npm - @authup/server-core - Versions diffs - 1.0.0-beta.59 → 1.0.0-beta.60 - Mend

@authup/server-core 1.0.0-beta.59 → 1.0.0-beta.60

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (409) hide show

package/dist/adapters/database/migrations/postgres/1786436332251-QueryIndexes.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"1786436332251-QueryIndexes.mjs","names":["QueryIndexes1786436332251","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/postgres/1786436332251-QueryIndexes.ts"],"sourcesContent":["import type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Indexes for the query surface and the foreign-key graph.\n *\n * Query surface: backs the rapiq schema `indexes` declarations (rapiq\n * 2.0.0-beta.20 indexed filters/sort, tada5hi/rapiq#895) — every key in a\n * schema's filter/sort allow-list must LEAD a real database index, so the\n * parse-time index policy never rejects a query the allow-lists permit.\n *\n * Foreign-key graph: indexes every remaining FK scalar column (junction\n * *_realm_id and policy_id columns, client.access_policy_id, the EA and\n * identity-provider mapping tables). MySQL always keeps an implicit FK\n * index, so these matter on Postgres, where realm deletion\n * (crypto-shredding) and cascade deletes otherwise full-scan every\n * junction, and EA tree loads sit on the permission-evaluation hot path.\n *\n * display_name is indexed wherever the column exists, alongside name:\n * the console searches both at once (`or(contains(name), contains(\n * display_name))`), and anchor mode passes an OR only when EVERY branch\n * leads an index, so one missing index would reject the whole search.\n *\n * Compound access paths: (actor_name, request_ip_address, created_at) on\n * auth_events serves the login-throttle countRecent key and replaces the\n * redundant actor_name single; auth_session_tokens.parent_id serves the\n * grace-window hasConsumedChild lookup; auth_sessions gains its three FK\n * indexes; (provider_user_id, provider_id) serves the federated-login\n * account lookup.\n *\n * Cleanup: drops the three orphaned legacy tables no entity has described\n * since their reworks — auth_authorization_codes (codes moved to cache\n * blobs), auth_refresh_tokens (superseded by auth_session_tokens),\n * auth_identity_provider_roles (superseded by\n * auth_identity_provider_role_mappings). down() recreates them exactly as\n * the pre-existing chain leaves them, so older down() paths keep working.\n *\n * Generated with `migration generate`; derived IDX_<hash> names, generated\n * DDL untouched (hand-authored blocks are marked).\n */\n\nexport class QueryIndexes1786436332251 implements MigrationInterface {\n name = 'QueryIndexes1786436332251';\n\n public async up(queryRunner: QueryRunner): Promise<void> {\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_ce33c3f58b802bb3c7b2668adc\"\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_4a9118b99a30cfd3d0c49c3f4b\" ON \"auth_realms\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_75e631fcfae706212f5bd67a93\" ON \"auth_realms\" (\"built_in\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_711b1c0c94c1f50b72ee0bc5b2\" ON \"auth_realms\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_98610803836c2be19b55bc016b\" ON \"auth_realms\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_7cdad1f4b4773508db1c7907e3\" ON \"auth_policies\" (\"type\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_14b3b3b9c0a1b3a1d2abecb6e7\" ON \"auth_policies\" (\"parent_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_3bdf0256c69127d59bfd92a313\" ON \"auth_policies\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_3f5906dabc9f129555d823408c\" ON \"auth_policies\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f4cdbb6a56eb93fa2598c8483d\" ON \"auth_policy_attributes\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_8b759199b8a0213a7a0f7b1986\" ON \"auth_policy_attributes\" (\"policy_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_7e7bca0ba30295b43b02a69051\" ON \"auth_clients\" (\"access_policy_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_e9d2f1997f5bb2e3b25edc3ab6\" ON \"auth_clients\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_01ff3aa3d7f3ea41711fa3abd5\" ON \"auth_clients\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b628ffa1b2f5415598cfb1a72a\" ON \"auth_clients\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_4f168a45a40758502e4833bb85\" ON \"auth_users\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_6597f3e492f4f8f3cc40772575\" ON \"auth_users\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_55c4ee639cdf45eb2453ee4fc7\" ON \"auth_users\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9a84db5a27d34b31644b54d910\" ON \"auth_user_attributes\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f50fe4004312e972a547c0e945\" ON \"auth_user_attributes\" (\"user_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_fa1bbd036543e4c4fda32b7ca6\" ON \"auth_user_attributes\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_0d93685dd655ce6ee7c8255503\" ON \"auth_user_attributes\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_a4a11809dcf8cdd5fcceec774e\" ON \"auth_sessions\" (\"expires_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b1d224a5ac76b109101ce07231\" ON \"auth_sessions\" (\"seen_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_46ab036699db960a12d34aad2b\" ON \"auth_sessions\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_60c2b21c37d79572f92da3476d\" ON \"auth_sessions\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_4b428fb760524b6ef45e7c2cbf\" ON \"auth_sessions\" (\"client_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_50ccaa6440288a06f0ba693ccc\" ON \"auth_sessions\" (\"user_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5a40fe23cbb002e73bf740715f\" ON \"auth_sessions\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_2cf41b241977b633ee7df5c8ae\" ON \"auth_keys\" (\"use\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_81ce3477ef39f7b5e0e009e81c\" ON \"auth_keys\" (\"status\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_0a1114947c976bbe430d24b2c9\" ON \"auth_keys\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5fc18a2304a0cd7129cb8736ed\" ON \"auth_keys\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5d1a390d8b26eb227c3d2a8ca5\" ON \"auth_roles\" (\"built_in\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_a7a399f06c259755d1b27b01ab\" ON \"auth_roles\" (\"target\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9c66869156cbedfc95533f0df1\" ON \"auth_roles\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_414d5037e0b67b5dc3643ac8b8\" ON \"auth_roles\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_2ba00548c512fffe2e5bf4bb3f\" ON \"auth_role_attributes\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_cd014be6be330f64b8405d0c72\" ON \"auth_role_attributes\" (\"role_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b4ec5361a8a3f49267ccef575c\" ON \"auth_role_attributes\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_76b7c51aeeeff6d695c0b8e17f\" ON \"auth_role_attributes\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_dbcfb3a6d68ad40775ff55b0fd\" ON \"auth_client_roles\" (\"role_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f88e0dfb5f8c30fc66fef320f6\" ON \"auth_client_roles\" (\"client_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_3a3a792dbd6d343c0dabe9900a\" ON \"auth_client_roles\" (\"client_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_ff4c8615288f1f8ebbeeed7f85\" ON \"auth_client_roles\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_8a110d4e8e1f9be98cc8d41c1c\" ON \"auth_client_roles\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_0979aabd6e00c278eb9ac1e0ca\" ON \"auth_permissions\" (\"built_in\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_798534b4e296f68e1bc658fbe3\" ON \"auth_permissions\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_e97033638618a50676a1637ad6\" ON \"auth_permissions\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5690205a3d8b0ab370f18c0e4f\" ON \"auth_permissions\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_d677e1082c27aae4ede40db0e9\" ON \"auth_client_permissions\" (\"policy_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b27b823c96287617e5bdf008ea\" ON \"auth_client_permissions\" (\"client_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_feb56f67d0c919e7626f1df836\" ON \"auth_client_permissions\" (\"permission_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_0d08f64ff34cb0d19deff4b1fc\" ON \"auth_client_permissions\" (\"permission_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_ccc15bd289a1ee0ba1ff9f061a\" ON \"auth_client_permissions\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_7a11a6fbab29ec59fc185d4f9e\" ON \"auth_client_permissions\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_e41ae7308e97ec75440f973cd8\" ON \"auth_scopes\" (\"built_in\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_a4d3545ecd5c7507c326f6ce0c\" ON \"auth_scopes\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_c6dc9d6f6199967609c555ca07\" ON \"auth_scopes\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_800cdb9ca2821bc6a81b1eff34\" ON \"auth_client_scopes\" (\"default\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_410780c372c6b400e9c6cba743\" ON \"auth_client_scopes\" (\"client_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_471f3da9df80f92c382a586e9c\" ON \"auth_client_scopes\" (\"scope_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_81f39f6e4a90fc8b861cf12dbf\" ON \"auth_client_scopes\" (\"scope_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_88c5c368c6216d7d1f0eb26a97\" ON \"auth_consents\" (\"sub_kind\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_31d8afae3f42a07450dc54c2cb\" ON \"auth_consents\" (\"scope\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_eb128508302d046ee176ef89fd\" ON \"auth_consents\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_6cff5665a42c31ebd8cdcfaad8\" ON \"auth_consents\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9486a670458a7377d1bd8f6245\" ON \"auth_events\" (\"scope\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_50f3b5dc6ae4eb17e736ca0a7d\" ON \"auth_events\" (\"ref_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_71c9adc2c466c149650c6c56e8\" ON \"auth_events\" (\"actor_type\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_37d01a405dc14c63738f1481b4\" ON \"auth_events\" (\"actor_name\", \"request_ip_address\", \"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_bac15f2c6806624e4f7223e5ed\" ON \"auth_identity_providers\" (\"protocol\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_213e1f3bdff969667e71206e9f\" ON \"auth_identity_providers\" (\"enabled\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_6584e5587d2075fb11a8953bdc\" ON \"auth_identity_providers\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_246ce67900aa852582dae0a7d8\" ON \"auth_identity_providers\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5ac40c5ce92142639df65a33e5\" ON \"auth_identity_provider_attributes\" (\"provider_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_60411456c45c831be656fbf850\" ON \"auth_identity_provider_attributes\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9630da9b4e6c478189cc6062c5\" ON \"auth_identity_provider_accounts\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_430b7434c1f881ab776562e508\" ON \"auth_identity_provider_accounts\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b07582d2705a04c2e868e6c374\" ON \"auth_identity_provider_accounts\" (\"user_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_c9432656798d6116dd47a896e4\" ON \"auth_identity_provider_accounts\" (\"user_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_209348829a22e0fb2715e937e4\" ON \"auth_identity_provider_accounts\" (\"provider_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_ccf3fd36253755bd9a5f43c516\" ON \"auth_identity_provider_accounts\" (\"provider_user_id\", \"provider_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_58a45697736646499b3dc7f0d0\" ON \"auth_identity_provider_attribute_mappings\" (\"provider_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f59883e2400b294414a495002a\" ON \"auth_identity_provider_permission_mappings\" (\"permission_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_acce12b53121e9eb413f32c719\" ON \"auth_identity_provider_permission_mappings\" (\"permission_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f2ea716aa0c8bd034b6f28e9eb\" ON \"auth_identity_provider_permission_mappings\" (\"provider_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_e84cd23669ae68b3bfd44ef986\" ON \"auth_identity_provider_role_mappings\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_d84c31eb147bde680370f00ea5\" ON \"auth_identity_provider_role_mappings\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_0c89b2c523eee535a9a18422fd\" ON \"auth_identity_provider_role_mappings\" (\"role_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_0c61ae237f6a87d65feed8bc45\" ON \"auth_identity_provider_role_mappings\" (\"role_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f8dfd31c9dc51e1fb8409c83d0\" ON \"auth_identity_provider_role_mappings\" (\"provider_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_883cfabf7d5f7466a27625843d\" ON \"auth_session_tokens\" (\"client_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_8d823bc0f1c9fae725fe3c6c9e\" ON \"auth_session_tokens\" (\"parent_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9de8962dead711a91eb52badef\" ON \"auth_session_tokens\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_35eec422fb312f3d2d5d104da3\" ON \"auth_trust_anchors\" (\"enabled\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_a788087fab74ba22302cc128eb\" ON \"auth_trust_anchors\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_16381ac607f6f4e37415a4879f\" ON \"auth_trust_anchors\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b4a3f78a50e369bfd2d1aa2445\" ON \"auth_permission_policies\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_85164349cdb62316ec19b88470\" ON \"auth_permission_policies\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_babb340dda101f2df8334eea5c\" ON \"auth_permission_policies\" (\"permission_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f5225aa8083c99b1cd09f4390c\" ON \"auth_permission_policies\" (\"policy_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_a76f5f6a12317ea0e24a84c1a5\" ON \"auth_permission_policies\" (\"policy_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_6b28c396d6f0c13165ae2d9abe\" ON \"auth_role_permissions\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_d1c82cf7a5659d0e6fce7aa481\" ON \"auth_role_permissions\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_cfa1834ece97297955f4a9539a\" ON \"auth_role_permissions\" (\"policy_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_3a6789765734cf5f3f555f2098\" ON \"auth_role_permissions\" (\"role_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_3d29528c774bc47404659fad03\" ON \"auth_role_permissions\" (\"role_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f9ab8919ff5d5993816f688187\" ON \"auth_role_permissions\" (\"permission_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_c5ad558296a77525b1f52919bf\" ON \"auth_user_authenticators\" (\"confirmed\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_7d3f50dac76afdc4f5a548eaf3\" ON \"auth_user_authenticators\" (\"last_used_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_fc331813cdc3b9c47a83c3be95\" ON \"auth_user_authenticators\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_eb9bd783394e3aedd35f855104\" ON \"auth_user_authenticators\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_db13de293f01ac8ab7bc0342c4\" ON \"auth_user_authenticators\" (\"realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_0a3a42400243fe3f9d969203a8\" ON \"auth_user_permissions\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_bc15924b6889713da243e883ca\" ON \"auth_user_permissions\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f15efcb7151cdd0d54ebafdd7f\" ON \"auth_user_permissions\" (\"policy_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_c1d4523b08aa27f07dff798f8d\" ON \"auth_user_permissions\" (\"user_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5bf6d1affe0575299c44bc58c0\" ON \"auth_user_permissions\" (\"user_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_e2de70574303693fea386cc0ed\" ON \"auth_user_permissions\" (\"permission_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_77fe9d38c984c640fc155503c4\" ON \"auth_user_roles\" (\"role_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_a3a59104c9c9f2a2458972bc96\" ON \"auth_user_roles\" (\"user_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_6161ccebf3af1c475758651de4\" ON \"auth_user_roles\" (\"user_realm_id\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_e0588e81b8ff3c640311b7ee39\" ON \"auth_user_roles\" (\"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_92ba9504d7698a5a3de297ac76\" ON \"auth_user_roles\" (\"updated_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f8538b58d9fe496e4c7bc6c565\" ON \"auth_users\" (\"reset_hash\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b2003e5ab8c075dc0a11f33bca\" ON \"auth_users\" (\"activate_hash\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9c861f8e8ea9fe35507b57fb88\" ON \"auth_policies\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_9c08d15bfcf413aad26ee3eda8\" ON \"auth_clients\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5015816deff1b14e7d669ed7cb\" ON \"auth_roles\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_f2835b7434c506b81e48a48229\" ON \"auth_scopes\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_5b1ba660790692f625c7a777d3\" ON \"auth_identity_providers\" (\"display_name\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_6f92ed4d9d7499b1dff735133c\" ON \"auth_policies\" (\"built_in\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_dd5af3e4a6f6157685f64d2c80\" ON \"auth_clients\" (\"active\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_b532f2eeaa9eb2b5c3ac65459b\" ON \"auth_clients\" (\"built_in\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_61132a880199e367d87d4f51b5\" ON \"auth_users\" (\"active\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_50bf2034bc55ce71102900f5ae\" ON \"auth_sessions\" (\"realm_id\", \"seen_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_1ab6178864ca0fd7d23efe6abf\" ON \"auth_sessions\" (\"user_id\", \"seen_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_6ff3a9ac44beabcc3a9642f0f9\" ON \"auth_events\" (\"realm_id\", \"created_at\")\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_74d37f543d9f9476b4b232c00b\" ON \"auth_session_tokens\" (\"session_id\", \"created_at\")\n `);\n // Hand-authored: drop the three orphaned legacy tables. Each predates a\n // rework that replaced it and nothing has referenced them since:\n // auth_authorization_codes (codes moved to cache blobs),\n // auth_refresh_tokens (superseded by auth_session_tokens, refresh\n // rotation), auth_identity_provider_roles (superseded by\n // auth_identity_provider_role_mappings in the identity-provider\n // rework). No entity describes them, so the schema-drift gate never\n // compared them; rows are pre-rework leftovers and are destroyed.\n await queryRunner.query(`\n DROP TABLE \"auth_authorization_codes\"\n `);\n await queryRunner.query(`\n DROP TABLE \"auth_refresh_tokens\"\n `);\n await queryRunner.query(`\n DROP TABLE \"auth_identity_provider_roles\"\n `);\n }\n public async down(queryRunner: QueryRunner): Promise<void> {\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_74d37f543d9f9476b4b232c00b\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_6ff3a9ac44beabcc3a9642f0f9\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_1ab6178864ca0fd7d23efe6abf\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_50bf2034bc55ce71102900f5ae\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_61132a880199e367d87d4f51b5\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b532f2eeaa9eb2b5c3ac65459b\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_dd5af3e4a6f6157685f64d2c80\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_6f92ed4d9d7499b1dff735133c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5b1ba660790692f625c7a777d3\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f2835b7434c506b81e48a48229\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5015816deff1b14e7d669ed7cb\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_9c08d15bfcf413aad26ee3eda8\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_9c861f8e8ea9fe35507b57fb88\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b2003e5ab8c075dc0a11f33bca\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f8538b58d9fe496e4c7bc6c565\"\n `);\n // Hand-authored: recreate the dropped legacy tables exactly as the\n // pre-existing chain leaves them (constraint and index names\n // included, robot FKs excluded — RemoveRobots dropped those), so\n // the older migrations' down() paths keep working.\n await queryRunner.query(`\n CREATE TABLE \"auth_authorization_codes\" (\n \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n \"content\" character varying(4096) NOT NULL,\n \"expires\" character varying(28) NOT NULL,\n \"scope\" character varying(512),\n \"redirect_uri\" character varying(2000),\n \"id_token\" character varying(1000),\n \"client_id\" uuid,\n \"user_id\" uuid,\n \"robot_id\" uuid,\n \"realm_id\" uuid NOT NULL,\n CONSTRAINT \"PK_c2ecb6968a63a751bd6fd2e2b6b\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query(`\n CREATE TABLE \"auth_refresh_tokens\" (\n \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n \"expires\" character varying(28) NOT NULL,\n \"scope\" character varying(512),\n \"access_token\" uuid,\n \"client_id\" uuid,\n \"user_id\" uuid,\n \"robot_id\" uuid,\n \"realm_id\" uuid NOT NULL,\n CONSTRAINT \"PK_df6893d2063a4ea7bbf1eda31e5\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query(`\n CREATE TABLE \"auth_identity_provider_roles\" (\n \"id\" uuid NOT NULL DEFAULT uuid_generate_v4(),\n \"external_id\" character varying(36) NOT NULL,\n \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"updated_at\" TIMESTAMP NOT NULL DEFAULT now(),\n \"role_id\" uuid NOT NULL,\n \"role_realm_id\" uuid,\n \"provider_id\" uuid NOT NULL,\n \"provider_realm_id\" uuid,\n CONSTRAINT \"PK_345f74231cf39250a3e572b84a7\" PRIMARY KEY (\"id\")\n )\n `);\n await queryRunner.query(`\n CREATE UNIQUE INDEX \"IDX_42df2e30eee05e54c74bced78b\" ON \"auth_identity_provider_roles\" (\"provider_id\", \"external_id\")\n `);\n await queryRunner.query(`\n CREATE UNIQUE INDEX \"IDX_fadb9ce4df580cc42e78b74b2f\" ON \"auth_identity_provider_roles\" (\"provider_id\", \"role_id\")\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_authorization_codes\"\n ADD CONSTRAINT \"FK_343b25488aef1b87f4771f8c7eb\" FOREIGN KEY (\"realm_id\") REFERENCES \"auth_realms\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_authorization_codes\"\n ADD CONSTRAINT \"FK_5119ffb8f6b8ba853e52be2e417\" FOREIGN KEY (\"user_id\") REFERENCES \"auth_users\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_authorization_codes\"\n ADD CONSTRAINT \"FK_ff6e597e9dd296da510efc06d28\" FOREIGN KEY (\"client_id\") REFERENCES \"auth_clients\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_refresh_tokens\"\n ADD CONSTRAINT \"FK_8f611e7ff67a2b013c909f60d52\" FOREIGN KEY (\"client_id\") REFERENCES \"auth_clients\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_refresh_tokens\"\n ADD CONSTRAINT \"FK_c1f59fdabbcf5dfd74d6af7f400\" FOREIGN KEY (\"realm_id\") REFERENCES \"auth_realms\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_refresh_tokens\"\n ADD CONSTRAINT \"FK_f795ad14f31838e3ddc663ee150\" FOREIGN KEY (\"user_id\") REFERENCES \"auth_users\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_identity_provider_roles\"\n ADD CONSTRAINT \"FK_2c3139bd232ffde35b71d43018e\" FOREIGN KEY (\"role_realm_id\") REFERENCES \"auth_realms\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_identity_provider_roles\"\n ADD CONSTRAINT \"FK_52a568200844cde16722b9bb95e\" FOREIGN KEY (\"provider_id\") REFERENCES \"auth_identity_providers\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_identity_provider_roles\"\n ADD CONSTRAINT \"FK_d49fb54b140869696a5a14285c7\" FOREIGN KEY (\"provider_realm_id\") REFERENCES \"auth_realms\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n ALTER TABLE \"auth_identity_provider_roles\"\n ADD CONSTRAINT \"FK_f32f792ca1aeacea0507ef80a11\" FOREIGN KEY (\"role_id\") REFERENCES \"auth_roles\" (\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_92ba9504d7698a5a3de297ac76\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_e0588e81b8ff3c640311b7ee39\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_6161ccebf3af1c475758651de4\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_a3a59104c9c9f2a2458972bc96\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_77fe9d38c984c640fc155503c4\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_e2de70574303693fea386cc0ed\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5bf6d1affe0575299c44bc58c0\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_c1d4523b08aa27f07dff798f8d\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f15efcb7151cdd0d54ebafdd7f\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_bc15924b6889713da243e883ca\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_0a3a42400243fe3f9d969203a8\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_db13de293f01ac8ab7bc0342c4\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_eb9bd783394e3aedd35f855104\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_fc331813cdc3b9c47a83c3be95\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_7d3f50dac76afdc4f5a548eaf3\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_c5ad558296a77525b1f52919bf\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f9ab8919ff5d5993816f688187\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_3d29528c774bc47404659fad03\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_3a6789765734cf5f3f555f2098\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_cfa1834ece97297955f4a9539a\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_d1c82cf7a5659d0e6fce7aa481\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_6b28c396d6f0c13165ae2d9abe\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_a76f5f6a12317ea0e24a84c1a5\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f5225aa8083c99b1cd09f4390c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_babb340dda101f2df8334eea5c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_85164349cdb62316ec19b88470\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b4a3f78a50e369bfd2d1aa2445\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_16381ac607f6f4e37415a4879f\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_a788087fab74ba22302cc128eb\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_35eec422fb312f3d2d5d104da3\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_9de8962dead711a91eb52badef\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_8d823bc0f1c9fae725fe3c6c9e\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_883cfabf7d5f7466a27625843d\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f8dfd31c9dc51e1fb8409c83d0\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_0c61ae237f6a87d65feed8bc45\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_0c89b2c523eee535a9a18422fd\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_d84c31eb147bde680370f00ea5\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_e84cd23669ae68b3bfd44ef986\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f2ea716aa0c8bd034b6f28e9eb\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_acce12b53121e9eb413f32c719\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f59883e2400b294414a495002a\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_58a45697736646499b3dc7f0d0\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_ccf3fd36253755bd9a5f43c516\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_209348829a22e0fb2715e937e4\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_c9432656798d6116dd47a896e4\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b07582d2705a04c2e868e6c374\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_430b7434c1f881ab776562e508\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_9630da9b4e6c478189cc6062c5\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_60411456c45c831be656fbf850\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5ac40c5ce92142639df65a33e5\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_246ce67900aa852582dae0a7d8\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_6584e5587d2075fb11a8953bdc\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_213e1f3bdff969667e71206e9f\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_bac15f2c6806624e4f7223e5ed\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_37d01a405dc14c63738f1481b4\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_71c9adc2c466c149650c6c56e8\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_50f3b5dc6ae4eb17e736ca0a7d\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_9486a670458a7377d1bd8f6245\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_6cff5665a42c31ebd8cdcfaad8\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_eb128508302d046ee176ef89fd\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_31d8afae3f42a07450dc54c2cb\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_88c5c368c6216d7d1f0eb26a97\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_81f39f6e4a90fc8b861cf12dbf\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_471f3da9df80f92c382a586e9c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_410780c372c6b400e9c6cba743\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_800cdb9ca2821bc6a81b1eff34\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_c6dc9d6f6199967609c555ca07\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_a4d3545ecd5c7507c326f6ce0c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_e41ae7308e97ec75440f973cd8\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_7a11a6fbab29ec59fc185d4f9e\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_ccc15bd289a1ee0ba1ff9f061a\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_0d08f64ff34cb0d19deff4b1fc\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_feb56f67d0c919e7626f1df836\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b27b823c96287617e5bdf008ea\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_d677e1082c27aae4ede40db0e9\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5690205a3d8b0ab370f18c0e4f\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_e97033638618a50676a1637ad6\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_798534b4e296f68e1bc658fbe3\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_0979aabd6e00c278eb9ac1e0ca\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_8a110d4e8e1f9be98cc8d41c1c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_ff4c8615288f1f8ebbeeed7f85\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_3a3a792dbd6d343c0dabe9900a\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f88e0dfb5f8c30fc66fef320f6\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_dbcfb3a6d68ad40775ff55b0fd\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_76b7c51aeeeff6d695c0b8e17f\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b4ec5361a8a3f49267ccef575c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_cd014be6be330f64b8405d0c72\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_2ba00548c512fffe2e5bf4bb3f\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_414d5037e0b67b5dc3643ac8b8\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_9c66869156cbedfc95533f0df1\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_a7a399f06c259755d1b27b01ab\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5d1a390d8b26eb227c3d2a8ca5\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5fc18a2304a0cd7129cb8736ed\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_0a1114947c976bbe430d24b2c9\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_81ce3477ef39f7b5e0e009e81c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_2cf41b241977b633ee7df5c8ae\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_5a40fe23cbb002e73bf740715f\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_50ccaa6440288a06f0ba693ccc\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_4b428fb760524b6ef45e7c2cbf\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_60c2b21c37d79572f92da3476d\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_46ab036699db960a12d34aad2b\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b1d224a5ac76b109101ce07231\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_a4a11809dcf8cdd5fcceec774e\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_0d93685dd655ce6ee7c8255503\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_fa1bbd036543e4c4fda32b7ca6\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f50fe4004312e972a547c0e945\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_9a84db5a27d34b31644b54d910\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_55c4ee639cdf45eb2453ee4fc7\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_6597f3e492f4f8f3cc40772575\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_4f168a45a40758502e4833bb85\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_b628ffa1b2f5415598cfb1a72a\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_01ff3aa3d7f3ea41711fa3abd5\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_e9d2f1997f5bb2e3b25edc3ab6\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_7e7bca0ba30295b43b02a69051\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_8b759199b8a0213a7a0f7b1986\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_f4cdbb6a56eb93fa2598c8483d\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_3f5906dabc9f129555d823408c\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_3bdf0256c69127d59bfd92a313\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_14b3b3b9c0a1b3a1d2abecb6e7\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_7cdad1f4b4773508db1c7907e3\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_98610803836c2be19b55bc016b\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_711b1c0c94c1f50b72ee0bc5b2\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_75e631fcfae706212f5bd67a93\"\n `);\n await queryRunner.query(`\n DROP INDEX \"public\".\"IDX_4a9118b99a30cfd3d0c49c3f4b\"\n `);\n await queryRunner.query(`\n CREATE INDEX \"IDX_ce33c3f58b802bb3c7b2668adc\" ON \"auth_events\" USING btree (\"actor_name\")\n `);\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCA,IAAaA,4BAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EACrD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EASD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;CACL;CACA,MAAaC,KAAKF,aAAyC;EACvD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAKD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;SAcvB;EACD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;SAYvB;EACD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;SAYvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;CACL;AACJ"}

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts CHANGED Viewed

@@ -1,7 +1,8 @@
 import type { IAppEvent } from 'routup';
 import type { IdentityProvider } from '@authup/core-kit';
-import type { EntityCollectionResponse, EntityRecordResponse, IdentityProviderCreatePayload, IdentityProviderSavePayload, IdentityProviderUpdatePayload } from '@authup/core-http-kit';
-import type { IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IOAuth2ClientRepository, IRealmRepository } from '../../../../../core/index.ts';
+import type { Logger } from '@authup/server-kit';
+import type { EntityCollectionResponse, EntityRecordResponse, IdentityProviderCreatePayload, IdentityProviderLinkRequestResponse, IdentityProviderSavePayload, IdentityProviderUpdatePayload } from '@authup/core-http-kit';
+import type { IEventService, IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IOAuth2ClientRepository, IRealmRepository } from '../../../../../core/index.ts';
 import { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';
 import type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';
 export declare class IdentityProviderController {
@@ -15,6 +16,8 @@ export declare class IdentityProviderController {
     protected stateManager: IOAuth2AuthorizationStateManager;
     protected codeIssuer: IOAuth2AuthorizationCodeIssuer;
     protected accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    protected eventService?: IEventService;
+    protected logger?: Logger;
     constructor(ctx: IdentityProviderControllerContext);
     getProviders(event: IAppEvent): Promise<EntityCollectionResponse<IdentityProvider>>;
     getProvider(id: string, event: IAppEvent): Promise<EntityRecordResponse<IdentityProvider>>;
@@ -23,10 +26,19 @@ export declare class IdentityProviderController {
     dropProvider(id: string, event: IAppEvent): Promise<EntityRecordResponse<IdentityProvider>>;
     addProvider(user: IdentityProviderCreatePayload, event: IAppEvent): Promise<EntityRecordResponse<IdentityProvider>>;
     authorizeOut(_id: string, event: IAppEvent): Promise<Response>;
+    linkRequest(_id: string, event: IAppEvent): Promise<IdentityProviderLinkRequestResponse>;
     authorizeIn(_id: string, event: IAppEvent): Promise<Response>;
     private write;
+    /**
+     * Callback half of the account-linking round-trip (plan 091): the
+     * external identity is bound to the state-referenced user instead of
+     * running the login path. No auth code and no session is minted; the
+     * browser lands back on the account console with a marker param.
+     */
+    private completeLink;
     private buildHostedAuthorizeURL;
     private resolve;
+    private buildProviderAuthenticator;
     private saveAuthorizationState;
     private verifyAuthorizationState;
 }

package/dist/adapters/http/controllers/entities/identity-provider/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,~~EAAE~~,gBAAgB,~~EAAkC~~,MAAM,kBAAkB,CAAC;~~AAiBzF~~,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,uBAAuB,EACvB,gBAAgB,~~EAEnB~~,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,~~EAO1C~~,MAAM,8BAA8B,CAAC;AAYtC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;~~gBAIpD~~,GAAG,EAAE,iCAAiC;~~IAgB5C~~,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IAuChD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA0B5C,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA6B7C,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAO7C,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;~~IAgD1B~~,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;~~YAyGlB~~,KAAK;IA+FnB,OAAO,CAAC,uBAAuB;YAmBjB,OAAO;~~YAYP~~,sBAAsB;YAWtB,wBAAwB;CAWzC"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAMxC,OAAO,KAAK,EACR,gBAAgB,EAInB,MAAM,kBAAkB,CAAC;AAc1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAKjD,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,mCAAmC,EACnC,2BAA2B,EAC3B,6BAA6B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EACR,aAAa,EACb,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,uBAAuB,EACvB,gBAAgB,EAGnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,uCAAuC,EAQ1C,MAAM,8BAA8B,CAAC;AAYtC,OAAO,KAAK,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAEa,0BAA0B;IACnC,SAAS,CAAC,OAAO,EAAE,iCAAiC,CAAC;IAErD,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,uCAAuC,CAAC;IAExE,SAAS,CAAC,oBAAoB,EAAG,uCAAuC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAG,gCAAgC,CAAC;IAE1D,SAAS,CAAC,UAAU,EAAG,8BAA8B,CAAC;IAEtD,SAAS,CAAC,qBAAqB,CAAC,EAAG,4BAA4B,CAAC;IAEhE,SAAS,CAAC,YAAY,CAAC,EAAG,aAAa,CAAC;IAExC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAIf,GAAG,EAAE,iCAAiC;IAkB5C,YAAY,CACF,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IAuChD,WAAW,CACA,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA0B5C,YAAY,CACD,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EAC9B,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAK7C,YAAY,CACD,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IA6B7C,WAAW,CACJ,IAAI,EAAE,6BAA6B,EAChC,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAO7C,YAAY,CACD,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;IA0C1B,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,GAC5B,OAAO,CAAC,mCAAmC,CAAC;IA6B1C,WAAW,CACA,GAAG,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS;YA4GlB,KAAK;IA+FnB;;;;;OAKG;YACW,YAAY;IAqF1B,OAAO,CAAC,uBAAuB;YAmBjB,OAAO;IAYrB,OAAO,CAAC,0BAA0B;YAcpB,sBAAsB;YAWtB,wBAAwB;CAWzC"}

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs CHANGED Viewed

@@ -6,6 +6,7 @@ import { identityProviderSchema } from "../../../../../core/entities/identity-pr
 import { decodeQuery } from "../../../../../core/query/module.mjs";
 import { OAuth2AuthorizationCodeRequestValidator } from "../../../../../core/oauth2/authorization/code-request/validator.mjs";
 import { toIdentityPolicyData } from "../../../../../core/identity/permission/identity-policy-data.mjs";
+import { isIdentityProviderAccountAlreadyLinkedError } from "../../../../../core/identity/provider/account/error.mjs";
 import { createIdentityProviderOAuth2Authenticator } from "../../../../../core/identity/provider/authentication/factory.mjs";
 import "../../../../../core/index.mjs";
 import { useRequestPermissionEvaluator } from "../../../request/permission/helper.mjs";
@@ -16,11 +17,12 @@ import { getRequestParamID, useRequestParamID } from "../../../request/helpers/p
 import { applyRouteRealmIDToBody, getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
 import "../../../request/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import { describeError } from "../../../../../utils/error.mjs";
 import { resolveURL } from "../../../../../utils/url.mjs";
 import "../../../../../utils/index.mjs";
 import "../../../middleware/index.mjs";
 import { ValidatorGroup, base64URLDecode, isUUID } from "@authup/kit";
-import { IdentityProviderAttributesValidator, IdentityProviderValidator, IdentityType, PermissionName, SessionAuthMethod, isOAuth2IdentityProvider, isOpenIDIdentityProvider } from "@authup/core-kit";
+import { EventName, EventRefType, EventScope, IdentityProviderAttributesValidator, IdentityProviderValidator, IdentityType, PermissionName, SessionAuthMethod, isOAuth2IdentityProvider, isOpenIDIdentityProvider } from "@authup/core-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { BadRequestError, EntityNotFoundError } from "@authup/errors";
 import { OAuth2ErrorCode, OAuth2RequestError } from "@authup/specs";
@@ -55,6 +57,8 @@ var IdentityProviderController = class {
 	stateManager;
 	codeIssuer;
 	accessPolicyEvaluator;
+	eventService;
+	logger;
 	constructor(ctx) {
 		this.options = ctx.options;
 		this.repository = ctx.repository;
@@ -66,6 +70,8 @@ var IdentityProviderController = class {
 		this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();
 		this.stateManager = ctx.stateManager;
 		this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;
+		this.eventService = ctx.eventService;
+		this.logger = ctx.logger;
 	}
 	async getProviders(event) {
 		const { data, meta } = await this.repository.findMany(await decodeQuery(useRequestQuery(event), {
@@ -146,12 +152,7 @@ var IdentityProviderController = class {
 		const id = useRequestParamID(event);
 		const entity = await this.resolve(id);
 		if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) throw new BadRequestError("Only an identity-provider based on the oauth protocol supports authorize redirect.");
-		const authenticator = createIdentityProviderOAuth2Authenticator({
-			accountManager: this.accountManager,
-			provider: entity,
-			options: { baseURL: this.options.baseURL }
-		});
-		const parameters = {};
+		const authenticator = this.buildProviderAuthenticator(entity);
 		let codeRequest;
 		const query = useRequestQuery(event);
 		if (typeof query.codeRequest === "string") {
@@ -166,24 +167,35 @@ var IdentityProviderController = class {
 			if (data.client.realmId && entity.realmId && entity.realmId !== data.client.realmId) throw OAuth2RequestError.malformed("The provider and client realm do not match.");
 			codeRequest = data.data;
 		}
-		parameters.state = await this.saveAuthorizationState(event, codeRequest);
-		return sendRedirect(event, authenticator.buildRedirectURL(parameters));
+		const state = await this.saveAuthorizationState(event, { codeRequest });
+		return sendRedirect(event, authenticator.buildRedirectURL({ state }));
+	}
+	async linkRequest(_id, event) {
+		const id = useRequestParamID(event);
+		const entity = await this.resolve(id);
+		if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) throw new BadRequestError("Only an identity-provider based on the oauth protocol supports account linking.");
+		if (!entity.enabled) throw new BadRequestError("The identity provider is not enabled.");
+		const identity = useRequestIdentityOrFail(event);
+		if (identity.type !== IdentityType.USER) throw new BadRequestError("Only a user can link an identity provider account.");
+		if (entity.realmId && entity.realmId !== identity.realmId) throw new BadRequestError("The identity provider does not belong to the user realm.");
+		const authenticator = this.buildProviderAuthenticator(entity);
+		const state = await this.saveAuthorizationState(event, { link: {
+			userId: identity.id,
+			providerId: entity.id
+		} });
+		return { url: authenticator.buildRedirectURL({ state }) };
 	}
 	async authorizeIn(_id, event) {
 		const id = useRequestParamID(event);
 		const entity = await this.resolve(id);
 		if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) throw new Error(`The provider protocol ${entity.protocol} is not valid.`);
 		const data = await this.verifyAuthorizationState(event);
+		const { link } = data;
+		if (link) return this.completeLink(event, entity, data, link);
 		if (entity.realmId && data.codeRequest && data.codeRequest.realm_id && data.codeRequest.realm_id !== entity.realmId) throw OAuth2RequestError.malformed("The provider and client realm do not match.");
 		const { code } = useRequestQuery(event);
-		const user = await createIdentityProviderOAuth2Authenticator({
-			accountManager: this.accountManager,
-			provider: entity,
-			options: {
-				baseURL: this.options.baseURL,
-				clientId: data.codeRequest?.client_id
-			}
-		}).authenticate(code);
+		if (typeof code !== "string" || code.length === 0) throw new BadRequestError("The authorization code is missing.");
+		const user = await this.buildProviderAuthenticator(entity, { clientId: data.codeRequest?.client_id }).authenticate({ code });
 		const realm = await this.realmRepository.resolve(entity.realmId, true);
 		if (data.codeRequest?.client_id) {
 			const client = await this.clientRepository.findOneByIdOrName(data.codeRequest.client_id, data.codeRequest.realm_id);
@@ -289,6 +301,42 @@ var IdentityProviderController = class {
 			meta: {}
 		};
 	}
+	/**
+	* Callback half of the account-linking round-trip (plan 091): the
+	* external identity is bound to the state-referenced user instead of
+	* running the login path. No auth code and no session is minted; the
+	* browser lands back on the account console with a marker param.
+	*/ async completeLink(event, provider, state, link) {
+		const url = new URL(resolveURL(this.options.baseURL, "account/connected-accounts"));
+		const { code } = useRequestQuery(event);
+		try {
+			if (link.providerId !== provider.id || !provider.enabled) throw new BadRequestError("The identity provider is not available for account linking.");
+			if (!state.ip || !state.userAgent) throw new BadRequestError("The account link request is not bound to a browser.");
+			if (typeof code !== "string" || code.length === 0) throw new BadRequestError("The authorization code is missing.");
+			const identity = await this.buildProviderAuthenticator(provider).resolveIdentity({ code });
+			const account = await this.accountManager.link(identity, link.userId);
+			await this.eventService?.record({
+				scope: EventScope.IDENTITY,
+				name: EventName.IDENTITY_PROVIDER_LINKED,
+				refType: EventRefType.IDENTITY_PROVIDER_ACCOUNT,
+				refId: account.id,
+				realmId: account.userRealmId ?? provider.realmId ?? null,
+				actorType: IdentityType.USER,
+				actorId: account.userId,
+				requestIpAddress: getRequestIP(event) ?? null,
+				requestUserAgent: getRequestHeader(event, "user-agent") ?? null,
+				data: {
+					providerId: provider.id,
+					providerName: provider.name
+				}
+			});
+			url.searchParams.set("linked", provider.id);
+		} catch (e) {
+			this.logger?.error(describeError(e, "The identity-provider account link failed."));
+			url.searchParams.set("linkError", isIdentityProviderAccountAlreadyLinkedError(e) ? "already_linked" : "link_failed");
+		}
+		return sendRedirect(event, url.href);
+	}
 	buildHostedAuthorizeURL(codeRequest) {
 		const url = new URL(resolveURL(this.options.baseURL, "authorize"));
 		const codeRequestKeys = Object.keys(codeRequest);
@@ -304,9 +352,19 @@ var IdentityProviderController = class {
 		if (!entity) throw new EntityNotFoundError();
 		return entity;
 	}
-	async saveAuthorizationState(event, codeRequest) {
+	buildProviderAuthenticator(provider, options = {}) {
+		return createIdentityProviderOAuth2Authenticator({
+			accountManager: this.accountManager,
+			provider,
+			options: {
+				baseURL: this.options.baseURL,
+				clientId: options.clientId
+			}
+		});
+	}
+	async saveAuthorizationState(event, data = {}) {
 		return this.stateManager.save({
-			codeRequest,
+			...data,
 			ip: getRequestIP(event) ?? "",
 			userAgent: getRequestHeader(event, "user-agent") ?? void 0
 		});
@@ -385,6 +443,14 @@ _ts_decorate([
 	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
 	_ts_metadata("design:returntype", Promise)
 ], IdentityProviderController.prototype, "authorizeOut", null);
+_ts_decorate([
+	DPost("/:id/link-request", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], IdentityProviderController.prototype, "linkRequest", null);
 _ts_decorate([
 	DGet("/:id/authorize-in", []),
 	_ts_param(0, DPath("id")),

package/dist/adapters/http/controllers/entities/identity-provider/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","base64URLDecode","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","SessionAuthMethod","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityNotFoundError","resolveURL","useRequestQuery","readRequestBody","OAuth2ErrorCode","OAuth2RequestError","URL","OAuth2AuthorizationCodeRequestValidator","RECORD_QUERY_PARAMETERS","createIdentityProviderOAuth2Authenticator","decodeQuery","describeQuerySchema","identityProviderSchema","toIdentityPolicyData","applyRouteRealmIDToBody","buildActorContext","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","realmRepository","clientRepository","accountManager","codeRequestVerifier","codeRequestValidator","stateManager","codeIssuer","accessPolicyEvaluator","ctx","getProviders","event","data","meta","findMany","schema","actor","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_READ","datum","evaluate","ATTRIBUTES","REALM_MATCH","realmId","getProvider","id","paramId","entity","findOneByIdOrName","editProvider","user","write","updateOnly","put","dropProvider","IDENTITY_PROVIDER_DELETE","findOneBy","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","authenticator","provider","baseURL","parameters","codeRequest","query","codeRequestDecoded","JSON","parse","malformed","codeRequestValidated","run","verify","client","state","saveAuthorizationState","buildRedirectURL","authorizeIn","Error","protocol","verifyAuthorizationState","realm_id","code","clientId","client_id","authenticate","realm","accessPolicyId","allowed","subject","type","USER","url","buildHostedAuthorizeURL","searchParams","set","ACCESS_DENIED","href","authorizationCode","issue","response_type","redirect_uri","scope","authMethod","EXTERNAL","group","body","where","IDENTITY_PROVIDER_UPDATE","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","identity","checkUniqueness","undefined","merge","saveWithEA","create","codeRequestKeys","Object","keys","codeRequestKey_","codeRequestKey","codeRequestValue","String","findOneById","save","ip","userAgent","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, base64URLDecode, isUUID } from '@authup/kit';\nimport {\n DBody,\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DPost,\n DPut,\n DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n getRequestHeader,\n getRequestIP,\n sendRedirect,\n} from 'routup';\nimport type { IdentityProvider, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport {\n\n IdentityProviderAttributesValidator,\n IdentityProviderValidator,\n IdentityType,\n PermissionName,\n SessionAuthMethod,\n isOAuth2IdentityProvider,\n isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { resolveURL } from '../../../../../utils/index.ts';\nimport type { AuthorizeParameters } from '@hapic/oauth2';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { readRequestBody } from '@routup/basic/body';\nimport { OAuth2ErrorCode, OAuth2RequestError } from '@authup/specs';\nimport type {\n EntityCollectionResponse,\n EntityRecordResponse,\n IdentityProviderCreatePayload,\n IdentityProviderSavePayload,\n IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n IIdentityProviderAccountManager,\n IIdentityProviderRepository,\n IOAuth2AccessPolicyEvaluator,\n IOAuth2AuthorizationCodeIssuer,\n IOAuth2AuthorizationCodeRequestVerifier,\n IOAuth2AuthorizationStateManager,\n IOAuth2ClientRepository,\n IRealmRepository,\n OAuth2AuthorizationState,\n} from '../../../../../core/index.ts';\nimport {\n OAuth2AuthorizationCodeRequestValidator,\n RECORD_QUERY_PARAMETERS,\n createIdentityProviderOAuth2Authenticator,\n decodeQuery,\n describeQuerySchema,\n identityProviderSchema,\n toIdentityPolicyData,\n} from '../../../../../core/index.ts';\nimport {\n applyRouteRealmIDToBody,\n buildActorContext,\n getBodyRealmID,\n getRequestParamID,\n getRequestRealmID,\n useRequestIdentityOrFail,\n useRequestParamID,\n useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n protected options: IdentityProviderControllerOptions;\n\n protected repository: IIdentityProviderRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected clientRepository: IOAuth2ClientRepository;\n\n protected accountManager: IIdentityProviderAccountManager;\n\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n protected stateManager : IOAuth2AuthorizationStateManager;\n\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n // ---------------------------------------------------------\n\n constructor(ctx: IdentityProviderControllerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.clientRepository = ctx.clientRepository;\n this.accountManager = ctx.accountManager;\n this.codeIssuer = ctx.codeIssuer;\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n this.stateManager = ctx.stateManager;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n }\n\n // ---------------------------------------------------------\n\n @DGet('', [])\n async getProviders(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<IdentityProvider>> {\n const {\n data,\n meta,\n } = await this.repository.findMany(\n await decodeQuery(useRequestQuery(event), {\n schema: identityProviderSchema,\n actor: buildActorContext(event),\n }),\n );\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });\n\n for (const datum of data) {\n try {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum, [BuiltInPolicyType.REALM_MATCH]: datum.realmId ?? null }),\n });\n } catch {\n // do nothing\n }\n }\n } catch {\n // do nothing\n }\n\n return {\n data,\n meta: {\n ...meta,\n schema: describeQuerySchema(identityProviderSchema),\n },\n };\n }\n\n @DGet('/:id', [])\n async getProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<EntityRecordResponse<IdentityProvider>> {\n const paramId = useRequestParamID(event, { isUUID: false });\n\n const entity = await this.repository.findOneByIdOrName(\n paramId,\n getRequestRealmID(event),\n );\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n });\n } catch {\n // do nothing\n }\n\n return { data: entity, meta: { schema: describeQuerySchema(identityProviderSchema, RECORD_QUERY_PARAMETERS) } };\n }\n\n @DPost('/:id', [ForceLoggedInMiddleware])\n async editProvider(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderUpdatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event, { updateOnly: true });\n }\n\n @DPut('/:id', [ForceLoggedInMiddleware])\n async put(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderSavePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event);\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async dropProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n const paramId = useRequestParamID(event);\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n const entity = await this.repository.findOneBy({ id: paramId });\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n });\n\n const { id: entityId } = entity;\n\n await this.repository.remove(entity);\n\n entity.id = entityId;\n\n event.response.status = 202;\n\n return { data: entity, meta: {} };\n }\n\n @DPost('', [ForceLoggedInMiddleware])\n async addProvider(\n @DBody() user: IdentityProviderCreatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event);\n }\n\n // ---------------------------------------------------------\n\n @DGet('/:id/authorize-out', [])\n async authorizeOut(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n }\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: { baseURL: this.options.baseURL },\n });\n\n const parameters : AuthorizeParameters = {};\n\n let codeRequest: OAuth2AuthorizationCodeRequest \| undefined;\n const query = useRequestQuery(event);\n if (typeof query.codeRequest === 'string') {\n let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n try {\n codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n } catch {\n throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n }\n\n const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n if (\n data.client.realmId &&\n entity.realmId &&\n entity.realmId !== data.client.realmId\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n codeRequest = data.data;\n }\n\n parameters.state = await this.saveAuthorizationState(event, codeRequest);\n\n return sendRedirect(event, authenticator.buildRedirectURL(parameters));\n }\n\n @DGet('/:id/authorize-in', [])\n async authorizeIn(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n }\n\n const data = await this.verifyAuthorizationState(event);\n if (\n entity.realmId &&\n data.codeRequest &&\n data.codeRequest.realm_id &&\n data.codeRequest.realm_id !== entity.realmId\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n const { code } = useRequestQuery(event);\n\n const authenticator = createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider: entity,\n options: {\n baseURL: this.options.baseURL,\n clientId: data.codeRequest?.client_id,\n },\n });\n\n const user = await authenticator.authenticate(code);\n\n const realm = await this.realmRepository.resolve(entity.realmId, true);\n\n // Application access policy (plan 052), federated leg: the callback\n // never redirects to the RP directly — a denial bounces back to the\n // hosted authorize page with error=access_denied, so no\n // redirectUriVerified threading through the state blob is needed.\n // A policy id with no wired evaluator denies (fail closed); a\n // since-deleted client is skipped (the /token backstop still covers it).\n if (data.codeRequest?.client_id) {\n const client = await this.clientRepository.findOneByIdOrName(\n data.codeRequest.client_id,\n data.codeRequest.realm_id,\n );\n\n if (client?.accessPolicyId) {\n let allowed = false;\n\n const subject = toIdentityPolicyData({\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n });\n if (this.accessPolicyEvaluator && subject) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n client.accessPolicyId,\n subject,\n );\n }\n\n if (!allowed) {\n const url = this.buildHostedAuthorizeURL(data.codeRequest);\n url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n\n return sendRedirect(event, url.href);\n }\n }\n }\n\n const authorizationCode = await this.codeIssuer.issue(\n {\n response_type: 'code',\n client_id: data.codeRequest?.client_id,\n redirect_uri: data.codeRequest?.redirect_uri,\n scope: data.codeRequest?.scope,\n },\n {\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n },\n { authMethod: SessionAuthMethod.EXTERNAL },\n );\n\n if (data.codeRequest) {\n const url = this.buildHostedAuthorizeURL(data.codeRequest);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n const url = new URL(this.options.baseURL);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n // ---------------------------------------------------------\n\n private async write(event: IAppEvent, options: {\n updateOnly?: boolean\n } = {}): Promise<EntityRecordResponse<IdentityProvider>> {\n let group: string;\n const id = getRequestParamID(event, { isUUID: false });\n const body = await readRequestBody(event);\n applyRouteRealmIDToBody(event, body);\n const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n let entity: IdentityProvider \| null \| undefined;\n if (id) {\n const where: Record<string, any> = {};\n if (isUUID(id)) {\n where.id = id;\n } else {\n where.name = id;\n }\n\n if (realmId) {\n where.realmId = realmId;\n }\n\n entity = await this.repository.findOneBy(where);\n // Only a NAME key may upsert-create. A UUID addresses one specific\n // row, so a miss is a 404 (creating would write a different id).\n if (!entity && (options.updateOnly \|\| where.id)) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n if (entity) {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n group = ValidatorGroup.UPDATE;\n } else {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n group = ValidatorGroup.CREATE;\n }\n\n const validator = new IdentityProviderValidator();\n const data = await validator.run(body, { group });\n\n const attributesValidator = new IdentityProviderAttributesValidator();\n const attributes = await attributesValidator.run(body);\n\n await this.repository.validateJoinColumns(data);\n\n if (entity) {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...data,\n },\n [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? entity.realmId ?? null,\n }),\n });\n } else {\n if (!data.realmId) {\n const identity = useRequestIdentityOrFail(event);\n data.realmId = identity.realmId;\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data, [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? null }),\n });\n }\n\n await this.repository.checkUniqueness(data, entity \|\| undefined);\n\n if (entity) {\n entity = this.repository.merge(entity, data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 202;\n\n return { data: entity, meta: {} };\n }\n\n entity = this.repository.create(data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 201;\n\n return { data: entity, meta: {} };\n }\n\n // ---------------------------------------------------------\n\n private buildHostedAuthorizeURL(codeRequest: OAuth2AuthorizationCodeRequest): URL {\n const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n\n const codeRequestKeys = Object.keys(codeRequest);\n for (const codeRequestKey_ of codeRequestKeys) {\n const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n const codeRequestValue = codeRequest[codeRequestKey];\n // Preserve meaningful falsy values (e.g. max_age=0, which OIDC\n // treats as prompt=login) — only skip absent ones.\n if (typeof codeRequestValue !== 'undefined' && codeRequestValue !== null) {\n url.searchParams.set(codeRequestKey, String(codeRequestValue));\n }\n }\n\n return url;\n }\n\n // ---------------------------------------------------------\n\n private async resolve(id: string) {\n const entity = await this.repository.findOneById(id);\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n // ---------------------------------------------------------\n\n private async saveAuthorizationState(\n event: IAppEvent,\n codeRequest?: OAuth2AuthorizationCodeRequest,\n ) : Promise<string> {\n return this.stateManager.save({\n codeRequest,\n ip: getRequestIP(event) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n\n private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n const query = useRequestQuery(event);\n if (typeof query.state !== 'string') {\n throw OAuth2RequestError.stateInvalid();\n }\n\n return this.stateManager.verify(query.state, {\n ip: getRequestIP(event) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsFA,IAAagD,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKV,UAAUU,IAAIV;EACnB,KAAKC,aAAaS,IAAIT;EACtB,KAAKC,kBAAkBQ,IAAIR;EAC3B,KAAKC,mBAAmBO,IAAIP;EAC5B,KAAKC,iBAAiBM,IAAIN;EAC1B,KAAKI,aAAaE,IAAIF;EACtB,KAAKH,sBAAsBK,IAAIL;EAC/B,KAAKC,uBAAuB,IAAIvB,wCAAAA;EAChC,KAAKwB,eAAeG,IAAIH;EACxB,KAAKE,wBAAwBC,IAAID;CACrC;CAIA,MACME,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKb,WAAWc,SACtB,MAAM7B,YAAYR,gBAAgBkC,KAAAA,GAAQ;GACtCI,QAAQ5B;GACR6B,OAAO1B,kBAAkBqB,KAAAA;EAC7B,CAAA,CAAA;EAGJ,IAAI;GACA,MAAMM,sBAAsBrB,8BAA8Be,KAAAA;GAC1D,MAAMM,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAekD,uBAAuB,CAAA;GAEpF,KAAK,MAAMC,SAAST,MAChB,IAAI;IACA,MAAMK,oBAAoBK,SAAS;KAC/BH,MAAMjD,eAAekD;KACrBR,MAAM7D,iBAAiB;OAAGD,kBAAkByE,aAAaF;OAAQvE,kBAAkB0E,cAAcH,MAAMI,WAAW;KAAK,CAAA;IAC3H,CAAA;GACJ,QAAQ,CAER;EAER,QAAQ,CAER;EAEA,OAAO;GACHb;GACAC,MAAM;IACF,GAAGA;IACHE,QAAQ7B,oBAAoBC,sBAAAA;GAChC;EACJ;CACJ;CAEA,MACMuC,YACF,IACA,OAC+C;EAC/C,MAAME,UAAUjC,kBAAkBgB,OAAO,EAAEzD,QAAQ,MAAM,CAAA;EAEzD,MAAM2E,SAAS,MAAM,KAAK7B,WAAW8B,kBACjCF,SACAnC,kBAAkBkB,KAAAA,CAAAA;EAGtB,IAAI,CAACkB,QACD,MAAM,IAAItD,oBAAAA;EAGd,IAAI;GAEA,MAD4BqB,8BAA8Be,KACpDM,CAAAA,CAAoBK,SAAS;IAC/BH,MAAMjD,eAAekD;IACrBR,MAAM7D,iBAAiB;MAAGD,kBAAkByE,aAAaM;MAAS/E,kBAAkB0E,cAAcK,OAAOJ,WAAW;IAAK,CAAA;GAC7H,CAAA;EACJ,QAAQ,CAER;EAEA,OAAO;GAAEb,MAAMiB;GAAQhB,MAAM,EAAEE,QAAQ7B,oBAAoBC,wBAAwBJ,uBAAAA,EAAyB;EAAE;CAClH;CAEA,MACMgD,aACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKE,MAAMtB,OAAO,EAAEuB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKF,MAAMtB,KAAAA;CACtB;CAEA,MACMyB,aACF,IACA,OACgD;EAChD,MAAMR,UAAUjC,kBAAkBgB,KAAAA;EAElC,MAAMM,sBAAsBrB,8BAA8Be,KAAAA;EAC1D,MAAMM,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAemE,yBAAyB,CAAA;EAEtF,MAAMR,SAAS,MAAM,KAAK7B,WAAWsC,UAAU,EAAEX,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAItD,oBAAAA;EAGd,MAAM0C,oBAAoBK,SAAS;GAC/BH,MAAMjD,eAAemE;GACrBzB,MAAM7D,iBAAiB;KAAGD,kBAAkByE,aAAaM;KAAS/E,kBAAkB0E,cAAcK,OAAOJ,WAAW;GAAK,CAAA;EAC7H,CAAA;EAEA,MAAM,EAAEE,IAAIY,aAAaV;EAEzB,MAAM,KAAK7B,WAAWwC,OAAOX,MAAAA;EAE7BA,OAAOF,KAAKY;EAEZ5B,MAAM8B,SAASC,SAAS;EAExB,OAAO;GAAE9B,MAAMiB;GAAQhB,MAAM,CAAC;EAAE;CACpC;CAEA,MACM8B,YACF,MACA,OACgD;EAChD,OAAO,KAAKV,MAAMtB,KAAAA;CACtB;CAIA,MACMiC,aACF,KACA,OACF;EACE,MAAMjB,KAAKhC,kBAAkBgB,KAAAA;EAC7B,MAAMkB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAACvD,yBAAyByD,MAAAA,KAAW,CAACxD,yBAAyBwD,MAAAA,GAC/D,MAAM,IAAIvD,gBAAgB,oFAAA;EAG9B,MAAMyE,gBAAgB/D,0CAA0C;GAC5DmB,gBAAgB,KAAKA;GACrB6C,UAAUnB;GACV9B,SAAS,EAAEkD,SAAS,KAAKlD,QAAQkD,QAAQ;EAC7C,CAAA;EAEA,MAAMC,aAAmC,CAAC;EAE1C,IAAIC;EACJ,MAAMC,QAAQ3E,gBAAgBkC,KAAAA;EAC9B,IAAI,OAAOyC,MAAMD,gBAAgB,UAAU;GACvC,IAAIE;GAEJ,IAAI;IACAA,qBAAqBC,KAAKC,MAAMtG,gBAAgBmG,MAAMD,WAAW,CAAA;GACrE,QAAQ;IACJ,MAAMvE,mBAAmB4E,UAAU,sDAAA;GACvC;GAEA,MAAMC,uBAAuB,MAAM,KAAKpD,qBAAqBqD,IAAIL,kBAAAA;GACjE,MAAMzC,OAAO,MAAM,KAAKR,oBAAoBuD,OAAOF,oBAAAA;GAEnD,IACI7C,KAAKgD,OAAOnC,WACZI,OAAOJ,WACPI,OAAOJ,YAAYb,KAAKgD,OAAOnC,SAE/B,MAAM7C,mBAAmB4E,UAAU,6CAAA;GAGvCL,cAAcvC,KAAKA;EACvB;EAEAsC,WAAWW,QAAQ,MAAM,KAAKC,uBAAuBnD,OAAOwC,WAAAA;EAE5D,OAAOrF,aAAa6C,OAAOoC,cAAcgB,iBAAiBb,UAAAA,CAAAA;CAC9D;CAEA,MACMc,YACF,KACA,OACF;EACE,MAAMrC,KAAKhC,kBAAkBgB,KAAAA;EAE7B,MAAMkB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAACvD,yBAAyByD,MAAAA,KAAW,CAACxD,yBAAyBwD,MAAAA,GAC/D,MAAM,IAAIoC,MAAM,yBAAyBpC,OAAOqC,SAAS,eAAe;EAG5E,MAAMtD,OAAO,MAAM,KAAKuD,yBAAyBxD,KAAAA;EACjD,IACIkB,OAAOJ,WACPb,KAAKuC,eACLvC,KAAKuC,YAAYiB,YACjBxD,KAAKuC,YAAYiB,aAAavC,OAAOJ,SAErC,MAAM7C,mBAAmB4E,UAAU,6CAAA;EAGvC,MAAM,EAAEa,SAAS5F,gBAAgBkC,KAAAA;EAWjC,MAAMqB,OAAO,MATShD,0CAA0C;GAC5DmB,gBAAgB,KAAKA;GACrB6C,UAAUnB;GACV9B,SAAS;IACLkD,SAAS,KAAKlD,QAAQkD;IACtBqB,UAAU1D,KAAKuC,aAAaoB;GAChC;EACJ,CAEmBxB,CAAAA,CAAcyB,aAAaH,IAAAA;EAE9C,MAAMI,QAAQ,MAAM,KAAKxE,gBAAgB6C,QAAQjB,OAAOJ,SAAS,IAAA;EAQjE,IAAIb,KAAKuC,aAAaoB,WAAW;GAC7B,MAAMX,SAAS,MAAM,KAAK1D,iBAAiB4B,kBACvClB,KAAKuC,YAAYoB,WACjB3D,KAAKuC,YAAYiB,QAAQ;GAG7B,IAAIR,QAAQc,gBAAgB;IACxB,IAAIC,UAAU;IAEd,MAAMC,UAAUxF,qBAAqB;KACjCyF,MAAM5G,aAAa6G;KACnBlE,MAAM;MACF,GAAGoB;MACHyC;KACJ;IACJ,CAAA;IACA,IAAI,KAAKjE,yBAAyBoE,SAC9BD,UAAU,MAAM,KAAKnE,sBAAsBc,SACvCsC,OAAOc,gBACPE,OAAAA;IAIR,IAAI,CAACD,SAAS;KACV,MAAMI,MAAM,KAAKC,wBAAwBpE,KAAKuC,WAAW;KACzD4B,IAAIE,aAAaC,IAAI,SAASvG,gBAAgBwG,aAAa;KAE3D,OAAOrH,aAAa6C,OAAOoE,IAAIK,IAAI;IACvC;GACJ;EACJ;EAEA,MAAMC,oBAAoB,MAAM,KAAK9E,WAAW+E,MAC5C;GACIC,eAAe;GACfhB,WAAW3D,KAAKuC,aAAaoB;GAC7BiB,cAAc5E,KAAKuC,aAAaqC;GAChCC,OAAO7E,KAAKuC,aAAasC;EAC7B,GACA;GACIZ,MAAM5G,aAAa6G;GACnBlE,MAAM;IACF,GAAGoB;IACHyC;GACJ;EACJ,GACA,EAAEiB,YAAYvH,kBAAkBwH,SAAS,CAAA;EAG7C,IAAI/E,KAAKuC,aAAa;GAClB,MAAM4B,MAAM,KAAKC,wBAAwBpE,KAAKuC,WAAW;GACzD4B,IAAIE,aAAaC,IAAI,QAAQG,kBAAkB1D,EAAE;GAEjD,OAAO7D,aAAa6C,OAAOoE,IAAIK,IAAI;EACvC;EAEA,MAAML,MAAM,IAAIlG,IAAI,KAAKkB,QAAQkD,OAAO;EACxC8B,IAAIE,aAAaC,IAAI,QAAQG,kBAAkB1D,EAAE;EAEjD,OAAO7D,aAAa6C,OAAOoE,IAAIK,IAAI;CACvC;CAIA,MAAcnD,MAAMtB,OAAkBZ,UAElC,CAAC,GAAoD;EACrD,IAAI6F;EACJ,MAAMjE,KAAKnC,kBAAkBmB,OAAO,EAAEzD,QAAQ,MAAM,CAAA;EACpD,MAAM2I,OAAO,MAAMnH,gBAAgBiC,KAAAA;EACnCtB,wBAAwBsB,OAAOkF,IAAAA;EAC/B,MAAMpE,UAAUhC,kBAAkBkB,KAAAA,KAAUpB,eAAesG,IAAAA;EAE3D,IAAIhE;EACJ,IAAIF,IAAI;GACJ,MAAMmE,QAA6B,CAAC;GACpC,IAAI5I,OAAOyE,EAAAA,GACPmE,MAAMnE,KAAKA;QAEXmE,MAAM3E,OAAOQ;GAGjB,IAAIF,SACAqE,MAAMrE,UAAUA;GAGpBI,SAAS,MAAM,KAAK7B,WAAWsC,UAAUwD,KAAAA;GAGzC,IAAI,CAACjE,WAAW9B,QAAQmC,cAAc4D,MAAMnE,KACxC,MAAM,IAAIpD,oBAAAA;EAElB,OAAO,IAAIwB,QAAQmC,YACf,MAAM,IAAI3D,oBAAAA;EAGd,MAAM0C,sBAAsBrB,8BAA8Be,KAAAA;EAC1D,IAAIkB,QAAQ;GACR,MAAMZ,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAe6H,yBAAyB,CAAA;GAEtFH,QAAQ5I,eAAegJ;EAC3B,OAAO;GACH,MAAM/E,oBAAoBC,YAAY,EAAEC,MAAMjD,eAAe+H,yBAAyB,CAAA;GAEtFL,QAAQ5I,eAAekJ;EAC3B;EAGA,MAAMtF,OAAO,MAAMuF,IADGnI,0BACHmI,CAAAA,CAAUzC,IAAImC,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMS,aAAa,MAAMD,IADOrI,oCACPqI,CAAAA,CAAoB1C,IAAImC,IAAAA;EAEjD,MAAM,KAAK7F,WAAWsG,oBAAoB1F,IAAAA;EAE1C,IAAIiB,QACA,MAAMZ,oBAAoBK,SAAS;GAC/BH,MAAMjD,eAAe6H;GACrBnF,MAAM7D,iBAAiB;KAClBD,kBAAkByE,aAAa;KAC5B,GAAGM;KACH,GAAGjB;IACP;KACC9D,kBAAkB0E,cAAcZ,KAAKa,WAAWI,OAAOJ,WAAW;GACvE,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACb,KAAKa,SAENb,KAAKa,UADY/B,yBAAyBiB,KAC3B4F,CAAAA,CAAS9E;GAG5B,MAAMR,oBAAoBK,SAAS;IAC/BH,MAAMjD,eAAe+H;IACrBrF,MAAM7D,iBAAiB;MAAGD,kBAAkByE,aAAaX;MAAO9D,kBAAkB0E,cAAcZ,KAAKa,WAAW;IAAK,CAAA;GACzH,CAAA;EACJ;EAEA,MAAM,KAAKzB,WAAWwG,gBAAgB5F,MAAMiB,UAAU4E,KAAAA,CAAAA;EAEtD,IAAI5E,QAAQ;GACRA,SAAS,KAAK7B,WAAW0G,MAAM7E,QAAQjB,IAAAA;GACvC,MAAM,KAAKZ,WAAW2G,WAAW9E,QAAQwE,UAAAA;GAEzC1F,MAAM8B,SAASC,SAAS;GAExB,OAAO;IAAE9B,MAAMiB;IAAQhB,MAAM,CAAC;GAAE;EACpC;EAEAgB,SAAS,KAAK7B,WAAW4G,OAAOhG,IAAAA;EAChC,MAAM,KAAKZ,WAAW2G,WAAW9E,QAAQwE,UAAAA;EAEzC1F,MAAM8B,SAASC,SAAS;EAExB,OAAO;GAAE9B,MAAMiB;GAAQhB,MAAM,CAAC;EAAE;CACpC;CAIQmE,wBAAwB7B,aAAkD;EAC9E,MAAM4B,MAAM,IAAIlG,IAAIL,WAAW,KAAKuB,QAAQkD,SAAS,WAAA,CAAA;EAErD,MAAM4D,kBAAkBC,OAAOC,KAAK5D,WAAAA;EACpC,KAAK,MAAM6D,mBAAmBH,iBAAiB;GAC3C,MAAMI,iBAAiBD;GACvB,MAAME,mBAAmB/D,YAAY8D;GAGrC,IAAI,OAAOC,qBAAqB,eAAeA,qBAAqB,MAChEnC,IAAIE,aAAaC,IAAI+B,gBAAgBE,OAAOD,gBAAAA,CAAAA;EAEpD;EAEA,OAAOnC;CACX;CAIA,MAAcjC,QAAQnB,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAK7B,WAAWoH,YAAYzF,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAItD,oBAAAA;EAGd,OAAOsD;CACX;CAIA,MAAciC,uBACVnD,OACAwC,aACgB;EAChB,OAAO,KAAK7C,aAAa+G,KAAK;GAC1BlE;GACAmE,IAAIzJ,aAAa8C,KAAAA,KAAU;GAC3B4G,WAAW3J,iBAAiB+C,OAAO,YAAA,KAAiB8F,KAAAA;EACxD,CAAA;CACJ;CAEA,MAActC,yBAAyBxD,OAAqD;EACxF,MAAMyC,QAAQ3E,gBAAgBkC,KAAAA;EAC9B,IAAI,OAAOyC,MAAMS,UAAU,UACvB,MAAMjF,mBAAmB4I,aAAY;EAGzC,OAAO,KAAKlH,aAAaqD,OAAOP,MAAMS,OAAO;GACzCyD,IAAIzJ,aAAa8C,KAAAA,KAAU;GAC3B4G,WAAW3J,iBAAiB+C,OAAO,YAAA,KAAiB8F,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;;;;;;;;;CA9WoB5G,MAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASDA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAgCNA,MAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;;;;;;;;;CA/JF,YAAA,CAAA,uBAAuB,qCAAA,CAAA"}
1	+ {"version":3,"file":"module.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","base64URLDecode","isUUID","DBody","DContext","DController","DDelete","DGet","DPath","DPost","DPut","DTags","getRequestHeader","getRequestIP","sendRedirect","EventName","EventRefType","EventScope","IdentityProviderAttributesValidator","IdentityProviderValidator","IdentityType","PermissionName","SessionAuthMethod","isOAuth2IdentityProvider","isOpenIDIdentityProvider","BadRequestError","EntityNotFoundError","describeError","resolveURL","useRequestQuery","readRequestBody","OAuth2ErrorCode","OAuth2RequestError","URL","OAuth2AuthorizationCodeRequestValidator","RECORD_QUERY_PARAMETERS","createIdentityProviderOAuth2Authenticator","decodeQuery","describeQuerySchema","identityProviderSchema","isIdentityProviderAccountAlreadyLinkedError","toIdentityPolicyData","applyRouteRealmIDToBody","buildActorContext","getBodyRealmID","getRequestParamID","getRequestRealmID","useRequestIdentityOrFail","useRequestParamID","useRequestPermissionEvaluator","ForceLoggedInMiddleware","IdentityProviderController","options","repository","realmRepository","clientRepository","accountManager","codeRequestVerifier","codeRequestValidator","stateManager","codeIssuer","accessPolicyEvaluator","eventService","logger","ctx","getProviders","event","data","meta","findMany","schema","actor","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_READ","datum","evaluate","ATTRIBUTES","REALM_MATCH","realmId","getProvider","id","paramId","entity","findOneByIdOrName","editProvider","user","write","updateOnly","put","dropProvider","IDENTITY_PROVIDER_DELETE","findOneBy","entityId","remove","response","status","addProvider","authorizeOut","_id","resolve","authenticator","buildProviderAuthenticator","codeRequest","query","codeRequestDecoded","JSON","parse","malformed","codeRequestValidated","run","verify","client","state","saveAuthorizationState","buildRedirectURL","linkRequest","enabled","identity","type","USER","link","userId","providerId","url","authorizeIn","Error","protocol","verifyAuthorizationState","completeLink","realm_id","code","length","clientId","client_id","authenticate","realm","accessPolicyId","allowed","subject","buildHostedAuthorizeURL","searchParams","set","ACCESS_DENIED","href","authorizationCode","issue","response_type","redirect_uri","scope","authMethod","EXTERNAL","baseURL","group","body","where","IDENTITY_PROVIDER_UPDATE","UPDATE","IDENTITY_PROVIDER_CREATE","CREATE","validator","attributesValidator","attributes","validateJoinColumns","checkUniqueness","undefined","merge","saveWithEA","create","provider","ip","userAgent","resolveIdentity","account","record","IDENTITY","IDENTITY_PROVIDER_LINKED","refType","IDENTITY_PROVIDER_ACCOUNT","refId","userRealmId","actorType","actorId","requestIpAddress","requestUserAgent","providerName","e","error","codeRequestKeys","Object","keys","codeRequestKey_","codeRequestKey","codeRequestValue","String","findOneById","save","stateInvalid"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/module.ts"],"sourcesContent":["/\n Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, base64URLDecode, isUUID } from '@authup/kit';\nimport {\n DBody,\n DContext,\n DController,\n DDelete,\n DGet,\n DPath,\n DPost,\n DPut,\n DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport {\n getRequestHeader,\n getRequestIP,\n sendRedirect,\n} from 'routup';\nimport type {\n IdentityProvider,\n OAuth2AuthorizationCodeRequest,\n OAuth2IdentityProvider,\n OpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport {\n EventName,\n EventRefType,\n EventScope,\n IdentityProviderAttributesValidator,\n IdentityProviderValidator,\n IdentityType,\n PermissionName,\n SessionAuthMethod,\n isOAuth2IdentityProvider,\n isOpenIDIdentityProvider,\n} from '@authup/core-kit';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport type { Logger } from '@authup/server-kit';\nimport { describeError, resolveURL } from '../../../../../utils/index.ts';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { readRequestBody } from '@routup/basic/body';\nimport { OAuth2ErrorCode, OAuth2RequestError } from '@authup/specs';\nimport type {\n EntityCollectionResponse,\n EntityRecordResponse,\n IdentityProviderCreatePayload,\n IdentityProviderLinkRequestResponse,\n IdentityProviderSavePayload,\n IdentityProviderUpdatePayload,\n} from '@authup/core-http-kit';\nimport { URL } from 'node:url';\nimport type {\n IEventService,\n IIdentityProviderAccountManager,\n IIdentityProviderRepository,\n IOAuth2AccessPolicyEvaluator,\n IOAuth2AuthorizationCodeIssuer,\n IOAuth2AuthorizationCodeRequestVerifier,\n IOAuth2AuthorizationStateManager,\n IOAuth2ClientRepository,\n IRealmRepository,\n OAuth2AuthorizationState,\n OAuth2AuthorizationStateLink,\n} from '../../../../../core/index.ts';\nimport {\n OAuth2AuthorizationCodeRequestValidator,\n RECORD_QUERY_PARAMETERS,\n createIdentityProviderOAuth2Authenticator,\n decodeQuery,\n describeQuerySchema,\n identityProviderSchema,\n isIdentityProviderAccountAlreadyLinkedError,\n toIdentityPolicyData,\n} from '../../../../../core/index.ts';\nimport {\n applyRouteRealmIDToBody,\n buildActorContext,\n getBodyRealmID,\n getRequestParamID,\n getRequestRealmID,\n useRequestIdentityOrFail,\n useRequestParamID,\n useRequestPermissionEvaluator,\n} from '../../../request/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport type { IdentityProviderControllerContext, IdentityProviderControllerOptions } from './types.ts';\n\n@DTags('identity')\n@DController(['/identity-providers', '/realms/:realmId/identity-providers'])\nexport class IdentityProviderController {\n protected options: IdentityProviderControllerOptions;\n\n protected repository: IIdentityProviderRepository;\n\n protected realmRepository: IRealmRepository;\n\n protected clientRepository: IOAuth2ClientRepository;\n\n protected accountManager: IIdentityProviderAccountManager;\n\n protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n protected stateManager : IOAuth2AuthorizationStateManager;\n\n protected codeIssuer : IOAuth2AuthorizationCodeIssuer;\n\n protected accessPolicyEvaluator? : IOAuth2AccessPolicyEvaluator;\n\n protected eventService? : IEventService;\n\n protected logger? : Logger;\n\n // ---------------------------------------------------------\n\n constructor(ctx: IdentityProviderControllerContext) {\n this.options = ctx.options;\n this.repository = ctx.repository;\n this.realmRepository = ctx.realmRepository;\n this.clientRepository = ctx.clientRepository;\n this.accountManager = ctx.accountManager;\n this.codeIssuer = ctx.codeIssuer;\n this.codeRequestVerifier = ctx.codeRequestVerifier;\n this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n this.stateManager = ctx.stateManager;\n this.accessPolicyEvaluator = ctx.accessPolicyEvaluator;\n this.eventService = ctx.eventService;\n this.logger = ctx.logger;\n }\n\n // ---------------------------------------------------------\n\n @DGet('', [])\n async getProviders(\n @DContext() event: IAppEvent,\n ): Promise<EntityCollectionResponse<IdentityProvider>> {\n const {\n data,\n meta,\n } = await this.repository.findMany(\n await decodeQuery(useRequestQuery(event), {\n schema: identityProviderSchema,\n actor: buildActorContext(event),\n }),\n );\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_READ });\n\n for (const datum of data) {\n try {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: datum, [BuiltInPolicyType.REALM_MATCH]: datum.realmId ?? null }),\n });\n } catch {\n // do nothing\n }\n }\n } catch {\n // do nothing\n }\n\n return {\n data,\n meta: {\n ...meta,\n schema: describeQuerySchema(identityProviderSchema),\n },\n };\n }\n\n @DGet('/:id', [])\n async getProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ): Promise<EntityRecordResponse<IdentityProvider>> {\n const paramId = useRequestParamID(event, { isUUID: false });\n\n const entity = await this.repository.findOneByIdOrName(\n paramId,\n getRequestRealmID(event),\n );\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n try {\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_READ,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n });\n } catch {\n // do nothing\n }\n\n return { data: entity, meta: { schema: describeQuerySchema(identityProviderSchema, RECORD_QUERY_PARAMETERS) } };\n }\n\n @DPost('/:id', [ForceLoggedInMiddleware])\n async editProvider(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderUpdatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event, { updateOnly: true });\n }\n\n @DPut('/:id', [ForceLoggedInMiddleware])\n async put(\n @DPath('id') id: string,\n @DBody() user: IdentityProviderSavePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event);\n }\n\n @DDelete('/:id', [ForceLoggedInMiddleware])\n async dropProvider(\n @DPath('id') id: string,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n const paramId = useRequestParamID(event);\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_DELETE });\n\n const entity = await this.repository.findOneBy({ id: paramId });\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_DELETE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, [BuiltInPolicyType.REALM_MATCH]: entity.realmId ?? null }),\n });\n\n const { id: entityId } = entity;\n\n await this.repository.remove(entity);\n\n entity.id = entityId;\n\n event.response.status = 202;\n\n return { data: entity, meta: {} };\n }\n\n @DPost('', [ForceLoggedInMiddleware])\n async addProvider(\n @DBody() user: IdentityProviderCreatePayload,\n @DContext() event: IAppEvent,\n ) : Promise<EntityRecordResponse<IdentityProvider>> {\n return this.write(event);\n }\n\n // ---------------------------------------------------------\n\n @DGet('/:id/authorize-out', [])\n async authorizeOut(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new BadRequestError('Only an identity-provider based on the oauth protocol supports authorize redirect.');\n }\n\n const authenticator = this.buildProviderAuthenticator(entity);\n\n let codeRequest: OAuth2AuthorizationCodeRequest \| undefined;\n const query = useRequestQuery(event);\n if (typeof query.codeRequest === 'string') {\n let codeRequestDecoded: OAuth2AuthorizationCodeRequest;\n\n try {\n codeRequestDecoded = JSON.parse(base64URLDecode(query.codeRequest));\n } catch {\n throw OAuth2RequestError.malformed('The code request is malformed and can not be parsed.');\n }\n\n const codeRequestValidated = await this.codeRequestValidator.run(codeRequestDecoded);\n const data = await this.codeRequestVerifier.verify(codeRequestValidated);\n\n if (\n data.client.realmId &&\n entity.realmId &&\n entity.realmId !== data.client.realmId\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n codeRequest = data.data;\n }\n\n const state = await this.saveAuthorizationState(event, { codeRequest });\n\n return sendRedirect(event, authenticator.buildRedirectURL({ state }));\n }\n\n @DPost('/:id/link-request', [ForceLoggedInMiddleware])\n async linkRequest(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) : Promise<IdentityProviderLinkRequestResponse> {\n const id = useRequestParamID(event);\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new BadRequestError('Only an identity-provider based on the oauth protocol supports account linking.');\n }\n\n if (!entity.enabled) {\n throw new BadRequestError('The identity provider is not enabled.');\n }\n\n const identity = useRequestIdentityOrFail(event);\n if (identity.type !== IdentityType.USER) {\n throw new BadRequestError('Only a user can link an identity provider account.');\n }\n\n if (entity.realmId && entity.realmId !== identity.realmId) {\n throw new BadRequestError('The identity provider does not belong to the user realm.');\n }\n\n const authenticator = this.buildProviderAuthenticator(entity);\n\n const state = await this.saveAuthorizationState(event, { link: { userId: identity.id, providerId: entity.id } });\n\n return { url: authenticator.buildRedirectURL({ state }) };\n }\n\n @DGet('/:id/authorize-in', [])\n async authorizeIn(\n @DPath('id') _id: string,\n @DContext() event: IAppEvent,\n ) {\n const id = useRequestParamID(event);\n\n const entity = await this.resolve(id);\n\n if (!isOAuth2IdentityProvider(entity) && !isOpenIDIdentityProvider(entity)) {\n throw new Error(`The provider protocol ${entity.protocol} is not valid.`);\n }\n\n const data = await this.verifyAuthorizationState(event);\n\n const { link } = data;\n if (link) {\n return this.completeLink(event, entity, data, link);\n }\n\n if (\n entity.realmId &&\n data.codeRequest &&\n data.codeRequest.realm_id &&\n data.codeRequest.realm_id !== entity.realmId\n ) {\n throw OAuth2RequestError.malformed('The provider and client realm do not match.');\n }\n\n const { code } = useRequestQuery(event);\n\n if (typeof code !== 'string' \|\| code.length === 0) {\n throw new BadRequestError('The authorization code is missing.');\n }\n\n const authenticator = this.buildProviderAuthenticator(entity, { clientId: data.codeRequest?.client_id });\n\n const user = await authenticator.authenticate({ code });\n\n const realm = await this.realmRepository.resolve(entity.realmId, true);\n\n // Application access policy (plan 052), federated leg: the callback\n // never redirects to the RP directly — a denial bounces back to the\n // hosted authorize page with error=access_denied, so no\n // redirectUriVerified threading through the state blob is needed.\n // A policy id with no wired evaluator denies (fail closed); a\n // since-deleted client is skipped (the /token backstop still covers it).\n if (data.codeRequest?.client_id) {\n const client = await this.clientRepository.findOneByIdOrName(\n data.codeRequest.client_id,\n data.codeRequest.realm_id,\n );\n\n if (client?.accessPolicyId) {\n let allowed = false;\n\n const subject = toIdentityPolicyData({\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n });\n if (this.accessPolicyEvaluator && subject) {\n allowed = await this.accessPolicyEvaluator.evaluate(\n client.accessPolicyId,\n subject,\n );\n }\n\n if (!allowed) {\n const url = this.buildHostedAuthorizeURL(data.codeRequest);\n url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n\n return sendRedirect(event, url.href);\n }\n }\n }\n\n const authorizationCode = await this.codeIssuer.issue(\n {\n response_type: 'code',\n client_id: data.codeRequest?.client_id,\n redirect_uri: data.codeRequest?.redirect_uri,\n scope: data.codeRequest?.scope,\n },\n {\n type: IdentityType.USER,\n data: {\n ...user,\n realm,\n },\n },\n { authMethod: SessionAuthMethod.EXTERNAL },\n );\n\n if (data.codeRequest) {\n const url = this.buildHostedAuthorizeURL(data.codeRequest);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n const url = new URL(this.options.baseURL);\n url.searchParams.set('code', authorizationCode.id);\n\n return sendRedirect(event, url.href);\n }\n\n // ---------------------------------------------------------\n\n private async write(event: IAppEvent, options: {\n updateOnly?: boolean\n } = {}): Promise<EntityRecordResponse<IdentityProvider>> {\n let group: string;\n const id = getRequestParamID(event, { isUUID: false });\n const body = await readRequestBody(event);\n applyRouteRealmIDToBody(event, body);\n const realmId = getRequestRealmID(event) ?? getBodyRealmID(body);\n\n let entity: IdentityProvider \| null \| undefined;\n if (id) {\n const where: Record<string, any> = {};\n if (isUUID(id)) {\n where.id = id;\n } else {\n where.name = id;\n }\n\n if (realmId) {\n where.realmId = realmId;\n }\n\n entity = await this.repository.findOneBy(where);\n // Only a NAME key may upsert-create. A UUID addresses one specific\n // row, so a miss is a 404 (creating would write a different id).\n if (!entity && (options.updateOnly \|\| where.id)) {\n throw new EntityNotFoundError();\n }\n } else if (options.updateOnly) {\n throw new EntityNotFoundError();\n }\n\n const permissionEvaluator = useRequestPermissionEvaluator(event);\n if (entity) {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_UPDATE });\n\n group = ValidatorGroup.UPDATE;\n } else {\n await permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_CREATE });\n\n group = ValidatorGroup.CREATE;\n }\n\n const validator = new IdentityProviderValidator();\n const data = await validator.run(body, { group });\n\n const attributesValidator = new IdentityProviderAttributesValidator();\n const attributes = await attributesValidator.run(body);\n\n await this.repository.validateJoinColumns(data);\n\n if (entity) {\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_UPDATE,\n data: definePolicyData({\n [BuiltInPolicyType.ATTRIBUTES]: {\n ...entity,\n ...data,\n },\n [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? entity.realmId ?? null,\n }),\n });\n } else {\n if (!data.realmId) {\n const identity = useRequestIdentityOrFail(event);\n data.realmId = identity.realmId;\n }\n\n await permissionEvaluator.evaluate({\n name: PermissionName.IDENTITY_PROVIDER_CREATE,\n data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: data, [BuiltInPolicyType.REALM_MATCH]: data.realmId ?? null }),\n });\n }\n\n await this.repository.checkUniqueness(data, entity \|\| undefined);\n\n if (entity) {\n entity = this.repository.merge(entity, data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 202;\n\n return { data: entity, meta: {} };\n }\n\n entity = this.repository.create(data);\n await this.repository.saveWithEA(entity, attributes);\n\n event.response.status = 201;\n\n return { data: entity, meta: {} };\n }\n\n // ---------------------------------------------------------\n\n /\n Callback half of the account-linking round-trip (plan 091): the\n * external identity is bound to the state-referenced user instead of\n * running the login path. No auth code and no session is minted; the\n * browser lands back on the account console with a marker param.\n */\n private async completeLink(\n event: IAppEvent,\n provider: OAuth2IdentityProvider \| OpenIDIdentityProvider,\n state: OAuth2AuthorizationState,\n link: OAuth2AuthorizationStateLink,\n ) {\n // Fixed, server-derived return target (the account console page).\n // No client-supplied redirect exists on this path.\n const url = new URL(resolveURL(this.options.baseURL, 'account/connected-accounts'));\n\n const { code } = useRequestQuery(event);\n\n try {\n // The state is bound to the provider it was minted for, and the\n // provider must still be enabled at completion — a state cannot\n // be replayed against a different provider's callback, nor\n // complete a link after its provider was disabled.\n if (link.providerId !== provider.id \|\| !provider.enabled) {\n throw new BadRequestError('The identity provider is not available for account linking.');\n }\n\n // The state must be bound to the browser that minted it. Both\n // bindings come from the minting request itself\n // (`saveAuthorizationState` stores its ip and user-agent) and\n // `OAuth2AuthorizationStateManager.verify` skips a check whose\n // STORED value is falsy, so an absent binding is a choice the\n // minter made rather than a property of the network — and it\n // leaves the state completable in any browser.\n //\n // On the login path that is a session-fixation nuisance. Here it\n // is a durable credential binding: an attacker who mints a state\n // carrying their OWN userId and gets a victim to follow it binds\n // the VICTIM's external identity to the attacker's account, and\n // the victim's next federated login then lands in it. Refuse an\n // unbound state instead of linking on it.\n //\n // This closes the absent-binding hole only. ip + user-agent\n // remain guessable, and with the shipped `trustProxy: true` the\n // ip is the client-supplied left-most X-Forwarded-For entry, so\n // this is a stopgap: see issue #3439 for moving the write behind\n // a bearer-authenticated confirmation.\n if (!state.ip \|\| !state.userAgent) {\n throw new BadRequestError('The account link request is not bound to a browser.');\n }\n\n if (typeof code !== 'string' \|\| code.length === 0) {\n throw new BadRequestError('The authorization code is missing.');\n }\n\n const authenticator = this.buildProviderAuthenticator(provider);\n\n const identity = await authenticator.resolveIdentity({ code });\n const account = await this.accountManager.link(identity, link.userId);\n\n await this.eventService?.record({\n scope: EventScope.IDENTITY,\n name: EventName.IDENTITY_PROVIDER_LINKED,\n refType: EventRefType.IDENTITY_PROVIDER_ACCOUNT,\n refId: account.id,\n realmId: account.userRealmId ?? provider.realmId ?? null,\n actorType: IdentityType.USER,\n actorId: account.userId,\n requestIpAddress: getRequestIP(event) ?? null,\n requestUserAgent: getRequestHeader(event, 'user-agent') ?? null,\n data: { providerId: provider.id, providerName: provider.name },\n });\n\n url.searchParams.set('linked', provider.id);\n } catch (e) {\n // The failure is swallowed into a redirect marker, so the log is\n // the only surface it can reach. Without this an unreachable or\n // rejecting provider is indistinguishable from a stale state.\n this.logger?.error(describeError(e, 'The identity-provider account link failed.'));\n\n url.searchParams.set(\n 'linkError',\n isIdentityProviderAccountAlreadyLinkedError(e) ? 'already_linked' : 'link_failed',\n );\n }\n\n return sendRedirect(event, url.href);\n }\n\n // ---------------------------------------------------------\n\n private buildHostedAuthorizeURL(codeRequest: OAuth2AuthorizationCodeRequest): URL {\n const url = new URL(resolveURL(this.options.baseURL, 'authorize'));\n\n const codeRequestKeys = Object.keys(codeRequest);\n for (const codeRequestKey_ of codeRequestKeys) {\n const codeRequestKey = codeRequestKey_ as keyof OAuth2AuthorizationCodeRequest;\n const codeRequestValue = codeRequest[codeRequestKey];\n // Preserve meaningful falsy values (e.g. max_age=0, which OIDC\n // treats as prompt=login) — only skip absent ones.\n if (typeof codeRequestValue !== 'undefined' && codeRequestValue !== null) {\n url.searchParams.set(codeRequestKey, String(codeRequestValue));\n }\n }\n\n return url;\n }\n\n // ---------------------------------------------------------\n\n private async resolve(id: string) {\n const entity = await this.repository.findOneById(id);\n\n if (!entity) {\n throw new EntityNotFoundError();\n }\n\n return entity;\n }\n\n // ---------------------------------------------------------\n\n private buildProviderAuthenticator(\n provider: OAuth2IdentityProvider \| OpenIDIdentityProvider,\n options: { clientId?: string } = {},\n ) {\n return createIdentityProviderOAuth2Authenticator({\n accountManager: this.accountManager,\n provider,\n options: {\n baseURL: this.options.baseURL,\n clientId: options.clientId,\n },\n });\n }\n\n private async saveAuthorizationState(\n event: IAppEvent,\n data: Pick<OAuth2AuthorizationState, 'codeRequest' \| 'link'> = {},\n ) : Promise<string> {\n return this.stateManager.save({\n ...data,\n ip: getRequestIP(event) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n\n private async verifyAuthorizationState(event: IAppEvent): Promise<OAuth2AuthorizationState> {\n const query = useRequestQuery(event);\n if (typeof query.state !== 'string') {\n throw OAuth2RequestError.stateInvalid();\n }\n\n return this.stateManager.verify(query.state, {\n ip: getRequestIP(event) ?? '',\n userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiGA,IAAaqD,6BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAwC;EAChD,KAAKZ,UAAUY,IAAIZ;EACnB,KAAKC,aAAaW,IAAIX;EACtB,KAAKC,kBAAkBU,IAAIV;EAC3B,KAAKC,mBAAmBS,IAAIT;EAC5B,KAAKC,iBAAiBQ,IAAIR;EAC1B,KAAKI,aAAaI,IAAIJ;EACtB,KAAKH,sBAAsBO,IAAIP;EAC/B,KAAKC,uBAAuB,IAAIxB,wCAAAA;EAChC,KAAKyB,eAAeK,IAAIL;EACxB,KAAKE,wBAAwBG,IAAIH;EACjC,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,SAASC,IAAID;CACtB;CAIA,MACME,aACF,OACmD;EACnD,MAAM,EACFE,MACAC,SACA,MAAM,KAAKf,WAAWgB,SACtB,MAAMhC,YAAYR,gBAAgBqC,KAAAA,GAAQ;GACtCI,QAAQ/B;GACRgC,OAAO5B,kBAAkBuB,KAAAA;EAC7B,CAAA,CAAA;EAGJ,IAAI;GACA,MAAMM,sBAAsBvB,8BAA8BiB,KAAAA;GAC1D,MAAMM,oBAAoBC,YAAY,EAAEC,MAAMrD,eAAesD,uBAAuB,CAAA;GAEpF,KAAK,MAAMC,SAAST,MAChB,IAAI;IACA,MAAMK,oBAAoBK,SAAS;KAC/BH,MAAMrD,eAAesD;KACrBR,MAAMpE,iBAAiB;OAAGD,kBAAkBgF,aAAaF;OAAQ9E,kBAAkBiF,cAAcH,MAAMI,WAAW;KAAK,CAAA;IAC3H,CAAA;GACJ,QAAQ,CAER;EAER,QAAQ,CAER;EAEA,OAAO;GACHb;GACAC,MAAM;IACF,GAAGA;IACHE,QAAQhC,oBAAoBC,sBAAAA;GAChC;EACJ;CACJ;CAEA,MACM0C,YACF,IACA,OAC+C;EAC/C,MAAME,UAAUnC,kBAAkBkB,OAAO,EAAEhE,QAAQ,MAAM,CAAA;EAEzD,MAAMkF,SAAS,MAAM,KAAK/B,WAAWgC,kBACjCF,SACArC,kBAAkBoB,KAAAA,CAAAA;EAGtB,IAAI,CAACkB,QACD,MAAM,IAAI1D,oBAAAA;EAGd,IAAI;GAEA,MAD4BuB,8BAA8BiB,KACpDM,CAAAA,CAAoBK,SAAS;IAC/BH,MAAMrD,eAAesD;IACrBR,MAAMpE,iBAAiB;MAAGD,kBAAkBgF,aAAaM;MAAStF,kBAAkBiF,cAAcK,OAAOJ,WAAW;IAAK,CAAA;GAC7H,CAAA;EACJ,QAAQ,CAER;EAEA,OAAO;GAAEb,MAAMiB;GAAQhB,MAAM,EAAEE,QAAQhC,oBAAoBC,wBAAwBJ,uBAAAA,EAAyB;EAAE;CAClH;CAEA,MACMmD,aACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKE,MAAMtB,OAAO,EAAEuB,YAAY,KAAK,CAAA;CAChD;CAEA,MACMC,IACF,IACA,MACA,OACgD;EAChD,OAAO,KAAKF,MAAMtB,KAAAA;CACtB;CAEA,MACMyB,aACF,IACA,OACgD;EAChD,MAAMR,UAAUnC,kBAAkBkB,KAAAA;EAElC,MAAMM,sBAAsBvB,8BAA8BiB,KAAAA;EAC1D,MAAMM,oBAAoBC,YAAY,EAAEC,MAAMrD,eAAeuE,yBAAyB,CAAA;EAEtF,MAAMR,SAAS,MAAM,KAAK/B,WAAWwC,UAAU,EAAEX,IAAIC,QAAQ,CAAA;EAE7D,IAAI,CAACC,QACD,MAAM,IAAI1D,oBAAAA;EAGd,MAAM8C,oBAAoBK,SAAS;GAC/BH,MAAMrD,eAAeuE;GACrBzB,MAAMpE,iBAAiB;KAAGD,kBAAkBgF,aAAaM;KAAStF,kBAAkBiF,cAAcK,OAAOJ,WAAW;GAAK,CAAA;EAC7H,CAAA;EAEA,MAAM,EAAEE,IAAIY,aAAaV;EAEzB,MAAM,KAAK/B,WAAW0C,OAAOX,MAAAA;EAE7BA,OAAOF,KAAKY;EAEZ5B,MAAM8B,SAASC,SAAS;EAExB,OAAO;GAAE9B,MAAMiB;GAAQhB,MAAM,CAAC;EAAE;CACpC;CAEA,MACM8B,YACF,MACA,OACgD;EAChD,OAAO,KAAKV,MAAMtB,KAAAA;CACtB;CAIA,MACMiC,aACF,KACA,OACF;EACE,MAAMjB,KAAKlC,kBAAkBkB,KAAAA;EAC7B,MAAMkB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC3D,yBAAyB6D,MAAAA,KAAW,CAAC5D,yBAAyB4D,MAAAA,GAC/D,MAAM,IAAI3D,gBAAgB,oFAAA;EAG9B,MAAM6E,gBAAgB,KAAKC,2BAA2BnB,MAAAA;EAEtD,IAAIoB;EACJ,MAAMC,QAAQ5E,gBAAgBqC,KAAAA;EAC9B,IAAI,OAAOuC,MAAMD,gBAAgB,UAAU;GACvC,IAAIE;GAEJ,IAAI;IACAA,qBAAqBC,KAAKC,MAAM3G,gBAAgBwG,MAAMD,WAAW,CAAA;GACrE,QAAQ;IACJ,MAAMxE,mBAAmB6E,UAAU,sDAAA;GACvC;GAEA,MAAMC,uBAAuB,MAAM,KAAKpD,qBAAqBqD,IAAIL,kBAAAA;GACjE,MAAMvC,OAAO,MAAM,KAAKV,oBAAoBuD,OAAOF,oBAAAA;GAEnD,IACI3C,KAAK8C,OAAOjC,WACZI,OAAOJ,WACPI,OAAOJ,YAAYb,KAAK8C,OAAOjC,SAE/B,MAAMhD,mBAAmB6E,UAAU,6CAAA;GAGvCL,cAAcrC,KAAKA;EACvB;EAEA,MAAM+C,QAAQ,MAAM,KAAKC,uBAAuBjD,OAAO,EAAEsC,YAAY,CAAA;EAErE,OAAO1F,aAAaoD,OAAOoC,cAAcc,iBAAiB,EAAEF,MAAM,CAAA,CAAA;CACtE;CAEA,MACMG,YACF,KACA,OAC6C;EAC7C,MAAMnC,KAAKlC,kBAAkBkB,KAAAA;EAC7B,MAAMkB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC3D,yBAAyB6D,MAAAA,KAAW,CAAC5D,yBAAyB4D,MAAAA,GAC/D,MAAM,IAAI3D,gBAAgB,iFAAA;EAG9B,IAAI,CAAC2D,OAAOkC,SACR,MAAM,IAAI7F,gBAAgB,uCAAA;EAG9B,MAAM8F,WAAWxE,yBAAyBmB,KAAAA;EAC1C,IAAIqD,SAASC,SAASpG,aAAaqG,MAC/B,MAAM,IAAIhG,gBAAgB,oDAAA;EAG9B,IAAI2D,OAAOJ,WAAWI,OAAOJ,YAAYuC,SAASvC,SAC9C,MAAM,IAAIvD,gBAAgB,0DAAA;EAG9B,MAAM6E,gBAAgB,KAAKC,2BAA2BnB,MAAAA;EAEtD,MAAM8B,QAAQ,MAAM,KAAKC,uBAAuBjD,OAAO,EAAEwD,MAAM;GAAEC,QAAQJ,SAASrC;GAAI0C,YAAYxC,OAAOF;EAAG,EAAE,CAAA;EAE9G,OAAO,EAAE2C,KAAKvB,cAAcc,iBAAiB,EAAEF,MAAM,CAAA,EAAG;CAC5D;CAEA,MACMY,YACF,KACA,OACF;EACE,MAAM5C,KAAKlC,kBAAkBkB,KAAAA;EAE7B,MAAMkB,SAAS,MAAM,KAAKiB,QAAQnB,EAAAA;EAElC,IAAI,CAAC3D,yBAAyB6D,MAAAA,KAAW,CAAC5D,yBAAyB4D,MAAAA,GAC/D,MAAM,IAAI2C,MAAM,yBAAyB3C,OAAO4C,SAAS,eAAe;EAG5E,MAAM7D,OAAO,MAAM,KAAK8D,yBAAyB/D,KAAAA;EAEjD,MAAM,EAAEwD,SAASvD;EACjB,IAAIuD,MACA,OAAO,KAAKQ,aAAahE,OAAOkB,QAAQjB,MAAMuD,IAAAA;EAGlD,IACItC,OAAOJ,WACPb,KAAKqC,eACLrC,KAAKqC,YAAY2B,YACjBhE,KAAKqC,YAAY2B,aAAa/C,OAAOJ,SAErC,MAAMhD,mBAAmB6E,UAAU,6CAAA;EAGvC,MAAM,EAAEuB,SAASvG,gBAAgBqC,KAAAA;EAEjC,IAAI,OAAOkE,SAAS,YAAYA,KAAKC,WAAW,GAC5C,MAAM,IAAI5G,gBAAgB,oCAAA;EAK9B,MAAM8D,OAAO,MAFS,KAAKgB,2BAA2BnB,QAAQ,EAAEkD,UAAUnE,KAAKqC,aAAa+B,UAAU,CAEnFjC,CAAAA,CAAckC,aAAa,EAAEJ,KAAK,CAAA;EAErD,MAAMK,QAAQ,MAAM,KAAKnF,gBAAgB+C,QAAQjB,OAAOJ,SAAS,IAAA;EAQjE,IAAIb,KAAKqC,aAAa+B,WAAW;GAC7B,MAAMtB,SAAS,MAAM,KAAK1D,iBAAiB8B,kBACvClB,KAAKqC,YAAY+B,WACjBpE,KAAKqC,YAAY2B,QAAQ;GAG7B,IAAIlB,QAAQyB,gBAAgB;IACxB,IAAIC,UAAU;IAEd,MAAMC,UAAUnG,qBAAqB;KACjC+E,MAAMpG,aAAaqG;KACnBtD,MAAM;MACF,GAAGoB;MACHkD;KACJ;IACJ,CAAA;IACA,IAAI,KAAK5E,yBAAyB+E,SAC9BD,UAAU,MAAM,KAAK9E,sBAAsBgB,SACvCoC,OAAOyB,gBACPE,OAAAA;IAIR,IAAI,CAACD,SAAS;KACV,MAAMd,MAAM,KAAKgB,wBAAwB1E,KAAKqC,WAAW;KACzDqB,IAAIiB,aAAaC,IAAI,SAAShH,gBAAgBiH,aAAa;KAE3D,OAAOlI,aAAaoD,OAAO2D,IAAIoB,IAAI;IACvC;GACJ;EACJ;EAEA,MAAMC,oBAAoB,MAAM,KAAKtF,WAAWuF,MAC5C;GACIC,eAAe;GACfb,WAAWpE,KAAKqC,aAAa+B;GAC7Bc,cAAclF,KAAKqC,aAAa6C;GAChCC,OAAOnF,KAAKqC,aAAa8C;EAC7B,GACA;GACI9B,MAAMpG,aAAaqG;GACnBtD,MAAM;IACF,GAAGoB;IACHkD;GACJ;EACJ,GACA,EAAEc,YAAYjI,kBAAkBkI,SAAS,CAAA;EAG7C,IAAIrF,KAAKqC,aAAa;GAClB,MAAMqB,MAAM,KAAKgB,wBAAwB1E,KAAKqC,WAAW;GACzDqB,IAAIiB,aAAaC,IAAI,QAAQG,kBAAkBhE,EAAE;GAEjD,OAAOpE,aAAaoD,OAAO2D,IAAIoB,IAAI;EACvC;EAEA,MAAMpB,MAAM,IAAI5F,IAAI,KAAKmB,QAAQqG,OAAO;EACxC5B,IAAIiB,aAAaC,IAAI,QAAQG,kBAAkBhE,EAAE;EAEjD,OAAOpE,aAAaoD,OAAO2D,IAAIoB,IAAI;CACvC;CAIA,MAAczD,MAAMtB,OAAkBd,UAElC,CAAC,GAAoD;EACrD,IAAIsG;EACJ,MAAMxE,KAAKrC,kBAAkBqB,OAAO,EAAEhE,QAAQ,MAAM,CAAA;EACpD,MAAMyJ,OAAO,MAAM7H,gBAAgBoC,KAAAA;EACnCxB,wBAAwBwB,OAAOyF,IAAAA;EAC/B,MAAM3E,UAAUlC,kBAAkBoB,KAAAA,KAAUtB,eAAe+G,IAAAA;EAE3D,IAAIvE;EACJ,IAAIF,IAAI;GACJ,MAAM0E,QAA6B,CAAC;GACpC,IAAI1J,OAAOgF,EAAAA,GACP0E,MAAM1E,KAAKA;QAEX0E,MAAMlF,OAAOQ;GAGjB,IAAIF,SACA4E,MAAM5E,UAAUA;GAGpBI,SAAS,MAAM,KAAK/B,WAAWwC,UAAU+D,KAAAA;GAGzC,IAAI,CAACxE,WAAWhC,QAAQqC,cAAcmE,MAAM1E,KACxC,MAAM,IAAIxD,oBAAAA;EAElB,OAAO,IAAI0B,QAAQqC,YACf,MAAM,IAAI/D,oBAAAA;EAGd,MAAM8C,sBAAsBvB,8BAA8BiB,KAAAA;EAC1D,IAAIkB,QAAQ;GACR,MAAMZ,oBAAoBC,YAAY,EAAEC,MAAMrD,eAAewI,yBAAyB,CAAA;GAEtFH,QAAQ1J,eAAe8J;EAC3B,OAAO;GACH,MAAMtF,oBAAoBC,YAAY,EAAEC,MAAMrD,eAAe0I,yBAAyB,CAAA;GAEtFL,QAAQ1J,eAAegK;EAC3B;EAGA,MAAM7F,OAAO,MAAM8F,IADG9I,0BACH8I,CAAAA,CAAUlD,IAAI4C,MAAM,EAAED,MAAM,CAAA;EAG/C,MAAMS,aAAa,MAAMD,IADOhJ,oCACPgJ,CAAAA,CAAoBnD,IAAI4C,IAAAA;EAEjD,MAAM,KAAKtG,WAAW+G,oBAAoBjG,IAAAA;EAE1C,IAAIiB,QACA,MAAMZ,oBAAoBK,SAAS;GAC/BH,MAAMrD,eAAewI;GACrB1F,MAAMpE,iBAAiB;KAClBD,kBAAkBgF,aAAa;KAC5B,GAAGM;KACH,GAAGjB;IACP;KACCrE,kBAAkBiF,cAAcZ,KAAKa,WAAWI,OAAOJ,WAAW;GACvE,CAAA;EACJ,CAAA;OACG;GACH,IAAI,CAACb,KAAKa,SAENb,KAAKa,UADYjC,yBAAyBmB,KAC3BqD,CAAAA,CAASvC;GAG5B,MAAMR,oBAAoBK,SAAS;IAC/BH,MAAMrD,eAAe0I;IACrB5F,MAAMpE,iBAAiB;MAAGD,kBAAkBgF,aAAaX;MAAOrE,kBAAkBiF,cAAcZ,KAAKa,WAAW;IAAK,CAAA;GACzH,CAAA;EACJ;EAEA,MAAM,KAAK3B,WAAWgH,gBAAgBlG,MAAMiB,UAAUkF,KAAAA,CAAAA;EAEtD,IAAIlF,QAAQ;GACRA,SAAS,KAAK/B,WAAWkH,MAAMnF,QAAQjB,IAAAA;GACvC,MAAM,KAAKd,WAAWmH,WAAWpF,QAAQ+E,UAAAA;GAEzCjG,MAAM8B,SAASC,SAAS;GAExB,OAAO;IAAE9B,MAAMiB;IAAQhB,MAAM,CAAC;GAAE;EACpC;EAEAgB,SAAS,KAAK/B,WAAWoH,OAAOtG,IAAAA;EAChC,MAAM,KAAKd,WAAWmH,WAAWpF,QAAQ+E,UAAAA;EAEzCjG,MAAM8B,SAASC,SAAS;EAExB,OAAO;GAAE9B,MAAMiB;GAAQhB,MAAM,CAAC;EAAE;CACpC;;;;;;IAUA,MAAc8D,aACVhE,OACAwG,UACAxD,OACAQ,MACF;EAGE,MAAMG,MAAM,IAAI5F,IAAIL,WAAW,KAAKwB,QAAQqG,SAAS,4BAAA,CAAA;EAErD,MAAM,EAAErB,SAASvG,gBAAgBqC,KAAAA;EAEjC,IAAI;GAKA,IAAIwD,KAAKE,eAAe8C,SAASxF,MAAM,CAACwF,SAASpD,SAC7C,MAAM,IAAI7F,gBAAgB,6DAAA;GAuB9B,IAAI,CAACyF,MAAMyD,MAAM,CAACzD,MAAM0D,WACpB,MAAM,IAAInJ,gBAAgB,qDAAA;GAG9B,IAAI,OAAO2G,SAAS,YAAYA,KAAKC,WAAW,GAC5C,MAAM,IAAI5G,gBAAgB,oCAAA;GAK9B,MAAM8F,WAAW,MAFK,KAAKhB,2BAA2BmE,QAE/BpE,CAAAA,CAAcuE,gBAAgB,EAAEzC,KAAK,CAAA;GAC5D,MAAM0C,UAAU,MAAM,KAAKtH,eAAekE,KAAKH,UAAUG,KAAKC,MAAM;GAEpE,MAAM,KAAK7D,cAAciH,OAAO;IAC5BzB,OAAOrI,WAAW+J;IAClBtG,MAAM3D,UAAUkK;IAChBC,SAASlK,aAAamK;IACtBC,OAAON,QAAQ5F;IACfF,SAAS8F,QAAQO,eAAeX,SAAS1F,WAAW;IACpDsG,WAAWlK,aAAaqG;IACxB8D,SAAST,QAAQnD;IACjB6D,kBAAkB3K,aAAaqD,KAAAA,KAAU;IACzCuH,kBAAkB7K,iBAAiBsD,OAAO,YAAA,KAAiB;IAC3DC,MAAM;KAAEyD,YAAY8C,SAASxF;KAAIwG,cAAchB,SAAShG;IAAK;GACjE,CAAA;GAEAmD,IAAIiB,aAAaC,IAAI,UAAU2B,SAASxF,EAAE;EAC9C,SAASyG,GAAG;GAIR,KAAK5H,QAAQ6H,MAAMjK,cAAcgK,GAAG,4CAAA,CAAA;GAEpC9D,IAAIiB,aAAaC,IACb,aACAvG,4CAA4CmJ,CAAAA,IAAK,mBAAmB,aAAA;EAE5E;EAEA,OAAO7K,aAAaoD,OAAO2D,IAAIoB,IAAI;CACvC;CAIQJ,wBAAwBrC,aAAkD;EAC9E,MAAMqB,MAAM,IAAI5F,IAAIL,WAAW,KAAKwB,QAAQqG,SAAS,WAAA,CAAA;EAErD,MAAMoC,kBAAkBC,OAAOC,KAAKvF,WAAAA;EACpC,KAAK,MAAMwF,mBAAmBH,iBAAiB;GAC3C,MAAMI,iBAAiBD;GACvB,MAAME,mBAAmB1F,YAAYyF;GAGrC,IAAI,OAAOC,qBAAqB,eAAeA,qBAAqB,MAChErE,IAAIiB,aAAaC,IAAIkD,gBAAgBE,OAAOD,gBAAAA,CAAAA;EAEpD;EAEA,OAAOrE;CACX;CAIA,MAAcxB,QAAQnB,IAAY;EAC9B,MAAME,SAAS,MAAM,KAAK/B,WAAW+I,YAAYlH,EAAAA;EAEjD,IAAI,CAACE,QACD,MAAM,IAAI1D,oBAAAA;EAGd,OAAO0D;CACX;CAIQmB,2BACJmE,UACAtH,UAAiC,CAAC,GACpC;EACE,OAAOhB,0CAA0C;GAC7CoB,gBAAgB,KAAKA;GACrBkH;GACAtH,SAAS;IACLqG,SAAS,KAAKrG,QAAQqG;IACtBnB,UAAUlF,QAAQkF;GACtB;EACJ,CAAA;CACJ;CAEA,MAAcnB,uBACVjD,OACAC,OAA+D,CAAC,GAChD;EAChB,OAAO,KAAKR,aAAa0I,KAAK;GAC1B,GAAGlI;GACHwG,IAAI9J,aAAaqD,KAAAA,KAAU;GAC3B0G,WAAWhK,iBAAiBsD,OAAO,YAAA,KAAiBoG,KAAAA;EACxD,CAAA;CACJ;CAEA,MAAcrC,yBAAyB/D,OAAqD;EACxF,MAAMuC,QAAQ5E,gBAAgBqC,KAAAA;EAC9B,IAAI,OAAOuC,MAAMS,UAAU,UACvB,MAAMlF,mBAAmBsK,aAAY;EAGzC,OAAO,KAAK3I,aAAaqD,OAAOP,MAAMS,OAAO;GACzCyD,IAAI9J,aAAaqD,KAAAA,KAAU;GAC3B0G,WAAWhK,iBAAiBsD,OAAO,YAAA,KAAiBoG,KAAAA;EACxD,CAAA;CACJ;AACJ;;;;;;;;;;;;;;;;;CApfoBpH,MAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASDA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;CASGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAgCNA,MAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;CAsDiBA,MAAAA,qBAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;;;;;;;;;CA3NnB,YAAA,CAAA,uBAAuB,qCAAA,CAAA"}

package/dist/adapters/http/controllers/entities/identity-provider/types.d.ts CHANGED Viewed

@@ -1,4 +1,5 @@
-import type { IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IOAuth2ClientRepository, IRealmRepository } from '../../../../../core/index.ts';
+import type { Logger } from '@authup/server-kit';
+import type { IEventService, IIdentityProviderAccountManager, IIdentityProviderRepository, IOAuth2AccessPolicyEvaluator, IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier, IOAuth2AuthorizationStateManager, IOAuth2ClientRepository, IRealmRepository } from '../../../../../core/index.ts';
 export type IdentityProviderControllerOptions = {
     baseURL: string;
 };
@@ -12,5 +13,7 @@ export type IdentityProviderControllerContext = {
     codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
     stateManager: IOAuth2AuthorizationStateManager;
     accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    eventService?: IEventService;
+    logger?: Logger;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/entities/identity-provider/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,uBAAuB,EACvB,gBAAgB,EACnB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,iCAAiC,CAAC;IAE3C,UAAU,EAAE,2BAA2B,CAAC;IACxC,eAAe,EAAE,gBAAgB,CAAC;IAClC,gBAAgB,EAAE,uBAAuB,CAAC;IAE1C,cAAc,EAAE,+BAA+B,CAAC;IAChD,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAC7D,YAAY,EAAE,gCAAgC,CAAC;IAE/C,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;~~CACxD~~,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,aAAa,EACb,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,EACvC,gCAAgC,EAChC,uBAAuB,EACvB,gBAAgB,EACnB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,iCAAiC,CAAC;IAE3C,UAAU,EAAE,2BAA2B,CAAC;IACxC,eAAe,EAAE,gBAAgB,CAAC;IAClC,gBAAgB,EAAE,uBAAuB,CAAC;IAE1C,cAAc,EAAE,+BAA+B,CAAC;IAChD,UAAU,EAAE,8BAA8B,CAAC;IAC3C,mBAAmB,EAAE,uCAAuC,CAAC;IAC7D,YAAY,EAAE,gCAAgC,CAAC;IAE/C,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IACrD,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/controllers/entities/identity-provider-account/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider-account/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/identity-provider-account/index.mjs ADDED Viewed

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IdentityProviderAccountController } from "./module.mjs";
+export { IdentityProviderAccountController };

package/dist/adapters/http/controllers/entities/identity-provider-account/module.d.ts ADDED Viewed

@@ -0,0 +1,15 @@
+import type { IdentityProviderAccount } from '@authup/core-kit';
+import type { IAppEvent } from 'routup';
+import type { EntityCollectionResponse, EntityRecordResponse } from '@authup/core-http-kit';
+import type { IIdentityProviderAccountService } from '../../../../../core/index.ts';
+export type IdentityProviderAccountControllerContext = {
+    service: IIdentityProviderAccountService;
+};
+export declare class IdentityProviderAccountController {
+    protected service: IIdentityProviderAccountService;
+    constructor(ctx: IdentityProviderAccountControllerContext);
+    getMany(event: IAppEvent): Promise<EntityCollectionResponse<IdentityProviderAccount>>;
+    getOne(id: string, event: IAppEvent): Promise<EntityRecordResponse<IdentityProviderAccount>>;
+    drop(id: string, event: IAppEvent): Promise<EntityRecordResponse<IdentityProviderAccount>>;
+}
+//# sourceMappingURL=module.d.ts.map