@authup/server-core 1.0.0-beta.57 → 1.0.0-beta.59

package/dist/core/entities/scope/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","PermissionName","ScopeValidator","AbstractEntityService","decodeQuery","scopeSchema","ScopeService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","SCOPE_READ","SCOPE_UPDATE","SCOPE_DELETE","findMany","schema","getOne","idOrName","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","SCOPE_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","merge","created","identity","getActorRealmId","resourceRealmMatch","delete","entityId","remove"],"sources":["../../../../src/core/entities/scope/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    ScopeValidator,\n} from '@authup/core-kit';\nimport type { Scope } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IScopeRepository, IScopeService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { scopeSchema } from './schema.ts';\n\nexport type ScopeServiceContext = {\n    repository: IScopeRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ScopeService extends AbstractEntityService implements IScopeService {\n    protected repository: IScopeRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ScopeValidator;\n\n    constructor(ctx: ScopeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ScopeValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Scope>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.SCOPE_READ,\n                PermissionName.SCOPE_UPDATE,\n                PermissionName.SCOPE_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: scopeSchema, actor }));\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.SCOPE_READ,\n                PermissionName.SCOPE_UPDATE,\n                PermissionName.SCOPE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Scope,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Scope | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SCOPE_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realmId') && actor.identity) {\n            validated.realmId = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.SCOPE_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.SCOPE_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA2BA,IAAaW,eAAb,cAAkCH,sBAAAA;CACpBI;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,eAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC8C;EAC9C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;EAClB,EACL,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMhB,YAAYQ,OAAO;GAAES,QAAQhB;GAAaQ;EAAM,CAAA,CAAA;CAC1F;CAEA,MAAMS,OACFC,UACAV,OACc;EACd,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;EAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIxB,oBAAAA;EAGd,OAAOwB;CACX;CAEA,MAAME,OACFC,MACAd,OACc;EACd,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMd,KAAAA;EACpD,OAAOW;CACX;CAEA,MAAMM,OACFP,UACAI,MACAd,OACc;EACd,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKL,UAAUI,MAAMd,OAAO,EAAEkB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFL,UACAI,MACAd,OACAmB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOP,KAAKQ,YAAY,WAClC,MAAM,KAAK3B,gBAAgB4B,QAAQT,KAAKQ,OAAO,IAC/CN,KAAAA;EAEJ,IAAIL;EACJ,IAAID,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAItC,OAAOwB,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMrB,OAAOO;GAGjB,IAAIW,OACAG,MAAMF,UAAUD,MAAMI;GAG1Bd,SAAS,MAAM,KAAKjB,WAAWgC,UAAUF,KAAAA;GACzC,IAAI,CAACb,UAAUQ,QAAQD,YACnB,MAAM,IAAI/B,oBAAAA;EAElB,OAAO,IAAIgC,QAAQD,YACf,MAAM,IAAI/B,oBAAAA;EAGd,IAAIwB,QAAQ;GACR,MAAMX,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMf,eAAeiB,aAAa,CAAA;GAChFe,QAAQpC,eAAe4C;EAC3B,OAAO;GACH,MAAM5B,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMf,eAAeyC,aAAa,CAAA;GAChFT,QAAQpC,eAAe8C;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKnC,UAAUoC,IAAIlB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK1B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIpB,QAAQ;GACR,MAAMX,MAAMC,oBAAoBiC,SAAS;IACrC/B,MAAMf,eAAeiB;IACrBS,MAAM/B,iBAAiB;MAClBD,kBAAkBqD,aAAa;MAC5B,GAAGxB;MACH,GAAGoB;KACP;MACCjD,kBAAkBsD,cAAcL,UAAUT,WAAWX,OAAOW,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK5B,WAAW2C,gBAAgBN,WAAWpB,MAAAA;GAEjDA,SAAS,KAAKjB,WAAW4C,MAAM3B,QAAQoB,SAAAA;GACvC,MAAM,KAAKrC,WAAWqB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA4B,SAAS;GACb;EACJ;EAEA,IAAI,CAACtD,cAAc8C,WAAW,SAAA,KAAc/B,MAAMwC,UAC9CT,UAAUT,UAAU,KAAKmB,gBAAgBzC,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMf,eAAeyC;GACrBf,MAAM/B,iBAAiB;KAAGD,kBAAkBqD,aAAaJ;IAAW,GAAG,KAAKW,mBAAmBX,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW2C,gBAAgBN,SAAAA;EAEtCpB,SAAS,KAAKjB,WAAWmB,OAAOkB,SAAAA;EAChC,MAAM,KAAKrC,WAAWqB,KAAKJ,MAAAA;EAE3B,OAAO;GACHA;GACA4B,SAAS;EACb;CACJ;CAEA,MAAMI,OACFlB,IACAzB,OACc;EACd,MAAMA,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMf,eAAekB,aAAa,CAAA;EAEhF,MAAMK,SAAS,MAAM,KAAKjB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAIxB,oBAAAA;EAGd,MAAMa,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMf,eAAekB;GACrBQ,MAAM/B,iBAAiB;KAAGD,kBAAkBqD,aAAaxB;IAAQ,GAAG,KAAK+B,mBAAmB/B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAImB,aAAajC;EACzB,MAAM,KAAKjB,WAAWmD,OAAOlC,MAAAA;EAC7BA,OAAOc,KAAKmB;EAEZ,OAAOjC;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","PermissionName","ScopeValidator","AbstractEntityService","decodeQuery","scopeSchema","ScopeService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","SCOPE_READ","SCOPE_UPDATE","SCOPE_DELETE","findMany","schema","getOne","idOrName","entity","findOneByIdOrName","create","data","save","undefined","update","updateOnly","options","group","realm","realmId","resolve","where","id","findOneBy","preEvaluate","UPDATE","SCOPE_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","REALM_MATCH","checkUniqueness","merge","created","identity","getActorRealmId","resourceRealmMatch","delete","entityId","remove"],"sources":["../../../../src/core/entities/scope/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport {\n    PermissionName,\n    ScopeValidator,\n} from '@authup/core-kit';\nimport type { Scope } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IScopeRepository, IScopeService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { scopeSchema } from './schema.ts';\n\nexport type ScopeServiceContext = {\n    repository: IScopeRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ScopeService extends AbstractEntityService implements IScopeService {\n    protected repository: IScopeRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ScopeValidator;\n\n    constructor(ctx: ScopeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ScopeValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Scope>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.SCOPE_READ,\n                PermissionName.SCOPE_UPDATE,\n                PermissionName.SCOPE_DELETE,\n            ],\n        });\n\n        return this.repository.findMany(await decodeQuery(query, { schema: scopeSchema, actor }));\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.SCOPE_READ,\n                PermissionName.SCOPE_UPDATE,\n                PermissionName.SCOPE_DELETE,\n            ],\n        });\n\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Scope,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Scope | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.SCOPE_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                    [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n                }),\n            });\n\n            await this.repository.checkUniqueness(validated, entity);\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!isPropertySet(validated, 'realmId') && actor.identity) {\n            validated.realmId = this.getActorRealmId(actor) || null;\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.SCOPE_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        await this.repository.checkUniqueness(validated);\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Scope> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.SCOPE_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.SCOPE_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA2BA,IAAaW,eAAb,cAAkCH,sBAAAA;CACpBI;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIP,eAAAA;CACzB;CAEA,MAAMS,QACFC,OACAC,OAC8C;EAC9C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;EAClB,EACL,CAAA;EAEA,OAAO,KAAKZ,WAAWa,SAAS,MAAMhB,YAAYQ,OAAO;GAAES,QAAQhB;GAAaQ;EAAM,CAAA,CAAA;CAC1F;CAEA,MAAMS,OACFC,UACAV,OACc;EACd,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM;GACFf,eAAegB;GACfhB,eAAeiB;GACfjB,eAAekB;EAClB,EACL,CAAA;EAEA,MAAMK,SAAS,MAAM,KAAKjB,WAAWkB,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIxB,oBAAAA;EAGd,OAAOwB;CACX;CAEA,MAAME,OACFC,MACAd,OACc;EACd,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKC,KAAAA,GAAWF,MAAMd,KAAAA;EACpD,OAAOW;CACX;CAEA,MAAMM,OACFP,UACAI,MACAd,OACc;EACd,MAAM,EAAEW,WAAW,MAAM,KAAKI,KAAKL,UAAUI,MAAMd,OAAO,EAAEkB,YAAY,KAAK,CAAA;EAC7E,OAAOP;CACX;CAEA,MAAMI,KACFL,UACAI,MACAd,OACAmB,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOP,KAAKQ,YAAY,WAClC,MAAM,KAAK3B,gBAAgB4B,QAAQT,KAAKQ,OAAO,IAC/CN,KAAAA;EAEJ,IAAIL;EACJ,IAAID,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAItC,OAAOwB,QAAAA,GACPc,MAAMC,KAAKf;QAEXc,MAAMrB,OAAOO;GAGjB,IAAIW,OACAG,MAAMF,UAAUD,MAAMI;GAG1Bd,SAAS,MAAM,KAAKjB,WAAWgC,UAAUF,KAAAA;GAGzC,IAAI,CAACb,WAAWQ,QAAQD,cAAcM,MAAMC,KACxC,MAAM,IAAItC,oBAAAA;EAElB,OAAO,IAAIgC,QAAQD,YACf,MAAM,IAAI/B,oBAAAA;EAGd,IAAIwB,QAAQ;GACR,MAAMX,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMf,eAAeiB,aAAa,CAAA;GAChFe,QAAQpC,eAAe4C;EAC3B,OAAO;GACH,MAAM5B,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMf,eAAeyC,aAAa,CAAA;GAChFT,QAAQpC,eAAe8C;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKnC,UAAUoC,IAAIlB,MAAM,EAAEM,MAAM,CAAA;EAEzD,MAAM,KAAK1B,WAAWuC,oBAAoBF,SAAAA;EAE1C,IAAIpB,QAAQ;GACR,MAAMX,MAAMC,oBAAoBiC,SAAS;IACrC/B,MAAMf,eAAeiB;IACrBS,MAAM/B,iBAAiB;MAClBD,kBAAkBqD,aAAa;MAC5B,GAAGxB;MACH,GAAGoB;KACP;MACCjD,kBAAkBsD,cAAcL,UAAUT,WAAWX,OAAOW,WAAW;IAC5E,CAAA;GACJ,CAAA;GAEA,MAAM,KAAK5B,WAAW2C,gBAAgBN,WAAWpB,MAAAA;GAEjDA,SAAS,KAAKjB,WAAW4C,MAAM3B,QAAQoB,SAAAA;GACvC,MAAM,KAAKrC,WAAWqB,KAAKJ,MAAAA;GAE3B,OAAO;IACHA;IACA4B,SAAS;GACb;EACJ;EAEA,IAAI,CAACtD,cAAc8C,WAAW,SAAA,KAAc/B,MAAMwC,UAC9CT,UAAUT,UAAU,KAAKmB,gBAAgBzC,KAAAA,KAAU;EAGvD,MAAMA,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMf,eAAeyC;GACrBf,MAAM/B,iBAAiB;KAAGD,kBAAkBqD,aAAaJ;IAAW,GAAG,KAAKW,mBAAmBX,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA,MAAM,KAAKrC,WAAW2C,gBAAgBN,SAAAA;EAEtCpB,SAAS,KAAKjB,WAAWmB,OAAOkB,SAAAA;EAChC,MAAM,KAAKrC,WAAWqB,KAAKJ,MAAAA;EAE3B,OAAO;GACHA;GACA4B,SAAS;EACb;CACJ;CAEA,MAAMI,OACFlB,IACAzB,OACc;EACd,MAAMA,MAAMC,oBAAoB0B,YAAY,EAAExB,MAAMf,eAAekB,aAAa,CAAA;EAEhF,MAAMK,SAAS,MAAM,KAAKjB,WAAWgC,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACd,QACD,MAAM,IAAIxB,oBAAAA;EAGd,MAAMa,MAAMC,oBAAoBiC,SAAS;GACrC/B,MAAMf,eAAekB;GACrBQ,MAAM/B,iBAAiB;KAAGD,kBAAkBqD,aAAaxB;IAAQ,GAAG,KAAK+B,mBAAmB/B,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEc,IAAImB,aAAajC;EACzB,MAAM,KAAKjB,WAAWmD,OAAOlC,MAAAA;EAC7BA,OAAOc,KAAKmB;EAEZ,OAAOjC;CACX;AACJ"}

package/dist/core/entities/user/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/service.ts"],"names":[],"mappings":"AAWA,OAAO,EAEH,aAAa,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAIhE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,qBAAa,WAAY,SAAQ,qBAAsB,YAAW,YAAY;IAC1E,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;gBAEvB,GAAG,EAAE,kBAAkB;IAO7B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;IA8E1C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IA8CV,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAsII,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;CA2BnB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/service.ts"],"names":[],"mappings":"AAWA,OAAO,EAEH,aAAa,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAIhE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,gBAAgB,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,qBAAa,WAAY,SAAQ,qBAAsB,YAAW,YAAY;IAC1E,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC;IAEtC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;gBAEvB,GAAG,EAAE,kBAAkB;IAO7B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;IA8E1C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IA8CV,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;IAKV,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,IAAI,CAAC;QACb,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAwII,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC;CA2BnB"}

package/dist/core/entities/user/service.mjs

@@ -119,7 +119,7 @@ var UserService = class extends AbstractEntityService {
 			else where.name = idOrName;
 			if (realm) where.realmId = realm.id;
 			entity = await this.repository.findOneBy(where);
-			if (!entity && options.updateOnly) throw new EntityNotFoundError();
+			if (!entity && (options.updateOnly || where.id)) throw new EntityNotFoundError();
 		} else if (options.updateOnly) throw new EntityNotFoundError();
 		let isSelfEdit = false;
 		if (entity) {

package/dist/core/entities/user/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","eq","inArray","or","PermissionName","UserValidator","AbstractEntityService","UserCredentialsService","appendQueryConditions","decodeQuery","userSchema","UserService","repository","realmRepository","validator","ctx","passwordMinLength","getMany","query","actor","permissionNames","USER_READ","USER_UPDATE","USER_DELETE","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","compiled","compile","verdict","self","identity","type","data","id","scoped","condition","findMany","entities","meta","total","entity","push","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","getOne","idOrName","realmId","isMe","findOne","parameters","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneBy","isSelfEdit","preEvaluate","e","USER_SELF_MANAGE","UPDATE","USER_CREATE","CREATE","validated","run","validateJoinColumns","credentialsService","originalName","originalNameLocked","nameLocked","evaluate","merge","REALM_MATCH","password","protect","created","actorRealmId","getActorRealmId","delete","entityId","remove"],"sources":["../../../../src/core/entities/user/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { eq, inArray, or } from '@rapiq/core';\nimport {\n    PermissionName,\n    UserValidator,\n} from '@authup/core-kit';\nimport type { User } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type { IUserRepository, IUserService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { userSchema } from './schema.ts';\n\nexport type UserServiceContext = {\n    repository: IUserRepository;\n    realmRepository: IRealmRepository;\n    passwordMinLength?: number;\n};\n\nexport class UserService extends AbstractEntityService implements IUserService {\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: UserValidator;\n\n    constructor(ctx: UserServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new UserValidator({ passwordMinLength: ctx.passwordMinLength });\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<User>> {\n        const permissionNames = [\n            PermissionName.USER_READ,\n            PermissionName.USER_UPDATE,\n            PermissionName.USER_DELETE,\n        ];\n\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n\n        const parsed = await decodeQuery(query, { schema: userSchema, actor });\n\n        // Compile the read permissions into a row condition (#3286 phase 3). The\n        // own row is always readable, so the self short-circuit composes as an\n        // OR-alternative — the whole gate runs as WHERE and pagination/totals\n        // stay exact. A non-expressible policy falls back to the per-row loop\n        // below.\n        const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });\n        if (compiled.verdict !== 'post') {\n            const self = actor.identity && actor.identity.type === 'user' ?\n                eq('id', actor.identity.data.id) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, self ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    self ? or(self, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped);\n        }\n\n        const {\n            data: entities,\n            meta,\n        } = await this.repository.findMany(parsed);\n\n        const data: User[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (\n                actor.identity &&\n                actor.identity.type === 'user' &&\n                actor.identity.data.id === entity.id\n            ) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: [\n                        PermissionName.USER_READ,\n                        PermissionName.USER_UPDATE,\n                        PermissionName.USER_DELETE,\n                    ],\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<User> {\n        const permissionNames = [\n            PermissionName.USER_READ,\n            PermissionName.USER_UPDATE,\n            PermissionName.USER_DELETE,\n        ];\n\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        const entity = await this.repository.findOne(\n            idOrName,\n            await decodeQuery(query, {\n                schema: userSchema, \n                parameters: ['fields', 'relations'], \n                actor, \n            }),\n            realmId,\n        );\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        if (!isMe) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: permissionNames,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: User,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: User | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            if (!entity && options.updateOnly) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'user' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n            }\n\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_CREATE });\n\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const credentialsService = new UserCredentialsService();\n\n        if (entity) {\n            const originalName = entity.name;\n            const originalNameLocked = entity.nameLocked;\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (\n                validated.name &&\n                validated.name !== originalName\n            ) {\n                if (validated.nameLocked) {\n                    entity.nameLocked = validated.nameLocked;\n                }\n\n                if (originalNameLocked && validated.nameLocked !== false) {\n                    entity.name = originalName;\n                }\n            }\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_UPDATE,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: {\n                            ...entity,\n                            ...validated,\n                        },\n                        [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n                    }),\n                });\n            }\n\n            if (validated.password) {\n                entity.password = await credentialsService.protect(validated.password);\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realmId) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        entity = this.repository.create(validated);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        if (validated.password) {\n            entity.password = await credentialsService.protect(validated.password);\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<User> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });\n\n        if (\n            actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === id\n        ) {\n            throw new ValidationError('The own user can not be deleted.');\n        }\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA8BA,IAAagB,cAAb,cAAiCL,sBAAAA;CACnBM;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIT,cAAc,EAAEW,mBAAmBD,IAAIC,kBAAkB,CAAA;CAClF;CAEA,MAAMC,QACFC,OACAC,OAC6C;EAC7C,MAAMC,kBAAkB;GACpBhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;EAClB;EAED,MAAMJ,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAEzE,MAAMO,SAAS,MAAMlB,YAAYS,OAAO;GAAEU,QAAQlB;GAAYS;EAAM,CAAA;EAOpE,MAAMU,WAAW,MAAMV,MAAMK,oBAAoBM,QAAQ,EAAEJ,MAAMN,gBAAgB,CAAA;EACjF,IAAIS,SAASE,YAAY,QAAQ;GAC7B,MAAMC,OAAOb,MAAMc,YAAYd,MAAMc,SAASC,SAAS,SACnDjC,GAAG,MAAMkB,MAAMc,SAASE,KAAKC,EAAE,IAC/B;GAEJ,IAAIC,SAASV;GACb,IAAIE,SAASE,YAAY,QACrBM,SAAS7B,sBAAsBmB,QAAQK,QAAQ9B,QAAQ,MAAM,CAAA,CAAE,CAAA;QAC5D,IAAI2B,SAASE,YAAY,eAC5BM,SAAS7B,sBACLmB,QACAK,OAAO7B,GAAG6B,MAAMH,SAASS,SAAS,IAAIT,SAASS,SAAS;GAIhE,OAAO,KAAK1B,WAAW2B,SAASF,MAAAA;EACpC;EAEA,MAAM,EACFF,MAAMK,UACNC,SACA,MAAM,KAAK7B,WAAW2B,SAASZ,MAAAA;EAEnC,MAAMQ,OAAe,CAAA;EACrB,IAAI,EAAEO,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IACIrB,MAAMc,YACNd,MAAMc,SAASC,SAAS,UACxBf,MAAMc,SAASE,KAAKC,OAAOO,OAAOP,IACpC;IACED,KAAKS,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMxB,MAAMK,oBAAoBqB,cAAc;KAC1CnB,MAAM;MACFtB,eAAeiB;MACfjB,eAAekB;MACflB,eAAemB;KAClB;KACDY,MAAMvC,iBAAiB;OAAGD,kBAAkBmD,aAAaH;MAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;KAAQ,CAAA;IACxG,CAAA;IAEAR,KAAKS,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHP;GACAM,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,UACA9B,OACAD,OACAgC,SACa;EACb,MAAM9B,kBAAkB;GACpBhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;EAClB;EAED,IAAI4B,OAAO,CAAC,CAAChC,MAAMc,YACfd,MAAMc,SAASC,SAAS,WAEpBf,MAAMc,SAASE,KAAKC,OAAOa,YAC3B9B,MAAMc,SAASE,KAAKT,SAASuB;EAGrC,IAAI,CAACE,MACD,MAAMhC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAG7E,MAAMuB,SAAS,MAAM,KAAK/B,WAAWwC,QACjCH,UACA,MAAMxC,YAAYS,OAAO;GACrBU,QAAQlB;GACR2C,YAAY,CAAC,UAAU,WAAY;GACnClC;EACJ,CAAA,GACA+B,OAAAA;EAEJ,IAAI,CAACP,QACD,MAAM,IAAI5C,oBAAAA;EAGd,IAAIoD,QAAQhC,MAAMc,SAAUE,KAAKC,OAAOO,OAAOP,IAAI;GAC/Ce,OAAO;GACP,MAAMhC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAC7E;EAEA,IAAI,CAAC+B,MACD,MAAMhC,MAAMK,oBAAoBqB,cAAc;GAC1CnB,MAAMN;GACNe,MAAMvC,iBAAiB;KAAGD,kBAAkBmD,aAAaH;IAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMW,OACFnB,MACAhB,OACa;EACb,MAAM,EAAEwB,WAAW,MAAM,KAAKY,KAAKC,KAAAA,GAAWrB,MAAMhB,KAAAA;EACpD,OAAOwB;CACX;CAEA,MAAMc,OACFR,UACAd,MACAhB,OACa;EACb,MAAM,EAAEwB,WAAW,MAAM,KAAKY,KAAKN,UAAUd,MAAMhB,OAAO,EAAEuC,YAAY,KAAK,CAAA;EAC7E,OAAOf;CACX;CAEA,MAAMY,KACFN,UACAd,MACAhB,OACAwC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO1B,KAAKe,YAAY,WAClC,MAAM,KAAKrC,gBAAgBiD,QAAQ3B,KAAKe,OAAO,IAC/CM,KAAAA;EAEJ,IAAIb;EACJ,IAAIM,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAIjE,OAAOmD,QAAAA,GACPc,MAAM3B,KAAKa;QAEXc,MAAMrC,OAAOuB;GAGjB,IAAIY,OACAE,MAAMb,UAAUW,MAAMzB;GAG1BO,SAAS,MAAM,KAAK/B,WAAWoD,UAAUD,KAAAA;GACzC,IAAI,CAACpB,UAAUgB,QAAQD,YACnB,MAAM,IAAI3D,oBAAAA;EAElB,OAAO,IAAI4D,QAAQD,YACf,MAAM,IAAI3D,oBAAAA;EAGd,IAAIkE,aAAa;EACjB,IAAItB,QAAQ;GACR,IAAI;IACA,MAAMxB,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAekB,YAAY,CAAA;GACnF,SAAS6C,GAAG;IACR,IACI,CAAChD,MAAMc,YACPd,MAAMc,SAASC,SAAS,UACxBf,MAAMc,SAASE,KAAKC,OAAOO,OAAOP,IAElC,MAAM+B;IAEVF,aAAa;IACb,MAAM9C,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAegE,iBAAiB,CAAA;GACxF;GAEAR,QAAQ/D,eAAewE;EAC3B,OAAO;GACH,MAAMlD,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAekE,YAAY,CAAA;GAE/EV,QAAQ/D,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK1D,UAAU2D,IAAItC,MAAM,EAAEyB,MAAM,CAAA;EAEzD,MAAM,KAAKhD,WAAW8D,oBAAoBF,SAAAA;EAE1C,MAAMG,qBAAqB,IAAIpE,uBAAAA;EAE/B,IAAIoC,QAAQ;GACR,MAAMiC,eAAejC,OAAOjB;GAC5B,MAAMmD,qBAAqBlC,OAAOmC;GAElC,IAAIb,YACA,MAAM9C,MAAMK,oBAAoBuD,SAAS;IACrCrD,MAAMtB,eAAegE;IACrBjC,MAAMvC,iBAAiB;MAAGD,kBAAkBmD,aAAa0B;KAAW,GAAG,KAAKzB,mBAAmByB,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJ7B,SAAS,KAAK/B,WAAWoE,MAAMrC,QAAQ6B,SAAAA;GAEvC,IACIA,UAAU9C,QACV8C,UAAU9C,SAASkD,cACrB;IACE,IAAIJ,UAAUM,YACVnC,OAAOmC,aAAaN,UAAUM;IAGlC,IAAID,sBAAsBL,UAAUM,eAAe,OAC/CnC,OAAOjB,OAAOkD;GAEtB;GAEA,IAAI,CAACX,YACD,MAAM9C,MAAMK,oBAAoBuD,SAAS;IACrCrD,MAAMtB,eAAekB;IACrBa,MAAMvC,iBAAiB;MAClBD,kBAAkBmD,aAAa;MAC5B,GAAGH;MACH,GAAG6B;KACP;MACC7E,kBAAkBsF,cAAcT,UAAUtB,WAAWP,OAAOO,WAAW;IAC5E,CAAA;GACJ,CAAA;GAGJ,IAAIsB,UAAUU,UACVvC,OAAOuC,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;GAGzE,MAAM,KAAKtE,WAAW2C,KAAKZ,MAAAA;GAE3B,OAAO;IACHA;IACAyC,SAAS;GACb;EACJ;EAEA,IAAI,CAACZ,UAAUtB,SAAS;GACpB,MAAMmC,eAAe,KAAKC,gBAAgBnE,KAAAA;GAC1C,IAAIkE,cACAb,UAAUtB,UAAUmC;EAE5B;EAEA1C,SAAS,KAAK/B,WAAW0C,OAAOkB,SAAAA;EAEhC,MAAMrD,MAAMK,oBAAoBuD,SAAS;GACrCrD,MAAMtB,eAAekE;GACrBnC,MAAMvC,iBAAiB;KAAGD,kBAAkBmD,aAAaH;IAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,IAAI6B,UAAUU,UACVvC,OAAOuC,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;EAGzE,MAAM,KAAKtE,WAAW2C,KAAKZ,MAAAA;EAE3B,OAAO;GACHA;GACAyC,SAAS;EACb;CACJ;CAEA,MAAMG,OACFnD,IACAjB,OACa;EACb,MAAMA,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAemB,YAAY,CAAA;EAE/E,IACIJ,MAAMc,YACNd,MAAMc,SAASC,SAAS,UACxBf,MAAMc,SAASE,KAAKC,OAAOA,IAE3B,MAAM,IAAIpC,gBAAgB,kCAAA;EAG9B,MAAM2C,SAAS,MAAM,KAAK/B,WAAWoD,UAAU,EAAE5B,GAAG,CAAA;EACpD,IAAI,CAACO,QACD,MAAM,IAAI5C,oBAAAA;EAGd,MAAMoB,MAAMK,oBAAoBuD,SAAS;GACrCrD,MAAMtB,eAAemB;GACrBY,MAAMvC,iBAAiB;KAAGD,kBAAkBmD,aAAaH;IAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEP,IAAIoD,aAAa7C;EACzB,MAAM,KAAK/B,WAAW6E,OAAO9C,MAAAA;EAC7BA,OAAOP,KAAKoD;EAEZ,OAAO7C;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","eq","inArray","or","PermissionName","UserValidator","AbstractEntityService","UserCredentialsService","appendQueryConditions","decodeQuery","userSchema","UserService","repository","realmRepository","validator","ctx","passwordMinLength","getMany","query","actor","permissionNames","USER_READ","USER_UPDATE","USER_DELETE","permissionEvaluator","preEvaluateOneOf","name","parsed","schema","compiled","compile","verdict","self","identity","type","data","id","scoped","condition","findMany","entities","meta","total","entity","push","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","getOne","idOrName","realmId","isMe","findOne","parameters","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneBy","isSelfEdit","preEvaluate","e","USER_SELF_MANAGE","UPDATE","USER_CREATE","CREATE","validated","run","validateJoinColumns","credentialsService","originalName","originalNameLocked","nameLocked","evaluate","merge","REALM_MATCH","password","protect","created","actorRealmId","getActorRealmId","delete","entityId","remove"],"sources":["../../../../src/core/entities/user/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { eq, inArray, or } from '@rapiq/core';\nimport {\n    PermissionName,\n    UserValidator,\n} from '@authup/core-kit';\nimport type { User } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type { IUserRepository, IUserService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { userSchema } from './schema.ts';\n\nexport type UserServiceContext = {\n    repository: IUserRepository;\n    realmRepository: IRealmRepository;\n    passwordMinLength?: number;\n};\n\nexport class UserService extends AbstractEntityService implements IUserService {\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: UserValidator;\n\n    constructor(ctx: UserServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new UserValidator({ passwordMinLength: ctx.passwordMinLength });\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<User>> {\n        const permissionNames = [\n            PermissionName.USER_READ,\n            PermissionName.USER_UPDATE,\n            PermissionName.USER_DELETE,\n        ];\n\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n\n        const parsed = await decodeQuery(query, { schema: userSchema, actor });\n\n        // Compile the read permissions into a row condition (#3286 phase 3). The\n        // own row is always readable, so the self short-circuit composes as an\n        // OR-alternative — the whole gate runs as WHERE and pagination/totals\n        // stay exact. A non-expressible policy falls back to the per-row loop\n        // below.\n        const compiled = await actor.permissionEvaluator.compile({ name: permissionNames });\n        if (compiled.verdict !== 'post') {\n            const self = actor.identity && actor.identity.type === 'user' ?\n                eq('id', actor.identity.data.id) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, self ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    self ? or(self, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped);\n        }\n\n        const {\n            data: entities,\n            meta,\n        } = await this.repository.findMany(parsed);\n\n        const data: User[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (\n                actor.identity &&\n                actor.identity.type === 'user' &&\n                actor.identity.data.id === entity.id\n            ) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluateOneOf({\n                    name: [\n                        PermissionName.USER_READ,\n                        PermissionName.USER_UPDATE,\n                        PermissionName.USER_DELETE,\n                    ],\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total, \n            }, \n        };\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<User> {\n        const permissionNames = [\n            PermissionName.USER_READ,\n            PermissionName.USER_UPDATE,\n            PermissionName.USER_DELETE,\n        ];\n\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        const entity = await this.repository.findOne(\n            idOrName,\n            await decodeQuery(query, {\n                schema: userSchema, \n                parameters: ['fields', 'relations'], \n                actor, \n            }),\n            realmId,\n        );\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: permissionNames });\n        }\n\n        if (!isMe) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: permissionNames,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<User> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: User,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: User | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'user' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n            }\n\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_CREATE });\n\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        const credentialsService = new UserCredentialsService();\n\n        if (entity) {\n            const originalName = entity.name;\n            const originalNameLocked = entity.nameLocked;\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (\n                validated.name &&\n                validated.name !== originalName\n            ) {\n                if (validated.nameLocked) {\n                    entity.nameLocked = validated.nameLocked;\n                }\n\n                if (originalNameLocked && validated.nameLocked !== false) {\n                    entity.name = originalName;\n                }\n            }\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.USER_UPDATE,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: {\n                            ...entity,\n                            ...validated,\n                        },\n                        [BuiltInPolicyType.REALM_MATCH]: validated.realmId ?? entity.realmId ?? null,\n                    }),\n                });\n            }\n\n            if (validated.password) {\n                entity.password = await credentialsService.protect(validated.password);\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realmId) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        entity = this.repository.create(validated);\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        if (validated.password) {\n            entity.password = await credentialsService.protect(validated.password);\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<User> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_DELETE });\n\n        if (\n            actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === id\n        ) {\n            throw new ValidationError('The own user can not be deleted.');\n        }\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.USER_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA8BA,IAAagB,cAAb,cAAiCL,sBAAAA;CACnBM;CAEAC;CAEAC;CAEV,YAAYC,KAAyB;EACjC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIT,cAAc,EAAEW,mBAAmBD,IAAIC,kBAAkB,CAAA;CAClF;CAEA,MAAMC,QACFC,OACAC,OAC6C;EAC7C,MAAMC,kBAAkB;GACpBhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;EAClB;EAED,MAAMJ,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAEzE,MAAMO,SAAS,MAAMlB,YAAYS,OAAO;GAAEU,QAAQlB;GAAYS;EAAM,CAAA;EAOpE,MAAMU,WAAW,MAAMV,MAAMK,oBAAoBM,QAAQ,EAAEJ,MAAMN,gBAAgB,CAAA;EACjF,IAAIS,SAASE,YAAY,QAAQ;GAC7B,MAAMC,OAAOb,MAAMc,YAAYd,MAAMc,SAASC,SAAS,SACnDjC,GAAG,MAAMkB,MAAMc,SAASE,KAAKC,EAAE,IAC/B;GAEJ,IAAIC,SAASV;GACb,IAAIE,SAASE,YAAY,QACrBM,SAAS7B,sBAAsBmB,QAAQK,QAAQ9B,QAAQ,MAAM,CAAA,CAAE,CAAA;QAC5D,IAAI2B,SAASE,YAAY,eAC5BM,SAAS7B,sBACLmB,QACAK,OAAO7B,GAAG6B,MAAMH,SAASS,SAAS,IAAIT,SAASS,SAAS;GAIhE,OAAO,KAAK1B,WAAW2B,SAASF,MAAAA;EACpC;EAEA,MAAM,EACFF,MAAMK,UACNC,SACA,MAAM,KAAK7B,WAAW2B,SAASZ,MAAAA;EAEnC,MAAMQ,OAAe,CAAA;EACrB,IAAI,EAAEO,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAAU;GAC3B,IACIrB,MAAMc,YACNd,MAAMc,SAASC,SAAS,UACxBf,MAAMc,SAASE,KAAKC,OAAOO,OAAOP,IACpC;IACED,KAAKS,KAAKD,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMxB,MAAMK,oBAAoBqB,cAAc;KAC1CnB,MAAM;MACFtB,eAAeiB;MACfjB,eAAekB;MACflB,eAAemB;KAClB;KACDY,MAAMvC,iBAAiB;OAAGD,kBAAkBmD,aAAaH;MAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;KAAQ,CAAA;IACxG,CAAA;IAEAR,KAAKS,KAAKD,MAAAA;GACd,QAAQ;IACJD,SAAS;GACb;EACJ;EAEA,OAAO;GACHP;GACAM,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMM,OACFC,UACA9B,OACAD,OACAgC,SACa;EACb,MAAM9B,kBAAkB;GACpBhB,eAAeiB;GACfjB,eAAekB;GACflB,eAAemB;EAClB;EAED,IAAI4B,OAAO,CAAC,CAAChC,MAAMc,YACfd,MAAMc,SAASC,SAAS,WAEpBf,MAAMc,SAASE,KAAKC,OAAOa,YAC3B9B,MAAMc,SAASE,KAAKT,SAASuB;EAGrC,IAAI,CAACE,MACD,MAAMhC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAG7E,MAAMuB,SAAS,MAAM,KAAK/B,WAAWwC,QACjCH,UACA,MAAMxC,YAAYS,OAAO;GACrBU,QAAQlB;GACR2C,YAAY,CAAC,UAAU,WAAY;GACnClC;EACJ,CAAA,GACA+B,OAAAA;EAEJ,IAAI,CAACP,QACD,MAAM,IAAI5C,oBAAAA;EAGd,IAAIoD,QAAQhC,MAAMc,SAAUE,KAAKC,OAAOO,OAAOP,IAAI;GAC/Ce,OAAO;GACP,MAAMhC,MAAMK,oBAAoBC,iBAAiB,EAAEC,MAAMN,gBAAgB,CAAA;EAC7E;EAEA,IAAI,CAAC+B,MACD,MAAMhC,MAAMK,oBAAoBqB,cAAc;GAC1CnB,MAAMN;GACNe,MAAMvC,iBAAiB;KAAGD,kBAAkBmD,aAAaH;IAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMW,OACFnB,MACAhB,OACa;EACb,MAAM,EAAEwB,WAAW,MAAM,KAAKY,KAAKC,KAAAA,GAAWrB,MAAMhB,KAAAA;EACpD,OAAOwB;CACX;CAEA,MAAMc,OACFR,UACAd,MACAhB,OACa;EACb,MAAM,EAAEwB,WAAW,MAAM,KAAKY,KAAKN,UAAUd,MAAMhB,OAAO,EAAEuC,YAAY,KAAK,CAAA;EAC7E,OAAOf;CACX;CAEA,MAAMY,KACFN,UACAd,MACAhB,OACAwC,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAO1B,KAAKe,YAAY,WAClC,MAAM,KAAKrC,gBAAgBiD,QAAQ3B,KAAKe,OAAO,IAC/CM,KAAAA;EAEJ,IAAIb;EACJ,IAAIM,UAAU;GACV,MAAMc,QAA6B,CAAC;GACpC,IAAIjE,OAAOmD,QAAAA,GACPc,MAAM3B,KAAKa;QAEXc,MAAMrC,OAAOuB;GAGjB,IAAIY,OACAE,MAAMb,UAAUW,MAAMzB;GAG1BO,SAAS,MAAM,KAAK/B,WAAWoD,UAAUD,KAAAA;GAGzC,IAAI,CAACpB,WAAWgB,QAAQD,cAAcK,MAAM3B,KACxC,MAAM,IAAIrC,oBAAAA;EAElB,OAAO,IAAI4D,QAAQD,YACf,MAAM,IAAI3D,oBAAAA;EAGd,IAAIkE,aAAa;EACjB,IAAItB,QAAQ;GACR,IAAI;IACA,MAAMxB,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAekB,YAAY,CAAA;GACnF,SAAS6C,GAAG;IACR,IACI,CAAChD,MAAMc,YACPd,MAAMc,SAASC,SAAS,UACxBf,MAAMc,SAASE,KAAKC,OAAOO,OAAOP,IAElC,MAAM+B;IAEVF,aAAa;IACb,MAAM9C,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAegE,iBAAiB,CAAA;GACxF;GAEAR,QAAQ/D,eAAewE;EAC3B,OAAO;GACH,MAAMlD,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAekE,YAAY,CAAA;GAE/EV,QAAQ/D,eAAe0E;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK1D,UAAU2D,IAAItC,MAAM,EAAEyB,MAAM,CAAA;EAEzD,MAAM,KAAKhD,WAAW8D,oBAAoBF,SAAAA;EAE1C,MAAMG,qBAAqB,IAAIpE,uBAAAA;EAE/B,IAAIoC,QAAQ;GACR,MAAMiC,eAAejC,OAAOjB;GAC5B,MAAMmD,qBAAqBlC,OAAOmC;GAElC,IAAIb,YACA,MAAM9C,MAAMK,oBAAoBuD,SAAS;IACrCrD,MAAMtB,eAAegE;IACrBjC,MAAMvC,iBAAiB;MAAGD,kBAAkBmD,aAAa0B;KAAW,GAAG,KAAKzB,mBAAmByB,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJ7B,SAAS,KAAK/B,WAAWoE,MAAMrC,QAAQ6B,SAAAA;GAEvC,IACIA,UAAU9C,QACV8C,UAAU9C,SAASkD,cACrB;IACE,IAAIJ,UAAUM,YACVnC,OAAOmC,aAAaN,UAAUM;IAGlC,IAAID,sBAAsBL,UAAUM,eAAe,OAC/CnC,OAAOjB,OAAOkD;GAEtB;GAEA,IAAI,CAACX,YACD,MAAM9C,MAAMK,oBAAoBuD,SAAS;IACrCrD,MAAMtB,eAAekB;IACrBa,MAAMvC,iBAAiB;MAClBD,kBAAkBmD,aAAa;MAC5B,GAAGH;MACH,GAAG6B;KACP;MACC7E,kBAAkBsF,cAAcT,UAAUtB,WAAWP,OAAOO,WAAW;IAC5E,CAAA;GACJ,CAAA;GAGJ,IAAIsB,UAAUU,UACVvC,OAAOuC,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;GAGzE,MAAM,KAAKtE,WAAW2C,KAAKZ,MAAAA;GAE3B,OAAO;IACHA;IACAyC,SAAS;GACb;EACJ;EAEA,IAAI,CAACZ,UAAUtB,SAAS;GACpB,MAAMmC,eAAe,KAAKC,gBAAgBnE,KAAAA;GAC1C,IAAIkE,cACAb,UAAUtB,UAAUmC;EAE5B;EAEA1C,SAAS,KAAK/B,WAAW0C,OAAOkB,SAAAA;EAEhC,MAAMrD,MAAMK,oBAAoBuD,SAAS;GACrCrD,MAAMtB,eAAekE;GACrBnC,MAAMvC,iBAAiB;KAAGD,kBAAkBmD,aAAaH;IAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,IAAI6B,UAAUU,UACVvC,OAAOuC,WAAW,MAAMP,mBAAmBQ,QAAQX,UAAUU,QAAQ;EAGzE,MAAM,KAAKtE,WAAW2C,KAAKZ,MAAAA;EAE3B,OAAO;GACHA;GACAyC,SAAS;EACb;CACJ;CAEA,MAAMG,OACFnD,IACAjB,OACa;EACb,MAAMA,MAAMK,oBAAoB0C,YAAY,EAAExC,MAAMtB,eAAemB,YAAY,CAAA;EAE/E,IACIJ,MAAMc,YACNd,MAAMc,SAASC,SAAS,UACxBf,MAAMc,SAASE,KAAKC,OAAOA,IAE3B,MAAM,IAAIpC,gBAAgB,kCAAA;EAG9B,MAAM2C,SAAS,MAAM,KAAK/B,WAAWoD,UAAU,EAAE5B,GAAG,CAAA;EACpD,IAAI,CAACO,QACD,MAAM,IAAI5C,oBAAAA;EAGd,MAAMoB,MAAMK,oBAAoBuD,SAAS;GACrCrD,MAAMtB,eAAemB;GACrBY,MAAMvC,iBAAiB;KAAGD,kBAAkBmD,aAAaH;IAAQ,GAAG,KAAKI,mBAAmBJ,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAEP,IAAIoD,aAAa7C;EACzB,MAAM,KAAK/B,WAAW6E,OAAO9C,MAAAA;EAC7BA,OAAOP,KAAKoD;EAEZ,OAAO7C;CACX;AACJ"}

package/dist/core/entities/user-authenticator/helpers.mjs

@@ -7,7 +7,7 @@ import { getRandomValues } from "uncrypto";
 const RECOVERY_CODE_ALPHABET = "23456789abcdefghjkmnpqrstuvwxyz";
 const RECOVERY_CODE_GROUP_LENGTH = 5;
 function generateRecoveryCode() {
-	const size = RECOVERY_CODE_GROUP_LENGTH * 2;
+	const size = 10;
 	const bytes = getRandomValues(new Uint8Array(size));
 	let output = "";
 	for (let i = 0; i < size; i++) {

package/dist/core/entities/user-authenticator/helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.mjs","names":["UserAuthenticatorKind","getRandomValues","RECOVERY_CODE_ALPHABET","RECOVERY_CODE_GROUP_LENGTH","generateRecoveryCode","size","bytes","Uint8Array","output","i","length","guessUserAuthenticatorKindByResponse","response","test","trim","TOTP","RECOVERY","generateNumericCode","String"],"sources":["../../../../src/core/entities/user-authenticator/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserAuthenticatorKind } from '@authup/core-kit';\nimport { getRandomValues } from 'uncrypto';\n\n// no ambiguous characters (0/o, 1/l/i) — codes get typed by hand\nconst RECOVERY_CODE_ALPHABET = '23456789abcdefghjkmnpqrstuvwxyz';\nconst RECOVERY_CODE_GROUP_LENGTH = 5;\n\nexport function generateRecoveryCode(): string {\n    const size = RECOVERY_CODE_GROUP_LENGTH * 2;\n    const bytes = getRandomValues(new Uint8Array(size));\n\n    let output = '';\n    for (let i = 0; i < size; i++) {\n        if (i === RECOVERY_CODE_GROUP_LENGTH) {\n            output += '-';\n        }\n        output += RECOVERY_CODE_ALPHABET[bytes[i] % RECOVERY_CODE_ALPHABET.length];\n    }\n\n    return output;\n}\n\n/**\n * Classify a bare one-time code by shape: an all-digit token is a TOTP\n * code, anything else (xxxxx-xxxxx) a recovery code. Used by the token\n * endpoint's `otp` parameter, which carries no explicit kind.\n */\nexport function guessUserAuthenticatorKindByResponse(response: string): `${UserAuthenticatorKind}` {\n    return /^[0-9]{4,10}$/.test(response.trim()) ?\n        UserAuthenticatorKind.TOTP :\n        UserAuthenticatorKind.RECOVERY;\n}\n\nexport function generateNumericCode(length: number): string {\n    const bytes = getRandomValues(new Uint8Array(length));\n\n    let output = '';\n    for (let i = 0; i < length; i++) {\n        output += String(bytes[i] % 10);\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;AAWA,MAAME,yBAAyB;AAC/B,MAAMC,6BAA6B;AAEnC,SAAgBC,uBAAAA;CACZ,MAAMC,OAAOF,6BAA6B;CAC1C,MAAMG,QAAQL,gBAAgB,IAAIM,WAAWF,IAAAA,CAAAA;CAE7C,IAAIG,SAAS;CACb,KAAK,IAAIC,IAAI,GAAGA,IAAIJ,MAAMI,KAAK;EAC3B,IAAIA,MAAMN,4BACNK,UAAU;EAEdA,UAAUN,uBAAuBI,MAAMG,KAAKP;CAChD;CAEA,OAAOM;AACX;;;;;GAOA,SAAgBG,qCAAqCC,UAAgB;CACjE,OAAO,gBAAgBC,KAAKD,SAASE,KAAI,CAAA,IACrCd,sBAAsBe,OACtBf,sBAAsBgB;AAC9B;AAEA,SAAgBC,oBAAoBP,QAAc;CAC9C,MAAMJ,QAAQL,gBAAgB,IAAIM,WAAWG,MAAAA,CAAAA;CAE7C,IAAIF,SAAS;CACb,KAAK,IAAIC,IAAI,GAAGA,IAAIC,QAAQD,KACxBD,UAAUU,OAAOZ,MAAMG,KAAK,EAAA;CAGhC,OAAOD;AACX"}
+{"version":3,"file":"helpers.mjs","names":["UserAuthenticatorKind","getRandomValues","RECOVERY_CODE_ALPHABET","RECOVERY_CODE_GROUP_LENGTH","generateRecoveryCode","size","bytes","Uint8Array","output","i","length","guessUserAuthenticatorKindByResponse","response","test","trim","TOTP","RECOVERY","generateNumericCode","String"],"sources":["../../../../src/core/entities/user-authenticator/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserAuthenticatorKind } from '@authup/core-kit';\nimport { getRandomValues } from 'uncrypto';\n\n// no ambiguous characters (0/o, 1/l/i) — codes get typed by hand\nconst RECOVERY_CODE_ALPHABET = '23456789abcdefghjkmnpqrstuvwxyz';\nconst RECOVERY_CODE_GROUP_LENGTH = 5;\n\nexport function generateRecoveryCode(): string {\n    const size = RECOVERY_CODE_GROUP_LENGTH * 2;\n    const bytes = getRandomValues(new Uint8Array(size));\n\n    let output = '';\n    for (let i = 0; i < size; i++) {\n        if (i === RECOVERY_CODE_GROUP_LENGTH) {\n            output += '-';\n        }\n        output += RECOVERY_CODE_ALPHABET[bytes[i] % RECOVERY_CODE_ALPHABET.length];\n    }\n\n    return output;\n}\n\n/**\n * Classify a bare one-time code by shape: an all-digit token is a TOTP\n * code, anything else (xxxxx-xxxxx) a recovery code. Used by the token\n * endpoint's `otp` parameter, which carries no explicit kind.\n */\nexport function guessUserAuthenticatorKindByResponse(response: string): `${UserAuthenticatorKind}` {\n    return /^[0-9]{4,10}$/.test(response.trim()) ?\n        UserAuthenticatorKind.TOTP :\n        UserAuthenticatorKind.RECOVERY;\n}\n\nexport function generateNumericCode(length: number): string {\n    const bytes = getRandomValues(new Uint8Array(length));\n\n    let output = '';\n    for (let i = 0; i < length; i++) {\n        output += String(bytes[i] % 10);\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;AAWA,MAAME,yBAAyB;AAC/B,MAAMC,6BAA6B;AAEnC,SAAgBC,uBAAAA;CACZ,MAAMC,OAAOF;CACb,MAAMG,QAAQL,gBAAgB,IAAIM,WAAWF,IAAAA,CAAAA;CAE7C,IAAIG,SAAS;CACb,KAAK,IAAIC,IAAI,GAAGA,IAAIJ,MAAMI,KAAK;EAC3B,IAAIA,MAAMN,4BACNK,UAAU;EAEdA,UAAUN,uBAAuBI,MAAMG,KAAKP;CAChD;CAEA,OAAOM;AACX;;;;;GAOA,SAAgBG,qCAAqCC,UAAgB;CACjE,OAAO,gBAAgBC,KAAKD,SAASE,KAAI,CAAA,IACrCd,sBAAsBe,OACtBf,sBAAsBgB;AAC9B;AAEA,SAAgBC,oBAAoBP,QAAc;CAC9C,MAAMJ,QAAQL,gBAAgB,IAAIM,WAAWG,MAAAA,CAAAA;CAE7C,IAAIF,SAAS;CACb,KAAK,IAAIC,IAAI,GAAGA,IAAIC,QAAQD,KACxBD,UAAUU,OAAOZ,MAAMG,KAAK,EAAA;CAGhC,OAAOD;AACX"}

package/dist/core/entities/user-authenticator/service.mjs

@@ -160,8 +160,8 @@ var UserAuthenticatorService = class extends AbstractEntityService {
 		entity = await this.repository.save(entity);
 		await this.cache.set(this.buildWebauthnCacheKey(USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, entity.id), {
 			challenge,
-			expiresAt: Date.now() + 300 * 1e3
-		}, { ttl: 300 * 1e3 });
+			expiresAt: Date.now() + 3e5
+		}, { ttl: 3e5 });
 		return {
 			data: this.sanitize(entity),
 			meta: { webauthn: options }
@@ -517,7 +517,7 @@ var UserAuthenticatorService = class extends AbstractEntityService {
 		if (!user || !user.email) return;
 		let withinCooldown;
 		try {
-			withinCooldown = !await this.cache.add(this.buildEmailSendCacheKey(userId), 1, { ttl: 60 * 1e3 });
+			withinCooldown = !await this.cache.add(this.buildEmailSendCacheKey(userId), 1, { ttl: 6e4 });
 		} catch {
 			withinCooldown = false;
 		}
@@ -525,8 +525,8 @@ var UserAuthenticatorService = class extends AbstractEntityService {
 		const codeValue = generateNumericCode(6);
 		await this.cache.set(this.buildEmailCodeCacheKey(userId), {
 			hash: await hash(codeValue),
-			expiresAt: Date.now() + 600 * 1e3
-		}, { ttl: 600 * 1e3 });
+			expiresAt: Date.now() + 6e5
+		}, { ttl: 6e5 });
 		const mail = await this.mailTemplateRenderer.render({
 			template: MailTemplateName.MFA_EMAIL_OTP,
 			params: {
@@ -567,8 +567,8 @@ var UserAuthenticatorService = class extends AbstractEntityService {
 			const { options, challenge } = await buildWebauthnAuthenticationOptions(this.options.webauthn, credentials);
 			await this.cache.set(this.buildWebauthnCacheKey(USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, userId), {
 				challenge,
-				expiresAt: Date.now() + 300 * 1e3
-			}, { ttl: 300 * 1e3 });
+				expiresAt: Date.now() + 3e5
+			}, { ttl: 3e5 });
 			status.challenge = { webauthn: options };
 		}
 		return status;