;GACzC,IAAI,CAACX,UAAUS,QAAQD,YACnB,MAAM,IAAI7B,oBAAAA;EAElB,OAAO,IAAI8B,QAAQD,YACf,MAAM,IAAI7B,oBAAAA;EAGd,IAAIqB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBC,YAAY,EAAEH,MAAMhC,eAAeoC,aAAa,CAAA;GAChFP,QAAQlC,eAAe0C;EAC3B,OAAO;GACH,MAAMd,MAAMW,oBAAoBC,YAAY,EAAEH,MAAMhC,eAAesC,aAAa,CAAA;GAChFT,QAAQlC,eAAe4C;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKhC,UAAUiC,IAAInB,MAAM,EAAEO,MAAM,CAAA;EAEzD,MAAM,KAAKtB,WAAWmC,oBAAoBF,SAAAA;EAE1C,IAAIrB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBS,SAAS;IACrCX,MAAMhC,eAAeoC;IACrBd,MAAM5B,iBAAiB,GAClBD,kBAAkBmD,aAAa;KAC5B,GAAGzB;KACH,GAAGqB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,IAAIrB,OAAOa,SAAS/B,qBAAqBL,cAAc4C,WAAW,MAAA,KAAWrB,OAAOa,SAASQ,UAAUR,MACnG,MAAM,IAAIjC,gBAAgB,mBAAmBE,kBAAkB,qBAAqB;GAGxFkB,SAAS,KAAKZ,WAAWsC,MAAM1B,QAAQqB,SAAAA;GACvC,MAAM,KAAKjC,WAAWiB,KAAKL,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,MAAMvB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAMhC,eAAesC;GACrBhB,MAAM5B,iBAAiB,GAAGD,kBAAkBmD,aAAaJ,UAAU,CAAA;EACvE,CAAA;EAEArB,SAAS,KAAKZ,WAAWc,OAAOmB,SAAAA;EAChC,MAAM,KAAKjC,WAAWiB,KAAKL,MAAAA;EAQ3B,IAAI,KAAKV,sBACL,IAAI;GACA,MAAM,KAAKA,qBAAqBsC,eAAe5B,MAAAA;EACnD,SAAS6B,GAAG;GACR,IAAI,KAAKrC,QACL,KAAKA,OAAOsC,KACR,4CAA4C9B,OAAOY,GAAG,IAAIiB,aAAaE,QAAQF,EAAEG,UAAUC,OAAOJ,CAAAA,GAAI;EAGlH;EAKJ,IAAI,KAAKtC,gBACL,MAAM,KAAKA,eAAeqC,eAAe5B,MAAAA;EAG7C,OAAO;GACHA;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMO,OACFtB,IACAR,OACc;EACd,MAAMA,MAAMW,oBAAoBC,YAAY,EAAEH,MAAMhC,eAAesD,aAAa,CAAA;EAEhF,MAAMnC,SAAS,MAAM,KAAKZ,WAAW0B,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACZ,QACD,MAAM,IAAIrB,oBAAAA;EAGd,IAAIqB,OAAOoC,SACP,MAAM,IAAIxD,gBAAgB,sCAAA;EAG9B,MAAMwB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAMhC,eAAesD;GACrBhC,MAAM5B,iBAAiB,GAAGD,kBAAkBmD,aAAazB,OAAO,CAAA;EACpE,CAAA;EAEA,MAAM,EAAEY,IAAIyB,aAAarC;EACzB,MAAM,KAAKZ,WAAWkD,OAAOtC,MAAAA;EAC7BA,OAAOY,KAAKyB;EAEZ,OAAOrC;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","ValidationError","PermissionName","REALM_MASTER_NAME","RealmValidator","AbstractEntityService","decodeQuery","realmSchema","RealmService","repository","validator","realmProvisioners","logger","ctx","getMany","query","findMany","schema","getOne","idOrName","entity","findOneByIdOrName","create","data","actor","save","undefined","update","updateOnly","options","group","where","id","name","findOneBy","permissionEvaluator","preEvaluate","REALM_UPDATE","UPDATE","REALM_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","merge","created","provisioner","ensureForRealm","e","warn","Error","message","String","delete","REALM_DELETE","builtIn","entityId","remove"],"sources":["../../../../src/core/entities/realm/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    REALM_MASTER_NAME,\n    RealmValidator,\n} from '@authup/core-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRealmProvisioner } from '../../provisioning/types.ts';\nimport type { IRealmRepository, IRealmService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { realmSchema } from './schema.ts';\n\nexport type RealmServiceContext = {\n    repository: IRealmRepository;\n    /**\n     * Applied in order on realm CREATE (system clients, keys, wildcard\n     * provisioning defaults). Never-fail: a provisioner failure is logged\n     * and swallowed.\n     */\n    realmProvisioners?: IRealmProvisioner[];\n    logger?: Logger;\n};\n\nexport class RealmService extends AbstractEntityService implements IRealmService {\n    protected repository: IRealmRepository;\n\n    protected validator: RealmValidator;\n\n    protected realmProvisioners?: IRealmProvisioner[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: RealmServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmProvisioners = ctx.realmProvisioners;\n        this.logger = ctx.logger;\n        this.validator = new RealmValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n    ): Promise<EntityRepositoryFindManyResult<Realm>> {\n        return this.repository.findMany(await decodeQuery(query, { schema: realmSchema }));\n    }\n\n    async getOne(\n        idOrName: string,\n    ): Promise<Realm> {\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Realm,\n        created: boolean \n    }> {\n        let group: string;\n\n        let entity: Realm | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.REALM_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            if (entity.name === REALM_MASTER_NAME && isPropertySet(validated, 'name') && entity.name !== validated.name) {\n                throw new ValidationError(`The name of the ${REALM_MASTER_NAME} can not be changed.`);\n            }\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        // Provision the realm's baseline (system clients, sig + enc keys,\n        // wildcard provisioning defaults) via the system-level realm\n        // provisioners (NOT the entity services) — they must not be gated\n        // on the actor's permissions, since a realm creator may lack e.g.\n        // CLIENT_CREATE. Realm creation must stay atomic from the caller's\n        // perspective: the realm is already persisted, so a provisioner\n        // failure is logged and swallowed (startup provisioning reconciles\n        // every realm on the next boot).\n        if (this.realmProvisioners) {\n            for (const provisioner of this.realmProvisioners) {\n                try {\n                    await provisioner.ensureForRealm(entity);\n                } catch (e) {\n                    if (this.logger) {\n                        this.logger.warn(\n                            `${provisioner.constructor.name} failed for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`,\n                        );\n                    }\n                }\n            }\n        }\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.builtIn) {\n            throw new ValidationError('A built-in realm can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAkCA,IAAaa,eAAb,cAAkCH,sBAAAA;CACpBI;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKE,oBAAoBE,IAAIF;EAC7B,KAAKC,SAASC,IAAID;EAClB,KAAKF,YAAY,IAAIN,eAAAA;CACzB;CAEA,MAAMU,QACFC,OAC8C;EAC9C,OAAO,KAAKN,WAAWO,SAAS,MAAMV,YAAYS,OAAO,EAAEE,QAAQV,YAAY,CAAA,CAAA;CACnF;CAEA,MAAMW,OACFC,UACc;EACd,MAAMC,SAAS,MAAM,KAAKX,WAAWY,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIpB,oBAAAA;EAGd,OAAOoB;CACX;CAEA,MAAME,OACFC,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKC,KAAAA,GAAWH,MAAMC,KAAAA;EACpD,OAAOJ;CACX;CAEA,MAAMO,OACFR,UACAI,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKN,UAAUI,MAAMC,OAAO,EAAEI,YAAY,KAAK,CAAA;EAC7E,OAAOR;CACX;CAEA,MAAMK,KACFN,UACAI,MACAC,OACAK,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,IAAIV;EACJ,IAAID,UAAU;GACV,MAAMY,QAA6B,CAAC;GACpC,IAAIhC,OAAOoB,QAAAA,GACPY,MAAMC,KAAKb;QAEXY,MAAME,OAAOd;GAGjBC,SAAS,MAAM,KAAKX,WAAWyB,UAAUH,KAAAA;GAGzC,IAAI,CAACX,WAAWS,QAAQD,cAAcG,MAAMC,KACxC,MAAM,IAAIhC,oBAAAA;EAElB,OAAO,IAAI6B,QAAQD,YACf,MAAM,IAAI5B,oBAAAA;EAGd,IAAIoB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM/B,eAAemC,aAAa,CAAA;GAChFP,QAAQjC,eAAeyC;EAC3B,OAAO;GACH,MAAMd,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM/B,eAAeqC,aAAa,CAAA;GAChFT,QAAQjC,eAAe2C;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK/B,UAAUgC,IAAInB,MAAM,EAAEO,MAAM,CAAA;EAEzD,MAAM,KAAKrB,WAAWkC,oBAAoBF,SAAAA;EAE1C,IAAIrB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBS,SAAS;IACrCX,MAAM/B,eAAemC;IACrBd,MAAM3B,iBAAiB,GAClBD,kBAAkBkD,aAAa;KAC5B,GAAGzB;KACH,GAAGqB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,IAAIrB,OAAOa,SAAS9B,qBAAqBL,cAAc2C,WAAW,MAAA,KAAWrB,OAAOa,SAASQ,UAAUR,MACnG,MAAM,IAAIhC,gBAAgB,mBAAmBE,kBAAkB,qBAAqB;GAGxFiB,SAAS,KAAKX,WAAWqC,MAAM1B,QAAQqB,SAAAA;GACvC,MAAM,KAAKhC,WAAWgB,KAAKL,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,MAAMvB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM/B,eAAeqC;GACrBhB,MAAM3B,iBAAiB,GAAGD,kBAAkBkD,aAAaJ,UAAU,CAAA;EACvE,CAAA;EAEArB,SAAS,KAAKX,WAAWa,OAAOmB,SAAAA;EAChC,MAAM,KAAKhC,WAAWgB,KAAKL,MAAAA;EAU3B,IAAI,KAAKT,mBACL,KAAK,MAAMqC,eAAe,KAAKrC,mBAC3B,IAAI;GACA,MAAMqC,YAAYC,eAAe7B,MAAAA;EACrC,SAAS8B,GAAG;GACR,IAAI,KAAKtC,QACL,KAAKA,OAAOuC,KACR,GAAGH,YAAY,YAAYf,KAAK,oBAAoBb,OAAOY,GAAG,IAAIkB,aAAaE,QAAQF,EAAEG,UAAUC,OAAOJ,CAAAA,GAAI;EAG1H;EAIR,OAAO;GACH9B;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMQ,OACFvB,IACAR,OACc;EACd,MAAMA,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM/B,eAAesD,aAAa,CAAA;EAEhF,MAAMpC,SAAS,MAAM,KAAKX,WAAWyB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACZ,QACD,MAAM,IAAIpB,oBAAAA;EAGd,IAAIoB,OAAOqC,SACP,MAAM,IAAIxD,gBAAgB,sCAAA;EAG9B,MAAMuB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM/B,eAAesD;GACrBjC,MAAM3B,iBAAiB,GAAGD,kBAAkBkD,aAAazB,OAAO,CAAA;EACpE,CAAA;EAEA,MAAM,EAAEY,IAAI0B,aAAatC;EACzB,MAAM,KAAKX,WAAWkD,OAAOvC,MAAAA;EAC7BA,OAAOY,KAAK0B;EAEZ,OAAOtC;CACX;AACJ"}

package/dist/core/entities/role/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,aAAa,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAIhE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,WAAY,SAAQ,qBAAsB,YAAW,YAAY;IAC1E,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;gBAEvB,GAAG,EAAE,kBAAkB;IAO7B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAY1C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAiBV,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAkFI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;CAuBnB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,aAAa,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAIhE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,WAAY,SAAQ,qBAAsB,YAAW,YAAY;IAC1E,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;gBAEvB,GAAG,EAAE,kBAAkB;IAO7B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAY1C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAiBV,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAoFI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;CAuBnB"}

package/dist/core/entities/role/service.mjs

@@ -59,7 +59,7 @@ var RoleService = class extends AbstractEntityService {
 			else where.name = idOrName;
 			if (realm) where.realmId = realm.id;
 			entity = await this.repository.findOneBy(where);
-			if (!entity && options.updateOnly) throw new EntityNotFoundError();
+			if (!entity && (options.updateOnly || where.id)) throw new EntityNotFoundError();
 		} else if (options.updateOnly) throw new EntityNotFoundError();
 		if (entity) {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });

package/dist/core/entities/role/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","ValidationError","PermissionName","ROLE_ADMIN_NAME","RoleValidator","AbstractEntityService","decodeQuery","roleSchema","RoleService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","ROLE_READ","ROLE_UPDATE","ROLE_DELETE","findMany","schema","getOne","idOrName","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","ROLE_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","REALM_MATCH","merge","checkUniqueness","created","identity","getActorRealmId","resourceRealmMatch","delete","entityId","remove"],"sources":["../../../../src/core/entities/role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    ROLE_ADMIN_NAME,\n    RoleValidator,\n} from '@authup/core-kit';\nimport type { Role } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRoleRepository, IRoleService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { roleSchema } from './schema.ts';\n\nexport type RoleServiceContext = {\n    repository: IRoleRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class RoleService extends AbstractEntityService implements IRoleService {\n    protected repository: IRoleRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: RoleValidator;\n\n    constructor(ctx: RoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new RoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Role>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: roleSchema, actor }));\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n    ): Promise<Role> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Role> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Role> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Role,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Role | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.ROLE_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n                }),\n            });\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.checkUniqueness(validated, entity);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realmId') && actor.identity) {\n            validated.realmId = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Role> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.name === ROLE_ADMIN_NAME) {\n            throw new ValidationError('The default admin role can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA4BA,IAAaa,cAAb,cAAiCH,sBAAAA;CACnBI;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,cAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC6C;EAC7C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;EAClB,EACL,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMhB,YAAYQ,OAAO;GAAES,QAAQhB;GAAYQ;EAAM,CAAA,CAAA;CACzF;CAEA,MAAMS,OACFC,UACAV,OACa;EACb,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;EAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAd,OACa;EACb,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMd,KAAAA;EACpD,OAAOW;CACX;CAEA,MAAMM,OACFP,UACAI,MACAd,OACa;EACb,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKL,UAAUI,MAAMd,OAAO,EAAEkB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFL,UACAI,MACAd,OACAmB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOP,KAAKQ,YAAY,WAClC,MAAM,KAAK3B,gBAAgB4B,QAAQT,KAAKQ,OAAO,IAC/CN,KAAAA;EAEJ,IAAIL;EACJ,IAAID,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAIxC,OAAO0B,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMrB,OAAOO;GAGjB,IAAIW,OACAG,MAAMF,UAAUD,MAAMI;GAG1Bd,SAAS,MAAM,KAAKjB,WAAWgC,UAAUF,KAAAA;GACzC,IAAI,CAACb,UAAUQ,QAAQD,YACnB,MAAM,IAAIjC,oBAAAA;EAElB,OAAO,IAAIkC,QAAQD,YACf,MAAM,IAAIjC,oBAAAA;EAGd,IAAI0B,QAAQ;GACR,MAAMX,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMhB,eAAekB,YAAY,CAAA;GAC/Ee,QAAQtC,eAAe8C;EAC3B,OAAO;GACH,MAAM5B,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMhB,eAAe0C,YAAY,CAAA;GAC/ET,QAAQtC,eAAegD;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKnC,UAAUoC,IAAIlB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK1B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIpB,QAAQ;GACR,MAAMX,MAAMC,oBAAoBiC,SAAS;IACrC/B,MAAMhB,eAAekB;IACrBS,MAAMjC,iBAAiB;MAClBD,kBAAkBuD,aAAa;MAC5B,GAAGxB;MACH,GAAGoB;KACP;MACCnD,kBAAkBwD,cAAcL,UAAUT,WAAWX,OAAOW,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEAX,SAAS,KAAKjB,WAAW2C,MAAM1B,QAAQoB,SAAAA;GACvC,MAAM,KAAKrC,WAAW4C,gBAAgBP,WAAWpB,MAAAA;GACjD,MAAM,KAAKjB,WAAWqB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA4B,SAAS;GACb;EACJ;EAEA,IAAI,CAACxD,cAAcgD,WAAW,SAAA,KAAc/B,MAAMwC,UAC9CT,UAAUT,UAAU,KAAKmB,gBAAgBzC,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMhB,eAAe0C;GACrBf,MAAMjC,iBAAiB;KAAGD,kBAAkBuD,aAAaJ;IAAW,GAAG,KAAKW,mBAAmBX,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,SAAAA;EAEtCpB,SAAS,KAAKjB,WAAWmB,OAAOkB,SAAAA;EAChC,MAAM,KAAKrC,WAAWqB,KAAKJ,MAAAA;EAE3B,OAAO;GACHA;GACA4B,SAAS;EACb;CACJ;CAEA,MAAMI,OACFlB,IACAzB,OACa;EACb,MAAMA,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMhB,eAAemB,YAAY,CAAA;EAE/E,MAAMK,SAAS,MAAM,KAAKjB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAI1B,oBAAAA;EAGd,IAAI0B,OAAOR,SAASf,iBAChB,MAAM,IAAIF,gBAAgB,4CAAA;EAG9B,MAAMc,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMhB,eAAemB;GACrBQ,MAAMjC,iBAAiB;KAAGD,kBAAkBuD,aAAaxB;IAAQ,GAAG,KAAK+B,mBAAmB/B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAImB,aAAajC;EACzB,MAAM,KAAKjB,WAAWmD,OAAOlC,MAAAA;EAC7BA,OAAOc,KAAKmB;EAEZ,OAAOjC;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","ValidationError","PermissionName","ROLE_ADMIN_NAME","RoleValidator","AbstractEntityService","decodeQuery","roleSchema","RoleService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","ROLE_READ","ROLE_UPDATE","ROLE_DELETE","findMany","schema","getOne","idOrName","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","ROLE_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","REALM_MATCH","merge","checkUniqueness","created","identity","getActorRealmId","resourceRealmMatch","delete","entityId","remove"],"sources":["../../../../src/core/entities/role/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    ROLE_ADMIN_NAME,\n    RoleValidator,\n} from '@authup/core-kit';\nimport type { Role } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRoleRepository, IRoleService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { roleSchema } from './schema.ts';\n\nexport type RoleServiceContext = {\n    repository: IRoleRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class RoleService extends AbstractEntityService implements IRoleService {\n    protected repository: IRoleRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: RoleValidator;\n\n    constructor(ctx: RoleServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new RoleValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Role>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: roleSchema, actor }));\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n    ): Promise<Role> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_READ,\n                PermissionName.ROLE_UPDATE,\n                PermissionName.ROLE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Role> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Role> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Role,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Role | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.ROLE_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n                }),\n            });\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.checkUniqueness(validated, entity);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realmId') && actor.identity) {\n            validated.realmId = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Role> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.name === ROLE_ADMIN_NAME) {\n            throw new ValidationError('The default admin role can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA4BA,IAAaa,cAAb,cAAiCH,sBAAAA;CACnBI;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,cAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC6C;EAC7C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;EAClB,EACL,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMhB,YAAYQ,OAAO;GAAES,QAAQhB;GAAYQ;EAAM,CAAA,CAAA;CACzF;CAEA,MAAMS,OACFC,UACAV,OACa;EACb,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;EAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAI1B,oBAAAA;EAGd,OAAO0B;CACX;CAEA,MAAME,OACFC,MACAd,OACa;EACb,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMd,KAAAA;EACpD,OAAOW;CACX;CAEA,MAAMM,OACFP,UACAI,MACAd,OACa;EACb,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKL,UAAUI,MAAMd,OAAO,EAAEkB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFL,UACAI,MACAd,OACAmB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOP,KAAKQ,YAAY,WAClC,MAAM,KAAK3B,gBAAgB4B,QAAQT,KAAKQ,OAAO,IAC/CN,KAAAA;EAEJ,IAAIL;EACJ,IAAID,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAIxC,OAAO0B,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMrB,OAAOO;GAGjB,IAAIW,OACAG,MAAMF,UAAUD,MAAMI;GAG1Bd,SAAS,MAAM,KAAKjB,WAAWgC,UAAUF,KAAAA;GAGzC,IAAI,CAACb,WAAWQ,QAAQD,cAAcM,MAAMC,KACxC,MAAM,IAAIxC,oBAAAA;EAElB,OAAO,IAAIkC,QAAQD,YACf,MAAM,IAAIjC,oBAAAA;EAGd,IAAI0B,QAAQ;GACR,MAAMX,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMhB,eAAekB,YAAY,CAAA;GAC/Ee,QAAQtC,eAAe8C;EAC3B,OAAO;GACH,MAAM5B,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMhB,eAAe0C,YAAY,CAAA;GAC/ET,QAAQtC,eAAegD;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKnC,UAAUoC,IAAIlB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK1B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIpB,QAAQ;GACR,MAAMX,MAAMC,oBAAoBiC,SAAS;IACrC/B,MAAMhB,eAAekB;IACrBS,MAAMjC,iBAAiB;MAClBD,kBAAkBuD,aAAa;MAC5B,GAAGxB;MACH,GAAGoB;KACP;MACCnD,kBAAkBwD,cAAcL,UAAUT,WAAWX,OAAOW,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEAX,SAAS,KAAKjB,WAAW2C,MAAM1B,QAAQoB,SAAAA;GACvC,MAAM,KAAKrC,WAAW4C,gBAAgBP,WAAWpB,MAAAA;GACjD,MAAM,KAAKjB,WAAWqB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA4B,SAAS;GACb;EACJ;EAEA,IAAI,CAACxD,cAAcgD,WAAW,SAAA,KAAc/B,MAAMwC,UAC9CT,UAAUT,UAAU,KAAKmB,gBAAgBzC,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMhB,eAAe0C;GACrBf,MAAMjC,iBAAiB;KAAGD,kBAAkBuD,aAAaJ;IAAW,GAAG,KAAKW,mBAAmBX,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW4C,gBAAgBP,SAAAA;EAEtCpB,SAAS,KAAKjB,WAAWmB,OAAOkB,SAAAA;EAChC,MAAM,KAAKrC,WAAWqB,KAAKJ,MAAAA;EAE3B,OAAO;GACHA;GACA4B,SAAS;EACb;CACJ;CAEA,MAAMI,OACFlB,IACAzB,OACa;EACb,MAAMA,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMhB,eAAemB,YAAY,CAAA;EAE/E,MAAMK,SAAS,MAAM,KAAKjB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAI1B,oBAAAA;EAGd,IAAI0B,OAAOR,SAASf,iBAChB,MAAM,IAAIF,gBAAgB,4CAAA;EAG9B,MAAMc,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMhB,eAAemB;GACrBQ,MAAMjC,iBAAiB;KAAGD,kBAAkBuD,aAAaxB;IAAQ,GAAG,KAAK+B,mBAAmB/B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAImB,aAAajC;EACzB,MAAM,KAAKjB,WAAWmD,OAAOlC,MAAAA;EAC7BA,OAAOc,KAAKmB;EAEZ,OAAOjC;CACX;AACJ"}

package/dist/core/entities/role-permission/service.mjs

@@ -54,15 +54,18 @@ var RolePermissionService = class extends JunctionEntityService {
 			});
 		}
 		if (validated.role) validated.roleRealmId = validated.role.realmId;
-		if (validated.permission && actor.identity) applyJunctionCreateGrant(validated, await this.identityPermissionProvider.resolveJunctionGrant({
-			type: actor.identity.type,
-			id: actor.identity.data.id
-		}, {
-			name: validated.permission.name,
-			realmId: validated.permission.realmId,
-			clientId: validated.permission.clientId,
-			realmScope: validated.realmScope ?? RealmScope.OWN
-		}));
+		if (validated.permission && actor.identity) {
+			const grant = await this.identityPermissionProvider.resolveJunctionGrant({
+				type: actor.identity.type,
+				id: actor.identity.data.id
+			}, {
+				name: validated.permission.name,
+				realmId: validated.permission.realmId,
+				clientId: validated.permission.clientId,
+				realmScope: validated.realmScope ?? RealmScope.OWN
+			});
+			applyJunctionCreateGrant(validated, grant);
+		}
 		await actor.permissionEvaluator.evaluate({
 			name: PermissionName.ROLE_PERMISSION_CREATE,
 			data: definePolicyData({

package/dist/core/entities/role-permission/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","RolePermissionValidator","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","decodeQuery","rolePermissionSchema","RolePermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","ROLE_PERMISSION_DELETE","ROLE_PERMISSION_READ","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","ROLE_PERMISSION_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","roleId","permissionId","permission","permissionRealmId","realmId","clientId","role","roleRealmId","identity","grant","resolveJunctionGrant","type","realmScope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","ROLE_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/role-permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    BuiltInPolicyType,\n    RealmScope,\n    definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport {\n    PermissionName,\n    RolePermissionValidator,\n} from '@authup/core-kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IRolePermissionRepository, IRolePermissionService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { rolePermissionSchema } from './schema.ts';\n\nexport type RolePermissionServiceContext = {\n    repository: IRolePermissionRepository;\n    permissionRepository: IEntityRepository<Permission>;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class RolePermissionService extends JunctionEntityService implements IRolePermissionService {\n    protected readonly ownerRealmKey = 'roleRealmId';\n\n    protected repository: IRolePermissionRepository;\n\n    protected permissionRepository: IEntityRepository<Permission>;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: RolePermissionValidator;\n\n    constructor(ctx: RolePermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.permissionRepository = ctx.permissionRepository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new RolePermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<RolePermission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_PERMISSION_DELETE,\n                PermissionName.ROLE_PERMISSION_READ,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: rolePermissionSchema, actor }));\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_PERMISSION_DELETE,\n                PermissionName.ROLE_PERMISSION_READ,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            roleId: validated.roleId,\n            permissionId: validated.permissionId,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'role-permission' });\n        }\n\n        if (validated.permission) {\n            validated.permissionRealmId = validated.permission.realmId;\n\n            // Q4: the superset gate runs uniformly — no ROLE_ADMIN_NAME bypass.\n            await actor.permissionEvaluator.preEvaluate({\n                name: validated.permission.name,\n                realmId: validated.permission.realmId,\n                clientId: validated.permission.clientId,\n            });\n        }\n\n        if (validated.role) {\n            validated.roleRealmId = validated.role.realmId;\n        }\n\n        if (validated.permission && actor.identity) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    name: validated.permission.name,\n                    realmId: validated.permission.realmId,\n                    clientId: validated.permission.clientId,\n                    realmScope: validated.realmScope ?? RealmScope.OWN,\n                },\n            );\n\n            applyJunctionCreateGrant(validated, grant);\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_PERMISSION_CREATE,\n            // Stamp the owner (role) realm as the canonical `realmId` so the realmScope\n            // factor gates this junction write against the actor's reach (no cross-realm).\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        // Resolve the actor's grant for this junction's permission (the existing entity only\n        // carries scalar FKs — load the permission relation to derive it).\n        const permission = await this.permissionRepository.findOneById(entity.permissionId);\n        if (permission) {\n            // Member-permission gate: an actor may only modify a binding for a permission it\n            // holds (mirrors create()).\n            await actor.permissionEvaluator.preEvaluate({\n                name: permission.name,\n                realmId: permission.realmId,\n                clientId: permission.clientId,\n            });\n        }\n\n        // No actor identity (system context) is not realm-gated here; the operation is still\n        // authorized by the evaluate() below.\n        let actorScope: `${RealmScope}` = RealmScope.ANY;\n        let actorPolicyFree = true;\n        let actorPolicyId: string | null = null;\n        if (actor.identity && permission) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                { type: actor.identity.type, id: actor.identity.data.id },\n                {\n                    name: permission.name,\n                    realmId: permission.realmId,\n                    clientId: permission.clientId,\n                    realmScope: validated.realmScope ?? entity.realmScope,\n                },\n            );\n            actorScope = grant.realmScope;\n            actorPolicyFree = !grant.policy;\n            actorPolicyId = grant.policy ? grant.policy.id : null;\n        } else if (actor.identity) {\n            actorScope = RealmScope.OWN;\n        }\n\n        const updateData = buildJunctionUpdateData({\n            data: validated,\n            existingScope: entity.realmScope,\n            actorScope,\n            actorPolicyFree,\n            actorPolicyId,\n        });\n\n        await this.repository.validateJoinColumns(updateData);\n\n        const merged = this.repository.merge(entity, updateData);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n            }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_PERMISSION_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAiCA,IAAaa,wBAAb,cAA2CH,sBAAAA;CACpBI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIX,wBAAAA;CACzB;CAEA,MAAMa,QACFC,OACAC,OACuD;EACvD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFnB,eAAeoB,wBACfpB,eAAeqB,oBAClB,EACL,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYU,OAAO;GAAEQ,QAAQjB;GAAsBU;EAAM,CAAA,CAAA;CACnG;CAEA,MAAMQ,OACFC,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFnB,eAAeoB,wBACfpB,eAAeqB,oBAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,OAAO4B;CACX;CAEA,MAAME,OACFC,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMnB,eAAe+B,uBAAuB,CAAA;EAE1F,MAAMC,YAAY,MAAM,KAAKpB,UAAUqB,IAAIJ,MAAM,EAAEK,OAAOnC,eAAeoC,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,QAAQN,UAAUM;GAClBC,cAAcP,UAAUO;EAC5B,CAAA,GAEI,MAAM,IAAI1C,oBAAoB,EAAE6B,QAAQ,kBAAkB,CAAA;EAG9D,IAAIM,UAAUQ,YAAY;GACtBR,UAAUS,oBAAoBT,UAAUQ,WAAWE;GAGnD,MAAM1B,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMa,UAAUQ,WAAWrB;IAC3BuB,SAASV,UAAUQ,WAAWE;IAC9BC,UAAUX,UAAUQ,WAAWG;GACnC,CAAA;EACJ;EAEA,IAAIX,UAAUY,MACVZ,UAAUa,cAAcb,UAAUY,KAAKF;EAG3C,IAAIV,UAAUQ,cAAcxB,MAAM8B,UAc9B5C,yBAAyB8B,WAAWe,MAbhB,KAAKpC,2BAA2BqC,qBAChD;GACIC,MAAMjC,MAAM8B,SAASG;GACrBxB,IAAIT,MAAM8B,SAASjB,KAAKJ;EAC5B,GACA;GACIN,MAAMa,UAAUQ,WAAWrB;GAC3BuB,SAASV,UAAUQ,WAAWE;GAC9BC,UAAUX,UAAUQ,WAAWG;GAC/BO,YAAYlB,UAAUkB,cAAcvD,WAAWwD;EACnD,CAAA,CAGgCJ;EAGxC,MAAM/B,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAe+B;GAGrBF,MAAMjC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBtB,SAAAA;KACvDtC,kBAAkB6D,cAAc,KAAKC,sBAAsBxB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAWgD,KAAK/B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMgC,OACFjC,IACAI,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMnB,eAAe2D,uBAAuB,CAAA;EAE1F,MAAMjC,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMkC,YAAY,MAAM,KAAKpB,UAAUqB,IAAIJ,MAAM,EAAEK,OAAOnC,eAAe6D,OAAO,CAAA;EAIhF,MAAMpB,aAAa,MAAM,KAAK9B,qBAAqBmD,YAAYnC,OAAOa,YAAY;EAClF,IAAIC,YAGA,MAAMxB,MAAMC,oBAAoBa,YAAY;GACxCX,MAAMqB,WAAWrB;GACjBuB,SAASF,WAAWE;GACpBC,UAAUH,WAAWG;EACzB,CAAA;EAKJ,IAAImB,aAA8BnE,WAAWoE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAIjD,MAAM8B,YAAYN,YAAY;GAC9B,MAAMO,QAAQ,MAAM,KAAKpC,2BAA2BqC,qBAChD;IAAEC,MAAMjC,MAAM8B,SAASG;IAAMxB,IAAIT,MAAM8B,SAASjB,KAAKJ;GAAG,GACxD;IACIN,MAAMqB,WAAWrB;IACjBuB,SAASF,WAAWE;IACpBC,UAAUH,WAAWG;IACrBO,YAAYlB,UAAUkB,cAAcxB,OAAOwB;GAC/C,CAAA;GAEJY,aAAaf,MAAMG;GACnBc,kBAAkB,CAACjB,MAAMmB;GACzBD,gBAAgBlB,MAAMmB,SAASnB,MAAMmB,OAAOzC,KAAK;EACrD,OAAO,IAAIT,MAAM8B,UACbgB,aAAanE,WAAWwD;EAG5B,MAAMgB,aAAahE,wBAAwB;GACvC0B,MAAMG;GACNoC,eAAe1C,OAAOwB;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAKxD,WAAW2B,oBAAoB+B,UAAAA;EAE1C,MAAME,SAAS,KAAK5D,WAAW6D,MAAM5C,QAAQyC,UAAAA;EAE7C,MAAMnD,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAe2D;GACrB9B,MAAMjC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBe,MAAAA;KACvD3E,kBAAkB6D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK5D,WAAWgD,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACF9C,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMnB,eAAeoB,uBAAuB,CAAA;EAE1F,MAAMM,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAeoB;GACrBS,MAAMjC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmB5B,MAAAA;KACvDhC,kBAAkB6D,cAAc,KAAKC,sBAAsB9B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI+C,aAAa9C;EACzB,MAAM,KAAKjB,WAAWgE,OAAO/C,MAAAA;EAC7BA,OAAOD,KAAK+C;EAEZ,OAAO9C;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","RealmScope","definePolicyData","EntityConflictError","EntityNotFoundError","ValidatorGroup","PermissionName","RolePermissionValidator","applyJunctionCreateGrant","buildJunctionUpdateData","JunctionEntityService","decodeQuery","rolePermissionSchema","RolePermissionService","ownerRealmKey","repository","permissionRepository","identityPermissionProvider","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","ROLE_PERMISSION_DELETE","ROLE_PERMISSION_READ","findMany","schema","getOne","id","entity","findOneBy","create","data","preEvaluate","ROLE_PERMISSION_CREATE","validated","run","group","CREATE","validateJoinColumns","existing","roleId","permissionId","permission","permissionRealmId","realmId","clientId","role","roleRealmId","identity","grant","resolveJunctionGrant","type","realmScope","OWN","evaluate","ATTRIBUTES","junctionAttributes","REALM_MATCH","junctionResourceRealm","save","update","ROLE_PERMISSION_UPDATE","UPDATE","findOneById","actorScope","ANY","actorPolicyFree","actorPolicyId","policy","updateData","existingScope","merged","merge","delete","entityId","remove"],"sources":["../../../../src/core/entities/role-permission/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    BuiltInPolicyType,\n    RealmScope,\n    definePolicyData,\n} from '@authup/access';\nimport { EntityConflictError, EntityNotFoundError } from '@authup/errors';\nimport { ValidatorGroup } from '@authup/kit';\nimport {\n    PermissionName,\n    RolePermissionValidator,\n} from '@authup/core-kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\nimport { applyJunctionCreateGrant, buildJunctionUpdateData } from '../../identity/permission/junction-grant.ts';\nimport type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';\nimport { JunctionEntityService } from '@authup/server-kit';\nimport type { IRolePermissionRepository, IRolePermissionService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { rolePermissionSchema } from './schema.ts';\n\nexport type RolePermissionServiceContext = {\n    repository: IRolePermissionRepository;\n    permissionRepository: IEntityRepository<Permission>;\n    identityPermissionProvider: IIdentityPermissionProvider;\n};\n\nexport class RolePermissionService extends JunctionEntityService implements IRolePermissionService {\n    protected readonly ownerRealmKey = 'roleRealmId';\n\n    protected repository: IRolePermissionRepository;\n\n    protected permissionRepository: IEntityRepository<Permission>;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    protected validator: RolePermissionValidator;\n\n    constructor(ctx: RolePermissionServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.permissionRepository = ctx.permissionRepository;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.validator = new RolePermissionValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<RolePermission>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_PERMISSION_DELETE,\n                PermissionName.ROLE_PERMISSION_READ,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: rolePermissionSchema, actor }));\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.ROLE_PERMISSION_DELETE,\n                PermissionName.ROLE_PERMISSION_READ,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_CREATE });\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.CREATE });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const existing = await this.repository.findOneBy({\n            roleId: validated.roleId,\n            permissionId: validated.permissionId,\n        });\n        if (existing) {\n            throw new EntityConflictError({ entity: 'role-permission' });\n        }\n\n        if (validated.permission) {\n            validated.permissionRealmId = validated.permission.realmId;\n\n            // Q4: the superset gate runs uniformly — no ROLE_ADMIN_NAME bypass.\n            await actor.permissionEvaluator.preEvaluate({\n                name: validated.permission.name,\n                realmId: validated.permission.realmId,\n                clientId: validated.permission.clientId,\n            });\n        }\n\n        if (validated.role) {\n            validated.roleRealmId = validated.role.realmId;\n        }\n\n        if (validated.permission && actor.identity) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                {\n                    type: actor.identity.type,\n                    id: actor.identity.data.id,\n                },\n                {\n                    name: validated.permission.name,\n                    realmId: validated.permission.realmId,\n                    clientId: validated.permission.clientId,\n                    realmScope: validated.realmScope ?? RealmScope.OWN,\n                },\n            );\n\n            applyJunctionCreateGrant(validated, grant);\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_PERMISSION_CREATE,\n            // Stamp the owner (role) realm as the canonical `realmId` so the realmScope\n            // factor gates this junction write against the actor's reach (no cross-realm).\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(validated),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(validated),\n            }),\n        });\n\n        let entity = this.repository.create(validated);\n        entity = await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_UPDATE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const validated = await this.validator.run(data, { group: ValidatorGroup.UPDATE });\n\n        // Resolve the actor's grant for this junction's permission (the existing entity only\n        // carries scalar FKs — load the permission relation to derive it).\n        const permission = await this.permissionRepository.findOneById(entity.permissionId);\n        if (permission) {\n            // Member-permission gate: an actor may only modify a binding for a permission it\n            // holds (mirrors create()).\n            await actor.permissionEvaluator.preEvaluate({\n                name: permission.name,\n                realmId: permission.realmId,\n                clientId: permission.clientId,\n            });\n        }\n\n        // No actor identity (system context) is not realm-gated here; the operation is still\n        // authorized by the evaluate() below.\n        let actorScope: `${RealmScope}` = RealmScope.ANY;\n        let actorPolicyFree = true;\n        let actorPolicyId: string | null = null;\n        if (actor.identity && permission) {\n            const grant = await this.identityPermissionProvider.resolveJunctionGrant(\n                { type: actor.identity.type, id: actor.identity.data.id },\n                {\n                    name: permission.name,\n                    realmId: permission.realmId,\n                    clientId: permission.clientId,\n                    realmScope: validated.realmScope ?? entity.realmScope,\n                },\n            );\n            actorScope = grant.realmScope;\n            actorPolicyFree = !grant.policy;\n            actorPolicyId = grant.policy ? grant.policy.id : null;\n        } else if (actor.identity) {\n            actorScope = RealmScope.OWN;\n        }\n\n        const updateData = buildJunctionUpdateData({\n            data: validated,\n            existingScope: entity.realmScope,\n            actorScope,\n            actorPolicyFree,\n            actorPolicyId,\n        });\n\n        await this.repository.validateJoinColumns(updateData);\n\n        const merged = this.repository.merge(entity, updateData);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_PERMISSION_UPDATE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(merged),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(merged),\n            }),\n        });\n\n        return this.repository.save(merged);\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<RolePermission> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.ROLE_PERMISSION_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.ROLE_PERMISSION_DELETE,\n            data: definePolicyData({\n                [BuiltInPolicyType.ATTRIBUTES]: this.junctionAttributes(entity),\n                [BuiltInPolicyType.REALM_MATCH]: this.junctionResourceRealm(entity),\n            }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAiCA,IAAaa,wBAAb,cAA2CH,sBAAAA;CACpBI,gBAAgB;CAEzBC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,uBAAuBG,IAAIH;EAChC,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,YAAY,IAAIX,wBAAAA;CACzB;CAEA,MAAMa,QACFC,OACAC,OACuD;EACvD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFnB,eAAeoB,wBACfpB,eAAeqB,oBAClB,EACL,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMjB,YAAYU,OAAO;GAAEQ,QAAQjB;GAAsBU;EAAM,CAAA,CAAA;CACnG;CAEA,MAAMQ,OACFC,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFnB,eAAeoB,wBACfpB,eAAeqB,oBAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,OAAO4B;CACX;CAEA,MAAME,OACFC,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMnB,eAAe+B,uBAAuB,CAAA;EAE1F,MAAMC,YAAY,MAAM,KAAKpB,UAAUqB,IAAIJ,MAAM,EAAEK,OAAOnC,eAAeoC,OAAO,CAAA;EAEhF,MAAM,KAAK1B,WAAW2B,oBAAoBJ,SAAAA;EAM1C,IAAIK,MAJmB,KAAK5B,WAAWkB,UAAU;GAC7CW,QAAQN,UAAUM;GAClBC,cAAcP,UAAUO;EAC5B,CAAA,GAEI,MAAM,IAAI1C,oBAAoB,EAAE6B,QAAQ,kBAAkB,CAAA;EAG9D,IAAIM,UAAUQ,YAAY;GACtBR,UAAUS,oBAAoBT,UAAUQ,WAAWE;GAGnD,MAAM1B,MAAMC,oBAAoBa,YAAY;IACxCX,MAAMa,UAAUQ,WAAWrB;IAC3BuB,SAASV,UAAUQ,WAAWE;IAC9BC,UAAUX,UAAUQ,WAAWG;GACnC,CAAA;EACJ;EAEA,IAAIX,UAAUY,MACVZ,UAAUa,cAAcb,UAAUY,KAAKF;EAG3C,IAAIV,UAAUQ,cAAcxB,MAAM8B,UAAU;GACxC,MAAMC,QAAQ,MAAM,KAAKpC,2BAA2BqC,qBAChD;IACIC,MAAMjC,MAAM8B,SAASG;IACrBxB,IAAIT,MAAM8B,SAASjB,KAAKJ;GAC5B,GACA;IACIN,MAAMa,UAAUQ,WAAWrB;IAC3BuB,SAASV,UAAUQ,WAAWE;IAC9BC,UAAUX,UAAUQ,WAAWG;IAC/BO,YAAYlB,UAAUkB,cAAcvD,WAAWwD;GACnD,CAAA;GAGJjD,yBAAyB8B,WAAWe,KAAAA;EACxC;EAEA,MAAM/B,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAe+B;GAGrBF,MAAMjC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBtB,SAAAA;KACvDtC,kBAAkB6D,cAAc,KAAKC,sBAAsBxB,SAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,IAAIN,SAAS,KAAKjB,WAAWmB,OAAOI,SAAAA;EACpCN,SAAS,MAAM,KAAKjB,WAAWgD,KAAK/B,MAAAA;EAEpC,OAAOA;CACX;CAEA,MAAMgC,OACFjC,IACAI,MACAb,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMnB,eAAe2D,uBAAuB,CAAA;EAE1F,MAAMjC,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMkC,YAAY,MAAM,KAAKpB,UAAUqB,IAAIJ,MAAM,EAAEK,OAAOnC,eAAe6D,OAAO,CAAA;EAIhF,MAAMpB,aAAa,MAAM,KAAK9B,qBAAqBmD,YAAYnC,OAAOa,YAAY;EAClF,IAAIC,YAGA,MAAMxB,MAAMC,oBAAoBa,YAAY;GACxCX,MAAMqB,WAAWrB;GACjBuB,SAASF,WAAWE;GACpBC,UAAUH,WAAWG;EACzB,CAAA;EAKJ,IAAImB,aAA8BnE,WAAWoE;EAC7C,IAAIC,kBAAkB;EACtB,IAAIC,gBAA+B;EACnC,IAAIjD,MAAM8B,YAAYN,YAAY;GAC9B,MAAMO,QAAQ,MAAM,KAAKpC,2BAA2BqC,qBAChD;IAAEC,MAAMjC,MAAM8B,SAASG;IAAMxB,IAAIT,MAAM8B,SAASjB,KAAKJ;GAAG,GACxD;IACIN,MAAMqB,WAAWrB;IACjBuB,SAASF,WAAWE;IACpBC,UAAUH,WAAWG;IACrBO,YAAYlB,UAAUkB,cAAcxB,OAAOwB;GAC/C,CAAA;GAEJY,aAAaf,MAAMG;GACnBc,kBAAkB,CAACjB,MAAMmB;GACzBD,gBAAgBlB,MAAMmB,SAASnB,MAAMmB,OAAOzC,KAAK;EACrD,OAAO,IAAIT,MAAM8B,UACbgB,aAAanE,WAAWwD;EAG5B,MAAMgB,aAAahE,wBAAwB;GACvC0B,MAAMG;GACNoC,eAAe1C,OAAOwB;GACtBY;GACAE;GACAC;EACJ,CAAA;EAEA,MAAM,KAAKxD,WAAW2B,oBAAoB+B,UAAAA;EAE1C,MAAME,SAAS,KAAK5D,WAAW6D,MAAM5C,QAAQyC,UAAAA;EAE7C,MAAMnD,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAe2D;GACrB9B,MAAMjC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmBe,MAAAA;KACvD3E,kBAAkB6D,cAAc,KAAKC,sBAAsBa,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,OAAO,KAAK5D,WAAWgD,KAAKY,MAAAA;CAChC;CAEA,MAAME,OACF9C,IACAT,OACuB;EACvB,MAAMA,MAAMC,oBAAoBa,YAAY,EAAEX,MAAMnB,eAAeoB,uBAAuB,CAAA;EAE1F,MAAMM,SAAS,MAAM,KAAKjB,WAAWkB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAI5B,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBmC,SAAS;GACrCjC,MAAMnB,eAAeoB;GACrBS,MAAMjC,iBAAiB;KAClBF,kBAAkB2D,aAAa,KAAKC,mBAAmB5B,MAAAA;KACvDhC,kBAAkB6D,cAAc,KAAKC,sBAAsB9B,MAAAA;GAChE,CAAA;EACJ,CAAA;EAEA,MAAM,EAAED,IAAI+C,aAAa9C;EACzB,MAAM,KAAKjB,WAAWgE,OAAO/C,MAAAA;EAC7BA,OAAOD,KAAK+C;EAEZ,OAAO9C;CACX;AACJ"}

package/dist/core/entities/scope/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/scope/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAEH,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIlE,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC;gBAExB,GAAG,EAAE,mBAAmB;IAO9B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAY3C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAiBX,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAmFI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;CAmBpB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/scope/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAEH,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIlE,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC;gBAExB,GAAG,EAAE,mBAAmB;IAO9B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAY3C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAiBX,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAqFI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;CAmBpB"}

package/dist/core/entities/scope/service.mjs

@@ -59,7 +59,7 @@ var ScopeService = class extends AbstractEntityService {
 			else where.name = idOrName;
 			if (realm) where.realmId = realm.id;
 			entity = await this.repository.findOneBy(where);
-			if (!entity && options.updateOnly) throw new EntityNotFoundError();
+			if (!entity && (options.updateOnly || where.id)) throw new EntityNotFoundError();
 		} else if (options.updateOnly) throw new EntityNotFoundError();
 		if (entity) {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_UPDATE });