@authup/server-core 1.0.0-beta.57 → 1.0.0-beta.59

package/dist/core/provisioning/merge/module.mjs

@@ -0,0 +1,82 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { isObject } from "@authup/kit";
+//#region src/core/provisioning/merge/module.ts
+function buildProvisioningEntityKey(attributes) {
+	if (!attributes.name) return void 0;
+	return `${attributes.name}:${attributes.realmId || ""}:${attributes.clientId || ""}`;
+}
+function mergeProvisioningEntities(target, source, options = {}) {
+	if (!source) return target;
+	if (!target) return [...source];
+	const result = [...target];
+	source.forEach((item) => {
+		const key = buildProvisioningEntityKey(item.attributes);
+		if (!key) {
+			result.push(item);
+			return;
+		}
+		const idx = result.findIndex((r) => buildProvisioningEntityKey(r.attributes) === key);
+		if (idx !== -1) result[idx] = mergeProvisioningEntity(result[idx], item, options);
+		else result.push(item);
+	});
+	return result;
+}
+/**
+* Deep-merge two entries sharing a composite key. The later (source) side
+* wins per attribute, but relations are UNIONED — a later source (e.g. a
+* mounted provisioning file) extending a built-in entry (the default
+* source's master realm) must not silently drop the built-in relations
+* (admin user, system client).
+*
+* Policy extraAttributes merge per key with the later source winning —
+* like attributes, NOT like relations: an EA value (a names denylist,
+* an ATTRIBUTES query tree) is policy configuration, and unioning would
+* make shrinking a list impossible and fabricate predicates neither
+* source authored.
+*/ function mergeProvisioningEntity(target, source, options = {}) {
+	const output = {
+		...target,
+		...source
+	};
+	output.attributes = {
+		...target.attributes,
+		...source.attributes
+	};
+	const inheritStrategy = options.inheritStrategy ?? true;
+	if (target.strategy && !source.strategy) if (inheritStrategy) output.strategy = target.strategy;
+	else delete output.strategy;
+	if (target.relations && source.relations) output.relations = mergeProvisioningRecord(target.relations, source.relations, options);
+	else if (target.relations && !source.relations) output.relations = target.relations;
+	if (target.extraAttributes && source.extraAttributes) output.extraAttributes = {
+		...target.extraAttributes,
+		...source.extraAttributes
+	};
+	else if (target.extraAttributes && !source.extraAttributes) output.extraAttributes = target.extraAttributes;
+	if (target.children && source.children) output.children = mergeProvisioningEntities(target.children, source.children, options);
+	else if (target.children && !source.children) output.children = target.children;
+	return output;
+}
+function mergeProvisioningRecord(target, source, options = {}) {
+	const output = { ...target };
+	for (const key of Object.keys(source)) output[key] = key in target ? mergeProvisioningValue(target[key], source[key], options) : source[key];
+	return output;
+}
+function mergeProvisioningValue(target, source, options = {}) {
+	if (typeof target === "undefined") return source;
+	if (typeof source === "undefined") return target;
+	if (Array.isArray(target) && Array.isArray(source)) {
+		if (isProvisioningEntityArray(target) || isProvisioningEntityArray(source)) return mergeProvisioningEntities(target, source, options);
+		return [.../* @__PURE__ */ new Set([...target, ...source])];
+	}
+	if (isObject(target) && isObject(source)) return mergeProvisioningRecord(target, source, options);
+	return source;
+}
+function isProvisioningEntityArray(value) {
+	return value.some((item) => isObject(item) && "attributes" in item);
+}
+//#endregion
+export { buildProvisioningEntityKey, mergeProvisioningEntities, mergeProvisioningEntity };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/merge/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["isObject","buildProvisioningEntityKey","attributes","name","undefined","realmId","clientId","mergeProvisioningEntities","target","source","options","result","forEach","item","key","push","idx","findIndex","r","mergeProvisioningEntity","output","inheritStrategy","strategy","relations","mergeProvisioningRecord","extraAttributes","children","Object","keys","mergeProvisioningValue","Array","isArray","isProvisioningEntityArray","Set","value","some"],"sources":["../../../../src/core/provisioning/merge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport type { MergeProvisioningOptions, MergeableProvisioningEntity } from './types.ts';\n\nexport function buildProvisioningEntityKey(\n    attributes: MergeableProvisioningEntity['attributes'],\n): string | undefined {\n    if (!attributes.name) return undefined;\n    return `${attributes.name}:${attributes.realmId || ''}:${attributes.clientId || ''}`;\n}\n\nexport function mergeProvisioningEntities<T extends MergeableProvisioningEntity>(\n    target: T[] | undefined,\n    source: T[] | undefined,\n    options: MergeProvisioningOptions = {},\n): T[] | undefined {\n    if (!source) return target;\n    if (!target) return [...source];\n\n    const result = [...target];\n    source.forEach((item) => {\n        const key = buildProvisioningEntityKey(item.attributes);\n        if (!key) {\n            result.push(item);\n            return;\n        }\n\n        const idx = result.findIndex((r) => buildProvisioningEntityKey(r.attributes) === key);\n        if (idx !== -1) {\n            result[idx] = mergeProvisioningEntity(result[idx], item, options) as T;\n        } else {\n            result.push(item);\n        }\n    });\n    return result;\n}\n\n/**\n * Deep-merge two entries sharing a composite key. The later (source) side\n * wins per attribute, but relations are UNIONED — a later source (e.g. a\n * mounted provisioning file) extending a built-in entry (the default\n * source's master realm) must not silently drop the built-in relations\n * (admin user, system client).\n *\n * Policy extraAttributes merge per key with the later source winning —\n * like attributes, NOT like relations: an EA value (a names denylist,\n * an ATTRIBUTES query tree) is policy configuration, and unioning would\n * make shrinking a list impossible and fabricate predicates neither\n * source authored.\n */\nexport function mergeProvisioningEntity(\n    target: MergeableProvisioningEntity,\n    source: MergeableProvisioningEntity,\n    options: MergeProvisioningOptions = {},\n): MergeableProvisioningEntity {\n    const output = { ...target, ...source };\n\n    output.attributes = { ...target.attributes, ...source.attributes };\n\n    const inheritStrategy = options.inheritStrategy ?? true;\n    if (target.strategy && !source.strategy) {\n        if (inheritStrategy) {\n            output.strategy = target.strategy;\n        } else {\n            delete output.strategy;\n        }\n    }\n\n    if (target.relations && source.relations) {\n        output.relations = mergeProvisioningRecord(target.relations, source.relations, options);\n    } else if (target.relations && !source.relations) {\n        output.relations = target.relations;\n    }\n\n    if (target.extraAttributes && source.extraAttributes) {\n        output.extraAttributes = { ...target.extraAttributes, ...source.extraAttributes };\n    } else if (target.extraAttributes && !source.extraAttributes) {\n        output.extraAttributes = target.extraAttributes;\n    }\n\n    if (target.children && source.children) {\n        output.children = mergeProvisioningEntities(target.children, source.children, options);\n    } else if (target.children && !source.children) {\n        output.children = target.children;\n    }\n\n    return output;\n}\n\nfunction mergeProvisioningRecord(\n    target: Record<string, unknown>,\n    source: Record<string, unknown>,\n    options: MergeProvisioningOptions = {},\n): Record<string, unknown> {\n    const output : Record<string, unknown> = { ...target };\n    for (const key of Object.keys(source)) {\n        output[key] = key in target ?\n            mergeProvisioningValue(target[key], source[key], options) :\n            source[key];\n    }\n    return output;\n}\n\nfunction mergeProvisioningValue(\n    target: unknown,\n    source: unknown,\n    options: MergeProvisioningOptions = {},\n): unknown {\n    if (typeof target === 'undefined') return source;\n    if (typeof source === 'undefined') return target;\n\n    if (Array.isArray(target) && Array.isArray(source)) {\n        if (isProvisioningEntityArray(target) || isProvisioningEntityArray(source)) {\n            return mergeProvisioningEntities(\n                target as MergeableProvisioningEntity[],\n                source as MergeableProvisioningEntity[],\n                options,\n            );\n        }\n        return [...new Set([...target, ...source])];\n    }\n\n    if (isObject(target) && isObject(source)) {\n        return mergeProvisioningRecord(target, source, options);\n    }\n\n    return source;\n}\n\nfunction isProvisioningEntityArray(value: unknown[]): value is MergeableProvisioningEntity[] {\n    return value.some(\n        (item) => isObject(item) && 'attributes' in item,\n    );\n}\n"],"mappings":";;;;;AAUA,SAAgBC,2BACZC,YAAqD;CAErD,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;CAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,WAAW,GAAG,GAAGH,WAAWI,YAAY;AACpF;AAEA,SAAgBC,0BACZC,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,IAAI,CAACD,QAAQ,OAAOD;CACpB,IAAI,CAACA,QAAQ,OAAO,CAAIC,GAAAA,MAAO;CAE/B,MAAME,SAAS,CAAIH,GAAAA,MAAO;CAC1BC,OAAOG,SAASC,SAAAA;EACZ,MAAMC,MAAMb,2BAA2BY,KAAKX,UAAU;EACtD,IAAI,CAACY,KAAK;GACNH,OAAOI,KAAKF,IAAAA;GACZ;EACJ;EAEA,MAAMG,MAAML,OAAOM,WAAWC,MAAMjB,2BAA2BiB,EAAEhB,UAAU,MAAMY,GAAAA;EACjF,IAAIE,QAAQ,IACRL,OAAOK,OAAOG,wBAAwBR,OAAOK,MAAMH,MAAMH,OAAAA;OAEzDC,OAAOI,KAAKF,IAAAA;CAEpB,CAAA;CACA,OAAOF;AACX;;;;;;;;;;;;;GAeA,SAAgBQ,wBACZX,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,MAAMU,SAAS;EAAE,GAAGZ;EAAQ,GAAGC;CAAO;CAEtCW,OAAOlB,aAAa;EAAE,GAAGM,OAAON;EAAY,GAAGO,OAAOP;CAAW;CAEjE,MAAMmB,kBAAkBX,QAAQW,mBAAmB;CACnD,IAAIb,OAAOc,YAAY,CAACb,OAAOa,UAC3B,IAAID,iBACAD,OAAOE,WAAWd,OAAOc;MAEzB,OAAOF,OAAOE;CAItB,IAAId,OAAOe,aAAad,OAAOc,WAC3BH,OAAOG,YAAYC,wBAAwBhB,OAAOe,WAAWd,OAAOc,WAAWb,OAAAA;MAC5E,IAAIF,OAAOe,aAAa,CAACd,OAAOc,WACnCH,OAAOG,YAAYf,OAAOe;CAG9B,IAAIf,OAAOiB,mBAAmBhB,OAAOgB,iBACjCL,OAAOK,kBAAkB;EAAE,GAAGjB,OAAOiB;EAAiB,GAAGhB,OAAOgB;CAAgB;MAC7E,IAAIjB,OAAOiB,mBAAmB,CAAChB,OAAOgB,iBACzCL,OAAOK,kBAAkBjB,OAAOiB;CAGpC,IAAIjB,OAAOkB,YAAYjB,OAAOiB,UAC1BN,OAAOM,WAAWnB,0BAA0BC,OAAOkB,UAAUjB,OAAOiB,UAAUhB,OAAAA;MAC3E,IAAIF,OAAOkB,YAAY,CAACjB,OAAOiB,UAClCN,OAAOM,WAAWlB,OAAOkB;CAG7B,OAAON;AACX;AAEA,SAASI,wBACLhB,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,MAAMU,SAAmC,EAAE,GAAGZ,OAAO;CACrD,KAAK,MAAMM,OAAOa,OAAOC,KAAKnB,MAAAA,GAC1BW,OAAON,OAAOA,OAAON,SACjBqB,uBAAuBrB,OAAOM,MAAML,OAAOK,MAAMJ,OAAAA,IACjDD,OAAOK;CAEf,OAAOM;AACX;AAEA,SAASS,uBACLrB,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,IAAI,OAAOF,WAAW,aAAa,OAAOC;CAC1C,IAAI,OAAOA,WAAW,aAAa,OAAOD;CAE1C,IAAIsB,MAAMC,QAAQvB,MAAAA,KAAWsB,MAAMC,QAAQtB,MAAAA,GAAS;EAChD,IAAIuB,0BAA0BxB,MAAAA,KAAWwB,0BAA0BvB,MAAAA,GAC/D,OAAOF,0BACHC,QACAC,QACAC,OAAAA;EAGR,OAAO,CAAI,mBAAA,IAAIuB,IAAI,CAAIzB,GAAAA,QAAWC,GAAAA,MAAO,CAAA,CAAE;CAC/C;CAEA,IAAIT,SAASQ,MAAAA,KAAWR,SAASS,MAAAA,GAC7B,OAAOe,wBAAwBhB,QAAQC,QAAQC,OAAAA;CAGnD,OAAOD;AACX;AAEA,SAASuB,0BAA0BE,OAAgB;CAC/C,OAAOA,MAAMC,MACRtB,SAASb,SAASa,IAAAA,KAAS,gBAAgBA,IAAAA;AAEpD"}

package/dist/core/provisioning/merge/types.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Structural view of a provisioning entity used by the deep merge.
+ * Covers every entity shape (realm, client, user, role, permission, scope,
+ * policy): the composite-key attribute bag plus the deep-mergeable groups.
+ */
+export type MergeProvisioningOptions = {
+    /**
+     * May a source entry that declares no `strategy` inherit the target's?
+     *
+     * True for the composite source, where target/source are "earlier file"
+     * and "later file" and inheriting an unspecified strategy is the
+     * documented rule.
+     *
+     * False for the wildcard expansion, where the precedence is INVERTED:
+     * the target is the wildcard (low precedence) and the source is an
+     * explicit realm block (high precedence). Inheriting there would let a
+     * wildcard child supply the lifecycle of an entity the operator declared
+     * explicitly, and `absent` is part of that vocabulary, so a wildcard
+     * sweep would delete the very row the explicit block declares.
+     */
+    inheritStrategy?: boolean;
+};
+export type MergeableProvisioningEntity = {
+    attributes: {
+        name?: string;
+        realmId?: string | null;
+        clientId?: string | null;
+    };
+    strategy?: unknown;
+    relations?: Record<string, unknown>;
+    children?: MergeableProvisioningEntity[];
+    extraAttributes?: Record<string, unknown>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/merge/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/merge/types.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACnC;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE;QACR,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,QAAQ,CAAC,EAAE,2BAA2B,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C,CAAC"}

package/dist/core/provisioning/merge/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/provisioning/synchronizer/client/module.mjs

@@ -65,7 +65,6 @@ var ClientProvisioningSynchronizer = class extends BaseProvisioningSynchronizer
 			case ProvisioningEntityStrategyType.REPLACE:
 				input.attributes.id = attributes.id;
 				attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));
-				break;
 		}
 		else attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));
 		const permissions = [...await this.permissionResolver.resolveGlobal(input.relations && input.relations.globalPermissions), ...attributes.realmId ? await this.permissionResolver.resolveRealm(input.relations && input.relations.realmPermissions, attributes.realmId) : []];

package/dist/core/provisioning/synchronizer/client/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","ClientProvisioningSynchronizer","clientRepository","permissionResolver","roleResolver","scopeResolver","permissionJunction","roleJunction","scopeJunction","permissionSynchronizer","roleSynchronizer","ctx","permissionRepository","roleRepository","scopeRepository","clientScoped","repository","clientPermissionRepository","ownerKey","ownerRealmKey","clientRoleRepository","clientScopeRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","length","roles","globalRoles","realmRoles","scopes","globalScopes","realmScopes","children","map","child","clientId","client","synchronizeMany"],"sources":["../../../../../src/core/provisioning/synchronizer/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    Permission,\n    Role,\n    Scope,\n} from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type { IClientRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity } from '../../entities/client';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport type { RoleProvisioningEntity } from '../../entities/role';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { ClientProvisioningSynchronizerContext } from './types.ts';\n\nexport class ClientProvisioningSynchronizer extends BaseProvisioningSynchronizer<ClientProvisioningEntity> {\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected scopeResolver: ProvisioningEntityResolver<Scope>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<ClientPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<ClientRole>;\n\n    protected scopeJunction: ProvisioningJunctionSynchronizer<ClientScope>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    constructor(ctx: ClientProvisioningSynchronizerContext) {\n        super();\n\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n        this.scopeResolver = new ProvisioningEntityResolver(ctx.scopeRepository, { clientScoped: false });\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientPermissionRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientRoleRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n        this.scopeJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientScopeRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n    }\n\n    async synchronize(input: ClientProvisioningEntity): Promise<ClientProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.clientRepository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.clientRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.clientRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n                    attributes = await this.clientRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n        }\n\n        // Permissions (Global + Realm)\n        const permissions = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realmId ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permissionId',\n                'permissionRealmId',\n            );\n        }\n\n        // Roles (Global + Realm)\n        const roles = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realmId ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'roleId',\n                'roleRealmId',\n            );\n        }\n\n        // Scopes (Global + Realm). The junction is the only source the\n        // /authorize code-request verifier reads scopes from.\n        const scopes = [\n            ...await this.scopeResolver.resolveGlobal(\n                input.relations && input.relations.globalScopes,\n            ),\n            ...(attributes.realmId ?\n                await this.scopeResolver.resolveRealm(\n                    input.relations && input.relations.realmScopes,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (scopes.length > 0) {\n            await this.scopeJunction.synchronize(\n                attributes,\n                scopes,\n                'scopeId',\n                'scopeRealmId',\n            );\n        }\n\n        // Containers\n\n        if (input.relations && input.relations.permissions) {\n            const children = input.relations.permissions.map((child) => {\n                child.attributes.clientId = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(children);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const children = input.relations.roles.map((child) => {\n                child.attributes.clientId = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(children);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;AA2BA,IAAaM,iCAAb,cAAoDH,6BAAAA;CACtCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAK;EAEL,KAAKT,mBAAmBS,IAAIT;EAE5B,KAAKC,qBAAqB,IAAIJ,2BAA2BY,IAAIC,oBAAoB;EACjF,KAAKR,eAAe,IAAIL,2BAA2BY,IAAIE,cAAc;EACrE,KAAKR,gBAAgB,IAAIN,2BAA2BY,IAAIG,iBAAiB,EAAEC,cAAc,MAAM,CAAA;EAE/F,KAAKT,qBAAqB,IAAIN,iCAAiC;GAC3DgB,YAAYL,IAAIM;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKZ,eAAe,IAAIP,iCAAiC;GACrDgB,YAAYL,IAAIS;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKX,gBAAgB,IAAIR,iCAAiC;GACtDgB,YAAYL,IAAIU;GAChBH,UAAU;GACVC,eAAe;EACnB,CAAA;EAEA,KAAKV,yBAAyBE,IAAIF;EAClC,KAAKC,mBAAmBC,IAAID;CAChC;CAEA,MAAMY,YAAYC,OAAoE;EAClF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAW7B,oCAAoC0B,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKvB,iBAAiByB,UAAU;GACnDC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAASlC,+BAA+BmC,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKvB,iBAAiB8B,OAAOP,UAAAA;GAEvC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAKlC,+BAA+BqC;IAChCR,aAAa,KAAKvB,iBAAiBgC,MAC/BT,YACAC,SAASD,aACL9B,WAAW4B,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAExBA,aAAa,MAAM,KAAKvB,iBAAiBiC,KAAKV,UAAAA;IAC9C;GACJ,KAAK7B,+BAA+BwC;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKvB,iBAAiBiC,KAAK,KAAKjC,iBAAiBoC,OAAOf,MAAME,UAAU,CAAA;IAC3F;EACR;OAEAA,aAAa,MAAM,KAAKvB,iBAAiBiC,KAAK,KAAKjC,iBAAiBoC,OAAOf,MAAME,UAAU,CAAA;EAI/F,MAAMc,cAAc,CACb,GAAA,MAAM,KAAKpC,mBAAmBqC,cAC7BjB,MAAMkB,aAAalB,MAAMkB,UAAUC,iBAAiB,GAEpDjB,GAAAA,WAAWI,UACX,MAAM,KAAK1B,mBAAmBwC,aAC1BpB,MAAMkB,aAAalB,MAAMkB,UAAUG,kBACnCnB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIU,YAAYM,SAAS,GACrB,MAAM,KAAKvC,mBAAmBgB,YAC1BG,YACAc,aACA,gBACA,mBAAA;EAKR,MAAMO,QAAQ,CACP,GAAA,MAAM,KAAK1C,aAAaoC,cACvBjB,MAAMkB,aAAalB,MAAMkB,UAAUM,WAAW,GAE9CtB,GAAAA,WAAWI,UACX,MAAM,KAAKzB,aAAauC,aACpBpB,MAAMkB,aAAalB,MAAMkB,UAAUO,YACnCvB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIiB,MAAMD,SAAS,GACf,MAAM,KAAKtC,aAAae,YACpBG,YACAqB,OACA,UACA,aAAA;EAMR,MAAMG,SAAS,CACR,GAAA,MAAM,KAAK5C,cAAcmC,cACxBjB,MAAMkB,aAAalB,MAAMkB,UAAUS,YAAY,GAE/CzB,GAAAA,WAAWI,UACX,MAAM,KAAKxB,cAAcsC,aACrBpB,MAAMkB,aAAalB,MAAMkB,UAAUU,aACnC1B,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIoB,OAAOJ,SAAS,GAChB,MAAM,KAAKrC,cAAcc,YACrBG,YACAwB,QACA,WACA,cAAA;EAMR,IAAI1B,MAAMkB,aAAalB,MAAMkB,UAAUF,aAAa;GAChD,MAAMa,WAAW7B,MAAMkB,UAAUF,YAAYc,KAAKC,UAAAA;IAC9CA,MAAM7B,WAAW8B,WAAW9B,WAAWY;IACvCiB,MAAM7B,WAAW+B,SAAS/B;IAC1B,OAAO6B;GACX,CAAA;GAEA,MAAM,KAAK7C,uBAAuBgD,gBAAgBL,QAAAA;EACtD;EAEA,IAAI7B,MAAMkB,aAAalB,MAAMkB,UAAUK,OAAO;GAC1C,MAAMM,WAAW7B,MAAMkB,UAAUK,MAAMO,KAAKC,UAAAA;IACxCA,MAAM7B,WAAW8B,WAAW9B,WAAWY;IACvCiB,MAAM7B,WAAW+B,SAAS/B;IAC1B,OAAO6B;GACX,CAAA;GAEA,MAAM,KAAK5C,iBAAiB+C,gBAAgBL,QAAAA;EAChD;EAEA,OAAO;GACH,GAAG7B;GACHE;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","ClientProvisioningSynchronizer","clientRepository","permissionResolver","roleResolver","scopeResolver","permissionJunction","roleJunction","scopeJunction","permissionSynchronizer","roleSynchronizer","ctx","permissionRepository","roleRepository","scopeRepository","clientScoped","repository","clientPermissionRepository","ownerKey","ownerRealmKey","clientRoleRepository","clientScopeRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","length","roles","globalRoles","realmRoles","scopes","globalScopes","realmScopes","children","map","child","clientId","client","synchronizeMany"],"sources":["../../../../../src/core/provisioning/synchronizer/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    Permission,\n    Role,\n    Scope,\n} from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type { IClientRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity } from '../../entities/client';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport type { RoleProvisioningEntity } from '../../entities/role';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { ClientProvisioningSynchronizerContext } from './types.ts';\n\nexport class ClientProvisioningSynchronizer extends BaseProvisioningSynchronizer<ClientProvisioningEntity> {\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected scopeResolver: ProvisioningEntityResolver<Scope>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<ClientPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<ClientRole>;\n\n    protected scopeJunction: ProvisioningJunctionSynchronizer<ClientScope>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    constructor(ctx: ClientProvisioningSynchronizerContext) {\n        super();\n\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n        this.scopeResolver = new ProvisioningEntityResolver(ctx.scopeRepository, { clientScoped: false });\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientPermissionRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientRoleRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n        this.scopeJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientScopeRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n    }\n\n    async synchronize(input: ClientProvisioningEntity): Promise<ClientProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.clientRepository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.clientRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.clientRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n                    attributes = await this.clientRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n        }\n\n        // Permissions (Global + Realm)\n        const permissions = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realmId ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permissionId',\n                'permissionRealmId',\n            );\n        }\n\n        // Roles (Global + Realm)\n        const roles = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realmId ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'roleId',\n                'roleRealmId',\n            );\n        }\n\n        // Scopes (Global + Realm). The junction is the only source the\n        // /authorize code-request verifier reads scopes from.\n        const scopes = [\n            ...await this.scopeResolver.resolveGlobal(\n                input.relations && input.relations.globalScopes,\n            ),\n            ...(attributes.realmId ?\n                await this.scopeResolver.resolveRealm(\n                    input.relations && input.relations.realmScopes,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (scopes.length > 0) {\n            await this.scopeJunction.synchronize(\n                attributes,\n                scopes,\n                'scopeId',\n                'scopeRealmId',\n            );\n        }\n\n        // Containers\n\n        if (input.relations && input.relations.permissions) {\n            const children = input.relations.permissions.map((child) => {\n                child.attributes.clientId = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(children);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const children = input.relations.roles.map((child) => {\n                child.attributes.clientId = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(children);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;AA2BA,IAAaM,iCAAb,cAAoDH,6BAAAA;CACtCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAK;EAEL,KAAKT,mBAAmBS,IAAIT;EAE5B,KAAKC,qBAAqB,IAAIJ,2BAA2BY,IAAIC,oBAAoB;EACjF,KAAKR,eAAe,IAAIL,2BAA2BY,IAAIE,cAAc;EACrE,KAAKR,gBAAgB,IAAIN,2BAA2BY,IAAIG,iBAAiB,EAAEC,cAAc,MAAM,CAAA;EAE/F,KAAKT,qBAAqB,IAAIN,iCAAiC;GAC3DgB,YAAYL,IAAIM;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKZ,eAAe,IAAIP,iCAAiC;GACrDgB,YAAYL,IAAIS;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKX,gBAAgB,IAAIR,iCAAiC;GACtDgB,YAAYL,IAAIU;GAChBH,UAAU;GACVC,eAAe;EACnB,CAAA;EAEA,KAAKV,yBAAyBE,IAAIF;EAClC,KAAKC,mBAAmBC,IAAID;CAChC;CAEA,MAAMY,YAAYC,OAAoE;EAClF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAW7B,oCAAoC0B,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKvB,iBAAiByB,UAAU;GACnDC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAASlC,+BAA+BmC,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKvB,iBAAiB8B,OAAOP,UAAAA;GAEvC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAKlC,+BAA+BqC;IAChCR,aAAa,KAAKvB,iBAAiBgC,MAC/BT,YACAC,SAASD,aACL9B,WAAW4B,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAExBA,aAAa,MAAM,KAAKvB,iBAAiBiC,KAAKV,UAAAA;IAC9C;GACJ,KAAK7B,+BAA+BwC;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKvB,iBAAiBiC,KAAK,KAAKjC,iBAAiBoC,OAAOf,MAAME,UAAU,CAAA;EAEnG;OAEAA,aAAa,MAAM,KAAKvB,iBAAiBiC,KAAK,KAAKjC,iBAAiBoC,OAAOf,MAAME,UAAU,CAAA;EAI/F,MAAMc,cAAc,CACb,GAAA,MAAM,KAAKpC,mBAAmBqC,cAC7BjB,MAAMkB,aAAalB,MAAMkB,UAAUC,iBAAiB,GAEpDjB,GAAAA,WAAWI,UACX,MAAM,KAAK1B,mBAAmBwC,aAC1BpB,MAAMkB,aAAalB,MAAMkB,UAAUG,kBACnCnB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIU,YAAYM,SAAS,GACrB,MAAM,KAAKvC,mBAAmBgB,YAC1BG,YACAc,aACA,gBACA,mBAAA;EAKR,MAAMO,QAAQ,CACP,GAAA,MAAM,KAAK1C,aAAaoC,cACvBjB,MAAMkB,aAAalB,MAAMkB,UAAUM,WAAW,GAE9CtB,GAAAA,WAAWI,UACX,MAAM,KAAKzB,aAAauC,aACpBpB,MAAMkB,aAAalB,MAAMkB,UAAUO,YACnCvB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIiB,MAAMD,SAAS,GACf,MAAM,KAAKtC,aAAae,YACpBG,YACAqB,OACA,UACA,aAAA;EAMR,MAAMG,SAAS,CACR,GAAA,MAAM,KAAK5C,cAAcmC,cACxBjB,MAAMkB,aAAalB,MAAMkB,UAAUS,YAAY,GAE/CzB,GAAAA,WAAWI,UACX,MAAM,KAAKxB,cAAcsC,aACrBpB,MAAMkB,aAAalB,MAAMkB,UAAUU,aACnC1B,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIoB,OAAOJ,SAAS,GAChB,MAAM,KAAKrC,cAAcc,YACrBG,YACAwB,QACA,WACA,cAAA;EAMR,IAAI1B,MAAMkB,aAAalB,MAAMkB,UAAUF,aAAa;GAChD,MAAMa,WAAW7B,MAAMkB,UAAUF,YAAYc,KAAKC,UAAAA;IAC9CA,MAAM7B,WAAW8B,WAAW9B,WAAWY;IACvCiB,MAAM7B,WAAW+B,SAAS/B;IAC1B,OAAO6B;GACX,CAAA;GAEA,MAAM,KAAK7C,uBAAuBgD,gBAAgBL,QAAAA;EACtD;EAEA,IAAI7B,MAAMkB,aAAalB,MAAMkB,UAAUK,OAAO;GAC1C,MAAMM,WAAW7B,MAAMkB,UAAUK,MAAMO,KAAKC,UAAAA;IACxCA,MAAM7B,WAAW8B,WAAW9B,WAAWY;IACvCiB,MAAM7B,WAAW+B,SAAS/B;IAC1B,OAAO6B;GACX,CAAA;GAEA,MAAM,KAAK5C,iBAAiB+C,gBAAgBL,QAAAA;EAChD;EAEA,OAAO;GACH,GAAG7B;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/permission/module.mjs

@@ -40,7 +40,6 @@ var PermissionProvisioningSynchronizer = class extends BaseProvisioningSynchroni
 			case ProvisioningEntityStrategyType.REPLACE:
 				input.attributes.id = attributes.id;
 				attributes = await this.repository.save(this.repository.create(input.attributes));
-				break;
 		}
 		else attributes = await this.repository.save(this.repository.create(input.attributes));
 		if (input.relations?.policies && input.relations.policies.length > 0) await this.synchronizePolicies(attributes, input.relations.policies);

package/dist/core/provisioning/synchronizer/permission/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","PermissionProvisioningSynchronizer","repository","policyRepository","permissionPolicyRepository","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","clientId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","policies","length","synchronizePolicies","permission","policyNames","Error","policyName","policy","findOneByName","trim","toLowerCase","existing","permissionId","policyId","entry","permissionRealmId","policyRealmId"],"sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPermissionRepository, IPolicyRepository } from '../../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PermissionProvisioningSynchronizerContext } from './types.ts';\n\nexport class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer<PermissionProvisioningEntity> {\n    protected repository : IPermissionRepository;\n\n    protected policyRepository?: IPolicyRepository;\n\n    protected permissionPolicyRepository?: IPermissionPolicyRepository;\n\n    constructor(ctx: PermissionProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PermissionProvisioningEntity): Promise<PermissionProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n            clientId: input.attributes.clientId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes,\n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (input.relations?.policies && input.relations.policies.length > 0) {\n            await this.synchronizePolicies(attributes, input.relations.policies);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n\n    private async synchronizePolicies(permission: Permission, policyNames: string[]): Promise<void> {\n        if (!this.policyRepository || !this.permissionPolicyRepository) {\n            throw new Error(\n                'Provisioning: policy/permissionPolicy repositories must be wired to attach policies to permissions.',\n            );\n        }\n\n        for (const policyName of policyNames) {\n            const policy = await this.policyRepository.findOneByName(policyName.trim().toLowerCase());\n            if (!policy) {\n                throw new Error(\n                    `Provisioning: policy '${policyName}' not found for permission '${permission.name}'.`,\n                );\n            }\n\n            const existing = await this.permissionPolicyRepository.findOneBy({\n                permissionId: permission.id,\n                policyId: policy.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.permissionPolicyRepository.create({\n                permissionId: permission.id,\n                permissionRealmId: permission.realmId,\n                policyId: policy.id,\n                policyRealmId: policy.realmId,\n            });\n            await this.permissionPolicyRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAaI,qCAAb,cAAwDD,6BAAAA;CAC1CE;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;EACxD,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,6BAA6BC,IAAID;CAC1C;CAEA,MAAME,YAAYC,OAA4E;EAC1F,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWX,oCAAoCQ,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKP,WAAWS,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;GACrCC,UAAUP,MAAME,WAAWK,YAAY;EAC3C,CAAA;EAEA,IAAIJ,SAASK,SAASjB,+BAA+BkB,QAAQ;GACzD,IAAIP,YACA,MAAM,KAAKP,WAAWe,OAAOR,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASK,MAAjB;GACI,KAAKjB,+BAA+BoB;IAChCT,aAAa,KAAKP,WAAWiB,MACzBV,YACAC,SAASD,aACLZ,WAAWU,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKP,WAAWkB,KAAKX,UAAAA;IACxC;GACJ,KAAKX,+BAA+BuB;IAChCd,MAAME,WAAWa,KAAKb,WAAWa;IACjCb,aAAa,MAAM,KAAKP,WAAWkB,KAAK,KAAKlB,WAAWqB,OAAOhB,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKP,WAAWkB,KAAK,KAAKlB,WAAWqB,OAAOhB,MAAME,UAAU,CAAA;EAGnF,IAAIF,MAAMiB,WAAWC,YAAYlB,MAAMiB,UAAUC,SAASC,SAAS,GAC/D,MAAM,KAAKC,oBAAoBlB,YAAYF,MAAMiB,UAAUC,QAAQ;EAGvE,OAAO;GACH,GAAGlB;GACHE;EACJ;CACJ;CAEA,MAAckB,oBAAoBC,YAAwBC,aAAsC;EAC5F,IAAI,CAAC,KAAK1B,oBAAoB,CAAC,KAAKC,4BAChC,MAAM,IAAI0B,MACN,qGAAA;EAIR,KAAK,MAAMC,cAAcF,aAAa;GAClC,MAAMG,SAAS,MAAM,KAAK7B,iBAAiB8B,cAAcF,WAAWG,KAAI,CAAA,CAAGC,YAAW,CAAA;GACtF,IAAI,CAACH,QACD,MAAM,IAAIF,MACN,yBAAyBC,WAAW,8BAA8BH,WAAWhB,KAAK,GAAG;GAQ7F,IAAIwB,MAJmB,KAAKhC,2BAA2BO,UAAU;IAC7D0B,cAAcT,WAAWN;IACzBgB,UAAUN,OAAOV;GACrB,CAAA,GAEI;GAGJ,MAAMiB,QAAQ,KAAKnC,2BAA2BmB,OAAO;IACjDc,cAAcT,WAAWN;IACzBkB,mBAAmBZ,WAAWf;IAC9ByB,UAAUN,OAAOV;IACjBmB,eAAeT,OAAOnB;GAC1B,CAAA;GACA,MAAM,KAAKT,2BAA2BgB,KAAKmB,KAAAA;EAC/C;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","PermissionProvisioningSynchronizer","repository","policyRepository","permissionPolicyRepository","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","clientId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","policies","length","synchronizePolicies","permission","policyNames","Error","policyName","policy","findOneByName","trim","toLowerCase","existing","permissionId","policyId","entry","permissionRealmId","policyRealmId"],"sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPermissionRepository, IPolicyRepository } from '../../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PermissionProvisioningSynchronizerContext } from './types.ts';\n\nexport class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer<PermissionProvisioningEntity> {\n    protected repository : IPermissionRepository;\n\n    protected policyRepository?: IPolicyRepository;\n\n    protected permissionPolicyRepository?: IPermissionPolicyRepository;\n\n    constructor(ctx: PermissionProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PermissionProvisioningEntity): Promise<PermissionProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n            clientId: input.attributes.clientId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes,\n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (input.relations?.policies && input.relations.policies.length > 0) {\n            await this.synchronizePolicies(attributes, input.relations.policies);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n\n    private async synchronizePolicies(permission: Permission, policyNames: string[]): Promise<void> {\n        if (!this.policyRepository || !this.permissionPolicyRepository) {\n            throw new Error(\n                'Provisioning: policy/permissionPolicy repositories must be wired to attach policies to permissions.',\n            );\n        }\n\n        for (const policyName of policyNames) {\n            const policy = await this.policyRepository.findOneByName(policyName.trim().toLowerCase());\n            if (!policy) {\n                throw new Error(\n                    `Provisioning: policy '${policyName}' not found for permission '${permission.name}'.`,\n                );\n            }\n\n            const existing = await this.permissionPolicyRepository.findOneBy({\n                permissionId: permission.id,\n                policyId: policy.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.permissionPolicyRepository.create({\n                permissionId: permission.id,\n                permissionRealmId: permission.realmId,\n                policyId: policy.id,\n                policyRealmId: policy.realmId,\n            });\n            await this.permissionPolicyRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAaI,qCAAb,cAAwDD,6BAAAA;CAC1CE;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;EACxD,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,6BAA6BC,IAAID;CAC1C;CAEA,MAAME,YAAYC,OAA4E;EAC1F,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWX,oCAAoCQ,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKP,WAAWS,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;GACrCC,UAAUP,MAAME,WAAWK,YAAY;EAC3C,CAAA;EAEA,IAAIJ,SAASK,SAASjB,+BAA+BkB,QAAQ;GACzD,IAAIP,YACA,MAAM,KAAKP,WAAWe,OAAOR,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASK,MAAjB;GACI,KAAKjB,+BAA+BoB;IAChCT,aAAa,KAAKP,WAAWiB,MACzBV,YACAC,SAASD,aACLZ,WAAWU,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKP,WAAWkB,KAAKX,UAAAA;IACxC;GACJ,KAAKX,+BAA+BuB;IAChCd,MAAME,WAAWa,KAAKb,WAAWa;IACjCb,aAAa,MAAM,KAAKP,WAAWkB,KAAK,KAAKlB,WAAWqB,OAAOhB,MAAME,UAAU,CAAA;EAEvF;OAEAA,aAAa,MAAM,KAAKP,WAAWkB,KAAK,KAAKlB,WAAWqB,OAAOhB,MAAME,UAAU,CAAA;EAGnF,IAAIF,MAAMiB,WAAWC,YAAYlB,MAAMiB,UAAUC,SAASC,SAAS,GAC/D,MAAM,KAAKC,oBAAoBlB,YAAYF,MAAMiB,UAAUC,QAAQ;EAGvE,OAAO;GACH,GAAGlB;GACHE;EACJ;CACJ;CAEA,MAAckB,oBAAoBC,YAAwBC,aAAsC;EAC5F,IAAI,CAAC,KAAK1B,oBAAoB,CAAC,KAAKC,4BAChC,MAAM,IAAI0B,MACN,qGAAA;EAIR,KAAK,MAAMC,cAAcF,aAAa;GAClC,MAAMG,SAAS,MAAM,KAAK7B,iBAAiB8B,cAAcF,WAAWG,KAAI,CAAA,CAAGC,YAAW,CAAA;GACtF,IAAI,CAACH,QACD,MAAM,IAAIF,MACN,yBAAyBC,WAAW,8BAA8BH,WAAWhB,KAAK,GAAG;GAQ7F,IAAIwB,MAJmB,KAAKhC,2BAA2BO,UAAU;IAC7D0B,cAAcT,WAAWN;IACzBgB,UAAUN,OAAOV;GACrB,CAAA,GAEI;GAGJ,MAAMiB,QAAQ,KAAKnC,2BAA2BmB,OAAO;IACjDc,cAAcT,WAAWN;IACzBkB,mBAAmBZ,WAAWf;IAC9ByB,UAAUN,OAAOV;IACjBmB,eAAeT,OAAOnB;GAC1B,CAAA;GACA,MAAM,KAAKT,2BAA2BgB,KAAKmB,KAAAA;EAC/C;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/realm/module.mjs

@@ -42,7 +42,6 @@ var RealmProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 			case ProvisioningEntityStrategyType.REPLACE:
 				input.attributes.id = attributes.id;
 				attributes = await this.repository.save(this.repository.create(input.attributes));
-				break;
 		}
 		else attributes = await this.repository.save(this.repository.create(input.attributes));
 		if (input.relations && input.relations.scopes) {

package/dist/core/provisioning/synchronizer/realm/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","RealmProvisioningSynchronizer","repository","clientSynchronizer","permissionSynchronizer","roleSynchronizer","userSynchronizer","scopeSynchronizer","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","scopes","map","child","realmId","realm","synchronizeMany","clients","permissions","roles","users"],"sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IRealmRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity, ScopeProvisioningEntity } from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { RealmProvisioningEntity } from '../../entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RealmProvisioningSynchronizerContext } from './types.ts';\n\nexport class RealmProvisioningSynchronizer extends BaseProvisioningSynchronizer<RealmProvisioningEntity> {\n    protected repository : IRealmRepository;\n\n    protected clientSynchronizer: IProvisioningSynchronizer<ClientProvisioningEntity>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    protected userSynchronizer: IProvisioningSynchronizer<UserProvisioningEntity>;\n\n    protected scopeSynchronizer : IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n    constructor(ctx: RealmProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.clientSynchronizer = ctx.clientSynchronizer;\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n        this.userSynchronizer = ctx.userSynchronizer;\n        this.scopeSynchronizer = ctx.scopeSynchronizer;\n    }\n\n    async synchronize(input: RealmProvisioningEntity): Promise<RealmProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n        let attributes = await this.repository.findOneBy({ name: input.attributes.name });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        // Scopes first: they are leaf entities carrying no relations of their\n        // own, and a client below may bind them through `realmScopes`.\n        if (input.relations && input.relations.scopes) {\n            const scopes = input.relations.scopes.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.scopeSynchronizer.synchronizeMany(scopes);\n        }\n\n        if (input.relations && input.relations.clients) {\n            const clients = input.relations.clients.map(\n                (child) => {\n                    child.attributes.realmId = attributes.id;\n                    child.attributes.realm = attributes;\n                    return child;\n                },\n            );\n\n            await this.clientSynchronizer.synchronizeMany(clients);\n        }\n\n        if (input.relations && input.relations.permissions) {\n            const permissions = input.relations.permissions.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(permissions);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const roles = input.relations.roles.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(roles);\n        }\n\n        if (input.relations && input.relations.users) {\n            const users = input.relations.users.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.userSynchronizer.synchronizeMany(users);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKN,aAAaM,IAAIN;EACtB,KAAKC,qBAAqBK,IAAIL;EAC9B,KAAKC,yBAAyBI,IAAIJ;EAClC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,oBAAoBC,IAAID;CACjC;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWd,oCAAoCW,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,KAAKV,WAAWY,UAAU,EAAEC,MAAML,MAAME,WAAWG,KAAK,CAAA;EAE/E,IAAIF,SAASG,SAASlB,+BAA+BmB,QAAQ;GACzD,IAAIL,YACA,MAAM,KAAKV,WAAWgB,OAAON,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASG,MAAjB;GACI,KAAKlB,+BAA+BqB;IAChCP,aAAa,KAAKV,WAAWkB,MACzBR,YACAC,SAASD,aACLf,WAAWa,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKV,WAAWmB,KAAKT,UAAAA;IACxC;GACJ,KAAKd,+BAA+BwB;IAChCZ,MAAME,WAAWW,KAAKX,WAAWW;IACjCX,aAAa,MAAM,KAAKV,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOd,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKV,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOd,MAAME,UAAU,CAAA;EAKnF,IAAIF,MAAMe,aAAaf,MAAMe,UAAUC,QAAQ;GAC3C,MAAMA,SAAShB,MAAMe,UAAUC,OAAOC,KAAKC,UAAAA;IACvCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKrB,kBAAkBwB,gBAAgBL,MAAAA;EACjD;EAEA,IAAIhB,MAAMe,aAAaf,MAAMe,UAAUO,SAAS;GAC5C,MAAMA,UAAUtB,MAAMe,UAAUO,QAAQL,KACnCC,UAAAA;IACGA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAGJ,MAAM,KAAKzB,mBAAmB4B,gBAAgBC,OAAAA;EAClD;EAEA,IAAItB,MAAMe,aAAaf,MAAMe,UAAUQ,aAAa;GAChD,MAAMA,cAAcvB,MAAMe,UAAUQ,YAAYN,KAAKC,UAAAA;IACjDA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKxB,uBAAuB2B,gBAAgBE,WAAAA;EACtD;EAEA,IAAIvB,MAAMe,aAAaf,MAAMe,UAAUS,OAAO;GAC1C,MAAMA,QAAQxB,MAAMe,UAAUS,MAAMP,KAAKC,UAAAA;IACrCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKvB,iBAAiB0B,gBAAgBG,KAAAA;EAChD;EAEA,IAAIxB,MAAMe,aAAaf,MAAMe,UAAUU,OAAO;GAC1C,MAAMA,QAAQzB,MAAMe,UAAUU,MAAMR,KAAKC,UAAAA;IACrCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKtB,iBAAiByB,gBAAgBI,KAAAA;EAChD;EAEA,OAAO;GACH,GAAGzB;GACHE;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","RealmProvisioningSynchronizer","repository","clientSynchronizer","permissionSynchronizer","roleSynchronizer","userSynchronizer","scopeSynchronizer","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","scopes","map","child","realmId","realm","synchronizeMany","clients","permissions","roles","users"],"sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IRealmRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity, ScopeProvisioningEntity } from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { RealmProvisioningEntity } from '../../entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RealmProvisioningSynchronizerContext } from './types.ts';\n\nexport class RealmProvisioningSynchronizer extends BaseProvisioningSynchronizer<RealmProvisioningEntity> {\n    protected repository : IRealmRepository;\n\n    protected clientSynchronizer: IProvisioningSynchronizer<ClientProvisioningEntity>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    protected userSynchronizer: IProvisioningSynchronizer<UserProvisioningEntity>;\n\n    protected scopeSynchronizer : IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n    constructor(ctx: RealmProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.clientSynchronizer = ctx.clientSynchronizer;\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n        this.userSynchronizer = ctx.userSynchronizer;\n        this.scopeSynchronizer = ctx.scopeSynchronizer;\n    }\n\n    async synchronize(input: RealmProvisioningEntity): Promise<RealmProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n        let attributes = await this.repository.findOneBy({ name: input.attributes.name });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        // Scopes first: they are leaf entities carrying no relations of their\n        // own, and a client below may bind them through `realmScopes`.\n        if (input.relations && input.relations.scopes) {\n            const scopes = input.relations.scopes.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.scopeSynchronizer.synchronizeMany(scopes);\n        }\n\n        if (input.relations && input.relations.clients) {\n            const clients = input.relations.clients.map(\n                (child) => {\n                    child.attributes.realmId = attributes.id;\n                    child.attributes.realm = attributes;\n                    return child;\n                },\n            );\n\n            await this.clientSynchronizer.synchronizeMany(clients);\n        }\n\n        if (input.relations && input.relations.permissions) {\n            const permissions = input.relations.permissions.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(permissions);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const roles = input.relations.roles.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(roles);\n        }\n\n        if (input.relations && input.relations.users) {\n            const users = input.relations.users.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.userSynchronizer.synchronizeMany(users);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKN,aAAaM,IAAIN;EACtB,KAAKC,qBAAqBK,IAAIL;EAC9B,KAAKC,yBAAyBI,IAAIJ;EAClC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,oBAAoBC,IAAID;CACjC;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWd,oCAAoCW,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,KAAKV,WAAWY,UAAU,EAAEC,MAAML,MAAME,WAAWG,KAAK,CAAA;EAE/E,IAAIF,SAASG,SAASlB,+BAA+BmB,QAAQ;GACzD,IAAIL,YACA,MAAM,KAAKV,WAAWgB,OAAON,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASG,MAAjB;GACI,KAAKlB,+BAA+BqB;IAChCP,aAAa,KAAKV,WAAWkB,MACzBR,YACAC,SAASD,aACLf,WAAWa,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKV,WAAWmB,KAAKT,UAAAA;IACxC;GACJ,KAAKd,+BAA+BwB;IAChCZ,MAAME,WAAWW,KAAKX,WAAWW;IACjCX,aAAa,MAAM,KAAKV,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOd,MAAME,UAAU,CAAA;EAEvF;OAEAA,aAAa,MAAM,KAAKV,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOd,MAAME,UAAU,CAAA;EAKnF,IAAIF,MAAMe,aAAaf,MAAMe,UAAUC,QAAQ;GAC3C,MAAMA,SAAShB,MAAMe,UAAUC,OAAOC,KAAKC,UAAAA;IACvCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKrB,kBAAkBwB,gBAAgBL,MAAAA;EACjD;EAEA,IAAIhB,MAAMe,aAAaf,MAAMe,UAAUO,SAAS;GAC5C,MAAMA,UAAUtB,MAAMe,UAAUO,QAAQL,KACnCC,UAAAA;IACGA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAGJ,MAAM,KAAKzB,mBAAmB4B,gBAAgBC,OAAAA;EAClD;EAEA,IAAItB,MAAMe,aAAaf,MAAMe,UAAUQ,aAAa;GAChD,MAAMA,cAAcvB,MAAMe,UAAUQ,YAAYN,KAAKC,UAAAA;IACjDA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKxB,uBAAuB2B,gBAAgBE,WAAAA;EACtD;EAEA,IAAIvB,MAAMe,aAAaf,MAAMe,UAAUS,OAAO;GAC1C,MAAMA,QAAQxB,MAAMe,UAAUS,MAAMP,KAAKC,UAAAA;IACrCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKvB,iBAAiB0B,gBAAgBG,KAAAA;EAChD;EAEA,IAAIxB,MAAMe,aAAaf,MAAMe,UAAUU,OAAO;GAC1C,MAAMA,QAAQzB,MAAMe,UAAUU,MAAMR,KAAKC,UAAAA;IACrCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKtB,iBAAiByB,gBAAgBI,KAAAA;EAChD;EAEA,OAAO;GACH,GAAGzB;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/role/module.mjs

@@ -46,7 +46,6 @@ var RoleProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 			case ProvisioningEntityStrategyType.REPLACE:
 				input.attributes.id = attributes.id;
 				attributes = await this.repository.save(this.repository.create(input.attributes));
-				break;
 		}
 		else attributes = await this.repository.save(this.repository.create(input.attributes));
 		if (!input.relations) return {

package/dist/core/provisioning/synchronizer/role/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RoleProvisioningSynchronizer","repository","permissionResolver","permissionJunction","ctx","permissionRepository","rolePermissionRepository","ownerKey","ownerRealmKey","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","clientId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","globalPermissions","resolveGlobal","globalPermissionsExclude","length","excludeSet","Set","filter","p","has","realmPermissions","resolveRealm","permissions","defaultScope","globalPermissionsRealmScope","overrides","buildRealmScopeOverrides","permission","realmScope","get","Map","globalPermissionsRealmScopeOverrides","permissionNames","Object","entries","permName","set"],"sources":["../../../../../src/core/provisioning/synchronizer/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IRoleRepository } from '../../../entities/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RoleProvisioningSynchronizerContext } from './types.ts';\n\nexport class RoleProvisioningSynchronizer extends BaseProvisioningSynchronizer<RoleProvisioningEntity> {\n    protected repository : IRoleRepository;\n\n    protected permissionResolver : ProvisioningEntityResolver<Permission>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<RolePermission>;\n\n    constructor(ctx: RoleProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.rolePermissionRepository,\n            ownerKey: 'roleId',\n            ownerRealmKey: 'roleRealmId',\n        });\n    }\n\n    async synchronize(input: RoleProvisioningEntity): Promise<RoleProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n            clientId: input.attributes.clientId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes,\n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (!input.relations) {\n            return {\n                ...input,\n                attributes,\n            };\n        }\n\n        let globalPermissions = await this.permissionResolver.resolveGlobal(input.relations.globalPermissions);\n\n        if (input.relations.globalPermissionsExclude && input.relations.globalPermissionsExclude.length > 0) {\n            const excludeSet = new Set(input.relations.globalPermissionsExclude);\n            globalPermissions = globalPermissions.filter((p) => !excludeSet.has(p.name));\n        }\n\n        const realmPermissions = attributes.realmId ?\n            await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realmId) :\n            [];\n\n        const permissions = [\n            ...globalPermissions,\n            ...realmPermissions,\n        ];\n\n        if (permissions.length > 0) {\n            const defaultScope = input.relations.globalPermissionsRealmScope;\n\n            if (defaultScope) {\n                const overrides = this.buildRealmScopeOverrides(input);\n                for (const permission of permissions) {\n                    const realmScope = overrides.get(permission.name) ?? defaultScope;\n                    await this.permissionJunction.synchronize(\n                        attributes,\n                        [permission],\n                        'permissionId',\n                        'permissionRealmId',\n                        { realmScope },\n                    );\n                }\n            } else {\n                await this.permissionJunction.synchronize(\n                    attributes,\n                    permissions,\n                    'permissionId',\n                    'permissionRealmId',\n                );\n            }\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n\n    private buildRealmScopeOverrides(input: RoleProvisioningEntity): Map<string, string> {\n        const overrides = new Map<string, string>();\n        if (input.relations?.globalPermissionsRealmScopeOverrides) {\n            for (const [realmScope, permissionNames] of Object.entries(input.relations.globalPermissionsRealmScopeOverrides)) {\n                if (!permissionNames) {\n                    continue;\n                }\n                for (const permName of permissionNames) {\n                    overrides.set(permName, realmScope);\n                }\n            }\n        }\n        return overrides;\n    }\n}\n"],"mappings":";;;;;;;;;;;AAiBA,IAAaM,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,qBAAqB,IAAIJ,2BAA2BM,IAAIC,oBAAoB;EACjF,KAAKF,qBAAqB,IAAIJ,iCAAiC;GAC3DE,YAAYG,IAAIE;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAMC,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWjB,oCAAoCc,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,KAAKX,WAAWa,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;GACrCC,UAAUP,MAAME,WAAWK,YAAY;EAC3C,CAAA;EAEA,IAAIJ,SAASK,SAASvB,+BAA+BwB,QAAQ;GACzD,IAAIP,YACA,MAAM,KAAKX,WAAWmB,OAAOR,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASK,MAAjB;GACI,KAAKvB,+BAA+B0B;IAChCT,aAAa,KAAKX,WAAWqB,MACzBV,YACAC,SAASD,aACLlB,WAAWgB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKX,WAAWsB,KAAKX,UAAAA;IACxC;GACJ,KAAKjB,+BAA+B6B;IAChCd,MAAME,WAAWa,KAAKb,WAAWa;IACjCb,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;EAGnF,IAAI,CAACF,MAAMiB,WACP,OAAO;GACH,GAAGjB;GACHE;EACJ;EAGJ,IAAIgB,oBAAoB,MAAM,KAAK1B,mBAAmB2B,cAAcnB,MAAMiB,UAAUC,iBAAiB;EAErG,IAAIlB,MAAMiB,UAAUG,4BAA4BpB,MAAMiB,UAAUG,yBAAyBC,SAAS,GAAG;GACjG,MAAMC,aAAa,IAAIC,IAAIvB,MAAMiB,UAAUG,wBAAwB;GACnEF,oBAAoBA,kBAAkBM,QAAQC,MAAM,CAACH,WAAWI,IAAID,EAAEpB,IAAI,CAAA;EAC9E;EAEA,MAAMsB,mBAAmBzB,WAAWI,UAChC,MAAM,KAAKd,mBAAmBoC,aAAa5B,MAAMiB,UAAUU,kBAAkBzB,WAAWI,OAAO,IAC/F,CAAA;EAEJ,MAAMuB,cAAc,CACbX,GAAAA,mBACAS,GAAAA,gBACN;EAED,IAAIE,YAAYR,SAAS,GAAG;GACxB,MAAMS,eAAe9B,MAAMiB,UAAUc;GAErC,IAAID,cAAc;IACd,MAAME,YAAY,KAAKC,yBAAyBjC,KAAAA;IAChD,KAAK,MAAMkC,cAAcL,aAAa;KAClC,MAAMM,aAAaH,UAAUI,IAAIF,WAAW7B,IAAI,KAAKyB;KACrD,MAAM,KAAKrC,mBAAmBM,YAC1BG,YACA,CAACgC,UAAW,GACZ,gBACA,qBACA,EAAEC,WAAW,CAAA;IAErB;GACJ,OACI,MAAM,KAAK1C,mBAAmBM,YAC1BG,YACA2B,aACA,gBACA,mBAAA;EAGZ;EAEA,OAAO;GACH,GAAG7B;GACHE;EACJ;CACJ;CAEQ+B,yBAAyBjC,OAAoD;EACjF,MAAMgC,4BAAY,IAAIK,IAAAA;EACtB,IAAIrC,MAAMiB,WAAWqB,sCACjB,KAAK,MAAM,CAACH,YAAYI,oBAAoBC,OAAOC,QAAQzC,MAAMiB,UAAUqB,oCAAoC,GAAG;GAC9G,IAAI,CAACC,iBACD;GAEJ,KAAK,MAAMG,YAAYH,iBACnBP,UAAUW,IAAID,UAAUP,UAAAA;EAEhC;EAEJ,OAAOH;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RoleProvisioningSynchronizer","repository","permissionResolver","permissionJunction","ctx","permissionRepository","rolePermissionRepository","ownerKey","ownerRealmKey","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","clientId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","globalPermissions","resolveGlobal","globalPermissionsExclude","length","excludeSet","Set","filter","p","has","realmPermissions","resolveRealm","permissions","defaultScope","globalPermissionsRealmScope","overrides","buildRealmScopeOverrides","permission","realmScope","get","Map","globalPermissionsRealmScopeOverrides","permissionNames","Object","entries","permName","set"],"sources":["../../../../../src/core/provisioning/synchronizer/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IRoleRepository } from '../../../entities/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RoleProvisioningSynchronizerContext } from './types.ts';\n\nexport class RoleProvisioningSynchronizer extends BaseProvisioningSynchronizer<RoleProvisioningEntity> {\n    protected repository : IRoleRepository;\n\n    protected permissionResolver : ProvisioningEntityResolver<Permission>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<RolePermission>;\n\n    constructor(ctx: RoleProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.rolePermissionRepository,\n            ownerKey: 'roleId',\n            ownerRealmKey: 'roleRealmId',\n        });\n    }\n\n    async synchronize(input: RoleProvisioningEntity): Promise<RoleProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n            clientId: input.attributes.clientId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes,\n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (!input.relations) {\n            return {\n                ...input,\n                attributes,\n            };\n        }\n\n        let globalPermissions = await this.permissionResolver.resolveGlobal(input.relations.globalPermissions);\n\n        if (input.relations.globalPermissionsExclude && input.relations.globalPermissionsExclude.length > 0) {\n            const excludeSet = new Set(input.relations.globalPermissionsExclude);\n            globalPermissions = globalPermissions.filter((p) => !excludeSet.has(p.name));\n        }\n\n        const realmPermissions = attributes.realmId ?\n            await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realmId) :\n            [];\n\n        const permissions = [\n            ...globalPermissions,\n            ...realmPermissions,\n        ];\n\n        if (permissions.length > 0) {\n            const defaultScope = input.relations.globalPermissionsRealmScope;\n\n            if (defaultScope) {\n                const overrides = this.buildRealmScopeOverrides(input);\n                for (const permission of permissions) {\n                    const realmScope = overrides.get(permission.name) ?? defaultScope;\n                    await this.permissionJunction.synchronize(\n                        attributes,\n                        [permission],\n                        'permissionId',\n                        'permissionRealmId',\n                        { realmScope },\n                    );\n                }\n            } else {\n                await this.permissionJunction.synchronize(\n                    attributes,\n                    permissions,\n                    'permissionId',\n                    'permissionRealmId',\n                );\n            }\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n\n    private buildRealmScopeOverrides(input: RoleProvisioningEntity): Map<string, string> {\n        const overrides = new Map<string, string>();\n        if (input.relations?.globalPermissionsRealmScopeOverrides) {\n            for (const [realmScope, permissionNames] of Object.entries(input.relations.globalPermissionsRealmScopeOverrides)) {\n                if (!permissionNames) {\n                    continue;\n                }\n                for (const permName of permissionNames) {\n                    overrides.set(permName, realmScope);\n                }\n            }\n        }\n        return overrides;\n    }\n}\n"],"mappings":";;;;;;;;;;;AAiBA,IAAaM,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,qBAAqB,IAAIJ,2BAA2BM,IAAIC,oBAAoB;EACjF,KAAKF,qBAAqB,IAAIJ,iCAAiC;GAC3DE,YAAYG,IAAIE;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAMC,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWjB,oCAAoCc,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,KAAKX,WAAWa,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;GACrCC,UAAUP,MAAME,WAAWK,YAAY;EAC3C,CAAA;EAEA,IAAIJ,SAASK,SAASvB,+BAA+BwB,QAAQ;GACzD,IAAIP,YACA,MAAM,KAAKX,WAAWmB,OAAOR,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASK,MAAjB;GACI,KAAKvB,+BAA+B0B;IAChCT,aAAa,KAAKX,WAAWqB,MACzBV,YACAC,SAASD,aACLlB,WAAWgB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKX,WAAWsB,KAAKX,UAAAA;IACxC;GACJ,KAAKjB,+BAA+B6B;IAChCd,MAAME,WAAWa,KAAKb,WAAWa;IACjCb,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;EAEvF;OAEAA,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;EAGnF,IAAI,CAACF,MAAMiB,WACP,OAAO;GACH,GAAGjB;GACHE;EACJ;EAGJ,IAAIgB,oBAAoB,MAAM,KAAK1B,mBAAmB2B,cAAcnB,MAAMiB,UAAUC,iBAAiB;EAErG,IAAIlB,MAAMiB,UAAUG,4BAA4BpB,MAAMiB,UAAUG,yBAAyBC,SAAS,GAAG;GACjG,MAAMC,aAAa,IAAIC,IAAIvB,MAAMiB,UAAUG,wBAAwB;GACnEF,oBAAoBA,kBAAkBM,QAAQC,MAAM,CAACH,WAAWI,IAAID,EAAEpB,IAAI,CAAA;EAC9E;EAEA,MAAMsB,mBAAmBzB,WAAWI,UAChC,MAAM,KAAKd,mBAAmBoC,aAAa5B,MAAMiB,UAAUU,kBAAkBzB,WAAWI,OAAO,IAC/F,CAAA;EAEJ,MAAMuB,cAAc,CACbX,GAAAA,mBACAS,GAAAA,gBACN;EAED,IAAIE,YAAYR,SAAS,GAAG;GACxB,MAAMS,eAAe9B,MAAMiB,UAAUc;GAErC,IAAID,cAAc;IACd,MAAME,YAAY,KAAKC,yBAAyBjC,KAAAA;IAChD,KAAK,MAAMkC,cAAcL,aAAa;KAClC,MAAMM,aAAaH,UAAUI,IAAIF,WAAW7B,IAAI,KAAKyB;KACrD,MAAM,KAAKrC,mBAAmBM,YAC1BG,YACA,CAACgC,UAAW,GACZ,gBACA,qBACA,EAAEC,WAAW,CAAA;IAErB;GACJ,OACI,MAAM,KAAK1C,mBAAmBM,YAC1BG,YACA2B,aACA,gBACA,mBAAA;EAGZ;EAEA,OAAO;GACH,GAAG7B;GACHE;EACJ;CACJ;CAEQ+B,yBAAyBjC,OAAoD;EACjF,MAAMgC,4BAAY,IAAIK,IAAAA;EACtB,IAAIrC,MAAMiB,WAAWqB,sCACjB,KAAK,MAAM,CAACH,YAAYI,oBAAoBC,OAAOC,QAAQzC,MAAMiB,UAAUqB,oCAAoC,GAAG;GAC9G,IAAI,CAACC,iBACD;GAEJ,KAAK,MAAMG,YAAYH,iBACnBP,UAAUW,IAAID,UAAUP,UAAAA;EAEhC;EAEJ,OAAOH;CACX;AACJ"}

package/dist/core/provisioning/synchronizer/scope/module.mjs

@@ -35,7 +35,6 @@ var ScopeProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 			case ProvisioningEntityStrategyType.REPLACE:
 				input.attributes.id = attributes.id;
 				attributes = await this.repository.save(this.repository.create(input.attributes));
-				break;
 		}
 		else attributes = await this.repository.save(this.repository.create(input.attributes));
 		return {

package/dist/core/provisioning/synchronizer/scope/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ScopeProvisioningSynchronizer","repository","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create"],"sources":["../../../../../src/core/provisioning/synchronizer/scope/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IScopeRepository } from '../../../entities/index.ts';\nimport type { ScopeProvisioningEntity } from '../../entities/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { ScopeProvisioningSynchronizerContext } from './types.ts';\n\nexport class ScopeProvisioningSynchronizer extends BaseProvisioningSynchronizer<ScopeProvisioningEntity> {\n    protected repository : IScopeRepository;\n\n    constructor(ctx: ScopeProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n    }\n\n    async synchronize(input: ScopeProvisioningEntity): Promise<ScopeProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWT,oCAAoCM,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKL,WAAWO,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAASd,+BAA+Be,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKL,WAAWY,OAAOP,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAKd,+BAA+BiB;IAChCR,aAAa,KAAKL,WAAWc,MACzBT,YACAC,SAASD,aACLV,WAAWQ,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKL,WAAWe,KAAKV,UAAAA;IACxC;GACJ,KAAKT,+BAA+BoB;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;EAGnF,OAAO;GACH,GAAGF;GACHE;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ScopeProvisioningSynchronizer","repository","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create"],"sources":["../../../../../src/core/provisioning/synchronizer/scope/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IScopeRepository } from '../../../entities/index.ts';\nimport type { ScopeProvisioningEntity } from '../../entities/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { ScopeProvisioningSynchronizerContext } from './types.ts';\n\nexport class ScopeProvisioningSynchronizer extends BaseProvisioningSynchronizer<ScopeProvisioningEntity> {\n    protected repository : IScopeRepository;\n\n    constructor(ctx: ScopeProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n    }\n\n    async synchronize(input: ScopeProvisioningEntity): Promise<ScopeProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWT,oCAAoCM,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKL,WAAWO,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAASd,+BAA+Be,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKL,WAAWY,OAAOP,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAKd,+BAA+BiB;IAChCR,aAAa,KAAKL,WAAWc,MACzBT,YACAC,SAASD,aACLV,WAAWQ,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKL,WAAWe,KAAKV,UAAAA;IACxC;GACJ,KAAKT,+BAA+BoB;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;EAEvF;OAEAA,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;EAGnF,OAAO;GACH,GAAGF;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/user/module.mjs

@@ -58,7 +58,6 @@ var UserProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 				input.attributes.email = input.attributes.email || attributes.email || (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : void 0);
 				input.attributes.id = attributes.id;
 				attributes = await this.userRepository.save(this.userRepository.create(input.attributes));
-				break;
 		}
 		else {
 			if (!input.attributes.email && input.attributes.name) input.attributes.email = buildUserFakeEmail(input.attributes.name);

package/dist/core/provisioning/synchronizer/user/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["buildUserFakeEmail","pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","UserProvisioningSynchronizer","userRepository","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","userPermissionRepository","ownerKey","ownerRealmKey","userRoleRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","includes","email","merge","save","REPLACE","undefined","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","clientPermissions","clientKeys","Object","keys","clientKey","client","entities","resolveClient","push","length","roles","globalRoles","realmRoles","clientRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Permission, \n    Role, \n    UserPermission, \n    UserRole,\n} from '@authup/core-kit';\nimport { buildUserFakeEmail } from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type {\n    IClientRepository,\n    IUserRepository,\n} from '../../../entities/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { UserProvisioningSynchronizerContext } from './types.ts';\n\nexport class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {\n    protected userRepository: IUserRepository;\n\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;\n\n    constructor(ctx: UserProvisioningSynchronizerContext) {\n        super();\n\n        this.userRepository = ctx.userRepository;\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userPermissionRepository,\n            ownerKey: 'userId',\n            ownerRealmKey: 'userRealmId',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userRoleRepository,\n            ownerKey: 'userId',\n            ownerRealmKey: 'userRealmId',\n        });\n    }\n\n    async synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.userRepository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.userRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    if (\n                        strategy.attributes &&\n                        strategy.attributes.includes('email')\n                    ) {\n                        input.attributes.email = input.attributes.email ||\n                            attributes.email ||\n                            buildUserFakeEmail(input.attributes.name || attributes.name);\n                    }\n\n                    attributes = this.userRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.userRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.email = input.attributes.email ||\n                        attributes.email ||\n                        (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);\n\n                    input.attributes.id = attributes.id;\n                    attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            if (!input.attributes.email && input.attributes.name) {\n                input.attributes.email = buildUserFakeEmail(input.attributes.name);\n            }\n\n            attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n        }\n\n        // Permissions (Global, Realm & Client)\n        const permissions : Permission[] = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realmId ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientPermissions) {\n            const clientKeys = Object.keys(input.relations.clientPermissions);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realmId: attributes.realmId,\n                });\n\n                if (client) {\n                    const entities = await this.permissionResolver.resolveClient(\n                        input.relations.clientPermissions[clientKey],\n                        attributes.realmId,\n                        client.id,\n                    );\n                    permissions.push(...entities);\n                }\n            }\n        }\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permissionId',\n                'permissionRealmId',\n            );\n        }\n\n        // Roles (Global, Realm & Client)\n        const roles : Role[] = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realmId ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientRoles) {\n            const clientKeys = Object.keys(input.relations.clientRoles);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realmId: attributes.realmId,\n                });\n\n                if (client) {\n                    const entities = await this.roleResolver.resolveClient(\n                        input.relations.clientRoles[clientKey],\n                        attributes.realmId,\n                        client.id,\n                    );\n                    roles.push(...entities);\n                }\n            }\n        }\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'roleId',\n                'roleRealmId',\n            );\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAaO,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKN,iBAAiBM,IAAIN;EAC1B,KAAKC,mBAAmBK,IAAIL;EAE5B,KAAKC,qBAAqB,IAAIL,2BAA2BS,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIN,2BAA2BS,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIN,iCAAiC;GAC3DW,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIP,iCAAiC;GACrDW,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWvB,oCAAoCoB,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKjB,eAAemB,UAAU;GACjDC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAAS5B,+BAA+B6B,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKjB,eAAewB,OAAOP,UAAAA;GAErC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAK5B,+BAA+B+B;IAChC,IACIP,SAASD,cACTC,SAASD,WAAWS,SAAS,OAAA,GAE7BX,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,SACXnC,mBAAmBuB,MAAME,WAAWG,QAAQH,WAAWG,IAAI;IAGnEH,aAAa,KAAKjB,eAAe4B,MAC7BX,YACAC,SAASD,aACLxB,WAAWsB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKjB,eAAe6B,KAAKZ,UAAAA;IAC5C;GACJ,KAAKvB,+BAA+BoC;IAChCf,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,UACVZ,MAAME,WAAWG,OAAO5B,mBAAmBuB,MAAME,WAAWG,IAAI,IAAIW,KAAAA;IAEzEhB,MAAME,WAAWe,KAAKf,WAAWe;IACjCf,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;IACvF;EACR;OACG;GACH,IAAI,CAACF,MAAME,WAAWU,SAASZ,MAAME,WAAWG,MAC5CL,MAAME,WAAWU,QAAQnC,mBAAmBuB,MAAME,WAAWG,IAAI;GAGrEH,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;EAC3F;EAGA,MAAMiB,cAA6B,CAC5B,GAAA,MAAM,KAAKhC,mBAAmBiC,cAC7BpB,MAAMqB,aAAarB,MAAMqB,UAAUC,iBAAiB,GAEpDpB,GAAAA,WAAWI,UACX,MAAM,KAAKnB,mBAAmBoC,aAC1BvB,MAAMqB,aAAarB,MAAMqB,UAAUG,kBACnCtB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUI,mBAAmB;GACtD,MAAMC,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUI,iBAAiB;GAChE,KAAK,MAAMI,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,SAASJ,WAAWI;IACxB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK5C,mBAAmB6C,cAC3ChC,MAAMqB,UAAUI,kBAAkBI,YAClC3B,WAAWI,SACXwB,OAAOb,EAAE;KAEbE,YAAYc,KAAI,GAAIF,QAAAA;IACxB;GACJ;EACJ;EAEA,IAAIZ,YAAYe,SAAS,GACrB,MAAM,KAAK7C,mBAAmBU,YAC1BG,YACAiB,aACA,gBACA,mBAAA;EAKR,MAAMgB,QAAiB,CAChB,GAAA,MAAM,KAAK/C,aAAagC,cACvBpB,MAAMqB,aAAarB,MAAMqB,UAAUe,WAAW,GAE9ClC,GAAAA,WAAWI,UACX,MAAM,KAAKlB,aAAamC,aACpBvB,MAAMqB,aAAarB,MAAMqB,UAAUgB,YACnCnC,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUiB,aAAa;GAChD,MAAMZ,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUiB,WAAW;GAC1D,KAAK,MAAMT,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,SAASJ,WAAWI;IACxB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK3C,aAAa4C,cACrChC,MAAMqB,UAAUiB,YAAYT,YAC5B3B,WAAWI,SACXwB,OAAOb,EAAE;KAEbkB,MAAMF,KAAI,GAAIF,QAAAA;IAClB;GACJ;EACJ;EAEA,IAAII,MAAMD,SAAS,GACf,MAAM,KAAK5C,aAAaS,YACpBG,YACAiC,OACA,UACA,aAAA;EAIR,OAAO;GACH,GAAGnC;GACHE;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["buildUserFakeEmail","pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","UserProvisioningSynchronizer","userRepository","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","userPermissionRepository","ownerKey","ownerRealmKey","userRoleRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","includes","email","merge","save","REPLACE","undefined","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","clientPermissions","clientKeys","Object","keys","clientKey","client","entities","resolveClient","push","length","roles","globalRoles","realmRoles","clientRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Permission, \n    Role, \n    UserPermission, \n    UserRole,\n} from '@authup/core-kit';\nimport { buildUserFakeEmail } from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type {\n    IClientRepository,\n    IUserRepository,\n} from '../../../entities/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { UserProvisioningSynchronizerContext } from './types.ts';\n\nexport class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {\n    protected userRepository: IUserRepository;\n\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;\n\n    constructor(ctx: UserProvisioningSynchronizerContext) {\n        super();\n\n        this.userRepository = ctx.userRepository;\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userPermissionRepository,\n            ownerKey: 'userId',\n            ownerRealmKey: 'userRealmId',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userRoleRepository,\n            ownerKey: 'userId',\n            ownerRealmKey: 'userRealmId',\n        });\n    }\n\n    async synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.userRepository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.userRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    if (\n                        strategy.attributes &&\n                        strategy.attributes.includes('email')\n                    ) {\n                        input.attributes.email = input.attributes.email ||\n                            attributes.email ||\n                            buildUserFakeEmail(input.attributes.name || attributes.name);\n                    }\n\n                    attributes = this.userRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.userRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.email = input.attributes.email ||\n                        attributes.email ||\n                        (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);\n\n                    input.attributes.id = attributes.id;\n                    attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            if (!input.attributes.email && input.attributes.name) {\n                input.attributes.email = buildUserFakeEmail(input.attributes.name);\n            }\n\n            attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n        }\n\n        // Permissions (Global, Realm & Client)\n        const permissions : Permission[] = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realmId ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientPermissions) {\n            const clientKeys = Object.keys(input.relations.clientPermissions);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realmId: attributes.realmId,\n                });\n\n                if (client) {\n                    const entities = await this.permissionResolver.resolveClient(\n                        input.relations.clientPermissions[clientKey],\n                        attributes.realmId,\n                        client.id,\n                    );\n                    permissions.push(...entities);\n                }\n            }\n        }\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permissionId',\n                'permissionRealmId',\n            );\n        }\n\n        // Roles (Global, Realm & Client)\n        const roles : Role[] = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realmId ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientRoles) {\n            const clientKeys = Object.keys(input.relations.clientRoles);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realmId: attributes.realmId,\n                });\n\n                if (client) {\n                    const entities = await this.roleResolver.resolveClient(\n                        input.relations.clientRoles[clientKey],\n                        attributes.realmId,\n                        client.id,\n                    );\n                    roles.push(...entities);\n                }\n            }\n        }\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'roleId',\n                'roleRealmId',\n            );\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAaO,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKN,iBAAiBM,IAAIN;EAC1B,KAAKC,mBAAmBK,IAAIL;EAE5B,KAAKC,qBAAqB,IAAIL,2BAA2BS,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIN,2BAA2BS,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIN,iCAAiC;GAC3DW,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIP,iCAAiC;GACrDW,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWvB,oCAAoCoB,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKjB,eAAemB,UAAU;GACjDC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAAS5B,+BAA+B6B,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKjB,eAAewB,OAAOP,UAAAA;GAErC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAK5B,+BAA+B+B;IAChC,IACIP,SAASD,cACTC,SAASD,WAAWS,SAAS,OAAA,GAE7BX,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,SACXnC,mBAAmBuB,MAAME,WAAWG,QAAQH,WAAWG,IAAI;IAGnEH,aAAa,KAAKjB,eAAe4B,MAC7BX,YACAC,SAASD,aACLxB,WAAWsB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKjB,eAAe6B,KAAKZ,UAAAA;IAC5C;GACJ,KAAKvB,+BAA+BoC;IAChCf,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,UACVZ,MAAME,WAAWG,OAAO5B,mBAAmBuB,MAAME,WAAWG,IAAI,IAAIW,KAAAA;IAEzEhB,MAAME,WAAWe,KAAKf,WAAWe;IACjCf,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;EAE/F;OACG;GACH,IAAI,CAACF,MAAME,WAAWU,SAASZ,MAAME,WAAWG,MAC5CL,MAAME,WAAWU,QAAQnC,mBAAmBuB,MAAME,WAAWG,IAAI;GAGrEH,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;EAC3F;EAGA,MAAMiB,cAA6B,CAC5B,GAAA,MAAM,KAAKhC,mBAAmBiC,cAC7BpB,MAAMqB,aAAarB,MAAMqB,UAAUC,iBAAiB,GAEpDpB,GAAAA,WAAWI,UACX,MAAM,KAAKnB,mBAAmBoC,aAC1BvB,MAAMqB,aAAarB,MAAMqB,UAAUG,kBACnCtB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUI,mBAAmB;GACtD,MAAMC,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUI,iBAAiB;GAChE,KAAK,MAAMI,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,SAASJ,WAAWI;IACxB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK5C,mBAAmB6C,cAC3ChC,MAAMqB,UAAUI,kBAAkBI,YAClC3B,WAAWI,SACXwB,OAAOb,EAAE;KAEbE,YAAYc,KAAI,GAAIF,QAAAA;IACxB;GACJ;EACJ;EAEA,IAAIZ,YAAYe,SAAS,GACrB,MAAM,KAAK7C,mBAAmBU,YAC1BG,YACAiB,aACA,gBACA,mBAAA;EAKR,MAAMgB,QAAiB,CAChB,GAAA,MAAM,KAAK/C,aAAagC,cACvBpB,MAAMqB,aAAarB,MAAMqB,UAAUe,WAAW,GAE9ClC,GAAAA,WAAWI,UACX,MAAM,KAAKlB,aAAamC,aACpBvB,MAAMqB,aAAarB,MAAMqB,UAAUgB,YACnCnC,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUiB,aAAa;GAChD,MAAMZ,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUiB,WAAW;GAC1D,KAAK,MAAMT,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,SAASJ,WAAWI;IACxB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK3C,aAAa4C,cACrChC,MAAMqB,UAAUiB,YAAYT,YAC5B3B,WAAWI,SACXwB,OAAOb,EAAE;KAEbkB,MAAMF,KAAI,GAAIF,QAAAA;IAClB;GACJ;EACJ;EAEA,IAAII,MAAMD,SAAS,GACf,MAAM,KAAK5C,aAAaS,YACpBG,YACAiC,OACA,UACA,aAAA;EAIR,OAAO;GACH,GAAGnC;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/types.d.ts

@@ -1,8 +1,18 @@
+import type { Realm } from '@authup/core-kit';
 import type { RootProvisioningEntity } from './entities/index.ts';
 import type { IContainer } from 'eldin';
 export interface IProvisioningSource {
     load(container: IContainer): Promise<RootProvisioningEntity>;
 }
+/**
+ * A provisioner invoked for one realm: at startup (backfill over every
+ * existing realm) and on runtime realm creation (`RealmService.save`).
+ * Implementations must be idempotent; a failure must never fail realm
+ * creation (the caller logs and continues).
+ */
+export interface IRealmProvisioner {
+    ensureForRealm(realm: Realm): Promise<void>;
+}
 export interface IProvisioningSynchronizer<T> {
     synchronize(input: T): Promise<T>;
     synchronizeMany(input: T[]): Promise<T[]>;

package/dist/core/provisioning/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/provisioning/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,MAAM,WAAW,mBAAmB;IAChC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC;IACxC,WAAW,CAAC,KAAK,EAAE,CAAC,GAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACnC,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,GAAI,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CAC9C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/provisioning/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,MAAM,WAAW,mBAAmB;IAChC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACjE;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAC9B,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC;IACxC,WAAW,CAAC,KAAK,EAAE,CAAC,GAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACnC,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,GAAI,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CAC9C"}

package/dist/core/provisioning/wildcard/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/wildcard/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/wildcard/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/wildcard/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry } from "./module.mjs";
+export { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry };

package/dist/core/provisioning/wildcard/module.d.ts

@@ -0,0 +1,53 @@
+import type { Realm } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
+import type { RealmProvisioningEntity, RealmProvisioningRelations } from '../entities/index.ts';
+import type { IProvisioningSynchronizer, IRealmProvisioner } from '../types.ts';
+import type { WildcardRealmProvisionerContext } from './types.ts';
+/**
+ * Split the wildcard entries (attributes.name === '*') out of
+ * `data.realms`, folding multiples (several files, several entries) into
+ * one via the composite merge rules. The folded entry is stripped to a
+ * relations-only shape: a wildcard entry is a SELECTOR over realms, so
+ * realm-level attributes and a realm-level strategy carry no meaning
+ * (validated away on the file path; discarded structurally here so
+ * programmatic sources get the same semantics).
+ */
+export declare function extractWildcardRealmEntry(data: {
+    realms?: RealmProvisioningEntity[];
+}): RealmProvisioningEntity | undefined;
+/**
+ * Deep-merge the wildcard entry UNDER every explicit realm entry (explicit
+ * wins per attribute, relation lists union, the explicit child's strategy
+ * wins when it carries one) so the graph sync covers those realms in
+ * one pass. Returns the merged relations per canonical realm name, kept
+ * PRISTINE (cloned before the sync mutates anything) for the runtime
+ * creation hook.
+ */
+export declare function expandWildcardRealmEntry(wildcard: RealmProvisioningEntity, data: {
+    realms?: RealmProvisioningEntity[];
+}): Map<string, RealmProvisioningRelations>;
+/**
+ * Applies the wildcard entry's relations to ONE realm, by synthesizing a
+ * realm provisioning entity and pushing it through the regular realm
+ * synchronizer (scopes -> clients -> permissions -> roles -> users; the
+ * realm row itself is resolved by name and, carrying no strategy, is
+ * never modified). The entry is deep-cloned per application: the
+ * synchronizer mutates its input (realmId stamping, `replace` writes the
+ * resolved row id back), so a shared object would leak one realm's ids
+ * into the next realm's sync.
+ */
+export declare class WildcardRealmProvisioner implements IRealmProvisioner {
+    protected relations: RealmProvisioningRelations;
+    protected relationsByRealmName?: Map<string, RealmProvisioningRelations>;
+    protected synchronizer: IProvisioningSynchronizer<RealmProvisioningEntity>;
+    protected logger?: Logger;
+    constructor(ctx: WildcardRealmProvisionerContext);
+    /**
+     * True when the loaded config also declares this realm explicitly:
+     * the startup graph sync already covers it (expansion), so the boot
+     * backfill loop skips it.
+     */
+    hasExplicitEntry(realm: Realm): boolean;
+    ensureForRealm(realm: Realm): Promise<void>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/wildcard/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/wildcard/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAEhG,OAAO,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAMlE;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACrC,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,uBAAuB,EAAE,CAAA;CAAE,GAC7C,uBAAuB,GAAG,SAAS,CAyBrC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACpC,QAAQ,EAAE,uBAAuB,EACjC,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,uBAAuB,EAAE,CAAA;CAAE,GAC7C,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CA8BzC;AAED;;;;;;;;;GASG;AACH,qBAAa,wBAAyB,YAAW,iBAAiB;IAC9D,SAAS,CAAC,SAAS,EAAE,0BAA0B,CAAC;IAEhD,SAAS,CAAC,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;IAE3E,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,+BAA+B;IAOhD;;;;OAIG;IACH,gBAAgB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO;IAOjC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBpD"}