@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/core/entities/client/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["and","defineSchema","eq","ne","or","EntityType","IdentityType","createFieldsReadGate","createRelationsReadGate","CLIENT_READ_PERMISSIONS","schemaMapping","realm","REALM","accessPolicy","POLICY","secretReadGate","actor","compiled","permissionEvaluator","compile","name","verdict","visible","push","condition","identity","type","CLIENT","data","id","clientSchema","fields","default","allowed","validateMany","secret","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICondition, KeyValidationVerdict } from '@rapiq/core';\nimport {\n    and,\n    defineSchema,\n    eq,\n    ne,\n    or,\n} from '@rapiq/core';\nimport type { Client } from '@authup/core-kit';\nimport { EntityType, IdentityType } from '@authup/core-kit';\nimport type { ActorContext } from '@authup/server-kit';\nimport { createFieldsReadGate } from '../../query/fields.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\n\nconst schemaMapping = { realm: EntityType.REALM, accessPolicy: EntityType.POLICY };\n\n/**\n * Per-row visibility gate for the `secret` column (issue #3322) —\n * schema-level, so it applies wherever the client schema governs a\n * projection: the `/clients` root AND the `include=client` paths of\n * client-permission / client-role / client-scope, which never run\n * `ClientService`'s read path.\n *\n * Only rows exposing a PLAINTEXT secret are guarded: `null`, hashed\n * and encrypted values stay visible to any actor that passed the read\n * pre-gate (the historical service semantics). A plaintext value is\n * additionally visible on the actor's OWN client row (the `getOne`\n * isMe bypass, list-shaped) and on rows the compiled permission\n * condition covers. A non-expressible (`post`) or settled-deny compile\n * yields no permission leg — fail closed for plaintext rows rather\n * than falling back to per-row evaluation.\n *\n * The outer `ne('realmId', null)` guard is semantically inert (clients\n * are realm-bound) but makes the condition fail closed on rows whose\n * gate columns were not fetched — an `ownOrNull` reach compiles to a\n * null-inclusive realm leg that would otherwise MATCH a missing\n * column. The SQL adapter force-selects every column the condition\n * reads (rapiq#830's operand projection), so this is defense in depth.\n */\nasync function secretReadGate(actor: ActorContext) : Promise<KeyValidationVerdict> {\n    const compiled = await actor.permissionEvaluator.compile({ name: CLIENT_READ_PERMISSIONS });\n    if (compiled.verdict === 'allow') {\n        return true;\n    }\n\n    const visible : ICondition[] = [\n        eq('secret', null),\n        eq('secretHashed', true),\n        eq('secretEncrypted', true),\n    ];\n\n    if (compiled.verdict === 'conditional') {\n        visible.push(compiled.condition);\n    }\n\n    if (\n        actor.identity &&\n        actor.identity.type === IdentityType.CLIENT &&\n        actor.identity.data.id\n    ) {\n        visible.push(eq('id', actor.identity.data.id));\n    }\n\n    return and(ne('realmId', null), or(...visible));\n}\n\nexport const clientSchema = defineSchema<Client>({\n    name: EntityType.CLIENT,\n    fields: {\n        default: [\n            'id',\n            'active',\n            'builtIn',\n            'name',\n            'displayName',\n            'description',\n            'secretHashed',\n            'secretEncrypted',\n            'baseUrl',\n            'rootUrl',\n            'redirectUri',\n            'postLogoutRedirectUri',\n            'grantTypes',\n            'scope',\n            'authMethod',\n            'tokenBindingMethod',\n            'accessPolicyId',\n            'realmId',\n            'updatedAt',\n            'createdAt',\n        ],\n        allowed: ['secret'],\n        validateMany: createFieldsReadGate({ secret: secretReadGate }),\n    },\n    filters: { allowed: ['id', 'name', 'realmId'] },\n    relations: { allowed: ['realm', 'accessPolicy'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;;AAsBA,MAAMU,gBAAgB;CAAEC,OAAON,WAAWO;CAAOC,cAAcR,WAAWS;AAAO;;;;;;;;;;;;;;;;;;;;;;;GAyBjF,eAAeC,eAAeC,OAAmB;CAC7C,MAAMC,WAAW,MAAMD,MAAME,oBAAoBC,QAAQ,EAAEC,MAAMX,wBAAwB,CAAA;CACzF,IAAIQ,SAASI,YAAY,SACrB,OAAO;CAGX,MAAMC,UAAyB;EAC3BpB,GAAG,UAAU,IAAA;EACbA,GAAG,gBAAgB,IAAA;EACnBA,GAAG,mBAAmB,IAAA;CACzB;CAED,IAAIe,SAASI,YAAY,eACrBC,QAAQC,KAAKN,SAASO,SAAS;CAGnC,IACIR,MAAMS,YACNT,MAAMS,SAASC,SAASpB,aAAaqB,UACrCX,MAAMS,SAASG,KAAKC,IAEpBP,QAAQC,KAAKrB,GAAG,MAAMc,MAAMS,SAASG,KAAKC,EAAE,CAAA;CAGhD,OAAO7B,IAAIG,GAAG,WAAW,IAAA,GAAOC,GAAAA,GAAMkB,OAAAA,CAAAA;AAC1C;AAEA,MAAaQ,eAAe7B,aAAqB;CAC7CmB,MAAMf,WAAWsB;CACjBI,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,QAAS;EACnBC,cAAc3B,qBAAqB,EAAE4B,QAAQpB,eAAe,CAAA;CAChE;CACAqB,SAAS,EAAEH,SAAS;EAAC;EAAM;EAAQ;CAAU,EAAC;CAC9CI,WAAW;EAAEJ,SAAS,CAAC,SAAS,cAAe;EAAEK,UAAU9B,wBAAwBE,aAAAA;CAAe;CAClG6B,MAAM,EAAEN,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDO,YAAY,EAAEC,UAAU,GAAG;CAC3B/B;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["and","defineSchema","eq","ne","or","EntityType","IdentityType","createFieldsReadGate","createRelationsReadGate","CLIENT_READ_PERMISSIONS","schemaMapping","realm","REALM","accessPolicy","POLICY","secretReadGate","actor","compiled","permissionEvaluator","compile","name","verdict","visible","push","condition","identity","type","CLIENT","data","id","clientSchema","indexes","fields","default","allowed","validateMany","secret","filters","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/client/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICondition, KeyValidationVerdict } from '@rapiq/core';\nimport {\n    and,\n    defineSchema,\n    eq,\n    ne,\n    or,\n} from '@rapiq/core';\nimport type { Client } from '@authup/core-kit';\nimport { EntityType, IdentityType } from '@authup/core-kit';\nimport type { ActorContext } from '@authup/server-kit';\nimport { createFieldsReadGate } from '../../query/fields.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\n\nconst schemaMapping = { realm: EntityType.REALM, accessPolicy: EntityType.POLICY };\n\n/**\n * Per-row visibility gate for the `secret` column (issue #3322) —\n * schema-level, so it applies wherever the client schema governs a\n * projection: the `/clients` root AND the `include=client` paths of\n * client-permission / client-role / client-scope, which never run\n * `ClientService`'s read path.\n *\n * Only rows exposing a PLAINTEXT secret are guarded: `null`, hashed\n * and encrypted values stay visible to any actor that passed the read\n * pre-gate (the historical service semantics). A plaintext value is\n * additionally visible on the actor's OWN client row (the `getOne`\n * isMe bypass, list-shaped) and on rows the compiled permission\n * condition covers. A non-expressible (`post`) or settled-deny compile\n * yields no permission leg — fail closed for plaintext rows rather\n * than falling back to per-row evaluation.\n *\n * The outer `ne('realmId', null)` guard is semantically inert (clients\n * are realm-bound) but makes the condition fail closed on rows whose\n * gate columns were not fetched — an `ownOrNull` reach compiles to a\n * null-inclusive realm leg that would otherwise MATCH a missing\n * column. The SQL adapter force-selects every column the condition\n * reads (rapiq#830's operand projection), so this is defense in depth.\n */\nasync function secretReadGate(actor: ActorContext) : Promise<KeyValidationVerdict> {\n    const compiled = await actor.permissionEvaluator.compile({ name: CLIENT_READ_PERMISSIONS });\n    if (compiled.verdict === 'allow') {\n        return true;\n    }\n\n    const visible : ICondition[] = [\n        eq('secret', null),\n        eq('secretHashed', true),\n        eq('secretEncrypted', true),\n    ];\n\n    if (compiled.verdict === 'conditional') {\n        visible.push(compiled.condition);\n    }\n\n    if (\n        actor.identity &&\n        actor.identity.type === IdentityType.CLIENT &&\n        actor.identity.data.id\n    ) {\n        visible.push(eq('id', actor.identity.data.id));\n    }\n\n    return and(ne('realmId', null), or(...visible));\n}\n\nexport const clientSchema = defineSchema<Client>({\n    name: EntityType.CLIENT,\n    indexes: [\n        ['id'],\n        ['name', 'realmId'],\n        ['displayName'],\n        ['realmId'],\n        ['active'],\n        ['builtIn'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        default: [\n            'id',\n            'active',\n            'builtIn',\n            'name',\n            'displayName',\n            'description',\n            'secretHashed',\n            'secretEncrypted',\n            'baseUrl',\n            'rootUrl',\n            'redirectUri',\n            'postLogoutRedirectUri',\n            'grantTypes',\n            'scope',\n            'authMethod',\n            'tokenBindingMethod',\n            'accessPolicyId',\n            'realmId',\n            'updatedAt',\n            'createdAt',\n        ],\n        allowed: ['secret'],\n        validateMany: createFieldsReadGate({ secret: secretReadGate }),\n    },\n    filters: { allowed: ['id', 'name', 'displayName', 'realmId', 'active', 'builtIn'], indexed: true },\n    relations: { allowed: ['realm', 'accessPolicy'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;;AAsBA,MAAMU,gBAAgB;CAAEC,OAAON,WAAWO;CAAOC,cAAcR,WAAWS;AAAO;;;;;;;;;;;;;;;;;;;;;;;GAyBjF,eAAeC,eAAeC,OAAmB;CAC7C,MAAMC,WAAW,MAAMD,MAAME,oBAAoBC,QAAQ,EAAEC,MAAMX,wBAAwB,CAAA;CACzF,IAAIQ,SAASI,YAAY,SACrB,OAAO;CAGX,MAAMC,UAAyB;EAC3BpB,GAAG,UAAU,IAAA;EACbA,GAAG,gBAAgB,IAAA;EACnBA,GAAG,mBAAmB,IAAA;CACzB;CAED,IAAIe,SAASI,YAAY,eACrBC,QAAQC,KAAKN,SAASO,SAAS;CAGnC,IACIR,MAAMS,YACNT,MAAMS,SAASC,SAASpB,aAAaqB,UACrCX,MAAMS,SAASG,KAAKC,IAEpBP,QAAQC,KAAKrB,GAAG,MAAMc,MAAMS,SAASG,KAAKC,EAAE,CAAA;CAGhD,OAAO7B,IAAIG,GAAG,WAAW,IAAA,GAAOC,GAAAA,GAAMkB,OAAAA,CAAAA;AAC1C;AAEA,MAAaQ,eAAe7B,aAAqB;CAC7CmB,MAAMf,WAAWsB;CACjBI,SAAS;EACL,CAAC,IAAK;EACN,CAAC,QAAQ,SAAU;EACnB,CAAC,aAAc;EACf,CAAC,SAAU;EACX,CAAC,QAAS;EACV,CAAC,SAAU;EACX,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,QAAS;EACnBC,cAAc5B,qBAAqB,EAAE6B,QAAQrB,eAAe,CAAA;CAChE;CACAsB,SAAS;EAAEH,SAAS;GAAC;GAAM;GAAQ;GAAe;GAAW;GAAU;EAAU;EAAEI,SAAS;CAAK;CACjGC,WAAW;EAAEL,SAAS,CAAC,SAAS,cAAe;EAAEM,UAAUhC,wBAAwBE,aAAAA;CAAe;CAClG+B,OAAO;EAAEP,SAAS;GAAC;GAAM;GAAa;EAAY;EAAEI,SAAS;CAAK;CAClEI,YAAY,EAAEC,UAAU,GAAG;CAC3BjC;AACJ,CAAA"}

package/dist/core/entities/client/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","CLIENT_READ_PERMISSIONS","decodeQuery","clientSchema","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","findMany","schema","getOne","idOrName","realmId","isMe","identity","type","data","id","entity","findOne","parameters","secret","secretEncrypted","secretHashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","CLIENT_UPDATE","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","builtIn","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","authMethod","SECRET","generateSecret","protect","created","delete","CLIENT_DELETE","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    CLIENT_RESERVED_NAMES,\n    ClientAuthMethod,\n    ClientValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientSchema } from './schema.ts';\n\nexport type ClientServiceContext = {\n    repository: IClientRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n    protected repository: IClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ClientValidator;\n\n    constructor(ctx: ClientServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ClientValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Client>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n\n        // The per-row `secret` visibility gate lives on the client SCHEMA\n        // (`fields.validateMany`, issue #3322), so it also covers the\n        // `include=client` paths served by other services; the repository\n        // layer redacts unauthorized values without dropping rows.\n        return this.repository.findMany(\n            await decodeQuery(query, { schema: clientSchema, actor }),\n        );\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<Client> {\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'client' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n        }\n\n        const entity = await this.repository.findOne(\n            idOrName,\n            await decodeQuery(query, {\n                schema: clientSchema, \n                parameters: ['fields', 'relations'], \n                actor, \n            }),\n            realmId,\n        );\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n        }\n\n        if (\n            !isMe &&\n            entity.secret &&\n            !entity.secretEncrypted &&\n            !entity.secretHashed\n        ) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: CLIENT_READ_PERMISSIONS,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Client,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Client | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneWithSecret(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'client' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n            }\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        // Reserve the system-provisioned client names (`system`, `web`) so an\n        // API caller can't create or rename a client onto them — that would\n        // collide on unique(name, realmId) or shadow the builtIn client.\n        // Provisioning and runtime hooks bypass this service, so they remain\n        // free to manage the reserved clients. builtIn clients are exempt\n        // (they ARE the provisioned ones) but API callers can never produce a\n        // builtIn client since the validator strips the flag.\n        if (\n            typeof validated.name === 'string' &&\n            CLIENT_RESERVED_NAMES.includes(validated.name) &&\n            !(entity && entity.builtIn && entity.name === validated.name)\n        ) {\n            throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n        }\n\n        await this.repository.validateJoinColumns(validated);\n        await this.repository.checkUniqueness(validated, entity || undefined);\n\n        const credentialsService = new ClientCredentialsService();\n\n        if (entity) {\n            if (\n                !isSelfEdit &&\n                !validated.realmId &&\n                !entity.realmId\n            ) {\n                const actorRealmId = this.getActorRealmId(actor);\n                if (actorRealmId) {\n                    validated.realmId = actorRealmId;\n                }\n            }\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_UPDATE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n            }\n\n            if (entity.authMethod === ClientAuthMethod.SECRET) {\n                if (!validated.secret && !entity.secret) {\n                    validated.secret = credentialsService.generateSecret();\n                }\n\n                if (validated.secret) {\n                    entity.secret = await credentialsService.protect(validated.secret, entity);\n                }\n            } else {\n                entity.secret = null;\n                entity.secretHashed = false;\n                entity.secretEncrypted = false;\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realmId) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        entity = this.repository.create(validated);\n\n        if (entity.authMethod === ClientAuthMethod.SECRET) {\n            if (!validated.secret) {\n                validated.secret = credentialsService.generateSecret();\n            }\n\n            entity.secret = await credentialsService.protect(validated.secret, validated);\n        } else {\n            entity.secret = null;\n            entity.secretHashed = false;\n            entity.secretEncrypted = false;\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,IAAae,gBAAb,cAAmCL,sBAAAA;CACrBM;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIV,gBAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAMjF,OAAO,KAAKI,WAAWU,SACnB,MAAMb,YAAYQ,OAAO;GAAEM,QAAQb;GAAcQ;EAAM,CAAA,CAAA;CAE/D;CAEA,MAAMM,OACFC,UACAP,OACAD,OACAS,SACe;EACf,IAAIC,OAAO,CAAC,CAACT,MAAMU,YACfV,MAAMU,SAASC,SAAS,aAEpBX,MAAMU,SAASE,KAAKC,OAAON,YAC3BP,MAAMU,SAASE,KAAKT,SAASI;EAGrC,IAAI,CAACE,MACD,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAGrF,MAAMwB,SAAS,MAAM,KAAKpB,WAAWqB,QACjCR,UACA,MAAMhB,YAAYQ,OAAO;GACrBM,QAAQb;GACRwB,YAAY,CAAC,UAAU,WAAY;GACnChB;EACJ,CAAA,GACAQ,OAAAA;EAEJ,IAAI,CAACM,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI2B,QAAQT,MAAMU,SAAUE,KAAKC,OAAOC,OAAOD,IAAI;GAC/CJ,OAAO;GACP,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EACrF;EAEA,IACI,CAACmB,QACDK,OAAOG,UACP,CAACH,OAAOI,mBACR,CAACJ,OAAOK,cAER,MAAMnB,MAAMC,oBAAoBmB,cAAc;GAC1CjB,MAAMb;GACNsB,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMS,OACFX,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKC,KAAAA,GAAWb,MAAMZ,KAAAA;EACpD,OAAOc;CACX;CAEA,MAAMY,OACFnB,UACAK,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKjB,UAAUK,MAAMZ,OAAO,EAAE2B,YAAY,KAAK,CAAA;EAC7E,OAAOb;CACX;CAEA,MAAMU,KACFjB,UACAK,MACAZ,OACA4B,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOlB,KAAKJ,YAAY,WAClC,MAAM,KAAKb,gBAAgBoC,QAAQnB,KAAKJ,OAAO,IAC/CiB,KAAAA;EAEJ,IAAIX;EACJ,IAAIP,UAAU;GACV,MAAMyB,QAA6B,CAAC;GACpC,IAAInD,OAAO0B,QAAAA,GACPyB,MAAMnB,KAAKN;QAEXyB,MAAM7B,OAAOI;GAGjB,IAAIuB,OACAE,MAAMxB,UAAUsB,MAAMjB;GAG1BC,SAAS,MAAM,KAAKpB,WAAWuC,kBAAkBD,KAAAA;GAGjD,IAAI,CAAClB,WAAWc,QAAQD,cAAcK,MAAMnB,KACxC,MAAM,IAAI/B,oBAAAA;EAElB,OAAO,IAAI8C,QAAQD,YACf,MAAM,IAAI7C,oBAAAA;EAGd,IAAIoD,aAAa;EACjB,IAAIpB,QAAQ;GACR,IAAI;IACA,MAAMd,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeiD,cAAc,CAAA;GACrF,SAASC,GAAG;IACR,IACI,CAACrC,MAAMU,YACPV,MAAMU,SAASC,SAAS,YACxBX,MAAMU,SAASE,KAAKC,OAAOC,OAAOD,IAElC,MAAMwB;IAEVH,aAAa;IACb,MAAMlC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAemD,mBAAmB,CAAA;GAC1F;GACAT,QAAQjD,eAAe2D;EAC3B,OAAO;GACH,MAAMvC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeqD,cAAc,CAAA;GACjFX,QAAQjD,eAAe6D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK9C,UAAU+C,IAAI/B,MAAM,EAAEiB,MAAM,CAAA;EASzD,IACI,OAAOa,UAAUvC,SAAS,YAC1BnB,sBAAsB4D,SAASF,UAAUvC,IAAI,KAC7C,EAAEW,UAAUA,OAAO+B,WAAW/B,OAAOX,SAASuC,UAAUvC,OAExD,MAAM,IAAIpB,gBAAgB,oBAAoB2D,UAAUvC,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAWoD,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKhD,WAAWqD,gBAAgBL,WAAW5B,UAAUW,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI3D,yBAAAA;EAE/B,IAAIyB,QAAQ;GACR,IACI,CAACoB,cACD,CAACQ,UAAUlC,WACX,CAACM,OAAON,SACV;IACE,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;IAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;GAE5B;GAEA,IAAIf,YACA,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAemD;IACrB1B,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaqB;KAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJ5B,SAAS,KAAKpB,WAAW0D,MAAMtC,QAAQ4B,SAAAA;GAEvC,IAAI,CAACR,YACD,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAeiD;IACrBxB,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaP;KAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAOuC,eAAepE,iBAAiBqE,QAAQ;IAC/C,IAAI,CAACZ,UAAUzB,UAAU,CAACH,OAAOG,QAC7ByB,UAAUzB,SAAS+B,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUzB,QACVH,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQH,MAAAA;GAE3E,OAAO;IACHA,OAAOG,SAAS;IAChBH,OAAOK,eAAe;IACtBL,OAAOI,kBAAkB;GAC7B;GAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;GAE3B,OAAO;IACHA;IACA2C,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUlC,SAAS;GACpB,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;GAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;EAE5B;EAEA,MAAMjD,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAeqD;GACrB5B,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaqB;IAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA5B,SAAS,KAAKpB,WAAW6B,OAAOmB,SAAAA;EAEhC,IAAI5B,OAAOuC,eAAepE,iBAAiBqE,QAAQ;GAC/C,IAAI,CAACZ,UAAUzB,QACXyB,UAAUzB,SAAS+B,mBAAmBO,eAAc;GAGxDzC,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQyB,SAAAA;EACvE,OAAO;GACH5B,OAAOG,SAAS;GAChBH,OAAOK,eAAe;GACtBL,OAAOI,kBAAkB;EAC7B;EAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;EAE3B,OAAO;GACHA;GACA2C,SAAS;EACb;CACJ;CAEA,MAAMC,OACF7C,IACAb,OACe;EACf,MAAMA,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAewE,cAAc,CAAA;EAEjF,MAAM7C,SAAS,MAAM,KAAKpB,WAAWkE,UAAU,EAAE/C,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAewE;GACrB/C,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAED,IAAIgD,aAAa/C;EACzB,MAAM,KAAKpB,WAAWoE,OAAOhD,MAAAA;EAC7BA,OAAOD,KAAKgD;EAEZ,OAAO/C;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","CLIENT_READ_PERMISSIONS","decodeQuery","clientSchema","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","findMany","schema","getOne","idOrName","realmId","isMe","identity","type","data","id","entity","findOne","parameters","secret","secretEncrypted","secretHashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","CLIENT_UPDATE","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","builtIn","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","authMethod","SECRET","generateSecret","protect","created","delete","CLIENT_DELETE","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    CLIENT_RESERVED_NAMES,\n    ClientAuthMethod,\n    ClientValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientSchema } from './schema.ts';\n\nexport type ClientServiceContext = {\n    repository: IClientRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n    protected repository: IClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ClientValidator;\n\n    constructor(ctx: ClientServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ClientValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Client>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n\n        // The per-row `secret` visibility gate lives on the client SCHEMA\n        // (`fields.validateMany`, issue #3322), so it also covers the\n        // `include=client` paths served by other services; the repository\n        // layer redacts unauthorized values without dropping rows.\n        return this.repository.findMany(\n            await decodeQuery(query, { schema: clientSchema, actor }),\n        );\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<Client> {\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'client' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n        }\n\n        const entity = await this.repository.findOne(\n            idOrName,\n            await decodeQuery(query, {\n                schema: clientSchema, \n                parameters: ['fields', 'relations'], \n                actor, \n            }),\n            realmId,\n        );\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n        }\n\n        if (\n            !isMe &&\n            entity.secret &&\n            !entity.secretEncrypted &&\n            !entity.secretHashed\n        ) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: CLIENT_READ_PERMISSIONS,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Client,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Client | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneWithSecret(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'client' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n            }\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        // Reserve the system-provisioned client names (`system`, the console\n        // clients) so an API caller can't create or rename a client onto them — that would\n        // collide on unique(name, realmId) or shadow the builtIn client.\n        // Provisioning and runtime hooks bypass this service, so they remain\n        // free to manage the reserved clients. builtIn clients are exempt\n        // (they ARE the provisioned ones) but API callers can never produce a\n        // builtIn client since the validator strips the flag.\n        if (\n            typeof validated.name === 'string' &&\n            CLIENT_RESERVED_NAMES.includes(validated.name) &&\n            !(entity && entity.builtIn && entity.name === validated.name)\n        ) {\n            throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n        }\n\n        await this.repository.validateJoinColumns(validated);\n        await this.repository.checkUniqueness(validated, entity || undefined);\n\n        const credentialsService = new ClientCredentialsService();\n\n        if (entity) {\n            if (\n                !isSelfEdit &&\n                !validated.realmId &&\n                !entity.realmId\n            ) {\n                const actorRealmId = this.getActorRealmId(actor);\n                if (actorRealmId) {\n                    validated.realmId = actorRealmId;\n                }\n            }\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_UPDATE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n            }\n\n            if (entity.authMethod === ClientAuthMethod.SECRET) {\n                if (!validated.secret && !entity.secret) {\n                    validated.secret = credentialsService.generateSecret();\n                }\n\n                if (validated.secret) {\n                    entity.secret = await credentialsService.protect(validated.secret, entity);\n                }\n            } else {\n                entity.secret = null;\n                entity.secretHashed = false;\n                entity.secretEncrypted = false;\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realmId) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        entity = this.repository.create(validated);\n\n        if (entity.authMethod === ClientAuthMethod.SECRET) {\n            if (!validated.secret) {\n                validated.secret = credentialsService.generateSecret();\n            }\n\n            entity.secret = await credentialsService.protect(validated.secret, validated);\n        } else {\n            entity.secret = null;\n            entity.secretHashed = false;\n            entity.secretEncrypted = false;\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,IAAae,gBAAb,cAAmCL,sBAAAA;CACrBM;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIV,gBAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAMjF,OAAO,KAAKI,WAAWU,SACnB,MAAMb,YAAYQ,OAAO;GAAEM,QAAQb;GAAcQ;EAAM,CAAA,CAAA;CAE/D;CAEA,MAAMM,OACFC,UACAP,OACAD,OACAS,SACe;EACf,IAAIC,OAAO,CAAC,CAACT,MAAMU,YACfV,MAAMU,SAASC,SAAS,aAEpBX,MAAMU,SAASE,KAAKC,OAAON,YAC3BP,MAAMU,SAASE,KAAKT,SAASI;EAGrC,IAAI,CAACE,MACD,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAGrF,MAAMwB,SAAS,MAAM,KAAKpB,WAAWqB,QACjCR,UACA,MAAMhB,YAAYQ,OAAO;GACrBM,QAAQb;GACRwB,YAAY,CAAC,UAAU,WAAY;GACnChB;EACJ,CAAA,GACAQ,OAAAA;EAEJ,IAAI,CAACM,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI2B,QAAQT,MAAMU,SAAUE,KAAKC,OAAOC,OAAOD,IAAI;GAC/CJ,OAAO;GACP,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EACrF;EAEA,IACI,CAACmB,QACDK,OAAOG,UACP,CAACH,OAAOI,mBACR,CAACJ,OAAOK,cAER,MAAMnB,MAAMC,oBAAoBmB,cAAc;GAC1CjB,MAAMb;GACNsB,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMS,OACFX,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKC,KAAAA,GAAWb,MAAMZ,KAAAA;EACpD,OAAOc;CACX;CAEA,MAAMY,OACFnB,UACAK,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKjB,UAAUK,MAAMZ,OAAO,EAAE2B,YAAY,KAAK,CAAA;EAC7E,OAAOb;CACX;CAEA,MAAMU,KACFjB,UACAK,MACAZ,OACA4B,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOlB,KAAKJ,YAAY,WAClC,MAAM,KAAKb,gBAAgBoC,QAAQnB,KAAKJ,OAAO,IAC/CiB,KAAAA;EAEJ,IAAIX;EACJ,IAAIP,UAAU;GACV,MAAMyB,QAA6B,CAAC;GACpC,IAAInD,OAAO0B,QAAAA,GACPyB,MAAMnB,KAAKN;QAEXyB,MAAM7B,OAAOI;GAGjB,IAAIuB,OACAE,MAAMxB,UAAUsB,MAAMjB;GAG1BC,SAAS,MAAM,KAAKpB,WAAWuC,kBAAkBD,KAAAA;GAGjD,IAAI,CAAClB,WAAWc,QAAQD,cAAcK,MAAMnB,KACxC,MAAM,IAAI/B,oBAAAA;EAElB,OAAO,IAAI8C,QAAQD,YACf,MAAM,IAAI7C,oBAAAA;EAGd,IAAIoD,aAAa;EACjB,IAAIpB,QAAQ;GACR,IAAI;IACA,MAAMd,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeiD,cAAc,CAAA;GACrF,SAASC,GAAG;IACR,IACI,CAACrC,MAAMU,YACPV,MAAMU,SAASC,SAAS,YACxBX,MAAMU,SAASE,KAAKC,OAAOC,OAAOD,IAElC,MAAMwB;IAEVH,aAAa;IACb,MAAMlC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAemD,mBAAmB,CAAA;GAC1F;GACAT,QAAQjD,eAAe2D;EAC3B,OAAO;GACH,MAAMvC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeqD,cAAc,CAAA;GACjFX,QAAQjD,eAAe6D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK9C,UAAU+C,IAAI/B,MAAM,EAAEiB,MAAM,CAAA;EASzD,IACI,OAAOa,UAAUvC,SAAS,YAC1BnB,sBAAsB4D,SAASF,UAAUvC,IAAI,KAC7C,EAAEW,UAAUA,OAAO+B,WAAW/B,OAAOX,SAASuC,UAAUvC,OAExD,MAAM,IAAIpB,gBAAgB,oBAAoB2D,UAAUvC,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAWoD,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKhD,WAAWqD,gBAAgBL,WAAW5B,UAAUW,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI3D,yBAAAA;EAE/B,IAAIyB,QAAQ;GACR,IACI,CAACoB,cACD,CAACQ,UAAUlC,WACX,CAACM,OAAON,SACV;IACE,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;IAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;GAE5B;GAEA,IAAIf,YACA,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAemD;IACrB1B,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaqB;KAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJ5B,SAAS,KAAKpB,WAAW0D,MAAMtC,QAAQ4B,SAAAA;GAEvC,IAAI,CAACR,YACD,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAeiD;IACrBxB,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaP;KAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAOuC,eAAepE,iBAAiBqE,QAAQ;IAC/C,IAAI,CAACZ,UAAUzB,UAAU,CAACH,OAAOG,QAC7ByB,UAAUzB,SAAS+B,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUzB,QACVH,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQH,MAAAA;GAE3E,OAAO;IACHA,OAAOG,SAAS;IAChBH,OAAOK,eAAe;IACtBL,OAAOI,kBAAkB;GAC7B;GAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;GAE3B,OAAO;IACHA;IACA2C,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUlC,SAAS;GACpB,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;GAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;EAE5B;EAEA,MAAMjD,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAeqD;GACrB5B,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaqB;IAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA5B,SAAS,KAAKpB,WAAW6B,OAAOmB,SAAAA;EAEhC,IAAI5B,OAAOuC,eAAepE,iBAAiBqE,QAAQ;GAC/C,IAAI,CAACZ,UAAUzB,QACXyB,UAAUzB,SAAS+B,mBAAmBO,eAAc;GAGxDzC,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQyB,SAAAA;EACvE,OAAO;GACH5B,OAAOG,SAAS;GAChBH,OAAOK,eAAe;GACtBL,OAAOI,kBAAkB;EAC7B;EAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;EAE3B,OAAO;GACHA;GACA2C,SAAS;EACb;CACJ;CAEA,MAAMC,OACF7C,IACAb,OACe;EACf,MAAMA,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAewE,cAAc,CAAA;EAEjF,MAAM7C,SAAS,MAAM,KAAKpB,WAAWkE,UAAU,EAAE/C,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAewE;GACrB/C,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAED,IAAIgD,aAAa/C;EACzB,MAAM,KAAKpB,WAAWoE,OAAOhD,MAAAA;EAC7BA,OAAOD,KAAKgD;EAEZ,OAAO/C;CACX;AACJ"}

package/dist/core/entities/client/system-clients.d.ts

@@ -0,0 +1,95 @@
+import type { Client, Realm } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
+import type { IClientScopeRepository } from '../client-scope/types.ts';
+import type { IScopeRepository } from '../scope/types.ts';
+import type { IClientRepository, ISystemClientProvisioner, SystemClientDefinition } from './types.ts';
+export type SystemClientProvisionerContext = {
+    clientRepository: IClientRepository;
+    scopeRepository: IScopeRepository;
+    clientScopeRepository: IClientScopeRepository;
+    appOrigins: string[];
+    logger?: Logger;
+};
+/**
+ * The scopes every system client is granted.
+ *
+ * `global` lets the issued token drive the management API (parity with the
+ * legacy password-grant admin login); `openid` yields the id-token.
+ */
+export declare const SYSTEM_CLIENT_SCOPE_NAMES: string[];
+/**
+ * The public (PKCE) clients provisioned for every realm (plan 079):
+ *
+ * - `admin-console` — authup's own admin console (apps/client-admin-console),
+ * - `account-console` — the account self-service surface (plan 080; each
+ *   definition gets its own `<origin>/**` patterns from
+ *   `buildSystemClientAttributes`, so an inert row adds no redirect
+ *   surface).
+ *
+ * Downstream RPs register their own clients (per realm, or in every realm
+ * via a wildcard realm provisioning entry, plan 082) — the former shared
+ * `web` client was removed.
+ *
+ * `displayName` is seeded at CREATE only and never re-asserted by the
+ * MERGE, so an admin may relabel a client without the next boot undoing it.
+ */
+export declare const SYSTEM_CLIENT_DEFINITIONS: SystemClientDefinition[];
+/**
+ * Build the MERGE-owned attribute set for a realm's system client.
+ *
+ * `builtIn` makes the client auto-consent in the /authorize flow and
+ * protects it from the API reserved-name guard.
+ *
+ * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the
+ * /token grants and the /authorize code-request verifier; null = allow-all),
+ * so it must list every flow the client uses. `redirectUri` and
+ * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted
+ * origin (matched by isSimpleMatch) — deliberately the shared app-origin
+ * set for every definition: `redirectUri` is re-asserted on each boot, so a
+ * separately-hosted surface (plan 078 "relocatable by choice") registers
+ * its origin via TRUSTED_ORIGINS rather than editing the client row.
+ *
+ * The `scope` column is descriptive only. Scope authorization resolves
+ * through the `auth_client_scopes` junction, which
+ * `SystemClientProvisioner.ensureForRealm` fills from the definition's
+ * `scopeNames`.
+ *
+ * `accessPolicyId` and `displayName` are deliberately NOT part of this set:
+ * the MERGE must neither wipe an admin-bound access policy nor undo a
+ * relabel.
+ */
+export declare function buildSystemClientAttributes(definition: SystemClientDefinition, realm: Realm | {
+    id: string;
+}, appOrigins: string[]): Partial<Client>;
+export declare class SystemClientProvisioner implements ISystemClientProvisioner {
+    protected clientRepository: IClientRepository;
+    protected scopeRepository: IScopeRepository;
+    protected clientScopeRepository: IClientScopeRepository;
+    protected appOrigins: string[];
+    protected logger?: Logger;
+    constructor(ctx: SystemClientProvisionerContext);
+    ensureForRealm(realm: Realm | {
+        id: string;
+    }): Promise<void>;
+    /**
+     * Upsert the client row itself.
+     *
+     * Every system client name is reserved (`CLIENT_RESERVED_NAMES`), so the
+     * row belongs to the system whatever state it is in. A non-built-in one
+     * predates the reservation and is taken over rather than left to shadow
+     * the realm's system client.
+     */
+    protected ensureClient(definition: SystemClientDefinition, realm: Realm | {
+        id: string;
+    }): Promise<Client>;
+    /**
+     * Bind the definition's scopes through `auth_client_scopes`. That
+     * junction is the only source the /authorize code-request verifier reads
+     * scopes from.
+     *
+     * Additive like the attribute MERGE above: an extra scope an admin bound
+     * by hand is left in place.
+     */
+    protected ensureScopes(definition: SystemClientDefinition, client: Client): Promise<void>;
+}
+//# sourceMappingURL=system-clients.d.ts.map

package/dist/core/entities/client/system-clients.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-clients.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/system-clients.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEtG,MAAM,MAAM,8BAA8B,GAAG;IACzC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,eAAe,EAAE,gBAAgB,CAAC;IAClC,qBAAqB,EAAE,sBAAsB,CAAC;IAC9C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,EAG7C,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAAsB,EAW7D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,2BAA2B,CACvC,UAAU,EAAE,sBAAsB,EAClC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;IAExD,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,8BAA8B;IAQzC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlE;;;;;;;OAOG;cACa,YAAY,CACxB,UAAU,EAAE,sBAAsB,EAClC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,MAAM,CAAC;IAyDlB;;;;;;;OAOG;cACa,YAAY,CAAC,UAAU,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAiClG"}

package/dist/core/entities/client/system-clients.mjs

@@ -0,0 +1,158 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { CLIENT_ACCOUNT_CONSOLE_NAME, CLIENT_ADMIN_CONSOLE_NAME, ClientAuthMethod, ClientTokenBindingMethod, ScopeName } from "@authup/core-kit";
+//#region src/core/entities/client/system-clients.ts
+/**
+* The scopes every system client is granted.
+*
+* `global` lets the issued token drive the management API (parity with the
+* legacy password-grant admin login); `openid` yields the id-token.
+*/ const SYSTEM_CLIENT_SCOPE_NAMES = [ScopeName.GLOBAL, ScopeName.OPEN_ID];
+/**
+* The public (PKCE) clients provisioned for every realm (plan 079):
+*
+* - `admin-console` — authup's own admin console (apps/client-admin-console),
+* - `account-console` — the account self-service surface (plan 080; each
+*   definition gets its own `<origin>/**` patterns from
+*   `buildSystemClientAttributes`, so an inert row adds no redirect
+*   surface).
+*
+* Downstream RPs register their own clients (per realm, or in every realm
+* via a wildcard realm provisioning entry, plan 082) — the former shared
+* `web` client was removed.
+*
+* `displayName` is seeded at CREATE only and never re-asserted by the
+* MERGE, so an admin may relabel a client without the next boot undoing it.
+*/ const SYSTEM_CLIENT_DEFINITIONS = [{
+	name: CLIENT_ADMIN_CONSOLE_NAME,
+	displayName: "Admin Console",
+	scopeNames: SYSTEM_CLIENT_SCOPE_NAMES
+}, {
+	name: CLIENT_ACCOUNT_CONSOLE_NAME,
+	displayName: "Account Console",
+	scopeNames: SYSTEM_CLIENT_SCOPE_NAMES
+}];
+/**
+* Build the MERGE-owned attribute set for a realm's system client.
+*
+* `builtIn` makes the client auto-consent in the /authorize flow and
+* protects it from the API reserved-name guard.
+*
+* `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the
+* /token grants and the /authorize code-request verifier; null = allow-all),
+* so it must list every flow the client uses. `redirectUri` and
+* `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted
+* origin (matched by isSimpleMatch) — deliberately the shared app-origin
+* set for every definition: `redirectUri` is re-asserted on each boot, so a
+* separately-hosted surface (plan 078 "relocatable by choice") registers
+* its origin via TRUSTED_ORIGINS rather than editing the client row.
+*
+* The `scope` column is descriptive only. Scope authorization resolves
+* through the `auth_client_scopes` junction, which
+* `SystemClientProvisioner.ensureForRealm` fills from the definition's
+* `scopeNames`.
+*
+* `accessPolicyId` and `displayName` are deliberately NOT part of this set:
+* the MERGE must neither wipe an admin-bound access policy nor undo a
+* relabel.
+*/ function buildSystemClientAttributes(definition, realm, appOrigins) {
+	const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(",");
+	return {
+		name: definition.name,
+		realmId: realm.id,
+		authMethod: ClientAuthMethod.NONE,
+		tokenBindingMethod: ClientTokenBindingMethod.NONE,
+		builtIn: true,
+		active: true,
+		grantTypes: "authorization_code refresh_token",
+		scope: definition.scopeNames.join(" "),
+		redirectUri: originPatterns,
+		postLogoutRedirectUri: originPatterns
+	};
+}
+var SystemClientProvisioner = class {
+	clientRepository;
+	scopeRepository;
+	clientScopeRepository;
+	appOrigins;
+	logger;
+	constructor(ctx) {
+		this.clientRepository = ctx.clientRepository;
+		this.scopeRepository = ctx.scopeRepository;
+		this.clientScopeRepository = ctx.clientScopeRepository;
+		this.appOrigins = ctx.appOrigins;
+		this.logger = ctx.logger;
+	}
+	async ensureForRealm(realm) {
+		for (const definition of SYSTEM_CLIENT_DEFINITIONS) {
+			const client = await this.ensureClient(definition, realm);
+			await this.ensureScopes(definition, client);
+		}
+	}
+	/**
+	* Upsert the client row itself.
+	*
+	* Every system client name is reserved (`CLIENT_RESERVED_NAMES`), so the
+	* row belongs to the system whatever state it is in. A non-built-in one
+	* predates the reservation and is taken over rather than left to shadow
+	* the realm's system client.
+	*/ async ensureClient(definition, realm) {
+		const attributes = buildSystemClientAttributes(definition, realm, this.appOrigins);
+		const existing = await this.clientRepository.findOneBy({
+			name: definition.name,
+			realmId: realm.id
+		});
+		if (existing) {
+			if (!Object.keys(attributes).some((key) => existing[key] !== attributes[key])) return existing;
+			let target = existing;
+			if (!existing.builtIn) {
+				if (this.logger) this.logger.warn(`Taking over the non-built-in client named '${definition.name}' in realm ${realm.id}: the name is reserved for a built-in system client.`);
+				target = await this.clientRepository.findOneWithSecret({ id: existing.id }) || existing;
+				target.secret = null;
+				target.secretHashed = false;
+				target.secretEncrypted = false;
+			}
+			const merged = this.clientRepository.merge(target, attributes);
+			return this.clientRepository.save(merged);
+		}
+		const entity = this.clientRepository.create({
+			...attributes,
+			displayName: definition.displayName
+		});
+		return this.clientRepository.save(entity);
+	}
+	/**
+	* Bind the definition's scopes through `auth_client_scopes`. That
+	* junction is the only source the /authorize code-request verifier reads
+	* scopes from.
+	*
+	* Additive like the attribute MERGE above: an extra scope an admin bound
+	* by hand is left in place.
+	*/ async ensureScopes(definition, client) {
+		for (const name of definition.scopeNames) {
+			const scope = await this.scopeRepository.findOneBy({
+				name,
+				realmId: null
+			});
+			if (!scope) {
+				if (this.logger) this.logger.warn(`Skipping scope '${name}' for the ${definition.name} client of realm ${client.realmId}: the scope is not provisioned.`);
+				continue;
+			}
+			if (await this.clientScopeRepository.findOneBy({
+				clientId: client.id,
+				scopeId: scope.id
+			})) continue;
+			await this.clientScopeRepository.save(this.clientScopeRepository.create({
+				clientId: client.id,
+				clientRealmId: client.realmId,
+				scopeId: scope.id,
+				scopeRealmId: scope.realmId
+			}));
+		}
+	}
+};
+//#endregion
+export { SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, SystemClientProvisioner, buildSystemClientAttributes };
+
+//# sourceMappingURL=system-clients.mjs.map

package/dist/core/entities/client/system-clients.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-clients.mjs","names":["CLIENT_ACCOUNT_CONSOLE_NAME","CLIENT_ADMIN_CONSOLE_NAME","ClientAuthMethod","ClientTokenBindingMethod","ScopeName","SYSTEM_CLIENT_SCOPE_NAMES","GLOBAL","OPEN_ID","SYSTEM_CLIENT_DEFINITIONS","name","displayName","scopeNames","buildSystemClientAttributes","definition","realm","appOrigins","originPatterns","map","origin","join","realmId","id","authMethod","NONE","tokenBindingMethod","builtIn","active","grantTypes","scope","redirectUri","postLogoutRedirectUri","SystemClientProvisioner","clientRepository","scopeRepository","clientScopeRepository","logger","ctx","ensureForRealm","client","ensureClient","ensureScopes","attributes","existing","findOneBy","isDirty","Object","keys","some","key","target","warn","findOneWithSecret","secret","secretHashed","secretEncrypted","merged","merge","save","entity","create","clientId","scopeId","clientRealmId","scopeRealmId"],"sources":["../../../../src/core/entities/client/system-clients.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    CLIENT_ACCOUNT_CONSOLE_NAME,\n    CLIENT_ADMIN_CONSOLE_NAME,\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    ScopeName,\n} from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientScopeRepository } from '../client-scope/types.ts';\nimport type { IScopeRepository } from '../scope/types.ts';\nimport type { IClientRepository, ISystemClientProvisioner, SystemClientDefinition } from './types.ts';\n\nexport type SystemClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    scopeRepository: IScopeRepository;\n    clientScopeRepository: IClientScopeRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * The scopes every system client is granted.\n *\n * `global` lets the issued token drive the management API (parity with the\n * legacy password-grant admin login); `openid` yields the id-token.\n */\nexport const SYSTEM_CLIENT_SCOPE_NAMES: string[] = [\n    ScopeName.GLOBAL,\n    ScopeName.OPEN_ID,\n];\n\n/**\n * The public (PKCE) clients provisioned for every realm (plan 079):\n *\n * - `admin-console` — authup's own admin console (apps/client-admin-console),\n * - `account-console` — the account self-service surface (plan 080; each\n *   definition gets its own `<origin>/**` patterns from\n *   `buildSystemClientAttributes`, so an inert row adds no redirect\n *   surface).\n *\n * Downstream RPs register their own clients (per realm, or in every realm\n * via a wildcard realm provisioning entry, plan 082) — the former shared\n * `web` client was removed.\n *\n * `displayName` is seeded at CREATE only and never re-asserted by the\n * MERGE, so an admin may relabel a client without the next boot undoing it.\n */\nexport const SYSTEM_CLIENT_DEFINITIONS: SystemClientDefinition[] = [\n    {\n        name: CLIENT_ADMIN_CONSOLE_NAME,\n        displayName: 'Admin Console',\n        scopeNames: SYSTEM_CLIENT_SCOPE_NAMES,\n    },\n    {\n        name: CLIENT_ACCOUNT_CONSOLE_NAME,\n        displayName: 'Account Console',\n        scopeNames: SYSTEM_CLIENT_SCOPE_NAMES,\n    },\n];\n\n/**\n * Build the MERGE-owned attribute set for a realm's system client.\n *\n * `builtIn` makes the client auto-consent in the /authorize flow and\n * protects it from the API reserved-name guard.\n *\n * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the\n * /token grants and the /authorize code-request verifier; null = allow-all),\n * so it must list every flow the client uses. `redirectUri` and\n * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted\n * origin (matched by isSimpleMatch) — deliberately the shared app-origin\n * set for every definition: `redirectUri` is re-asserted on each boot, so a\n * separately-hosted surface (plan 078 \"relocatable by choice\") registers\n * its origin via TRUSTED_ORIGINS rather than editing the client row.\n *\n * The `scope` column is descriptive only. Scope authorization resolves\n * through the `auth_client_scopes` junction, which\n * `SystemClientProvisioner.ensureForRealm` fills from the definition's\n * `scopeNames`.\n *\n * `accessPolicyId` and `displayName` are deliberately NOT part of this set:\n * the MERGE must neither wipe an admin-bound access policy nor undo a\n * relabel.\n */\nexport function buildSystemClientAttributes(\n    definition: SystemClientDefinition,\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(',');\n\n    return {\n        name: definition.name,\n        realmId: realm.id,\n        authMethod: ClientAuthMethod.NONE,\n        tokenBindingMethod: ClientTokenBindingMethod.NONE,\n        builtIn: true,\n        active: true,\n        grantTypes: 'authorization_code refresh_token',\n        scope: definition.scopeNames.join(' '),\n        redirectUri: originPatterns,\n        postLogoutRedirectUri: originPatterns,\n    };\n}\n\nexport class SystemClientProvisioner implements ISystemClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected scopeRepository: IScopeRepository;\n\n    protected clientScopeRepository: IClientScopeRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: SystemClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n        this.clientScopeRepository = ctx.clientScopeRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        for (const definition of SYSTEM_CLIENT_DEFINITIONS) {\n            const client = await this.ensureClient(definition, realm);\n\n            // Always run, even when the attributes were already up to date:\n            // an instance provisioned before the junction rows existed\n            // carries a steady-state client with no scopes at all.\n            await this.ensureScopes(definition, client);\n        }\n    }\n\n    /**\n     * Upsert the client row itself.\n     *\n     * Every system client name is reserved (`CLIENT_RESERVED_NAMES`), so the\n     * row belongs to the system whatever state it is in. A non-built-in one\n     * predates the reservation and is taken over rather than left to shadow\n     * the realm's system client.\n     */\n    protected async ensureClient(\n        definition: SystemClientDefinition,\n        realm: Realm | { id: string },\n    ): Promise<Client> {\n        const attributes = buildSystemClientAttributes(definition, realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: definition.name,\n            realmId: realm.id,\n        });\n\n        if (existing) {\n            // MERGE: refresh attributes (e.g. redirectUri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updatedAt) per client and realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return existing;\n            }\n\n            let target = existing;\n\n            if (!existing.builtIn) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Taking over the non-built-in client named '${definition.name}' in realm ${realm.id}: the name is reserved for a built-in system client.`,\n                    );\n                }\n\n                // The takeover makes the client public, so a secret it carried\n                // as a confidential client can never authenticate it again.\n                // Drop it instead of leaving the material at rest.\n                //\n                // The row has to be re-read WITH the secret for that: `secret`\n                // is a `select: false` column, so the loaded entity carries no\n                // value for it and typeorm's changed-column diff would not\n                // emit the null. Re-reading is confined to this branch, and\n                // the secret stays out of `buildSystemClientAttributes` for\n                // the same reason (an undefined-vs-null compare would read as\n                // dirty on every boot).\n                target = await this.clientRepository.findOneWithSecret({ id: existing.id }) || existing;\n                target.secret = null;\n                target.secretHashed = false;\n                target.secretEncrypted = false;\n            }\n\n            const merged = this.clientRepository.merge(target, attributes);\n\n            return this.clientRepository.save(merged);\n        }\n\n        const entity = this.clientRepository.create({\n            ...attributes,\n            displayName: definition.displayName,\n        });\n        return this.clientRepository.save(entity);\n    }\n\n    /**\n     * Bind the definition's scopes through `auth_client_scopes`. That\n     * junction is the only source the /authorize code-request verifier reads\n     * scopes from.\n     *\n     * Additive like the attribute MERGE above: an extra scope an admin bound\n     * by hand is left in place.\n     */\n    protected async ensureScopes(definition: SystemClientDefinition, client: Client): Promise<void> {\n        for (const name of definition.scopeNames) {\n            const scope = await this.scopeRepository.findOneBy({\n                name,\n                realmId: null,\n            });\n\n            if (!scope) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping scope '${name}' for the ${definition.name} client of realm ${client.realmId}: the scope is not provisioned.`,\n                    );\n                }\n                continue;\n            }\n\n            const existing = await this.clientScopeRepository.findOneBy({\n                clientId: client.id,\n                scopeId: scope.id,\n            });\n\n            if (existing) {\n                continue;\n            }\n\n            await this.clientScopeRepository.save(this.clientScopeRepository.create({\n                clientId: client.id,\n                clientRealmId: client.realmId,\n                scopeId: scope.id,\n                scopeRealmId: scope.realmId,\n            }));\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;GAkCA,MAAaK,4BAAsC,CAC/CD,UAAUE,QACVF,UAAUG,OACb;;;;;;;;;;;;;;;;GAkBD,MAAaC,4BAAsD,CAC/D;CACIC,MAAMR;CACNS,aAAa;CACbC,YAAYN;AAChB,GACA;CACII,MAAMT;CACNU,aAAa;CACbC,YAAYN;AAChB,CACH;;;;;;;;;;;;;;;;;;;;;;;;GA0BD,SAAgBO,4BACZC,YACAC,OACAC,YAAoB;CAEpB,MAAMC,iBAAiBD,WAAWE,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAEvE,OAAO;EACHV,MAAMI,WAAWJ;EACjBW,SAASN,MAAMO;EACfC,YAAYpB,iBAAiBqB;EAC7BC,oBAAoBrB,yBAAyBoB;EAC7CE,SAAS;EACTC,QAAQ;EACRC,YAAY;EACZC,OAAOf,WAAWF,WAAWQ,KAAK,GAAA;EAClCU,aAAab;EACbc,uBAAuBd;CAC3B;AACJ;AAEA,IAAae,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAnB;CAEAoB;CAEV,YAAYC,KAAqC;EAC7C,KAAKJ,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,wBAAwBE,IAAIF;EACjC,KAAKnB,aAAaqB,IAAIrB;EACtB,KAAKoB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAevB,OAA8C;EAC/D,KAAK,MAAMD,cAAcL,2BAA2B;GAChD,MAAM8B,SAAS,MAAM,KAAKC,aAAa1B,YAAYC,KAAAA;GAKnD,MAAM,KAAK0B,aAAa3B,YAAYyB,MAAAA;EACxC;CACJ;;;;;;;;IAUA,MAAgBC,aACZ1B,YACAC,OACe;EACf,MAAM2B,aAAa7B,4BAA4BC,YAAYC,OAAO,KAAKC,UAAU;EAEjF,MAAM2B,WAAW,MAAM,KAAKV,iBAAiBW,UAAU;GACnDlC,MAAMI,WAAWJ;GACjBW,SAASN,MAAMO;EACnB,CAAA;EAEA,IAAIqB,UAAU;GAOV,IAAI,CAFY,OAAQI,KAAKL,UAAAA,CAAAA,CACxBM,MAAMC,QAAQN,SAASM,SAASP,WAAWO,IAC3CJ,GACD,OAAOF;GAGX,IAAIO,SAASP;GAEb,IAAI,CAACA,SAASjB,SAAS;IACnB,IAAI,KAAKU,QACL,KAAKA,OAAOe,KACR,8CAA8CrC,WAAWJ,KAAK,aAAaK,MAAMO,GAAG,qDAAqD;IAejJ4B,SAAS,MAAM,KAAKjB,iBAAiBmB,kBAAkB,EAAE9B,IAAIqB,SAASrB,GAAG,CAAA,KAAMqB;IAC/EO,OAAOG,SAAS;IAChBH,OAAOI,eAAe;IACtBJ,OAAOK,kBAAkB;GAC7B;GAEA,MAAMC,SAAS,KAAKvB,iBAAiBwB,MAAMP,QAAQR,UAAAA;GAEnD,OAAO,KAAKT,iBAAiByB,KAAKF,MAAAA;EACtC;EAEA,MAAMG,SAAS,KAAK1B,iBAAiB2B,OAAO;GACxC,GAAGlB;GACH/B,aAAaG,WAAWH;EAC5B,CAAA;EACA,OAAO,KAAKsB,iBAAiByB,KAAKC,MAAAA;CACtC;;;;;;;;IAUA,MAAgBlB,aAAa3B,YAAoCyB,QAA+B;EAC5F,KAAK,MAAM7B,QAAQI,WAAWF,YAAY;GACtC,MAAMiB,QAAQ,MAAM,KAAKK,gBAAgBU,UAAU;IAC/ClC;IACAW,SAAS;GACb,CAAA;GAEA,IAAI,CAACQ,OAAO;IACR,IAAI,KAAKO,QACL,KAAKA,OAAOe,KACR,mBAAmBzC,KAAK,YAAYI,WAAWJ,KAAK,mBAAmB6B,OAAOlB,QAAQ,gCAAgC;IAG9H;GACJ;GAOA,IAAIsB,MALmB,KAAKR,sBAAsBS,UAAU;IACxDiB,UAAUtB,OAAOjB;IACjBwC,SAASjC,MAAMP;GACnB,CAAA,GAGI;GAGJ,MAAM,KAAKa,sBAAsBuB,KAAK,KAAKvB,sBAAsByB,OAAO;IACpEC,UAAUtB,OAAOjB;IACjByC,eAAexB,OAAOlB;IACtByC,SAASjC,MAAMP;IACf0C,cAAcnC,MAAMR;GACxB,CAAA,CAAA;EACJ;CACJ;AACJ"}

package/dist/core/entities/client/types.d.ts

@@ -2,12 +2,25 @@ import type { Client, Realm, Role } from '@authup/core-kit';
 import type { IQuery } from '@rapiq/core';
 import type { PermissionPolicyBinding } from '@authup/access';
 import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
+import type { IRealmProvisioner } from '../../provisioning/types.ts';
 /**
- * Ensures a realm has its system-provisioned public `web` client.
- * Used by startup provisioning (every realm) and the runtime realm-create
- * hook (a single realm). System-level — never gated on an actor.
+ * One system-provisioned public client (plan 079): `admin-console` or
+ * `account-console`. `displayName` is seeded at CREATE only; the
+ * MERGE-owned attribute set is derived per definition by
+ * `buildSystemClientAttributes`.
  */
-export interface IWebClientProvisioner {
+export type SystemClientDefinition = {
+    name: string;
+    displayName: string;
+    scopeNames: string[];
+};
+/**
+ * Ensures a realm has its system-provisioned public clients
+ * (`admin-console`, `account-console`). Used by startup provisioning
+ * (every realm) and the runtime realm-create hook (a single realm).
+ * System-level — never gated on an actor.
+ */
+export interface ISystemClientProvisioner extends IRealmProvisioner {
     ensureForRealm(realm: Realm | {
         id: string;
     }): Promise<void>;

package/dist/core/entities/client/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IAClC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB,CAAC,MAAM,CAAC;IAChE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE5E,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,CACF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAC3G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IAC/D,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB,CAAC,MAAM,CAAC;IAChE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE5E,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,CACF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}

package/dist/core/entities/client-permission/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-permission/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAMzD,eAAO,MAAM,sBAAsB,qDAqBjC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-permission/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAMzD,eAAO,MAAM,sBAAsB,qDA+BjC,CAAC"}

package/dist/core/entities/client-permission/schema.mjs

@@ -11,6 +11,16 @@ const schemaMapping = {
 };
 const clientPermissionSchema = defineSchema({
 	name: EntityType.CLIENT_PERMISSION,
+	indexes: [
+		["id"],
+		["clientId", "permissionId"],
+		["permissionId"],
+		["clientRealmId"],
+		["permissionRealmId"],
+		["policyId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { default: [
 		"id",
 		"policyId",
@@ -22,16 +32,29 @@ const clientPermissionSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: ["clientId", "permissionId"] },
+	filters: {
+		allowed: [
+			"clientId",
+			"permissionId",
+			"id",
+			"clientRealmId",
+			"permissionRealmId",
+			"policyId"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["client", "permission"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/client-permission/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","permission","PERMISSION","clientPermissionSchema","name","CLIENT_PERMISSION","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-permission/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientPermission } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, permission: EntityType.PERMISSION };\n\nexport const clientPermissionSchema = defineSchema<ClientPermission>({\n    name: EntityType.CLIENT_PERMISSION,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'policyId',\n            'realmScope',\n            'permissionId',\n            'permissionRealmId',\n            'clientId',\n            'clientRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['clientId', 'permissionId'] },\n    relations: { allowed: ['client', 'permission'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,YAAYL,WAAWM;AAAW;AAErF,MAAaC,yBAAyBR,aAA+B;CACjES,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS,CAAC,YAAY,cAAe,EAAC;CACjDC,WAAW;EAAED,SAAS,CAAC,UAAU,YAAa;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CACjGc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","permission","PERMISSION","clientPermissionSchema","name","CLIENT_PERMISSION","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-permission/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientPermission } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, permission: EntityType.PERMISSION };\n\nexport const clientPermissionSchema = defineSchema<ClientPermission>({\n    name: EntityType.CLIENT_PERMISSION,\n    indexes: [\n        ['id'],\n        ['clientId', 'permissionId'],\n        ['permissionId'],\n        ['clientRealmId'],\n        ['permissionRealmId'],\n        ['policyId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'policyId',\n            'realmScope',\n            'permissionId',\n            'permissionRealmId',\n            'clientId',\n            'clientRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['clientId', 'permissionId', 'id', 'clientRealmId', 'permissionRealmId', 'policyId'], indexed: true },\n    relations: { allowed: ['client', 'permission'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,YAAYL,WAAWM;AAAW;AAErF,MAAaC,yBAAyBR,aAA+B;CACjES,MAAMR,WAAWS;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,YAAY,cAAe;EAC5B,CAAC,cAAe;EAChB,CAAC,eAAgB;EACjB,CAAC,mBAAoB;EACrB,CAAC,UAAW;EACZ,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CAEDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAY;GAAgB;GAAM;GAAiB;GAAqB;EAAW;EAAEC,SAAS;CAAK;CACxHC,WAAW;EAAEF,SAAS,CAAC,UAAU,YAAa;EAAEG,UAAUhB,wBAAwBC,aAAAA;CAAe;CACjGgB,OAAO;EAAEJ,SAAS;GAAC;GAAM;GAAa;EAAY;EAAEC,SAAS;CAAK;CAClEI,YAAY,EAAEC,UAAU,GAAG;CAC3BlB;AACJ,CAAA"}

package/dist/core/entities/client-role/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-role/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMnD,eAAO,MAAM,gBAAgB,+CAmB3B,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-role/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMnD,eAAO,MAAM,gBAAgB,+CA4B3B,CAAC"}

package/dist/core/entities/client-role/schema.mjs

@@ -11,6 +11,15 @@ const schemaMapping = {
 };
 const clientRoleSchema = defineSchema({
 	name: EntityType.CLIENT_ROLE,
+	indexes: [
+		["id"],
+		["roleId", "clientId"],
+		["clientId"],
+		["clientRealmId"],
+		["roleRealmId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { default: [
 		"id",
 		"clientId",
@@ -20,16 +29,28 @@ const clientRoleSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: ["clientId", "roleId"] },
+	filters: {
+		allowed: [
+			"clientId",
+			"roleId",
+			"id",
+			"clientRealmId",
+			"roleRealmId"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["client", "role"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/client-role/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","role","ROLE","clientRoleSchema","name","CLIENT_ROLE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-role/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientRole } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, role: EntityType.ROLE };\n\nexport const clientRoleSchema = defineSchema<ClientRole>({\n    name: EntityType.CLIENT_ROLE,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'clientId',\n            'clientRealmId',\n            'roleId',\n            'roleRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['clientId', 'roleId'] },\n    relations: { allowed: ['client', 'role'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,MAAML,WAAWM;AAAK;AAEzE,MAAaC,mBAAmBR,aAAyB;CACrDS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS,CAAC,YAAY,QAAS,EAAC;CAC3CC,WAAW;EAAED,SAAS,CAAC,UAAU,MAAO;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC3Fc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","role","ROLE","clientRoleSchema","name","CLIENT_ROLE","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-role/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientRole } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, role: EntityType.ROLE };\n\nexport const clientRoleSchema = defineSchema<ClientRole>({\n    name: EntityType.CLIENT_ROLE,\n    indexes: [\n        ['id'],\n        ['roleId', 'clientId'],\n        ['clientId'],\n        ['clientRealmId'],\n        ['roleRealmId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'clientId',\n            'clientRealmId',\n            'roleId',\n            'roleRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['clientId', 'roleId', 'id', 'clientRealmId', 'roleRealmId'], indexed: true },\n    relations: { allowed: ['client', 'role'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,MAAML,WAAWM;AAAK;AAEzE,MAAaC,mBAAmBR,aAAyB;CACrDS,MAAMR,WAAWS;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,UAAU,UAAW;EACtB,CAAC,UAAW;EACZ,CAAC,eAAgB;EACjB,CAAC,aAAc;EACf,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CAEDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAY;GAAU;GAAM;GAAiB;EAAc;EAAEC,SAAS;CAAK;CAChGC,WAAW;EAAEF,SAAS,CAAC,UAAU,MAAO;EAAEG,UAAUhB,wBAAwBC,aAAAA;CAAe;CAC3FgB,OAAO;EAAEJ,SAAS;GAAC;GAAM;GAAa;EAAY;EAAEC,SAAS;CAAK;CAClEI,YAAY,EAAEC,UAAU,GAAG;CAC3BlB;AACJ,CAAA"}

package/dist/core/entities/client-scope/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,eAAO,MAAM,iBAAiB,gDAmB5B,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,eAAO,MAAM,iBAAiB,gDA2B5B,CAAC"}